JP2007102441A - Security monitoring system, security monitoring method, computer program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent unauthorized use of a terminal by predetecting that the terminal is illicitly used while securing the mobility of a computer terminal. <P>SOLUTION: This security monitoring system is provided with a storage part for storing registration area information showing an area where the use of a terminal is permitted; a location information acquiring part for acquiring the location information of the current location of the terminal; a determination part for determining whether or not the current location shown by the location information acquired by the location information acquiring part is included in a user permission area shown by the registration area information in the storage part; and a security processing execution part for executing the start processing of the terminal when it is determined that the current location is included in the use permission area by the decision part, and for executing prescribed processing for securing the security of the terminal when it is determined that the current location is beyond the use permission area by the determination part. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a security monitoring system, a security monitoring method, a computer program, and a recording medium.

In recent years, notebook personal computers (hereinafter simply referred to as “PC”) have been widely used. Notebook PCs are convenient because they can be used by moving from place to place, but lost and stolen accidents occur one after another. Conventionally, even if the computer is in the hands of a third party, password authentication has been carried out to prevent unauthorized browsing or rewriting of data or unauthorized operations. Only when the computer was operated or accessed. In addition, some data cannot be operated or accessed unless the hard disk data is encrypted and the correct decryption key is provided.
On the other hand, Patent Document 1 describes that a moving body is provided with a GPS (Global Positioning System) and used for tracking investigation when the moving body is stolen. Patent Document 2 describes that an unauthorized use of a portable information terminal is detected based on a password and the passage of time from the last access to a host personal computer. Japanese Patent Application Laid-Open No. 2004-228561 describes that authentication using a fingerprint or voiceprint is performed in a mobile communication device, and if the authentication fails, a mail notifying theft is sent to the service center.
JP 2000-182194 A JP-A-11-184756 JP 2003-199155 A

  A computer is relatively secure when security monitoring techniques such as passwords and encryption are applied. However, in the conventional technology as described above, unauthorized use can be prevented when authentication fails, but information such as when the password or key is accidentally matched or the password or key itself is stolen is used. There was a risk that the assets could not be fully protected.

  The present invention has been made in view of such circumstances, and its purpose is to prevent unauthorized use by detecting the terminal before it is illegally used while ensuring the mobility of the computer terminal. A security monitoring system, a management device, a terminal, a security monitoring method, a computer program, and a recording medium are provided.

The present invention has been made to solve the above-described problem. A storage unit that stores registration area information indicating an area where use of a terminal is permitted, and position information acquisition that acquires position information of the current position of the terminal are provided. A determination unit that determines whether the current position indicated by the position information acquired by the position information acquisition unit is included in the use-permitted area indicated by the registration area information in the storage unit, and the determination unit If the current position is determined to be included in the use-permitted area, the terminal activation process is performed. If the determination unit determines that the current position is outside the use-permitted area, the terminal A security monitoring system comprising: a security processing execution unit that executes predetermined processing for ensuring security.
According to the above invention, when the security monitoring system determines that the current position of the terminal is within the pre-registered use permission area, the security monitoring system starts the terminal, and the terminal is started outside the use permission area. First, a process for ensuring the security of the terminal is executed.
Thereby, when a third party tries to use the terminal illegally outside the use permission area because the terminal is stolen or the like, it is possible to detect it and take measures to prevent unauthorized use. Therefore, it is possible to dramatically increase the security level.

The present invention is the above-described security monitoring system, wherein the storage unit further stores theft information indicating a stolen terminal, and the determination unit refers to the theft information in the storage unit, and It is determined whether or not the terminal is a stolen terminal, and the security processing execution unit determines a predetermined security for ensuring security when the determination unit determines that the terminal is a stolen terminal. The process is executed.
According to the above invention, when it is determined that the terminal is a pre-registered theft terminal, the process for ensuring the security of the terminal is executed.
Thereby, for example, even if the terminal is activated in the use-permitted area, it is possible to take measures to prevent unauthorized use if the terminal has been reported in advance.

In addition, the present invention is the security monitoring system described above, further comprising a notification unit that outputs a notification to another device when the determination unit determines that the current position is outside the use permission area. Features.
According to the said invention, when a terminal is started out of a use permission area, it can notify a legitimate user and an administrator.
As a result, a legitimate user or administrator of the terminal can immediately know when the terminal is about to be used outside the use permission area.

