JP2008139996A - Information leakage prevention system and data storage method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To safely and inexpensively prevent leakage of important data in an information terminal for loss/theft of a portable information terminal. <P>SOLUTION: Data inside the portable terminal are isolated into a single image file as data associated with an optional module such as an application operated on the information terminal, and as to the one image file, a plurality of share files are created by applying a secret sharing technology. The share files are divided to be stored in the information terminal and a radio communication-capable portable terminal 110 or a management server 117. In occurrence of loss/theft of the information terminal 100, using a radio communication function of the portable communication terminal, the share file stored in the portable communication terminal is deleted by remote operation. In this way, an effect equivalent to complete deletion of the important data inside the information terminal can be obtained. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an information leakage suppression system and a data storage method, and in particular, an information leakage suppression system capable of preventing leakage of important data in the information terminal when a portable information terminal is lost or stolen. The present invention relates to a data storage method.

  With the full enforcement of the Personal Information Protection Law, employees are becoming more aware of measures against information leakage. On the other hand, with the widespread use of information terminals (excluding mobile phones) such as notebook PCs and PDAs, it is common for employees who go outside the company to work using those terminals, such as customer information and confidential information. The number of cases where information terminals are stolen or lost for important data is increasing. In recent years, the data in the information terminal is mostly encrypted, but the data itself is carried around. If the password is leaked, the data in the information terminal is leaked. Will end up.

Currently, a method using a thin client system is known as an effective solution as a technique that can prevent information leakage due to loss or theft of an information terminal or the like. As another method, a method of deleting data in the information terminal when the information terminal is lost or stolen has been proposed. As a conventional technique related to such a method, for example, a technique described in Patent Document 1 is known. This prior art is based on strict password authentication, and when authentication fails, the data in the information terminal is erased and the data cannot be used.
JP 2004-295386 A

  However, when the above-described thin client system is used, it is necessary to introduce a thin client system, and for this purpose, it is necessary to purchase a new thin client terminal, resulting in a great burden in terms of cost. . Further, since it is assumed that the thin client system is always connected and operated with the network system, there is a problem that it is difficult to transfer all information terminals to the thin client system.

  In addition, the prior art described in Patent Document 1 leaks important data by acquiring data in the information terminal before authentication, even if measures are taken to erase data using this technology. There is a problem that there is no danger that a third party acquires data in the secondary storage device. Even if a means for erasing data in the information terminal by remote control is taken, the information terminal is often not turned on and may not be erased. At that time, a malicious third party may move the information terminal to a place where remote operation is impossible and acquire data.

  The object of the present invention is to solve the above-mentioned problems of the prior art, and to realize the prevention of data leakage in the information terminal at the time of theft or loss of the information terminal at low cost by using an existing system. Information leakage that can prevent leakage of important data in the information terminal by quickly making the important data in the information terminal completely unusable before a third party acquires the data It is to provide a deterrence system and a data storage method.

  According to the present invention, the object is to provide an information leakage suppression system for preventing data stored in the information terminal from leaking to the outside when the information terminal is lost or stolen. A mobile communication terminal having a wireless communication function; and a management server, wherein the information terminal creates a virtual AP image file that creates a virtual AP image file from an execution file, a driver, and data stored in the terminal; A secret sharing means for distributing the AP image file into two or more share files, and a connection confirmation means for confirming whether communication with the mobile communication terminal and the management server can be established, A communication confirmation means for confirming whether communication with the mobile communication terminal can be established; and a data for managing a flag indicating the occurrence of loss or theft of the information terminal. Erasure management means, and secret sharing management means for transmitting and holding the share file transmitted from the information terminal to the mobile communication terminal, wherein the mobile communication terminal is a share file held in its own terminal And a data erasure unit that erases the virtual AP image file created by the virtual AP unit and processed by the user's operation. The shared file is distributed into two or more by the secret sharing unit. Is held in its own terminal, and the other part is transmitted to and held in the mobile communication terminal or the management server. The management server has transmitted the secret sharing management means from the information terminal. Synchronize so that the mobile communication terminal holds the same share file as the share file, and the flag managed by the data erasure management means is lost in the information terminal When changed to indicate theft, the mobile communication terminal is instructed to delete the shared file held by the mobile communication terminal, and the mobile communication terminal receives the instruction to delete the share file, and the data This is achieved by erasing the shared file held in the portable communication terminal by the erasing means.

