JP2012203805A - Information management device, information management system, information management method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device for holding confidential information which prevents both erroneous detection of theft of the device and leakage of confidential information in theft.SOLUTION: In a control device 11, a volatile memory 18 stores confidential information. A current detection section 17 is connected to a load 12 incorporated in a building or the like near the control device 11 via a signal line 20 and continuously feeds the current of theft detection signals to the load 12 via the signal line 20. An information erasure section 19 monitors the current through the signal line 20 and, when detecting that the current through the signal line 20 is interrupted, stops power feeding to the volatile memory 18. As a result, confidential information stored in the volatile memory 18 is erased.

Description

  The present invention relates to an information management apparatus, an information management system, an information management method, and a program. The present invention particularly relates to a control device (device with a theft detection function) used in a system that handles confidential information that should not be leaked to the outside, such as an electronic money system, an IC (integrated circuit) card application system, and a prepaid card system. Is.

  In recent years, many systems that handle confidential information have been developed, such as an electronic money system, an IC card application system, and a prepaid card system. In such a system, confidential information is stored inside a device (control device) that controls the system. Also, as control information for controlling access to the confidential information stored in the device, mutual authentication between the device and other devices and information for concealing communication between devices are also held inside the device. is doing. Since this control information should not be leaked to the outside, it can be said that it is a part of confidential information.

  Conventionally, as a method of preventing unauthorized access to confidential information, a method of erasing confidential information inside the device has been devised by regarding the fact that the external power supply to the device has been interrupted as theft of the device (for example, Patent Document 1). However, this method cannot distinguish between a case where the external power supply is cut off due to a power failure and a case where the external power supply is cut off due to theft. Therefore, there is a problem that confidential information is erased even during a power failure and the apparatus becomes unusable. As a countermeasure, there has been considered a method of erasing confidential information inside the device by regarding the device being stolen when vibration is applied to the device when external power supply is cut off (see, for example, Patent Document 2).

JP 2004-287984 A JP 2006-301879 A

  As described above, in the prior art, leakage of confidential information to the outside is suppressed by erasing confidential information inside the device triggered by the detection of vibration when the external power supply is disconnected or when the external power supply is disconnected. ing. However, in the prior art, when the device is used in an environment in which vibration is applied to the device even during a power failure, there is still a problem that it is impossible to distinguish between a power failure and a theft. Also, if an attacker to the device (who tries to steal confidential information) carefully removes the device so as not to vibrate the device, there is a risk that confidential information will not be erased and leaked. was there.

  For example, an object of the present invention is to suppress both erroneous detection of device theft and leakage of confidential information during theft in a device that holds confidential information.

An information management apparatus according to one aspect of the present invention includes:
A memory for storing information;
A communication unit that continuously communicates with an external device;
An information erasure unit that monitors the state of communication by the communication unit and erases information stored in the memory when it is determined that communication by the communication unit has been interrupted.

  According to one aspect of the present invention, in an apparatus (information management apparatus) that holds confidential information, it is possible to suppress both false detection of theft of the apparatus and leakage of confidential information during theft.

1 is a diagram showing a configuration of an information management system according to Embodiment 1. FIG. FIG. 3 is a diagram illustrating a configuration example of a current detection unit according to the first embodiment. FIG. 3 is a state transition diagram illustrating a state transition example of the control device according to the first embodiment. 4 is a table showing an example of state parameters of the control device according to the first embodiment. FIG. 3 is a diagram illustrating a hardware configuration example of a control device according to the first embodiment. FIG. 5 is a diagram illustrating a configuration example of a current detection unit according to the second embodiment. FIG. 10 is a diagram illustrating a configuration of an information management system according to a third embodiment. FIG. 10 is a diagram showing a configuration of an information management system according to a fourth embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a configuration of an information management system 10 according to the present embodiment.

  In FIG. 1, an information management system 10 includes a control device 11 (an example of an information management device) and a load 12 (an example of an external device).