Further, the present invention is the security monitoring system described above, wherein the security processing execution unit performs a startup process of the terminal when receiving a use permission notification in response to the notification output by the notification unit. It is characterized by performing.
According to the above invention, even when a terminal is activated outside the use permission area, the terminal is activated when a use permission notification is received from a valid user or administrator.
Thus, if the user is a valid user, the terminal can be used even when the terminal is activated outside the pre-registered use permission area.

Further, the present invention is the security monitoring system described above, wherein the process for ensuring the security includes a process of turning off the power of the terminal, a process of physically destroying the terminal, and the terminal storing Or a communication establishment process between the terminal and another apparatus.
According to the above-described invention, as a process for ensuring security, the power of the terminal is turned off, the terminal is physically destroyed, the data stored in the terminal is destroyed, the unauthorized use is notified to other devices, the terminal and others Establish communication with other devices.
This makes it possible to prevent unauthorized use of the terminal by making the terminal unusable, notifying the theft, or outputting a message from another device to the terminal.

The present invention is also a security monitoring method used in a security monitoring system, wherein a position information acquisition unit acquires position information of a current position of a terminal, and a determination unit determines an area where use of the terminal is permitted. With reference to the storage unit that stores the registered area information that is indicated, it is determined whether the current position indicated by the location information acquired by the location information acquisition unit is included in the use-permitted area indicated by the registration area information And the security processing execution unit executes the activation process of the terminal when the determination unit determines that the current position is included in the use permission area, and the determination unit determines that the current position is outside the use permission area. In the security monitoring method, a predetermined process for ensuring the security of the terminal is executed when it is determined that
According to the above invention, when the security monitoring system determines that the current position of the terminal is within the pre-registered use permission area, the security monitoring system starts the terminal, and the terminal is started outside the use permission area. First, a process for ensuring the security of the terminal is executed.
Thereby, when a third party tries to use the terminal illegally outside the use permission area because the terminal is stolen or the like, it is possible to detect it and take measures to prevent unauthorized use. Therefore, it is possible to dramatically increase the security level.

The present invention is also a computer program used in a security monitoring system, which stores a location information acquisition step for acquiring location information of a current location of a terminal, and registered area information indicating an area where the use of the terminal is permitted. A determination step of determining whether the current position indicated by the position information acquired by the position information acquisition step is included in the use-permitted area indicated by the registration area information; When the determination step determines that the current position is included in the use-permitted area, the terminal is activated. When the determination step determines that the current position is outside the use-permitted area, A security processing execution step for executing predetermined processing for ensuring the security of the terminal, and A computer program for causing performed.
According to the above invention, when the security monitoring system determines that the current position of the terminal is within the pre-registered use permission area, the security monitoring system starts the terminal, and the terminal is started outside the use permission area. First, a process for ensuring the security of the terminal is executed.
Thereby, when a third party tries to use the terminal illegally outside the use permission area because the terminal is stolen or the like, it is possible to detect it and take measures to prevent unauthorized use. Therefore, it is possible to dramatically increase the security level.

The present invention is also a computer-readable recording medium that records a computer program used in a security monitoring system, the position information obtaining step for obtaining the position information of the current position of the terminal, and the use of the terminal is permitted. The current location indicated by the location information acquired by the location information acquisition step is included in the use-permitted area indicated by the registration area information with reference to the storage unit that stores the registered area information indicating the area that is present A determination step of determining whether or not the current position is included in the use-permitted area by the determination step, and starting the terminal when the determination step determines that the current position is outside the use-permitted area When it is determined that the terminal is secure, a process for executing a predetermined process for ensuring the security of the terminal is performed. A recording medium for recording a computer program, characterized in that to execute a Yuriti process executing step, to a computer.
According to the above invention, when the security monitoring system determines that the current position of the terminal is within the pre-registered use permission area, the security monitoring system starts the terminal, and the terminal is started outside the use permission area. First, a process for ensuring the security of the terminal is executed.
Thereby, when a third party tries to use the terminal illegally outside the use permission area because the terminal is stolen or the like, it is possible to detect it and take measures to prevent unauthorized use. Therefore, it is possible to dramatically increase the security level.