  According to the present invention, the leakage of data in an information terminal when the information terminal is stolen or lost can be realized at low cost using an existing system, and a third party obtains the data. The important data in the information terminal can be prevented from leaking quickly by making the important data in the information terminal completely unusable immediately.

  Embodiments of an information leakage prevention system and a data storage method according to the present invention will be described below in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an information leakage suppression system according to an embodiment of the present invention. In FIG. 1, 100 is an information terminal, 101, 111, 118 are OSs, 102, 112, 119 are data transmission / reception modules, 103 is a secret sharing module, 104 is a virtual application (AP) module, 105 is a data management module, 106 is Connection confirmation module, 107 and 123 are secondary storage devices, 108 is a virtual AP image file, 109 and 116 are virtual AP share image files, 110 is a mobile communication terminal, 113 is a data erasure module, 114 is a transfer confirmation module, and 115 is Storage, 117 is a management server, 120 is a secret sharing management module, 121 is a data erasure management module, 122 is a wireless communication confirmation module, 123 is a dedicated cable, 125 is a LAN, and 126 is a wireless communication line.

  The information leakage suppression system according to the embodiment of the present invention includes an information terminal 100, a mobile communication terminal 110, and a management server 117. Each of the information terminal 100, the mobile communication terminal 110, and the management server 117 includes an input device such as a CPU, a main memory, a keyboard, and a mouse, an output device such as a display device, a printer, etc. An information processing apparatus including a secondary storage device and a storage. In the main memory, the OS and various modules as programs for executing the functions according to the present invention are loaded and stored from a disk device or the like, and are executed on the OS by a CPU (not shown) to construct each function. .

  OS 101, 111, 118 and data transmission / reception modules 102, 112, 119 are installed in each of the information terminal 100, the mobile communication terminal 110, and the management server 117. The information terminal 100, the mobile communication terminal 110, and the management server 117 are Data can be transferred to each other using the dedicated cable 124, the LAN 125, and the wireless communication line 126.

  The information terminal 100 includes a secondary storage device 107 like a normal notebook PC, can be connected to the LAN 125, and is connected to the portable communication terminal 110 using an interface such as a USB and a dedicated cable 124. It has a function that allows data communication. In addition, it is assumed that the information terminal 100 has taken a general security measure. For example, when the information terminal 100 is used, login authentication using a password is performed, or an appropriate password is set. For example, measures are taken so that a third party cannot easily acquire data in the information terminal 100.

  In the information terminal 100, an OS 101, a data transmission / reception module 102, a secret sharing module 103, a virtual AP module 104, a data management module 105, and a connection confirmation module 106 are installed.

  The secret sharing module 103 is a module that can distribute a virtual AP image file 108 (described later) into two or more files by using a secret sharing technique. The secret sharing technique is a technique for distributing one data to two or more data (hereinafter, the distributed data is described as a share, and the distributed file is described as a share file. ). The individual shares are distributed so that the original information cannot be inferred from each share at all, so that data can be stored safely. In addition, it is possible to restore the original data by arranging the number of shares equal to or greater than a predetermined threshold (all in the example described).

  The virtual AP image file 108 is obtained by separating all data related to modules such as applications installed in the information terminal 100 as one image file. For example, the application execution file, driver, and setting data (For example, setting data stored in a registry or the like) is an image file in which is written.

  In FIG. 1, the reason why the virtual AP image file 108 stored in the secondary storage device 107 of the information terminal 100 is indicated by a dotted line is that the virtual AP image file 108 is in the secondary storage device during the operation of the information terminal 100. 107 is stored as one image file in the information terminal 100, but when the information terminal 100 is shut down, it is divided into two or more by the secret sharing module 103 and the secondary storage device in the information terminal 100 This is because the data is stored in the storage device 107 of the mobile communication terminal 110, the secondary storage device 123 of the management server 117, or both.