  The control device 11 is a device that controls a system that handles confidential information that should not be leaked to the outside, such as an electronic money system, an IC card application system, and a prepaid card system. The control device 11 includes a power switch 13, a power control unit 14, batteries 15 and 16, a current detection unit 17 (an example of a communication unit), a volatile memory 18 (an example of a memory), and an information erasing unit 19. Moreover, although not shown in figure, the control apparatus 11 has a function part for controlling systems, such as an electronic money system, an IC card application system, and a prepaid card system.

  The power switch 13 is connected to the external power source 30 by an electric wire 31 and receives supply of electric power from the external power source 30 via the electric wire 31. That is, the power switch 13 receives external power supply. The external power source 30 is a power supply facility provided in an environment where the control device 11 is installed, and is a commercial power source, for example. The power switch 13 is operated manually, for example, and outputs a signal indicating ON / OFF. Specifically, the power switch 13 outputs a voltage LOW (low level voltage) if it is ON, and outputs a voltage HIGH (high level voltage) if it is OFF. If the power switch 13 is ON, the power of the external power supply is supplied to the power supply control unit 14, and if it is OFF, the power supply to the power supply control unit 14 is stopped. When a power failure occurs, external power supply is cut off, so power supply to the power supply control unit 14 is automatically stopped.

  The power controller 14 receives a signal indicating ON / OFF from the power switch 13, and determines the ON / OFF state of the power switch 13 based on this signal. When the power switch 13 is ON, the power control unit 14 supplies power to the current detection unit 17 by the battery 15 regardless of whether power is supplied from the power switch 13. When the power switch 13 is ON and power is supplied from the power switch 13, the power control unit 14 supplies the externally supplied power (power supplied from the power switch 13) to the volatile memory 18. Further, in this case, the power supply control unit 14 charges the batteries 15 and 16 with externally supplied power. When the power switch 13 is ON and the power supply from the power switch 13 is cut off, the power control unit 14 determines that a power failure has occurred and switches the power supply source to the volatile memory 18 to the battery 16. That is, in this case, the power supply control unit 14 supplies power to the volatile memory 18 by the battery 16. When the power switch 13 is OFF, the power control unit 14 stops supplying power to the current detection unit 17 and the volatile memory 18 even if the batteries 15 and 16 are charged.

  The battery 15 is mounted on the control device 11 as a power source for supplying a current of a theft detection signal described later.

  The battery 16 is mounted on the control device 11 as a power source for supplying power to the volatile memory 18 in the event of a power failure.

  The current detection unit 17 communicates with the load 12 continuously. Specifically, the current detection unit 17 is connected to the load 12 by the signal line 20, and continuously passes a current of a theft detection signal (an example of a predetermined signal) to the load 12 through the signal line 20. The current detection unit 17 operates with power supplied from the battery 15. When the power supply is cut off, the current of the theft detection signal does not flow through the signal line 20. The load 12 is, for example, an electrical load (resistance), and is built in a facility that is difficult to steal together with the control device 11 such as a building near the control device 11. For example, the load 12 may be built in a housing or a rack that houses the control device 11, and in this case, the housing or the rack is preferably fixed to a floor or the like so that it cannot be taken out of a building. . The control device 11 cannot be taken outside unless the signal line 20 is cut. The current detection unit 17 outputs a voltage HIGH when the current of the theft detection signal flows through the signal line 20 and outputs a voltage LOW when the current does not flow.

  The volatile memory 18 is, for example, an SRAM (Static / Random / Access / Memory), and stores confidential information (an example of information). The volatile memory 18 operates with external power supply during normal operation and power supplied by the battery 16 during power outage. When the power supply is cut off, confidential information is lost from the volatile memory 18. The information stored in the volatile memory 18 is not limited to confidential information, and may be other arbitrary information.