FIG. 1 is a diagram showing an overall configuration of a security monitoring system according to an embodiment of the present invention.
The security monitoring system shown in FIG. 1 includes a portable terminal 1 that is a security monitoring target, a security monitoring center management device 3, a mobile phone 5 as a user terminal that is always carried by the user, and a network connecting them. N. The network N includes the Internet, a public telephone network, a mobile phone network, and the like. In such a configuration, for example, it is assumed that the user uses the company terminal 1 to perform business-related processing or the like at a work place or at home.

  FIG. 2 is a block diagram showing an internal configuration of the terminal 1, and only functional blocks related to the present invention are extracted and shown. The terminal 1 is a portable computer terminal equipped with a GPS (Global Positioning System) such as a notebook personal computer (hereinafter simply referred to as “PC”), and includes a storage unit 10, a communication unit 11, and position information. An acquisition unit 12, a time information acquisition unit 13, a notification unit 14, an instruction reception unit 15, a security processing execution unit 16, a determination unit 17, an authentication unit 18, an update unit 19, and a registration area notification unit 20 are provided.

  The storage unit 10 stores the terminal ID, registration area information, authentication information, and the like of the terminal 1. The registered area information indicates an area where the use of the terminal 1 is permitted. Here, position information composed of latitude and longitude information is used as the registration area information, and a predetermined range from this position information is regarded as a use-permitted area. Note that the use permission area may be used only when the position information matches. The authentication information is information used at the time of processing for user authentication. For example, when password authentication is used, it indicates a correct password.

  The communication unit 11 is connected to the network N wirelessly or by wire and transmits and receives data via the network N. The position information acquisition unit 12 acquires position information of the current position from the GPS. The time information acquisition unit 13 acquires time information of the current time. When the terminal 1 is activated, the notification unit 14 transmits an activation notification including the terminal ID, the activation time, and the current position information to the management apparatus 3. The instruction receiving unit 15 receives a command for instructing execution of activation processing or security processing. The security process is a process for ensuring the security of the terminal 1, and includes, for example, a process of disabling the terminal 1 or notifying a predetermined place or user of theft. The security process execution unit 16 executes the activation process or security process of the terminal 1 according to the command. The determination unit 17 compares the position information of the current position acquired by the position information acquisition unit 12 with the registration area information in the storage unit 10 in a state where communication with the management device 3 is not possible, and the current position is the use permission area. It is determined whether or not it is included. The authentication unit 18 performs user authentication. The update unit 19 registers the position information of the current position in the registration area information in the storage unit 10 as a new usable area. The registration area notification unit 20 notifies the management device 3 of the position information newly registered in the registration area information in the storage unit 10.

FIG. 3 is a block diagram showing the internal configuration of the management apparatus 3, and only functional blocks related to the present invention are extracted and shown.
The management device 3 can be configured by a server, for example, and includes a storage unit 30, a communication unit 31, a determination unit 32, an update unit 33, a notification unit 34, a response reception unit 35, an authentication unit 36, and an instruction transmission unit 37. Is provided.

  The storage unit 30 stores activation permission information, activation history information, theft information, user information, and the like. The activation permission information includes a record that associates a terminal ID, registration area information, and permission time zone information indicating a time zone in which use of the terminal 1 is permitted. The activation history information includes a record including the terminal ID of the activated terminal 1, the activation time, the location information of the location where the terminal 1 is activated, and the like. The theft information indicates the terminal ID of the terminal 1 that has been notified of the theft. User information consists of a record containing terminal ID, a user address, authentication information, etc. Here, the user address indicates an e-mail address or a telephone number of the mobile phone 5.

  The communication unit 31 transmits and receives data via the network N. The determination unit 32 compares the information included in the activation notification received from the terminal 1 with the activation permission information in the storage unit 30, and whether the current position of the terminal 1 is included in the registration area or the activation time is permitted. To determine if it is within the time zone. The update unit 33 updates data in the storage unit 30. The notification unit 34 transmits a notification that the terminal 1 is about to be activated to the user's mobile phone 5. The response receiving unit 35 receives a response from the user's mobile phone 5 in response to the notification from the notification unit 34. The authentication unit 36 performs user authentication. The instruction transmission unit 37 transmits a command for instructing the terminal 1 to execute a startup process or a security process.