  In the example illustrated in FIG. 1, the virtual AP image file 108 is distributed into two, a virtual AP share image file 109 and a virtual AP share image file 116, and the virtual AP share image file 109 is a secondary storage in the information terminal 100. The device 107 also shows a case where the virtual AP share image file 116 is stored in the storage 115 in the mobile communication terminal 110 and the secondary storage device 123 in the management server 117. When starting an application on the information terminal 100, the information terminal 100 acquires the virtual AP share image file 116 from the mobile communication terminal 110 or the management server 117, and stores the virtual AP stored in the secondary storage device 107 of the information terminal 100. This is possible by restoring the virtual AP image file 108 together with the AP share image file 109.

  The virtual AP module 104 is a module that creates and uses a virtual AP image file 108. In the information terminal 100, an arbitrary module such as an application stores data to be performed on an arbitrary area of the secondary storage device 107. A function for monitoring file I / O operations such as reading and writing and redirecting these file I / O operations to an arbitrary area on the virtual AP image file 108 and the redirected destination are stored in advance. Data that an arbitrary module such as an application has previously read and written to an arbitrary area on the secondary storage device 107 (in practice, the virtual AP module 104 redirects the data to the virtual AP image file 108 by the redirect function). When reading and writing to (saved data) Read for any area of the aforementioned virtual AP image file 108 is a module having a function to redirect to the writing. The virtual AP module 104 can separate the data related to all the applications operating on the OS 101 as one image file by the above-described redirect function.

  The data management module 105 is a module that manages the storage and download of the share file divided by the secret sharing module 103, and the share file (in FIG. 1, in FIG. 1) of the virtual AP image file 108 created when the information terminal 100 is shut down. A function of storing one or more of the virtual AP share image file 109 and the virtual AP share image file 116 (in FIG. 1, the virtual AP share image file 116) in the management server 117 or the mobile communication terminal 110; It has a function of downloading a share file (in FIG. 1, a virtual AP share image file 116) stored in the management server 117 or the mobile communication terminal 110.

  The connection confirmation module 106 is a module having a function of detecting that the information terminal 100 is connected to the management server 117 via the LAN 125 and connected to the portable communication terminal 110 via the dedicated cable 124. The connection confirmation module 106 is used to determine the storage and download destination when the data management module 105 stores and downloads the share file.

  The mobile communication terminal 110 is a mobile phone, a PHS, or the like, can perform data communication with the management server 117 through the wireless communication line 126, and is connected to the information terminal 100 through the dedicated cable 124. Data transfer is possible. In addition, a storage 115 having a sufficient capacity capable of storing the share file transferred from the information terminal 100 and the management server 117 is provided. When the portable communication terminal 110 is used in an environment where the LAN 125 cannot be used, such as outside the company, the portable communication terminal 110 is connected to the information terminal 100 by the dedicated cable 124, and the information terminal 100 is included in the share file of the virtual AP image file 108. Is used to store and download one or a plurality of (the virtual AP share image file 116 in FIG. 1).

  In the mobile communication terminal 110, an OS 111, a data transmission / reception module 112, a data erasure module 113, and a transfer confirmation module 114 are installed. For simplicity of explanation, it is assumed that one virtual AP share image file 116 is stored in the storage 115 of the mobile communication terminal 110, but a plurality of share files may be stored. .

  The data erasure module 113 is a module for erasing the share file (the virtual AP share image file 116 in FIG. 1) in the mobile communication terminal 110 when the information terminal 100 is lost or stolen. The data erasure module 113 also has a function of transmitting an “erase success signal” to the management server 117 when the share file is successfully erased. The data erasure module 113 includes a share file erasure command issued to the data erasure module 113 by a transfer confirmation module 114 (described later) in the mobile communication terminal 110 or a data erasure management module 121 in the management server 117. By receiving the “delete signal” of the share file transmitted to 110, the share file stored in the storage 115 in the mobile communication terminal 110 (in FIG. 1, the virtual AP share image file 116) is completely deleted. .