  The information erasure unit 19 monitors the state of communication by the current detection unit 17. Specifically, the information erasure unit 19 monitors the current flowing through the signal line 20 as the state of communication by the current detection unit 17 (in this embodiment, the current detection unit 17 uses the current detection unit 17 to monitor the current flowing through the signal line 20. If it is detected that the current flowing through the signal line 20 has been interrupted, it is determined that communication by the current detector 17 has been interrupted. When the information erasure unit 19 determines that the communication by the current detection unit 17 is interrupted, the information erasure unit 19 erases the confidential information stored in the volatile memory 18.

  In the present embodiment, the information erasing unit 19 includes an AND circuit 21 and an electronic switch 22. The AND circuit 21 has a first port for inputting a signal indicating ON / OFF from the power switch 13 and a second port for inputting an output from the current detection unit 17. The second port is a negative logic port that inverts an input signal. The AND circuit 21 outputs a logical product of an input of the first port (a signal indicating ON / OFF of the power switch 13) and an input of the second port (a signal obtained by inverting the output from the current detection unit 17). The electronic switch 22 switches between conduction / non-conduction between the volatile memory 18 and its power supply source (the power supply control unit 14 or the battery 16) in accordance with the output from the AND circuit 21.

  When the voltage LOW (indicating the ON state) is output from the power switch 13 and the voltage HIGH (indicating the state in which the current of the theft detection signal is flowing through the signal line 20) is output from the current detecting unit 17 The voltage LOW is output from the AND circuit 21. In response to this, the electronic switch 22 is turned on (conducted), and the power of the external power supply is supplied to the volatile memory 18 at the normal time and the power of the battery 16 is supplied at the time of a power failure. In other cases, that is, the voltage HIGH (indicating the OFF state) is output from the power switch 13, or the voltage LOW (the current of the theft detection signal does not flow through the signal line 20) from the current detection unit 17. Is output), the AND circuit 21 outputs the voltage HIGH. In response to this, the electronic switch 22 is turned off (non-conducting), and power supply to the volatile memory 18 is stopped. As a result, confidential information stored in the volatile memory 18 is lost.

  In the present embodiment, the battery 15 that supplies power to the current detection unit 17 and the battery 16 that supplies power to the volatile memory 18 are separated, but the batteries 15 and 16 are integrated into one battery. May be used.

  In the present embodiment, the battery 15 supplies power to the current detection unit 17 not only at the time of power failure but also at normal time. However, power may be supplied to the current detection unit 17 only at the time of power failure. In this case, when the power switch 13 is ON and power is supplied from the power switch 13, the power controller 14 supplies externally supplied power (power supplied from the power switch 13) to the current detector 17. Thereafter, when the power switch 13 is ON and the power supply from the power switch 13 is cut off, the power control unit 14 determines that a power failure has occurred and switches the power supply source to the current detection unit 17 to the battery 15.

  In the present embodiment, the battery 16 supplies power to the volatile memory 18 only during a power failure, but power may be supplied to the volatile memory 18 also during normal times. In this case, if the power switch 13 is ON, the power control unit 14 supplies power to the volatile memory 18 by the battery 16 regardless of whether power is supplied from the power switch 13 (more precisely, the electronic switch 22 Only when is ON). This eliminates the need to switch the power supply source to the volatile memory 18 to the battery 16 in the event of a power failure, so that it is possible to reliably avoid a situation where confidential information is lost from the volatile memory 18 during this operation.

  In the present embodiment, the power control unit 14 controls the power supply from the batteries 15 and 16 in accordance with the ON / OFF of the power switch 13, but the batteries 15 and 16 are directly connected to the power switch 13, and the power switch The batteries 15 and 16 themselves may switch ON / OFF of power feeding in conjunction with the ON / OFF of 13.

