JP2009105862A - Security system and security method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security system and a security method capable of securing the security to the network. <P>SOLUTION: The security system comprises: an IC tag 12A capable of reading and writing data by communication; a sensitive device 11 placed in an A facility and writing specific data to the IC tag 12A when the IC tag 12A goes away from the A facility; a sensitive device 31 placed in a B facility and reading data from the IC tag 12A when the IC tag 12A reaches the B facility; a switching device 15 for switching enabled/disabled condition of a corporate network 22 in the B facility; a control device 13 and a personal computer 14 for collating the data written to the IC tag 12A by the sensitive device 11 with the data read out from the IC tag 12A by the sensitive device 31 to control the switching device 15 when the two data are coincident, thereby enabling the corporate network 22. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a security system and a security method for a network such as a LAN (Local Area Network) constructed in the company.

  In a network used exclusively by an organization such as a company, for example, an in-house network, various types of security are applied to prevent intrusion from the outside. As such security, there is a system that uses authentication data (for example, see Patent Document 1). In this system, the owner of the terminal device registers authentication data in the administrator's authentication device in advance. Thereafter, when the authentication device receives authentication data that requires confirmation from the terminal device, the authentication device compares the authentication data stored in advance with the received authentication data. If it is determined that the received authentication data is appropriate, the authentication device controls the modem and permits the terminal device to use the communication network.

  Some security uses a restriction device that restricts users. (For example, refer to Patent Document 2). The terminal device can be used only when the restriction device is incorporated into the terminal device and a predetermined card is inserted into the restriction device. Furthermore, there is a system using position detection of a terminal device as security (for example, see Patent Document 3). In this system, an area where the terminal device can be used is set in advance. And the position of a terminal device is detected using GPS (Global Positioning System) etc., When this terminal device exists in the area which can be used, communication by a network etc. are enabled.

This system using security prevents third parties from entering the corporate network.
JP 2005-39697 A JP-A-10-243136 JP 10-56449 A

  By the way, the system and apparatus described above have the following problems. In the case of a system using authentication data, confirmation of authentication data sent from a terminal device, that is, an authentication request, uses an extended AT command for controlling a modem. Since this AT command is widespread, security may be broken. In addition, when a restriction device that restricts users is used, security is broken due to card duplication. Furthermore, in the case of a system using the position detection of the terminal device, the position of the terminal device is specified using GPS or the like, but only an area can be set according to the position detection accuracy of the terminal device. Cannot be set.

  An object of the present invention is to provide a security system and a security method capable of solving the above-described problems and ensuring security for a network.

  In order to solve the above-mentioned problem, the invention of claim 1 is provided in a communication medium capable of reading and writing data by communication and a first point, and when the communication medium moves away from the first point, it is optional. A first communication device that writes the data to the communication medium, and a second communication device that is installed at a second point and reads data from the communication medium when the communication medium arrives at the second point; , A switching device for switching between enabling and disabling the network at the second point, data written by the first communication device to the communication medium, and the second communication device from the communication medium Control means for collating the read data and controlling the switching device when the two data match to enable the network to be used at the second point. It is a system.

  In the invention of claim 1, a communication medium capable of reading and writing data by communication, for example, an IC tag is used. The first communication device is installed at a first point, and writes arbitrary data into the communication medium when the communication medium leaves the first point. The second communication device is installed at the second point, and reads data from the communication medium when the communication medium arrives at the second point. Further, at this second point, the switching device controls whether to enable or disable the network, for example, the in-house network. The control means collates the data written by the first communication device to the communication medium and the data read by the second communication device from the communication medium. Then, when the two data match, the control means controls the switching device to make the network usable at the second point.

  According to a second aspect of the present invention, in the security system according to the first aspect, the data written by the first communication device to a communication medium and the data read from the communication medium by the second communication device are the control means. It is characterized by having a dedicated line to send to.

  According to a third aspect of the present invention, in the security system according to the first or second aspect, the communication medium stores in advance an identification code for identifying the other communication medium, and the control means includes the first communication. Arbitrary data written to the communication medium by the device and identification data read from the communication medium are collated with data read from the communication medium by the second communication device. Controlling to enable the network at the second point.