  The transfer confirmation module 114 is used to determine whether or not to transfer a share file stored in the mobile communication terminal 110 (in FIG. 1, the virtual AP share image file 116) to the information terminal 100. It is a module. When there is a share file transfer request from the information terminal 100, the mobile communication terminal 110 makes an inquiry to the data erasure management module 121 of the management server 117. If the information terminal 100 is stolen or lost, the data erasure management module 121 in the management server 117 transmits an “erase signal” for erasing the share file to the mobile communication terminal 110. When receiving the data “erase signal”, the transfer confirmation module 114 stops the transfer of the share file, and instructs the data erase module 113 to delete the share file at that time. In response to this command, the data erasure module 113 completely erases the share file stored in the storage 115.

  The management server 117 has a function of storing one or more of the share files of the virtual AP image file 108 divided by the secret sharing module 103 of the information terminal 100 (the virtual AP share image file 116 in FIG. 1). When the information terminal 100 is lost / stolen, one or a plurality of share files (the virtual AP share image file 116 in FIG. 1) stored in the storage 115 in the mobile communication terminal 110 are deleted. The function of transmitting the “erase signal” of the mobile station to the mobile communication terminal 110 and the share file transferred from the information terminal 100 (in FIG. 1, the virtual AP share image file 116) are transferred to the mobile communication terminal 110, and the management server Synchronize so that 117 and mobile communication terminal 110 have the same share file With the ability. The management server 117 also includes an interface for operation when the administrator transmits a “delete signal” of the share file to the mobile communication terminal 110 when the information terminal 100 is lost or stolen.

  In the management server 117, an OS 118, a data transmission / reception module 119, a secret sharing management module 120, a data erasure management module 121, and a wireless communication module 122 are installed.

  The secret sharing management module 120 transfers the share file (the virtual AP share image file 116 in FIG. 1) transferred from the information terminal 100 to the mobile communication terminal 110, and the management server 117 and the mobile communication terminal management 110 are the same. This is a module for synchronizing to have a shared file. The secret sharing management module 120 automatically retransfers the share file transferred from the information terminal 100 to the mobile communication terminal 110. The mobile communication terminal 110 stores the transferred share file in the storage 115, and transfers the share file to the information terminal 100 when a request for downloading the share file is received from the information terminal 100. Thereby, the information terminal 100 can start an application in the information terminal 100 by connecting to either the management server 117 or the mobile communication terminal 110.

  The data erasure management module 121 has a function of managing an “erase flag” for indicating whether or not the information terminal 100 has been lost or stolen, and a shared file stored in the storage 115 of the mobile communication terminal 110 ( In FIG. 1, the virtual AP share image file 116) has a function of transmitting an “erase signal” for remotely erasing the wireless AP share image file 116) by wireless communication. The “erase flag” indicates that the information terminal 100 has been lost or stolen when its value is “ON”, and that it has not been lost or stolen when it is “OFF”. The ON / OFF switching can be performed by the administrator through a change operation from the interface screen of the management server 117. When the “erase flag” is turned ON, an “erase signal” is automatically transmitted to the mobile communication terminal 110, and the shared file in the storage 115 of the mobile communication terminal 110 is completely erased.

  The wireless communication confirmation module 122 is a module for confirming whether the management server 117 and the mobile communication terminal 110 can perform wireless communication. This module 122 is used when the management server 117 transmits an “erase signal” to the mobile communication terminal 110.

  FIG. 2 is a diagram for explaining how to create and use the virtual AP image file 108 in the information terminal 100. Next, this will be described. Note that the information terminal 100 illustrated in FIG. 2 includes an AP installer 200 that installs an arbitrary application.

(1) When the AP installer 200 starts installation, in a PC environment in which a normal virtual AP module does not exist, data to be installed (for example, an execution file, a driver, data stored in a registry, etc.) is secondary The file is stored in an arbitrary area in the storage device 107 (for example, an execution file or the like is an Application folder or the like under the Program folder of the C drive). In the example shown in FIG. 2, the data to be installed is an execution file 202, a driver 203, data 204,... (Step s200).

(2) In the case of the system according to the embodiment of the present invention, when the AP installer 200 starts installation, the virtual AP module 104 redirects the data to be installed from the area where it is originally stored, and the virtual AP image file 108 Save to any area of. In the example shown in FIG. 2, the installed data is installed on the virtual AP image file 108 as an execution file 205, a driver 206, data 207,. That is, the virtual AP conversion module 104 packages data related to the application as a virtual AP image file 108 when the application is installed (step s201).