  In the present embodiment, the volatile memory 18 stores confidential information, but a nonvolatile memory may be used instead of the volatile memory 18. In this case, when the information erasure unit 19 determines that the communication by the current detection unit 17 is interrupted, the confidential information stored in the volatile memory 18 may be another information (for example, information obtained by encrypting confidential information, Overwrite with dummy information that is not related to the information). Alternatively, the volatile memory 18 is physically destroyed. Thereby, since confidential information is substantially erased from the volatile memory 18, leakage of confidential information can be prevented.

  FIG. 2 is a diagram illustrating a configuration example of the current detection unit 17.

  In FIG. 2, the current detection unit 17 includes a large resistor 23, a resistor 24, and an FET 25 (field effect transistor).

  The large resistor 23 has a resistance value sufficiently larger than the load 12 (for example, about 10 times) and is connected to the battery 15. The resistor 24 is connected in parallel with the large resistor 23. The FET 25 has a base terminal (B) connected to the large resistor 23, a collector terminal (C) connected to the resistor 24, and an emitter terminal (E) grounded. A connection point between the large resistor 23 and the base terminal of the FET 25 is connected to the signal line 20 shown in FIG. A connection point between the resistor 24 and the collector terminal of the FET 25 is connected to the AND circuit 21 of the information erasing unit 19 shown in FIG.

  When a theft detection signal current flows from the connection point between the large resistor 23 and the base terminal of the FET 25 to the signal line 20, a potential difference occurs in the large resistor 23, and a voltage lower than the threshold (threshold voltage) is applied to the base terminal of the FET 25. The As a result, the FET 25 is turned OFF and the collector terminal of the FET 25 becomes the voltage HIGH, so that the voltage HIGH is output to the AND circuit 21 from the connection point between the resistor 24 and the collector terminal of the FET 25. On the other hand, when the current of the theft detection signal does not flow to the signal line 20 from the connection point between the large resistor 23 and the base terminal of the FET 25, the base terminal of the FET 25 becomes the voltage HIGH. As a result, the FET 25 is turned on, and the collector terminal of the FET 25 becomes the voltage LOW, so that the voltage LOW is output to the AND circuit 21 from the connection point between the resistor 24 and the collector terminal of the FET 25.

  FIG. 3 is a state transition diagram illustrating an example of state transition of the control device 11. FIG. 4 is a table showing an example of the state parameter in the state transition shown in FIG.

  3 and 4, in the “OFF” state, the power switch 13 is OFF, the current of the theft detection signal does not flow through the signal line 20, and power is not supplied to the volatile memory 18 (external power supply). May or may not be). When the power switch 13 is turned on when there is external power supply in the “OFF” state, the state transitions to the “normal operation” state (T1). At this time, the power control unit 14 detects that the power switch 13 is turned on, and starts power feeding from the battery 15 to the current detection unit 17. Further, since the power supply control unit 14 supplies power to the volatile memory 18, the power supply control unit 14 also starts to supply power to the electronic switch 22 of the information erasing unit 19. The current detection unit 17 starts supplying the current of the theft detection signal to the signal line 20 by being fed. Since the power switch 13 is ON, the electronic switch 22 of the information erasing unit 19 is turned ON, and power supply to the volatile memory 18 is started.

  In the “normal operation” state, the current of the theft detection signal flows through the signal line 20, and power is supplied to the volatile memory 18. Therefore, confidential information can be stored in the volatile memory 18. The writing of confidential information to the volatile memory 18 is performed via an input device. The confidential information is read from the volatile memory 18 through, for example, an output device. When there is no external power supply in the “normal operation” state, the state transitions to the “power failure” state (T2). At this time, the power control unit 14 detects that the power supply from the power switch 13 is lost, and switches the power supply to the volatile memory 18 to the power supply from the battery 16.

  In the “power failure” state, similarly to the “normal operation” state, the current of the theft detection signal flows through the signal line 20, and power is supplied to the volatile memory 18. Therefore, confidential information can be stored in the volatile memory 18. When the external power supply returns in the “power failure” state, the state transits to the “normal operation” state (T3). At this time, the power supply control unit 14 detects that the power supply from the power switch 13 has been resumed, and switches the power supply to the volatile memory 18 to the external power supply.