FIG. 4 is a device configuration diagram showing a hardware configuration of the terminal 1.
As shown in the figure, the terminal 1 includes a CPU 71, a ROM 72, a RAM 73, a storage device 74, a communication interface 75, a user interface 76, a GPS 77, and a clock 78.
The CPU 71 is a central processing unit that performs calculation and control. The position information acquisition unit 12, the time information acquisition unit 13, the notification unit 14, the instruction reception unit 15, the security processing execution unit 16, the determination unit 17, and the authentication unit 18 illustrated in FIG. The update unit 19 and the registration area notification unit 20 are realized. The ROM 72 is a read-only memory and stores a system program and the like. The RAM 73 is a readable / writable memory, and includes a work area when the CPU 71 executes various programs. The storage device 74 is a hard disk or the like, and stores a program for executing the processes of FIGS. 6 and 7 to be described later, and realizes the storage unit 10. The communication interface 75 is connected to be communicable with another device, and implements the communication unit 11 of FIG. The user interface 76 is a power button, an input device such as a keyboard or a pointing device such as a mouse, or a display device such as a display. The position information acquisition unit 12 in FIG. 2 acquires the latitude and longitude information of the current position from the GPS 77, and the time information acquisition unit 13 in FIG. 2 acquires the current time information from the clock 78.

FIG. 5 is a device configuration diagram showing the device configuration of the management device 3. The management device 3 includes a CPU 81, a ROM 82, a RAM 83, a storage device 84, a communication interface 85, and a user interface 86.
The CPU 81 is a central processing unit that performs calculation and control, and implements the determination unit 32, the update unit 33, the notification unit 34, the response reception unit 35, the authentication unit 36, and the instruction transmission unit 37 of FIG. The ROM 82 is a read-only memory and stores a system program and the like. The RAM 83 is a readable / writable memory, and includes a work area when the CPU 81 executes various programs. The storage device 84 is a hard disk or the like, and stores a program for executing the processing of FIG. The communication interface 85 is connected to be communicable with another device, and implements the communication unit 31 of FIG. The user interface 86 is an input device such as a keyboard or a pointing device such as a mouse, or a display device such as a display.

FIG. 6 shows an operation flow of the security monitoring system.
In the storage unit 10 of the terminal 1, the terminal ID, registration area information, and authentication information of the terminal 1 are registered in advance, and in the storage unit 30 of the management device 3, activation permission information and user information are registered in advance. It is assumed that In addition, when a theft is reported, the stolen terminal ID is immediately registered in the theft information in the storage unit 30 of the management device 3.

  First, the user turns on the power button of the terminal 1 (step S100). When the power button of the terminal 1 is set to ON, the position information acquisition unit 12 acquires position information indicating the latitude and longitude of the current position, and the time information acquisition unit 13 acquires time information of the current time ( Step S110). The communication unit 11 executes processing for establishing a connection with the network N. In the communication unit 11, when the connection with the network N is successful (step S120: YES), the notification unit 14 and the terminal ID read from the storage unit 10 and the position acquired by the position information acquisition unit 12 in step S110. An activation notification including the information and the time information acquired by the time information acquisition unit 13 is transmitted to the management device 3 (step S130).

  The determination unit 32 of the management device 3 receives the activation notification transmitted by the terminal 1 via the communication unit 31 (step S140). The determination unit 32 reads the user address from the user information in the storage unit 30 based on the terminal ID in the activation notification (step S150). The update unit 33 adds a record including the terminal ID, time information, position information, and the like in the activation notification to the activation history information (step S160).

  The determination unit 32 refers to the theft information in the storage unit 30 and determines whether or not the terminal ID in the activation notification is registered (step S170). When the terminal ID is not registered in the theft information (step S170: NO), the determination unit 32 reads the registration area information and the permission time zone information from the activation permission information in the storage unit 30 based on the terminal ID. Then, the determination unit 32 determines whether or not the current position of the terminal 1 indicated by the position information in the activation notification is included in the use permission area indicated by the read registration area information. Furthermore, the determination unit 32 determines whether or not the activation time indicated by the time information in the activation notification is included in the permission time zone indicated by the read permission time zone information (step S180).