  As described above, data related to an application running on the information terminal 100 can be stored as the virtual AP image file 108. Thereafter, an arbitrary module 201 such as an application running on the OS performs writing and reading with respect to data on the virtual AP image file 108.

(3) Now, for example, when an arbitrary module 201 operating on the OS 101 tries to read an execution file, the arbitrary module 201 tries to read the execution file 202 (step s202).

(4) In response to the attempt of the arbitrary module 201 in step s202, the virtual AP module 104 causes the arbitrary module 201 to actually refer to the execution file 205 on the virtual AP image file 108 by the redirect function. Is read (step s203).

  As described above, it is possible to separate data related to all applications installed in the information terminal 100 as one image file.

  FIG. 3 is a flowchart for explaining the processing operation of starting the information terminal 100 and starting the virtual application, which will be described next.

(1) When the information terminal 100 is activated by the user turning on the power, the connection confirmation module 106 in the information terminal 100 is connected to either the mobile communication terminal 110 or the management server 117. Whether or not the information terminal 100 is connected is confirmed (steps s300 and s301).

(2) If the information terminal 100 is not connected to either the mobile communication terminal 110 or the management server 117 in the confirmation process in step s301, a text requesting connection to the mobile communication terminal 110 or the management server 117 is displayed. The information is displayed on the display of the information terminal 110 (step s302).

(3) Thereafter, the connection confirmation process is performed again, and if the connection is not performed even after a predetermined time has elapsed, the information terminal 100 is forcibly shut down without starting the application, and the process is terminated (step). s303, s304).

(4) When the information terminal 100 is connected to either the mobile communication terminal 110 or the management server 117 in the confirmation process in step s301, or in the confirmation process in step s303, the information terminal 100 is 110, when the information terminal 100 is connected to the management server 117, it is detected whether the information terminal 100 is connected to the management server 117, the mobile communication terminal 110, or both. Step s305).

(5) If the information terminal 100 is connected to the management server 117 in the confirmation process in step s305, or if both are connected to the management server 117, the data transmission / reception module 102 uses the virtual AP share image file on the management server 117. 116 is downloaded. Here, when both are disconnected, the management server is given priority (step s306).

(6) The information terminal 100 that has downloaded the virtual AP share image file 116 on the management server 117 includes the virtual AP share image file 109 held by the secret sharing module 103 in the self information terminal 100 and the downloaded virtual AP share image file. 116 and the virtual AP image file 108 is restored (step s307).

(7) Thereafter, the information terminal 100 uses the virtual module restored by an arbitrary module that activates the application on the information terminal 100 (for example, in the case of Windows (registered trademark), the service control manager (SCM)). The application is activated using the AP image file 108, and the information terminal 100 can be used as usual (step s308).

(8) When the information terminal 100 is connected to the mobile communication terminal 110 in the confirmation process in step s305, the secret sharing module 103 in the information terminal 100 sends a virtual AP share image file to the mobile communication terminal 110. 116 is requested to transfer (step s309).

(9) When the mobile communication terminal 110 receives a request to transfer the virtual AP share image file 116, the transfer confirmation module 114 confirms whether the information terminal 100 has been stolen or lost. The data erasure management module 121 is inquired of the “erase flag”, and information on the “erase flag” is received from the data erasure management module 121 in the management server 117 (step s310).

(10) The transfer confirmation module 114 of the mobile communication terminal 110 determines whether the information terminal 100 is lost or stolen depending on whether the content of the received “erase signal” is ON or OFF (step s311).

(11) If it is determined in step s311 that the content of the “erase signal” is ON and the information terminal 100 is lost or stolen, the mobile communication terminal 110 determines that the virtual AP share image file 106 , The data erasure module 113 is instructed to erase the virtual AP share image file 116, and the data erasure module 113 erases the virtual AP share image file 116 and ends the processing here (step s312). .

(12) If it is determined in step s311 that the content of the “erase signal” is OFF and the information terminal 100 is not lost or stolen, the transfer confirmation module 114 transmits / receives data to / from the information terminal 100. The module 102 is notified of data transfer approval.