  When the current of the theft detection signal does not flow through the signal line 20 in the “normal operation” state, the state shifts to the “theft” state (T4). Even in the “power failure” state, when the current of the theft detection signal does not flow through the signal line 20, the state shifts to the “theft” state (T5).

  In the “theft” state, the current of the theft detection signal does not flow through the signal line 20. For this reason, the information erasure unit 19 determines that communication by the current detection unit 17 has been interrupted, and immediately transitions to the “information erasure” state (T6). At this time, since the current of the theft detection signal does not flow through the signal line 20, the electronic switch 22 of the information erasing unit 19 is turned off, and the power supply to the volatile memory 18 is stopped.

  In the “information erased” state, power is not supplied to the volatile memory 18. Therefore, confidential information is lost from the volatile memory 18. When the power switch 13 is turned off in the “information erasure” state, the state transits to the “OFF” state (T7).

  Thus, in this embodiment, the theft of the control device 11 can be reliably detected not only in the “normal operation” state but also in the “power failure” state. If the theft of the control device 11 is detected, the state can be immediately changed from the “theft” state to the “information erased” state, and the confidential information can be erased. That is, according to the present embodiment, it is possible to suppress both the false detection of theft of the control device 11 and the leakage of confidential information at the time of theft.

  As described above, in the present embodiment, the control device 11 has a function of identifying when a power failure occurs or when a theft occurs, and not erasing the information when a power failure occurs but erasing the information when the theft occurs. The current detection unit 17 generates an output HIGH when a current is flowing from the battery 15 inside the control device 11 to the load 12 arranged in a building or the like outside the control device 11. When a power failure occurs, the output of the power switch 13 remains LOW and the output of the current detection unit 17 remains HIGH, so the output of the AND circuit 21 of the information erasure unit 19 becomes LOW and information is not erased. When the theft occurs, the output of the current detection unit 17 is LOW regardless of whether the output of the power switch 13 is LOW or HIGH, so that the output of the AND circuit 21 becomes HIGH and the information is erased.

  As described above, according to the present embodiment, it is possible to reliably distinguish between a power failure and a theft. In the event of a power failure, the power supply from the battery 16 to the volatile memory 18 is continued, and in the case of theft, the power supply from the battery 16 is stopped and the confidential information is lost, thereby preventing leakage of the confidential information. can do.

  FIG. 5 is a diagram illustrating a hardware configuration example of the control device 11.

  In FIG. 5, the control device 11 is a computer, and includes an LCD 71 (Liquid / Crystal / Display), a keyboard 72 (K / B), a mouse 73, an FDD 74 (Flexible Disk / Drive), and a CDD 75 (Compact / Disk / Drive). , A hardware device such as a printer 76 is provided. These hardware devices are connected by cables and signal lines. Instead of the LCD 71, a CRT (Cathode / Ray / Tube) or other display device may be used. Instead of the mouse 73, a touch panel, a touch pad, a trackball, a pen tablet, or other pointing devices may be used.

  The control device 11 includes a CPU 81 (Central Processing Unit) that executes a program. The CPU 81 is an example of a processing device. The CPU 81 is connected to the ROM 83 (Read / Only / Memory), the RAM 84, the communication board 85, the LCD 71, the keyboard 72, the mouse 73, the FDD 74, the CDD 75, the printer 76, and the HDD 90 (Hard / Disk / Drive) via the bus 82. Control these hardware devices. Instead of the HDD 90, a flash memory, an optical disk device, a memory card reader / writer, or other recording medium may be used.

  The RAM 84 is an example of the volatile memory 18. ROM83, FDD74, CDD75, HDD90 is an example of a non-volatile memory. These are examples of the storage device. The communication board 85, the keyboard 72, the mouse 73, the FDD 74, and the CDD 75 are examples of input devices. The communication board 85, the LCD 71, and the printer 76 are examples of output devices.