  When the determination unit 32 determines that the current position of the terminal 1 is included in the use permission area and the activation time is included in the permission time zone (step S180: YES), the notification unit 34 Using the user address read in step S150, communication with the mobile phone 5 is performed via the network N (step S190). Then, the notification unit 34 causes the mobile phone 5 to output a message instructing the user to transmit authentication information in order to permit the activation of the terminal. The user inputs authentication information to the mobile phone 5 and transmits it to the management device 3.

  For example, when the user address is a telephone number and password authentication is performed, the notification unit 34 of the management device 3 calls the mobile phone 5 in step S190. When the user responds to the mobile phone 5, the notification unit 34 of the management device 3 sends a guidance such as “Please enter a password if activation is permitted”. When the user inputs a password to the mobile phone 5 with a key or voice, the entered password information is transmitted to the management apparatus 3 as authentication information. Alternatively, when the user address is an email address, the notification unit 34 of the management device 3 notifies the mobile phone 5 of the same content by email. In addition to password authentication, biometric authentication (biometrics), voiceprint authentication, or the like may be performed. When the response receiving unit 35 of the management device 3 receives the authentication information from the mobile phone 5, the authentication unit 36 reads out from the user information in the storage unit 30 based on the received authentication information and the terminal ID in the activation notification. The user is authenticated by comparing with the authentication information (step S200).

  When the authentication is successful (step S200: YES), the instruction transmission unit 37 transmits an activation command to the terminal 1. When the instruction reception unit 15 of the terminal 1 receives the activation command (step S220: YES), the security process execution unit 16 executes the activation process (step S230). For example, when the terminal 1 is powered on for the first time, the terminal 1 starts a light OS (for example, Linux) that is different from the OS (operation system) that is normally used, and executes the processing up to step S220. Then, the terminal 1 is rebooted by the activation process by the activation command, and the OS that is normally used is activated. After starting up the normally used OS, the terminal 1 executes applications related to various business operations by user operations. Note that the terminal 1 may disconnect the connection with the management apparatus 3 after executing the startup process.

  If the authentication fails (step S200: NO), the instruction transmission unit 37 transmits a security processing command to the terminal 1 (step S240). When the instruction receiving unit 15 of the terminal 1 receives the security processing command (step S220: NO), the security processing executing unit 16 performs the security processing instructed by the security processing command (step S250).

  Security processing includes powering off the terminal 1, physically destroying the hardware in the terminal 1, destroying data stored in the terminal 1, notifying a designated location, and starting a chat with a predetermined terminal There is processing such as. In addition, after notification to a designated place, processing such as power-off, physical hardware destruction, data destruction, and the like may be performed. What kind of security processing is performed is determined in advance in the terminal 1.

  The process of physically destroying the hardware is executed when the startup retry of the terminal 1 is performed a predetermined number of times or more. For example, the security process execution unit 16 can measure the number of times the security process command is received as the number of activation retries. Alternatively, the monitoring device 3 may measure the number of times that the activation is not permitted, and transmit a physical destruction processing command when the number of times exceeds a predetermined number.

  In the notification process to the designated location, the startup location of the terminal 1, the terminal ID, the fact that the theft has occurred, etc. are notified to a predetermined device such as a security monitoring center, a security company maintenance terminal, or the user's mobile phone 5. The message is transmitted via the network N. Alternatively, it may be automatically transmitted to a telephone such as the police, and the starting location of the terminal 1, the terminal ID, the fact that the theft has occurred, etc. may be output by voice guidance.

  In the chat activation process with the designated terminal, a chat is activated with a maintenance terminal such as a security monitoring center or a security company, or with a predetermined device such as a user's PC. A security monitoring center, a security company employee, or a user uses a chat to input a message to a maintenance terminal, a PC, etc., and display the message on the terminal 1. As a result, it is possible to warn the user of the terminal 1 that it is illegal use or to output a warning that the user should return immediately.

On the other hand, when the determination unit 32 determines in step S180 that the current position of the terminal 1 is not included in the use permission area or the activation time is not included in the permission time zone (step S180: NO). The notification unit 34 notifies the mobile phone 5 of activation outside the area via the network N using the user address read in step S150 (step S260).
For example, when the user address is a telephone number, the notification unit 34 calls the mobile phone 5 and when the user responds to the mobile phone 5, “The terminal is about to be activated outside the use permission area. Send guidance such as “Do you want to allow it?”. When the user address is an e-mail address, the same content is notified by e-mail. When the user permits activation, the user inputs authentication information and an activation permission instruction to the mobile phone 5. The mobile phone 5 transmits the input authentication information and activation permission instruction to the management apparatus 3.