(13) Receiving the notification of data transfer approval, the information terminal 100 loads the virtual AP share image file 116 from the mobile communication terminal 110 to the Dow using the data transmission / reception module 102 (step s306).

(14) After that, the information terminal 100 executes the processes of steps s307 and s308 described above to activate the application and use the information terminal 100 as usual.

  FIG. 4 is a flowchart for connecting the processing operations of the shutdown of the information terminal 100, the secret sharing and storage of the virtual AP image file, and this will be described next.

(1) When the user shuts down the information terminal 100, the secret sharing module 103 receives the shutdown request of the information terminal 100, and converts the virtual AP image file 108 into the virtual AP share image file 109 and the virtual AP share image file 116. And split into In this example, the virtual AP image file 108 is divided into two files, but may be divided into three or more (steps s400 and s401).

(2) Next, the connection confirmation module 106 in the information terminal 100 confirms the connection status of the information terminal 100 that determines whether the information terminal 100 is connected to either the mobile communication terminal 110 or the management server 117. Is performed (step s402).

(3) If the information terminal 100 is not connected to either the mobile communication terminal 110 or the management server 117 in the confirmation process in step s402, a text requesting connection to the mobile communication terminal 110 or the management server 117 is displayed. The information is displayed on the display of the information terminal 110 (step s403).

(4) Thereafter, the connection confirmation process is performed again. If the connection is not made even after a predetermined time has elapsed, the data storage is stopped and the data is erased. However, the situation where data is erased here is a very rare case, and there is usually no case where data is erased. This is because when the information terminal 100 is started up, the virtual share image file 116 must be downloaded by connecting to the mobile communication terminal 110 or the management server 117, so that the mobile communication terminal 110 and the management server 117 cannot be connected. This is because the situation in which the application is activated is rare (step s405).

(5) When the information terminal 100 is connected to either the portable communication terminal 110 or the management server 117 in the confirmation process in step s402, or in the confirmation process in step s303, the information terminal 100 is changed to the portable communication terminal. 110, when the information terminal 100 is connected to the management server 117, it is confirmed whether the information terminal 100 is connected to the management server 117, the mobile communication terminal 110, or both. Step s406).

(6) If the information terminal 100 is connected to the management server 117 in the confirmation processing in step s406, or if it is connected to both, the virtual AP share image file 116 is transferred and stored on the management server 117. Let Here, if both are connected, the management server 117 is prioritized (step s407).

(7) If the information terminal 100 is connected to the mobile communication terminal 110 in the confirmation process in step s406, the virtual AP share image file 116 is transferred to the mobile communication terminal 110 and stored (step s408).

(8) After step s407 or step s408, the virtual AP share image file 116 is deleted from the information terminal 100 when the transfer is completed (step s409).

(9) When the storage of the virtual AP share image file 116 is completed, the management server 117 and the mobile communication terminal 110 synchronize the virtual AP share image file 116 so that the same data is stored in both. (Step s410).

(10) When the processing up to this point is completed, the information terminal 100 is shut down (step s411) because the information terminal 100 is in the same state as when there is no important information.

  FIG. 5 is a diagram showing the transition of the virtual AP image file. The transition of the virtual AP image file is shown in FIG. 3 and FIG. 4 by the processing in the flow described above, and the virtual AP image file 108 is divided into virtual AP share image files 109 and 116 and combined. It is shown.

  FIG. 6 is a flowchart for explaining the processing operation when the information terminal 100 is lost or stolen. Next, this will be explained.

(1) When the user of the information terminal 100 notices that the information terminal 100 is lost or stolen, the user reports to the administrator (step s600).

(2) Upon receiving this report, the administrator turns on the “erase flag” managed by the data erasure management module 121 through the interface on the management server 117 (step s601).

(3) In response to the “erase flag” being turned ON, the wireless communication confirmation module 122 confirms the wireless communication status between the management server 117 and the portable communication terminal 110 and determines whether communication is possible. (Step s602).