  According to a fourth aspect of the present invention, in the security system according to any one of the first to third aspects, the communication medium is an IC tag, and the first communication device and the second communication device are IC tags. When the IC tag enters and exits the sensing range, data is read and written.

  According to a fifth aspect of the present invention, in the security system according to any one of the first to fourth aspects, the switching device includes a switch unit provided in a line that is drawn into the second point of the network. Under the control of the control means, the switch unit is opened and closed to switch between enabling and disabling the network at the second point.

  The invention of claim 6 is a security method using a communication medium in which data can be read and written by communication, and when the communication medium leaves the first point, arbitrary data is written to the communication medium, and the communication medium Reads data from the communication medium when it arrives at the second point, and collates the data written to the communication medium at the first point with the data read from the communication medium at the second point And when the two data coincide with each other, the network is made usable at the second point.

  According to the first and sixth aspects of the invention, the network can be used when the data written at the first point matches the data read at the second point. In other words, since the specific arbitrary data written in the communication medium is used when leaving the first point, it is difficult for a third party to create the arbitrary data, and the security for this network is increased and the security is ensured. be able to.

  According to the second aspect of the present invention, since data is transmitted to the control means using a dedicated line, unlike conventional techniques using a widely used AT command, it is possible to prevent the security from being broken. it can.

  According to the third aspect of the present invention, the network is configured using arbitrary data when leaving the first point and the identification code stored in the communication medium in advance, that is, using two specific data. Since the data can be used, it is difficult for a third party to create these data, and security for the network can be further increased.

  According to the invention of claim 4, since an IC tag is used as a communication medium and data is read and written by entering and exiting the sensing range of the IC tag, the prior art can only set an area according to position detection accuracy such as GPS. Compared to, it is possible to set a narrower area.

  According to the fifth aspect of the present invention, since the network can be used or not used by opening and closing the switch unit, the configuration of the switch unit can be simplified and the reliability of the apparatus can be improved.

  Next, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, the case where the organization is a company and the network used by the organization is an in-house network is taken as an example.

(Embodiment 1)
A security system according to this embodiment is shown in FIGS. This security system includes a sensing device 11, a personal computer (PC) 12 to which an IC (Integrated Circuit) tag 12A is attached, a control device 13, a control personal computer (PC) 14, and a switching device 15. A facility is equipped. In addition, the B facility located away from the A facility includes a sensing device 31. Data communication is possible between the A facility and the B facility through the dedicated line 21. The in-house network 22 is a communication network that enables personal computers installed in each department in the company to communicate with each other. In this embodiment, employees are stationed at the A facility. In addition, the B facility is unmanned, and no personal computer is permanently installed in the B facility. Therefore, a person in charge of using the personal computer in the office B, for example, in the office room, brings the personal computer and moves from the facility A to the facility B. Facility B includes a jack 32 attached to the tip of the in-house network line 23 on the wall surface of the office.

  The switching device 15 is connected to an in-house network line 23 drawn from the in-house network 22 and drawn into the facility B, and normally the in-house network line 23 is turned off. The switching device 15 includes a first switch 15A and a second switch 15B. The first switch 15 </ b> A and the second switch 15 </ b> B are normally open and are closed under the control of the control device 13. That is, the switching device 15 closes the first switch 15A when receiving a high-level first control signal from the control device 13, and closes the second switch 15B when receiving a high-level second control signal from the control device 13. . Conversely, the first switch 15A and the second switch 15B are opened by the low-level first control signal and the second control signal, respectively. As described above, the opening and closing of the first switch 15A and the second switch 15B are individually controlled. The first switch 15A and the second switch 15B are connected in series, and the opening and closing of the first switch 15A and the second switch 15B switches the use or non-use of the in-house network line 23.

  The control device 13 controls opening and closing of the changeover switches 15A and 15B of the changeover device 15 under the control of the control personal computer 14. Further, the control device 13 sends various data received from the sensing devices 11 and 12 to the control personal computer 14. That is, the control device 13 connects the control personal computer 14 to the sensing device 11 and the sensing device 31 via the dedicated line 21.