  When the response reception unit 35 of the management device 3 receives the authentication information and the activation permission instruction from the mobile phone 5 (step S270: YES), the authentication unit 36 is based on the received authentication information and the terminal ID in the activation notification. The authentication information read from the user information in the storage unit 30 is compared to authenticate the user. When the authentication is successful, the updating unit 33 adds the position information in the activation notification as registration area information to the activation permission information in the storage unit 30 specified by the terminal ID in the activation notification (step S280). . At this time, a predetermined time before and after the time information in the activation notification may be registered as permission time zone information corresponding to the registered position information. After the registration of the position information, the processes after step S210 described above are performed. That is, the management apparatus 3 transmits a start command, and the terminal 1 executes a start process.

In step S <b> 260, when the notification unit 34 of the management device 3 notifies the mobile phone 5, if it is determined that the user does not permit activation, an instruction to disable activation is input to the mobile phone 5. The mobile phone 5 transmits the input instruction indicating that the activation is not possible to the management device 3.
When the response receiving unit 35 of the management device 3 receives an instruction to disable activation from the mobile phone 5 (step S270: NO), the instruction transmitting unit 37 transmits a security processing command to the terminal 1 (step S240). When the instruction receiving unit 15 of the terminal 1 receives the security processing command (step S220: NO), the security processing executing unit 16 performs the security processing instructed by the security processing command (step S250).
Note that in step S270, an instruction as to which security processing to execute may be received from the mobile phone 5, and the security processing command instructed in step S240 may be transmitted.

  If the determination unit 32 determines in step S170 that the terminal ID is registered in the theft information (step S170: YES), the instruction transmission unit 37 transmits a security processing command to the terminal 1. When the instruction receiving unit 15 of the terminal 1 receives the security processing command (step S220: NO), the security processing executing unit 16 performs the security processing instructed by the security processing command (step S250). Here, since it is clear that the terminal is stolen, it is desirable to execute physical destruction and data destruction as security processing.

FIG. 7 shows an operation flow of the security monitoring system when connection to the network N cannot be made in step S120 of FIG.
In step S120 of FIG. 6, when the communication unit 11 of the terminal 1 cannot establish connection with the network N (step S120: NO), the determination unit 17 determines the current position acquired by the position information acquisition unit 12 in step S110. And the registration area information in the storage unit 10 are compared to determine whether or not the current position is included in the use permission area indicated by the registration area information (step S310).
If the determination unit 17 determines that the current position is within the use-permitted area (step S320: YES), the determination unit 17 outputs an activation command to the instruction reception unit 15. Thereby, the process of step S230 of FIG. 6 is performed in which the security process execution unit 16 executes the startup process.

  In addition, when the determination unit 17 determines that the current position does not correspond to the use permission area (step S320: NO), a message instructing the user to input authentication information is displayed on the screen. The user inputs authentication information to the terminal 1 according to the message. For example, when performing password authentication, the user inputs the password using a keyboard or the like. In addition to password authentication, biometric authentication, voiceprint authentication, or the like may be performed. The authentication unit 18 compares the authentication information read from the storage unit 10 with the input authentication information, and authenticates the user (step S340).

When the authentication unit 18 determines that the authentication is successful (step S340: YES), the update unit 19 adds the position information of the current position to the registration area information in the storage unit 10 as an available area (step S350). Thereafter, when the communication unit 11 can establish a connection with the network N (step S360: YES), the notification unit 14 obtains its own terminal ID read from the storage unit 10 and the location information registered in step S350. The registration instruction including this is transmitted to the management apparatus 3 (step S370). The update unit 33 of the management device 3 adds the position information in the received registration instruction as registration area information to the activation permission information in the storage unit 30 specified by the terminal ID in the registration instruction. In addition, time information of the activation time may be included in the registration instruction. At this time, a predetermined time before and after the time information in the activation notification is registered as permission time zone information corresponding to the registered position information.
After the activation permission information is updated, the processing after step S110 in FIG.