  The communication board 85 is connected to a LAN (Local / Area / Network) or the like. The communication board 85 is not limited to a LAN, and may be connected to a VPN (Virtual / Private / Network) or the like.

  The HDD 90 stores an operating system 91 (OS), a window system 92, a program group 93, and a file group 94. The programs in the program group 93 are executed by the CPU 81, the operating system 91, and the window system 92. The program group 93 includes a program for executing a function described as “˜unit” in the description of the present embodiment. The program is read and executed by the CPU 81. The file group 94 includes data, information, and signal values described as “˜data”, “˜information”, “˜ID (identifier)”, “˜flag”, and “˜result” in the description of the present embodiment. And variable values and parameters are included as items of “˜file”, “˜database”, and “˜table”. The “˜file”, “˜database”, and “˜table” are stored in a recording medium such as the RAM 84 or the HDD 90. Data, information, signal values, variable values, and parameters stored in a recording medium such as the RAM 84 and the HDD 90 are read out to the main memory and the cache memory by the CPU 81 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. It is used for processing (operation) of the CPU 81 such as calculation, control, output, printing, and display. During processing of the CPU 81 such as extraction, search, reference, comparison, calculation, calculation, control, output, printing, and display, data, information, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory. Remembered.

  The arrows in the figure used in the description of this embodiment mainly indicate input / output of data, signals, and power. Data and signals are recorded in a memory such as RAM 84, FDD 74 flexible disk (FD), CDD 75 compact disk (CD), HDD 90 magnetic disk, optical disk, DVD (Digital Versatile Disc), or other recording media. Is done. Data and signals are transmitted by a bus 82, signal lines, cables, or other transmission media.

  In the description of the present embodiment, what is described as “to part” may be “to circuit”, “to device”, “to device”, and “to step”, “to process”, “to” ~ Procedure "," ~ process ". That is, what is described as “˜unit” may be realized by firmware stored in the ROM 83. Alternatively, what is described as “˜unit” may be realized only by software, or only by hardware such as an element, a device, a board, and wiring. Alternatively, what is described as “to part” may be realized by a combination of software and hardware, or a combination of software, hardware and firmware. Firmware and software are stored as programs in a recording medium such as a flexible disk, a compact disk, a magnetic disk, an optical disk, and a DVD. The program is read by the CPU 81 and executed by the CPU 81. That is, the program causes the computer to function as “to part” described in the description of the present embodiment. Or a program makes a computer perform the procedure and method of "-part" described by description of this Embodiment.

Embodiment 2. FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  The configuration of the information management system 10 according to the present embodiment is the same as that of the first embodiment shown in FIG.

  FIG. 6 is a diagram illustrating a configuration example of the current detection unit 17.

  In FIG. 6, the current detection unit 17 includes a D-type flip-flop 26.

  The D-type flip-flop 26 has a D input terminal and a clock input terminal connected to the battery 15 and an inverted output terminal connected to the AND circuit 21 of the information erasing unit 19 shown in FIG. A connection point between the clock input terminal of the D-type flip-flop 26 and the battery 15 is connected to the signal line 20 shown in FIG.

  In the present embodiment, since the current detection unit 17 is configured as described above, instead of outputting a signal indicating the presence or absence of the current of the theft detection signal, a change in the current waveform of the theft detection signal (edge detection). A signal indicating is output. Therefore, the information erasing unit 19 can detect a change in the current value of the theft detection signal. Specifically, when the current value of the theft detection signal fluctuates, voltage fluctuations of HIGH → LOW → HIGH appear at the D input terminal and the clock input terminal of the D-type flip-flop 26. At that time, since the change of the voltage of the D input terminal to HIGH cannot satisfy the setup time with respect to the rise of the voltage of the clock input terminal, the state of the D-type flip-flop 26 is inverted. Since the voltage LOW is output from the inverting output terminal of the D-type flip-flop 26 to the AND circuit 21, the output of the AND circuit 21 becomes the voltage HIGH. As a result, the electronic switch 22 is turned off and power supply to the volatile memory 18 is stopped.