  The personal computer 12 is a small and portable terminal device used by a person in charge within the company. An IC tag 12A is attached to the personal computer 12, and the personal computer 12 is managed by the IC tag 12A. The IC tag 12A is a small, non-contact communication medium that has a memory (not shown) therein and can read and write data. The IC tag 12A stores in advance an identification code made up of numbers and the like in order to distinguish it from other IC tags. Furthermore, the IC tag 12A can read out an identification code stored in advance in a memory (not shown) and data written in the memory (not shown).

  The sensing device 11 installed in the facility A uses the IC tag 12A of the personal computer 12 to detect the presence or absence of the personal computer 12 and the like, for example, as shown in FIG. Thus, it is installed on the storage shelf 41 in the A facility. The storage shelf 41 is a shelf for storing and managing the personal computer 12 in the concave storage portion 41A. As shown in FIG. 2, the sensing device 11 includes a control unit 11A, a communication unit 11B, a sensing sensor 11C, and a read / write unit 11D.

  The communication unit 11B of the sensing device 11 transmits / receives data to / from the control personal computer 14 of the control device 13 via the dedicated line 21. The detection sensor 11 </ b> C is a sensor having a range including the storage shelf 41 as a detection range. The detection sensor 11C transmits / receives an electromagnetic field to / from the IC tag 12A of the personal computer 12, and detects whether the IC tag 12A, that is, the personal computer 12 is within a detection range, for example, according to the intensity of the received electromagnetic field. Then, the detection sensor 11C notifies the control unit 11A of the detection result. When the IC tag 12A is within the sensing range, the sensing result is “sensed”, and when the IC tag 12A is outside the sensing range, the sensing result is “no sensing”. The read / write unit 11D writes data to the IC tag 12A and reads data from the IC tag 12A under the control of the control unit 11A.

  The control unit 11A of the sensing device 11 performs various processes based on the sensing result from the sensing sensor 11C. As a process performed by the controller 11A, there is a base point movement start process. The control unit 11A always determines whether or not the IC tag 12A is within the sensing range by the sensing sensor 11C. If it is determined that it is outside the sensing range, the control unit 11A performs base point movement start processing. That is, when the IC tag 12A does not store the exit data and the sensing result from the sensing sensor 11C changes from sensing to sensing, the control unit 11A controls the read / write unit 11D and the IC The exit data is written to the tag 12A. The exit data is any specific data composed of numbers or the like. In this embodiment, time data representing the time when the sensing result from the sensing sensor 11C has changed from sensing to sensing is used as the exit data. At the same time, a base point movement signal indicating that the IC tag 12A has moved is generated. The base point movement signal is a signal representing movement from the base point, that is, movement from the storage shelf 41 in this embodiment. The control unit 11A transmits the generated time data, the read identification code, and the base point movement signal to the control personal computer 14 by controlling the communication unit 11B. In addition to the time data, various types of data such as a password that is different every time the control unit 11A issues can be used as the exit data.

  Further, as a process performed by the control unit 11A, there is a base point arrival process. That is, when the IC tag 12A stores the time data and the sensing result from the sensing sensor 11C changes from no sensing to sensing, the control unit 11A displays the base point arrival signal indicating the arrival of the IC tag 12A. Is generated. The base point arrival signal is a signal indicating arrival at the base point, and in this embodiment, is a signal indicating that the IC tag 12A has entered the storage shelf 41. Further, the control unit 11A reads time data and an identification code from the IC tag 12A. Thereafter, the control unit 11A controls the communication unit 11B to transmit the time data, the identification code, and the base point arrival signal to the control personal computer 14. Then, the control unit 11A transmits a clear signal to the IC tag 12A, and clears the time data stored in the memory (not shown) by the IC tag 12A.