  When the authentication unit 18 determines that the authentication has failed in step S340 (step S340: NO), the security processing command is output to the instruction receiving unit 15. Thereby, the process of step S250 in FIG. 6 is performed in which the security process execution unit 16 executes the security process.

If it is assumed that the activation position is not changed, such as the terminal 1 is a desktop PC, the determination unit 17 determines in step S320 that the current position does not correspond to the use permission area (step S320: NO) Immediately, the security process in step S250 of FIG. 6 may be executed. In this case, it is particularly desirable to perform physical destruction or data destruction.
In step S320, when the determination unit 17 determines that the current position does not correspond to the use-permitted area (step S320: NO), the terminal 1 outputs a message instructing to start where communication with the center is possible. The power supply may be turned off.

FIG. 8 is a diagram illustrating an example of a message displayed on the display by the terminal 1 when position information cannot be acquired in step S110 of FIG.
This message includes an instruction to move to a position where position information can be detected and a warning to turn off the power. The terminal 1 turns off the power after a predetermined time after displaying the message.

FIG. 9 is a diagram illustrating an example of a message displayed on the display by the terminal 1 in step S330 of FIG.
This message includes the fact that the current position is outside the use permission area (operable area) and the instruction to input authentication information (password) for registering the current position as the use permission area. ing. If the authentication information is not input within a predetermined time after the message is displayed, the terminal 1 considers that the authentication has failed and executes the security process in step S250 of FIG.

FIG. 10 is a diagram illustrating an example of a message displayed on the display by the terminal 1 in step S350 of FIG.
The message in the figure includes an area where the current position is registered as a use-permitted area, and information that the computer is activated and can be used. The terminal 1 executes the activation process after a predetermined time after displaying the message.

FIG. 11 is a diagram illustrating an example of a message displayed on the display by the terminal 1 in step S250 of FIG.
The terminal 1 displays a message shown in the figure after executing a security process such as a process for contacting a designated place. This message includes a warning that the theft has been reported due to detection of unauthorized use, and an instruction to stop using and contact the security monitoring center. The terminal 1 may further perform security processing after displaying the message.

In step S100 of FIG. 6, when the power of the terminal 1 is turned on, the processing from step S110 is performed, but when the power is turned on, the sleep state (suspend state) returns to the normal operation state. In such a case, the processing after step S110 may be performed.
Moreover, in step S120 of FIG. 6, when the communication unit 110 of the terminal 1 cannot establish a connection with the network N (step S120: NO), the security process in step S250 may be executed.
Further, when it is determined in step S180 of FIG. 6 that it is within the use permission area and the permission time zone (step S180: YES), the processing after the start command transmission in step S210 may be executed immediately.

  In the above, the position information acquisition unit 12 of the terminal 1 uses the latitude / longitude acquired from the GPS as the position information. For example, the terminal 1 communicates with a PHS (Personal Handyphone System) or the like. When performing, the base station which is performing radio | wireless communication can be used as a positional information. In addition, when the terminal 1 performs communication using a public wireless LAN (Local Area Network), a hot spot can be used as position information.

According to the above embodiment, since unauthorized use of the terminal 1 can be detected based on the current position and activation time of the terminal 1, when a third party tries to use the terminal 1 illegally due to theft or the like, Can be detected and measures to prevent unauthorized use can be taken. Therefore, it is possible to dramatically increase the security level than before.
Further, even if a third party activates the terminal 1 in the use permission area, it is possible to take measures to prevent unauthorized use if the terminal has been reported in advance.
In addition, when the user of the terminal 1 is used outside the use permission area, the legitimate user can be notified immediately. At this time, if the legitimate user who has received the notification determines that it is not unauthorized use, the terminal 1 can be used and the current position can be registered as a newly available place. For example, when a legitimate user uses the terminal 1 during commuting, the location registration is repeated every time the terminal 1 is activated on the commuting route, even if the commuting route is not registered as an available area in advance. The commuting route is registered as an available area. On the other hand, when it is determined that it is unauthorized use, a measure for preventing unauthorized use can be taken, and the measure for preventing unauthorized use can also be selected by the user.
Even in a situation where communication between the terminal 1 and the management device 3 is not possible, it is possible to ensure the security of the terminal.