  As described above, in the present embodiment, the current detection unit 17 continuously supplies the current of the theft detection signal having a predetermined waveform to the load 12 through the signal line 20. The information erasure unit 19 monitors the current flowing through the signal line 20 as the state of communication by the current detection unit 17. When the information erasing unit 19 detects that the waveform of the current flowing through the signal line 20 is disturbed, the communication by the current detection unit 17 is interrupted. judge. When the information erasure unit 19 determines that the communication by the current detection unit 17 is interrupted, the information erasure unit 19 erases the confidential information stored in the volatile memory 18.

  According to the present embodiment, even when an attacker to the control device 11 tries to steal the control device 11 by forming a detour of the theft detection signal in the control device 11, the current of the theft detection signal is changed. By detecting and erasing confidential information, leakage of confidential information can be suppressed.

Embodiment 3 FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  FIG. 7 is a diagram showing a configuration of the information management system 10 according to the present embodiment.

  In FIG. 7, the information management system 10 includes a communication device 12 a (an example of an external device) instead of the load 12. The communication device 12a transmits a theft detection signal via the signal line 20 every predetermined time (for example, 1 minute). Similar to the load 12 in the first embodiment, the communication device 12a is built in a building or the like in the vicinity of the control device 11, desirably in a facility that is difficult to steal together with the control device 11.

  The control device 11 includes a reception unit 17a (an example of a communication unit) instead of the current detection unit 17. The receiving unit 17a communicates with the communication device 12a continuously. Specifically, the receiving unit 17a is connected to the communication device 12a via the signal line 20, and receives a theft detection signal from the communication device 12a via the signal line 20 at regular intervals. The receiver 17a operates with power supplied from the battery 15. The receiving unit 17a outputs a voltage HIGH if a theft detection signal is received every predetermined time, and outputs a voltage LOW if the theft detection signal cannot be received even after a predetermined time has elapsed.

  The information erasure unit 19 monitors the state of communication by the reception unit 17a. Specifically, when the information erasure unit 19 detects that the theft detection signal has not been received by the receiving unit 17a even after a predetermined time has elapsed, the information erasing unit 19 determines that communication by the receiving unit 17a has been interrupted. When the information erasure unit 19 determines that the communication by the reception unit 17a is interrupted, the information erasure unit 19 erases the confidential information stored in the volatile memory 18.

  According to the present embodiment, as in the first embodiment, it is possible to suppress both the false detection of the theft of the control device 11 and the leakage of confidential information during the theft.

  Unlike the passive device such as the load 12 in the first embodiment, the communication device 12a operates while being powered. However, since the communication device 12a needs to operate even during a power failure, a battery is used as a power supply source. It is desirable. At this time, the main power source may be the external power source 30 and the auxiliary power source may be a battery.

Embodiment 4 FIG.
The difference between the present embodiment and the third embodiment will be mainly described.

  FIG. 8 is a diagram showing a configuration of the information management system 10 according to the present embodiment.

  In FIG. 8, the communication device 12a is, for example, an RFID (Radio Frequency Frequency IDentification), and wirelessly transmits a theft detection signal every certain time (for example, 1 minute). When the communication device 12a is installed close to the control device 11, the communication device 12a may be mounted as a passive RFID or a non-contact IC card that is fed by electromagnetic induction from the control device 11. In this case, it is not necessary to provide a battery or the like for power supply to the communication device 12a.