  The sensing device 31 installed in the office of the facility B uses the IC tag 12A of the personal computer 12 to detect the presence or absence of the personal computer 12 and the like. As shown in FIG. 5, it is installed on the upper wall surface of the office desk 51 in the office. As shown in FIG. 3, the sensing device 31 includes a control unit 31A, a communication unit 31B, a sensing sensor 31C, and a lead unit 31D.

  The communication unit 31B of the sensing device 31 transmits / receives data to / from the control personal computer 14 of the control device 13 via the dedicated line 21. The detection sensor 31C is a sensor having a detection range around the office desk 51 in the office. The detection sensor 31C detects whether the IC tag 12A of the personal computer 12 is within the detection range in the same manner as the detection sensor 11C. The sensing sensor 31C notifies the sensing result to the control unit 31A. The read unit 31D reads data from the IC tag 12A under the control of the control unit 31A.

  The control unit 31A of the sensing device 31 performs various processes based on the sensing result from the sensing sensor 31C. As processing performed by the control unit 31A, there is access point arrival processing. That is, when the sensing result from the sensing sensor 31C changes from sensing to sensing with the IC tag 12A storing the exit data, the control unit 31A controls the lead unit 31D to control the IC tag. The identification code and time data written in 12A are read. Further, the control unit 31A generates an access point arrival signal indicating that the IC tag 12A has arrived at the access point, that is, in this embodiment, that it has arrived at the office desk 51 in the office. Then, the control unit 31A controls the communication unit 31B to transmit the time data, the identification code, and the access point arrival signal to the control personal computer 14.

  Further, as a process performed by the control unit 31A of the sensing device 31 in the facility B, there is an access point movement start process. The control unit 31A performs access point movement start processing when the sensing result from the sensing sensor 31C changes from sensing to sensing without the IC tag 12A storing time data. That is, the control unit 31A generates an access point movement signal indicating that the IC tag 12A has moved from the access point when the detection result from the detection sensor 31C changes from detection to non-detection. Under control, this access point movement signal is transmitted to the control personal computer 14.

  The control personal computer 14 performs processing based on various data received from the sensing device 11 and the sensing device 31, and controls the control device 13 according to the processing result. When receiving the time data, the identification code, and the base point movement signal by the base point movement start process of the sensing device 11, the control personal computer 14 performs a first opening / closing process. That is, when receiving the time data and the identification code from the sensing device 11 of the facility A, the control personal computer 14 stores these data in a memory (not shown) and controls the control device 13 to control the switching device. A first control signal of a high level is sent to 15, and the first switch 15A of the switching device 15 is closed. At this time, since the second switch 15B is in the open state, the jack 32 of the facility B is not connected to the internal network 22, and the internal network 22 cannot be used.

  When receiving the time data, the identification code, and the access point arrival signal by the access point arrival process of the sensing device 31, the control personal computer 14 performs the second opening / closing process. That is, the control personal computer 14 collates the time data and identification code received from the sensing device 31 of the facility B with the time data and identification code stored in the first opening / closing process. When the time data and the identification code coincide with each other by the collation, the control personal computer 14 controls the control device 13, sends a high-level second control signal to the switching device 15, and closes the second switch 15B. Thereby, the jack 32 of the B facility is connected to the in-house network 22, and the in-house network 22 can be used in the office of the B facility.

  When receiving the access point movement signal by the access point movement start process of the sensing device 31, the control personal computer 14 performs the separation process. That is, the control personal computer 14 controls the control device 13 to send a low-level first control signal and a second control signal to the switching device 15, so that the first switch 15 A and the second switch 15 B of the switching device 15 are turned on. open. As a result, the jack 32 of the B facility is disconnected from the in-house network 22, and the in-house network 22 becomes unusable in the office of the B facility.

  When receiving the time data, the identification code, and the base point arrival signal from the sensing device 11 by the base point arrival processing of the sensing device 11, the control personal computer 14 performs initialization processing. That is, the control personal computer 14 collates the received time data and identification code with the time data and identification code stored in the first opening / closing process. When the time data and the identification code coincide with each other, the control personal computer 14 determines that the IC tag 12A is again stored in the storage shelf 41 which is the base point based on the base point arrival signal, and the internal memory (not shown) ) And the time data and the identification code stored in the internal memory (not shown) in the first opening / closing process are cleared.