(4) If it is determined in step s602 that wireless communication with the mobile communication terminal 110 is not possible, the wireless communication confirmation module 122 waits for a certain period of time and performs processing for confirming the communication status again. Here, in order to use the information terminal 100 even if the information terminal 100 is lost or stolen and a malicious third party who has stolen tries to misuse the data in the information terminal 100, the mobile communication terminal Of these, it is necessary to acquire the virtual AP share image file 116 of 110 and restore the virtual AP image file 108, so that safety is maintained. Even if a malicious third party obtains both the mobile communication terminal 110 and the information terminal 100, the virtual AP share image file 116 cannot be transferred to the information terminal 100 by the transfer confirmation module 114 of the mobile communication terminal 110. Therefore, the information terminal 100 and the application cannot be activated and data cannot be used (step s603).

(5) If it is determined in step s602 that wireless communication with the portable communication terminal 110 is possible, the data deletion management module 121 of the management server 117 deletes the virtual AP share image file 116 in the communication portable communication terminal 110. An “erase signal” is transmitted for performing (Step s604).

(6) When receiving the “erase signal”, the mobile communication terminal 110 temporarily suspends operations other than the module related to data erasure among the modules operating in the mobile communication terminal 110 and stored in the storage 115. The existing virtual AP share image file 116 is deleted with the highest priority (step s605).

(7) After the erasure of the virtual AP share image file 116 is completed, the mobile communication terminal 110 transmits an “erase success signal” notifying that the virtual AP share image file 116 has been successfully erased to the management server 117 (step s606).

(8) The data erasure management module 121 in the management server 117 confirms whether or not the “erase success signal” has been received, and if received, ends the processing here (step s607).

(9) If it is confirmed in step s607 that the “erase success signal” has not been returned even after a predetermined time, the management server 117 returns to the processing from step s602 and repeats the processing. That is, when the “erase success signal” is not returned, the “erase signal” is periodically transmitted from the management server 117 to the mobile communication terminal 110.

  In the above-described processing, the information terminal has been lost. However, as a loss type, only the mobile communication terminal 110 is lost, or both the mobile communication terminal 110 and the information terminal 100 are lost. Although it exists, regardless of the type of loss, by performing the processing of steps s600 to s607 described above, the same effect as erasing all the data in the information terminal 100 can be obtained, and the data in the information terminal 100 can be obtained. It is possible to prevent leakage easily and safely.

  Each process in the above-described embodiment of the present invention is configured by a program and can be executed by a CPU included in the present invention. These programs are stored in a recording medium such as an FD, CDROM, or DVD. It can be provided and can be provided by digital information via a network.

  The above-described embodiment of the present invention includes the information terminal 100, the mobile communication terminal 110, and the management server 117 to configure the system. The reason for using the mobile communication terminal 110 is that the mobile communication terminal is always powered. Is generally used when it is turned on, has a large wireless communication function, and is always possessed when going out, etc., so that it is convenient for the implementation of the present invention. Instead of the terminal 110, another information terminal or the like can be used. For example, when the information terminal 100 according to the embodiment of the present invention has a function of performing communication by connecting to a wireless LAN, other information that can be connected to the information terminal 100 via the wireless LAN instead of the mobile communication terminal 110 is provided. An information terminal can also be used. In this case, since the other wireless terminal and the wireless terminal 100 are connected not via the dedicated cable 124 but via the wireless LAN, the dedicated cable 124 is not necessary. Other information terminals may communicate with the management server 117 via a wireless LAN, or may be connected via the LAN 125 to which the management server 117 is connected. .

It is a block diagram which shows the structure of the information leakage suppression system by one Embodiment of this invention. It is a figure explaining how to create and use a virtual AP image file on an information terminal. It is a flowchart explaining the processing operation of starting of an information terminal and starting of a virtual application. It is a flowchart which connects the processing operation | movement of shutdown of an information terminal, secret sharing of a virtual AP image file, and preservation | save. It is a figure which shows the transition of a virtual AP image file. It is a flowchart explaining processing operation when an information terminal is lost or stolen.