  The receiving unit 17a of the control device 11 includes an antenna 27, and performs wireless communication with the communication device 12a instead of being connected to the communication device 12a via the signal line 20. Specifically, the receiving unit 17a receives a theft detection signal from the communication device 12a via the antenna 27 at regular intervals. The receiver 17a operates with power supplied from the battery 15. The receiving unit 17a outputs a voltage HIGH if a theft detection signal is received every predetermined time, and outputs a voltage LOW if the theft detection signal cannot be received even after a predetermined time has elapsed.

  The information erasure unit 19 monitors the state of communication by the reception unit 17a. Specifically, when the information erasing unit 19 detects that the theft detection signal has not been received by the receiving unit 17a even after a predetermined time has elapsed, the communication by the receiving unit 17a is interrupted (the control device 11 is disconnected from the communication device). 12a). When the information erasure unit 19 determines that the communication by the reception unit 17a is interrupted, the information erasure unit 19 erases the confidential information stored in the volatile memory 18.

  According to the present embodiment, similarly to the third embodiment, it is possible to suppress both the false detection of the theft of the control device 11 and the leakage of confidential information at the time of theft.

  As mentioned above, although embodiment of this invention was described, you may implement combining 2 or more embodiment among these. Alternatively, one of these embodiments may be partially implemented. Or you may implement combining two or more embodiment among these partially.

  DESCRIPTION OF SYMBOLS 10 Information management system, 11 Control apparatus, 12 Load, 12a Communication apparatus, 13 Power switch, 14 Power supply control part, 15, 16 Battery, 17 Current detection part, 17a Reception part, 18 Volatile memory, 19 Information erasure part, 20 Signal line, 21 AND circuit, 22 Electronic switch, 23 Large resistor, 24 Resistor, 25 FET, 26 D-type flip-flop, 27 Antenna, 30 External power supply, 31 Electric wire, 71 LCD, 72 Keyboard, 73 Mouse, 74 FDD, 75 CDD, 76 printer, 81 CPU, 82 bus, 83 ROM, 84 RAM, 85 communication board, 90 HDD, 91 operating system, 92 window system, 93 program group, 94 file group.

Claims (8)

A memory for storing information;
A communication unit that continuously communicates with an external device;
An information management apparatus comprising: an information erasure unit that monitors a state of communication by the communication unit and erases information stored in the memory when it is determined that communication by the communication unit is interrupted. The information management device further includes a battery for supplying power,
The information management apparatus according to claim 1, wherein the communication unit operates with power supplied from the battery. The communication unit is connected to the external device via a signal line, and continuously passes a current to the external device via the signal line,
The information erasure unit monitors the current flowing through the signal line as the state of communication by the communication unit, and determines that communication by the communication unit has been interrupted when detecting that the current flowing through the signal line has been interrupted. The information management apparatus according to claim 1 or 2, characterized in that The communication unit is connected to the external device via a signal line, and continuously flows a current having a predetermined waveform to the external device via the signal line,
The information erasure unit monitors the current flowing through the signal line as the state of communication by the communication unit, and determines that communication by the communication unit has been interrupted when detecting that the waveform of the current flowing through the signal line is disturbed The information management apparatus according to claim 1 or 2, wherein The communication unit receives the predetermined signal at regular intervals from a device that transmits a predetermined signal as the external device,
2. The information erasing unit, when detecting that the predetermined signal has not been received by the communication unit even after the predetermined time has elapsed, determines that communication by the communication unit has been interrupted. Or the information management apparatus of 2. An information management device according to any one of claims 1 to 5,
An information management system comprising the external device. In an information management method using an information management apparatus having a memory for storing information,
The communication unit of the information management device continuously communicates with an external device,
An information management method comprising: erasing information stored in the memory when an information erasure unit of the information management device monitors a communication state of the communication unit and determines that communication by the communication unit is interrupted . A computer having a memory for storing information;
A communication unit that continuously communicates with an external device;
A program for monitoring a state of communication by the communication unit and functioning as an information erasing unit for erasing information stored in the memory when it is determined that communication by the communication unit is interrupted.

Images