  The control personal computer 14 performs the above-described various processes in accordance with the data stored in the IC tag 12A attached to the personal computer 12 and each movement signal and each arrival signal, that is, according to the sensing location of the IC tag 12A. To control the switching device 15.

  Next, a security method by the security system of this embodiment will be described with reference to FIGS. Usually, the sensing device 11 at the facility A senses the IC tag 12A attached to the personal computer 12 (step S1) and determines whether there is an IC tag 12A (step S2).

  When the IC tag 12A changes from sensing to non-sensing, that is, when the person in charge carries the personal computer 12 to move to the facility B and the personal computer 12 moves from the storage shelf 41, the sensing device 11 performs a base point movement start process (step S3), and transmits time data to the IC tag 12A. Thereby, the IC tag 12A stores the time data (step S4). In addition, the sensing device 11 transmits time data, an identification code, and a base point movement signal to the control personal computer 14 by the base point movement start process. Thus, the control personal computer 14 performs the first opening / closing process (step S5), stores the time data and the identification code received from the sensing device 11, and controls the control device 13 to the switching device 15. A high level first control signal is sent. When receiving the control signal, the switching device 15 closes the first switch 15A (step S6). However, since the second switch 15B is in a closed state at this time, the in-house network 22 cannot be used in the unattended B facility.

  The person in charge carrying the personal computer 12 arrives at the facility B and places the personal computer 12 on the office desk 51 in the office. The sensing device 31 senses the IC tag 12A of the personal computer 12 (step S7), and determines whether there is an IC tag 12A (step S8). When the IC tag 12A changes from non-detection to detection, that is, when the personal computer 12 is placed on the office desk 51, the sensing device 31 performs access point arrival processing (step S9), and the IC tag 12A. The time data and the identification code read from, and the access point arrival signal are transmitted to the control personal computer 14. When receiving the data and the access point arrival signal, the control personal computer 14 performs a second opening / closing process (step S10). At this time, if the received time data and identification code match with the time data and identification code received and stored from the sensing device 11 at the facility A in the previous starting point movement start processing, the control personal computer 14 controls the control device 13 to send a high-level second control signal to the switching device 15. When receiving the second control signal, the switching device 15 closes the second switch 15B (step S11). As a result, as shown in FIG. 8, the first switch 15A and the second switch 15B of the switching device 15 are closed, and the jack 32 provided in the facility B is connected to the in-house network line 23 and the switching device 15. And connected to the in-house network 22. As a result, even in an unmanned B facility, if the person in charge connects the personal computer 12 in a state where a unique identification code and time data are stored to the jack 32, the in-house network 22 can be used. That is, only the personal computer 12 that stores the unique identification code and time data can use the in-house network 22 at the B facility.

  As described above, the sensing device 31 of the facility B senses the IC tag 12A of the personal computer 12 (step S12), and determines whether there is an IC tag 12A (step S13). At this time, when the person in charge carries the personal computer 12 and leaves the office desk 51 in the office, the sensing device 31 changes from sensing to sensing without detecting the IC tag 12A. A movement start process is performed (step S14). As a result, the sensing device 31 sends an access point movement signal to the control personal computer 14. When receiving the access point movement signal, the control personal computer 14 performs a disconnection process (step S15), controls the control device 13, and sends the low-level first control signal and the second control signal to the switching device 15. . When receiving the control signal, the switching device 15 opens the first switch 15A and the second switch 15B (step S16). As a result, the jack 32 provided in the facility B is disconnected from the in-house network 22, and the in-house network 22 becomes unusable again in the facility B that has become unattended.