The block diagram which shows the outline | summary structure of a security monitoring system. The block diagram which shows the internal structure of a terminal. The block diagram which shows the internal structure of a management apparatus. The block diagram which shows the hardware constitutions of a terminal. Block diagram showing the hardware configuration of the management device The figure which shows the operation | movement flow of a security monitoring system. The figure which shows the operation | movement flow of a security monitoring system. The figure which shows the example of the output message of a terminal. The figure which shows the example of the output message of a terminal. The figure which shows the example of the output message of a terminal. The figure which shows the example of the output message of a terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Terminal, 2 ... Management apparatus, 5 ... Mobile phone, 10 ... Memory | storage part, 11 ... Communication part, 12 ... Location information acquisition part, 13 ... Time information acquisition part, 14 ... Notification part, 15 ... Instruction reception part, 16 ... security processing execution unit, 17 ... determination unit, 18 ... authentication unit, 19 ... update unit, 20 ... registration area notification unit, 30 ... storage unit, 31 ... communication unit, 32 ... determination unit, 33 ... update unit, 34 ... Notification unit 35 ... Response reception unit 36 ... Authentication unit 37 ... Instruction transmission unit

Claims (8)

A storage unit that stores registration area information indicating an area in which use of the terminal is permitted;
A location information acquisition unit that acquires location information of the current location of the terminal;
A determination unit that determines whether the current position indicated by the position information acquired by the position information acquisition unit is included in the use-permitted area indicated by the registration area information in the storage unit;
When the determination unit determines that the current position is included in the use-permitted area, the terminal is activated. When the determination unit determines that the current position is outside the use-permitted area A security process execution unit that executes a predetermined process for ensuring the security of the terminal;
A security monitoring system comprising: The storage unit further stores theft information indicating the stolen terminal,
The determination unit refers to the theft information in the storage unit to determine whether the terminal is a stolen terminal;
The security processing execution unit executes a predetermined process for ensuring security when the determination unit determines that the terminal is a stolen terminal;
The security monitoring system according to claim 1.   The security monitoring according to claim 1, further comprising: a notification unit that outputs a notification to another device when the determination unit determines that the current position is outside the use permission area. system.   4. The security monitoring according to claim 3, wherein the security processing execution unit executes a startup process of the terminal when a use permission notification is received in response to the notification output by the notification unit. system. The process for ensuring the security is as follows:
Processing to turn off the terminal, processing to physically destroy the terminal, processing to destroy data stored in the terminal, notification processing of unauthorized use to other devices, The security monitoring system according to any one of claims 1 to 4, wherein the security monitoring system is any one of communication establishment processes. A security monitoring method used in a security monitoring system,
The location information acquisition unit acquires the location information of the current location of the terminal,
The determination unit refers to a storage unit that stores registration area information indicating an area in which use of the terminal is permitted, and the current position indicated by the position information acquired by the position information acquisition unit is the registration area information. To determine whether it is included in the permitted use area indicated by
The security process execution unit executes the activation process of the terminal when the determination unit determines that the current position is included in the use permission area, and the determination unit determines that the current position is outside the use permission area. Execute predetermined processing for ensuring the security of the terminal when it is determined that
A security monitoring method characterized by the above. A computer program used in a security monitoring system,
A location information acquisition step for acquiring location information of the current location of the terminal;
Referring to a storage unit that stores registration area information indicating an area where the use of the terminal is permitted, the current position indicated by the position information acquired by the position information acquisition step is indicated by the registration area information. A determination step for determining whether it is included in the permitted area;
When the determination step determines that the current position is included in the use-permitted area, the terminal activation process is performed, and when the determination step determines that the current position is outside the use-permitted area. A security process execution step for executing a predetermined process for ensuring the security of the terminal;
A computer program for causing a computer to execute. A computer-readable recording medium recording a computer program used in a security monitoring system,
A location information acquisition step for acquiring location information of the current location of the terminal;
Referring to a storage unit that stores registration area information indicating an area where the use of the terminal is permitted, the current position indicated by the position information acquired by the position information acquisition step is indicated by the registration area information. A determination step for determining whether it is included in the permitted area;
When the determination step determines that the current position is included in the use-permitted area, the terminal activation process is performed, and when the determination step determines that the current position is outside the use-permitted area. A security process execution step for executing a predetermined process for ensuring the security of the terminal;
A computer-readable recording medium on which a computer program is recorded.

Images