Explanation of symbols

100 Information terminal 101, 111, 118 OS
102, 112, 119 Data transmission / reception module 103 Secret sharing module 104 Virtual application (AP) module 105 Data management module 106 Connection confirmation module 107, 123 Secondary storage device 108 Virtual AP image file 109, 116 Virtual AP share image file 110 Mobile communication Terminal 113 Data erasure module 114 Transfer confirmation module 115 Storage 117 Management server 120 Secret sharing management module 121 Data erasure management module 122 Wireless communication confirmation module 123 Dedicated cable 125 LAN
126 wireless communication line

Claims (5)

In an information leakage suppression system for preventing data stored in the information terminal from leaking to the outside when the information terminal is lost or stolen,
The information terminal, a mobile communication terminal having a wireless communication function, and a management server,
The information terminal includes a virtual AP unit that creates a virtual AP image file from an execution file, a driver, and data held in the terminal; a secret sharing unit that distributes the virtual AP image file to two or more share files; Connection confirmation means for confirming whether communication with the mobile communication terminal and the management server can be established;
The management server includes a communication confirmation means for confirming whether communication with the mobile communication terminal can be established, a data erasure management means for managing a flag indicating the occurrence of loss / theft of the information terminal, and the information terminal Secret sharing management means for transmitting and holding the share file transmitted from the mobile communication terminal,
The mobile communication terminal has data erasing means for erasing a share file held in the terminal,
The information terminal holds the virtual AP image file created by the virtual AP unit and processed by the user's operation, and a part of the share file distributed to two or more by the secret sharing unit in its own terminal, Send the other part to the mobile communication terminal or the management server to hold it,
The management server synchronizes the secret sharing management means so that the mobile communication terminal holds the same share file as the share file transmitted from the information terminal, and the flag managed by the data erasure management means When the information terminal is changed to indicate loss or theft, the portable communication terminal is instructed to delete the shared file held by the portable communication terminal,
The mobile communication terminal receives an instruction to delete the shared file, and deletes the shared file held in the mobile communication terminal by the data erasing unit.   When the information terminal requests the management server or the mobile communication terminal to transfer the shared file held by the information terminal and receives the shared file, the secret sharing means holds the shared file held in the own terminal. 2. The information leakage suppression system according to claim 1, wherein a virtual AP image file is generated from the received share file. The portable communication terminal further has a transfer confirmation means for inquiring of the server whether or not to transmit the share file held in the own terminal to the information terminal, and is held in the own portable communication terminal from the information terminal. When the transfer request of the shared file is received, the transfer confirmation unit inquires the server whether the share file may be transmitted to the information terminal.
When the management server receives the inquiry, the management server transmits flag information managed by the data erasure management means to the mobile communication terminal,
2. The mobile communication terminal according to claim 1, wherein when the received flag indicates that the information terminal is lost or stolen, the data erasure unit erases the shared file held in the mobile communication terminal. Or the information leakage suppression system of 2 description.   4. The information leakage suppression system according to claim 1, 2, or 3, wherein, instead of the portable communication terminal, another information terminal capable of communicating with the information terminal is used. In the data storage method in the information leakage suppression system for preventing the data stored in the information terminal from leaking to the outside when the information terminal is lost or stolen,
The information terminal, a mobile communication terminal having a wireless communication function, and a management server,
The information terminal includes a virtual AP unit that creates a virtual AP image file from an execution file, a driver, and data held in the terminal; a secret sharing unit that distributes the virtual AP image file to two or more share files; Connection confirmation means for confirming whether communication with the mobile communication terminal and the management server can be established;
The management server includes a communication confirmation means for confirming whether communication with the mobile communication terminal can be established, a data erasure management means for managing a flag indicating the occurrence of loss / theft of the information terminal, and the information terminal Secret sharing management means for transmitting and holding the share file transmitted from the mobile communication terminal,
The mobile communication terminal has data erasing means for erasing a share file held in the terminal,
The information terminal holds the virtual AP image file created by the virtual AP unit and processed by the user's operation, and a part of the share file distributed to two or more by the secret sharing unit in its own terminal, Send the other part to the mobile communication terminal or the management server to hold it,
The management server synchronizes the secret sharing management means so that the mobile communication terminal holds the same share file as the share file transmitted from the information terminal, and the flag managed by the data erasure management means When the information terminal is changed to indicate loss or theft, the portable communication terminal is instructed to delete the shared file held by the portable communication terminal,
The data storage method, wherein the mobile communication terminal receives an instruction to delete the share file, and the data delete unit deletes the share file held in the mobile communication terminal.

Images