  The person in charge carrying the personal computer 12 returns to the facility A and places the personal computer 12 on the storage shelf 41. As described above, the sensing device 11 senses the IC tag 12A of the personal computer 12 (step S17) and determines whether there is an IC tag 12A (step S18). At this time, when the person in charge puts the personal computer 12 in the storage shelf 41, since the sensing device 31 changes from not sensing the IC tag 12A to sensing, the sensing device 11 performs base point arrival processing (step S19). Accordingly, the sensing device 11 reads the time data and the identification code from the IC tag 12A, and transmits the time data, the identification code, and the base point arrival signal to the control personal computer 14. When receiving the time data, the identification code, and the base point arrival signal, the control personal computer 14 performs an initialization process (step S20). That is, the control personal computer 14 collates the received time data and identification code with the time data and identification code stored in the first opening / closing process. When the time data and the identification code coincide with each other by the collation, the control personal computer 14 resets the internal memory (not shown), and the internal memory (not shown) in the first opening / closing process of step S5. The time data and the identification code stored in are cleared. On the other hand, after reading the time data and the identification code from the IC tag 12A in step S19, the sensing device 11 sends a clear signal to the IC tag 12A. Thereby, the IC tag 12A resets the memory (not shown) (step S21), and clears the time data stored in the memory (not shown).

  Thus, when the IC tag 12A affixed to the personal computer 12 returns to the storage shelf 41 of the facility A, which is the base point, the memory (not shown) is reset to an initial state and prepared for the next movement.

Thus, according to this embodiment, the time data written at the A facility and the read identification code, and the time data and the identification code read out at the B facility are
Condition 1: The identification code stored in the IC tag 12A in advance matches the identification code read out at the B facility.
Condition 2: The time data recorded when leaving the facility A coincides with the time data read out at the facility B.
When the above condition is satisfied, the in-house network line 23 can be used at the facility B. That is, since a unique identification code and time data that are difficult to be created by a third party are used, security can be improved. In addition, since the identification code and time data are transmitted using the dedicated line 21, unlike conventional techniques using widely used AT commands, it is possible to prevent security from being broken. Further, in the facility A, the storage shelf 41 of the facility A becomes the initial position, that is, the starting point of the personal computer 12 and the office desk 51 of the facility B serves as an access point according to the sensing range of the IC tag 12A. Compared with the prior art that can only set the area according to the position detection accuracy of the terminal device, a narrower area such as the storage shelf 41 or the office desk 51 can be set.

(Embodiment 2)
In the previous embodiment, the IC tag 12A is affixed to the personal computer 12, but in this embodiment, as shown in FIG. 9, the IC tag 12A is placed on the permission card 61 for managing the use of the personal computer 12. May be used to restrict the use of the in-house network 22 at the facility B. In this embodiment, components that are considered to be the same as or the same as those of the above-described embodiment are denoted by the same reference numerals, and description thereof is omitted. In this embodiment, a storage case 62 is used instead of the storage shelf 41 of the first embodiment. The storage case 62 is provided with a concave storage portion 62A for storing the permission card 61, and the sensing device 11 is provided at the bottom of each storage portion 62A.

  When the person in charge moves from the facility A to the facility B and uses the in-house network 22 at the facility B, the person in charge extracts the permission card 61 from the storage case 62 and carries the permission card 61 together with the personal computer 12 to the facility B. Head for. As a result, as in the first embodiment, the sensing device 31 at the facility B collates data with the IC tag 12A of the permission card 61. When the unique time data and the identification code match, the jack 32 is connected to the in-house network 22 so that the in-house network 22 in the unattended B facility can be used.

  Thus, according to this embodiment, by using the permission card 61 and the storage case 62, the storage case 62 becomes a base point as in the first embodiment, and if the permission card 61 is not once stored in the storage case 62, B The in-house network 22 cannot be used at the facility. As a result, even if the duplicated card is used to enter the facility B, the unique identification code and time data are not stored in the card, so that the card cannot be connected to the in-house network 22. As a result, it is possible to prevent security from being broken.

(Embodiment 3)
In this embodiment, a switching device 16 shown in FIG. 10 is used instead of the switching device 15 of the above-described embodiment. In this embodiment, components that are considered to be the same as or the same as those of the above-described embodiment are denoted by the same reference numerals, and description thereof is omitted. The switching device 16 includes an AND circuit 16A and a switch 16B, and has one switch. Only when the control device 13 sends the high-level first control signal and the second control signal to the AND circuit 16A under the control of the control personal computer 14, the output of the AND circuit 16A becomes high level and the switch 16B is closed. . Thereby, since the jack 32 is connected to the in-house network 22 as in the previous embodiment, the in-house network 22 can be used in an unmanned B facility.

  Thus, according to this embodiment, even if one switch 16B is used in the switching device 16, the first control signal based on the data from the facility A and the first control signal based on the data from the facility B as in the first embodiment. Since the switch 16B is switched by the two control signals, it is possible to switch whether the in-house network 22 can be used or not used in the unmanned B facility.

  As mentioned above, although each embodiment of this invention has been described in detail, the specific configuration is not limited to each embodiment, and even if there is a design change or the like without departing from the gist of this invention, It is included in this invention. For example, in each embodiment, the IC tag 12A is used for managing the personal computer 12, but the present invention is not limited to this. For example, the IC tag 12A may be pasted on the key to manage the key, and the present invention can be applied to various other types of management. In each embodiment, a switch is used to turn on and off the in-house network line 23. However, this switch may be formed by software. In each embodiment, the IC tag 12A is used as a communication medium. However, an IC chip having a CPU (Central Processing Unit) or the like can be used as the communication medium. In each embodiment, one IC tag 12A is used, but a plurality of IC tags may be used. Furthermore, a plurality of sensing devices may be used.

It is a block diagram which shows the security system by Embodiment 1 of this invention. It is a block diagram which shows a sensing apparatus. It is a block diagram which shows another sensing apparatus. It is a perspective view which shows the mode of installation of a sensing apparatus. It is a perspective view which shows the mode of installation of the sensing apparatus in another facility. It is a sequence diagram for demonstrating the security method of this invention. It is a sequence diagram for demonstrating the security method of this invention. It is a figure which shows the mode of a movement of a personal computer. 6 is a perspective view showing a storage case used in Embodiment 2. FIG. FIG. 10 is a configuration diagram illustrating a switching device used in a third embodiment.

Explanation of symbols

11 Sensing device (first communication device)
12 Personal computer 12A IC tag 13 Control device (control means)
14 Personal computer for control (control means)
15 switching device 15A 1st switch (switch part)
15B 2nd switch (switch part)
21 Dedicated line 22 Internal network 31 Sensing device (second communication device)

Claims (6)

A communication medium capable of reading and writing data by communication;
A first communication device that is installed at a first point and writes arbitrary data to the communication medium when the communication medium leaves the first point;
A second communication device installed at a second point and reading data from the communication medium when the communication medium arrives at the second point;
A switching device for switching between enabling and disabling the network at the second point;
The data written in the communication medium by the first communication device and the data read from the communication medium by the second communication device are collated, and when the two data match, the switching device is controlled, Control means for enabling the network at the second point;
A security system comprising:   The dedicated line for sending the data written in the communication medium by the first communication device and the data read from the communication medium by the second communication device to the control means. Security system. The communication medium stores in advance an identification code for identification with other communication media,
The control means collates arbitrary data written in the communication medium by the first communication device and identification data read out from the communication medium with data read out from the communication medium by the second communication device. 3. The security system according to claim 1, wherein when the two match each other, the switching device is controlled so that the network can be used at the second point. 4. The communication medium is an IC tag;
The first communication device and the second communication device read and write data when the IC tag enters and exits a sensing range of the IC tag.
The security system according to any one of claims 1 to 3.   The switching device includes a switch unit provided in a line drawn into the second point of the network, and uses the network at the second point by opening and closing the switch unit under the control of the control unit. The security system according to any one of claims 1 to 4, wherein the security system is switched between enabling and disabling. A security method using a communication medium capable of reading and writing data by communication,
Write arbitrary data to the communication medium when the communication medium leaves the first point;
When the communication medium arrives at the second point, the data is read from the communication medium,
The data written to the communication medium at the first point and the data read from the communication medium at the second point are collated, and when the two data match, the network is set at the second point. Enable,
A security method characterized by the above.

Images