JP5398867B2 - Information management apparatus, information management system, information management method and program - Google Patents

Description

  The present invention relates to an information management apparatus, an information management system, an information management method, and a program. The present invention particularly relates to an anti-theft mechanism for a security device used in a system that handles confidential information that should not be leaked to the outside, such as an electronic money system, an IC (integrated circuit) card application system, and a prepaid card system. .

  In recent years, many systems that handle confidential information have been developed, such as an electronic money system, an IC card application system, and a prepaid card system. In such a system, confidential information is stored inside an apparatus that controls the system. Also, as control information for controlling access to the confidential information stored in the device, mutual authentication between the device and other devices and information for concealing communication between devices are also held inside the device. doing. Since this control information should not be leaked to the outside, it can be said that it is a part of confidential information.

  Conventionally, as a method of preventing unauthorized access to confidential information, a method of erasing confidential information inside the device has been devised by regarding the fact that the external power supply to the device has been interrupted as theft of the device (for example, Patent Document 1). However, this method cannot distinguish between a case where the external power supply is cut off due to a power failure and a case where the external power supply is cut off due to theft. Therefore, there is a problem that confidential information is erased even during a power failure and the apparatus becomes unusable. As a countermeasure, there has been considered a method of erasing confidential information inside the device by regarding the device being stolen when vibration is applied to the device when external power supply is cut off (see, for example, Patent Document 2).

  In addition, as another method of preventing unauthorized access to confidential information, the current position information of the apparatus is periodically acquired using GPS (Global Positioning System), and the position information at the time of installation registered in advance A method has been devised in which device theft is determined by comparison, and confidential information inside the device is erased during theft (see, for example, Patent Document 3).

JP 2004-287984 A JP 2006-301879 A JP 2002-236619 A

  As described above, in the prior art, leakage of confidential information to the outside is suppressed by erasing confidential information inside the device triggered by the detection of vibration when the external power supply is disconnected or when the external power supply is disconnected. ing. However, in the prior art, when the device is used in an environment in which vibration is applied to the device even during a power failure, there is still a problem that it is impossible to distinguish between a power failure and a theft. Also, if an attacker to the device (who tries to steal confidential information) carefully removes the device so as not to vibrate the device, there is a risk that confidential information will not be erased and leaked. was there.

  In another prior art, leakage of confidential information to the outside is suppressed by detecting a change in GPS position information and deleting confidential information inside the apparatus. However, this conventional technique has a problem that it cannot be used in an environment where the apparatus cannot receive a carrier wave (position information) from a GPS satellite. Also, if an attacker to the device takes away the device while emitting a radio wave simulating a GPS carrier wave from the outside of the device, the device cannot detect the theft and leaks confidential information. There was a risk of it.

  For example, an object of the present invention is to reliably detect theft of a device in a device holding confidential information and suppress leakage of confidential information during theft.

An information management apparatus according to one aspect of the present invention includes:
A memory for storing information;
A communication unit that receives encrypted data repeatedly transmitted from an external device;
When monitoring the reception status of the encrypted data by the communication unit, decrypting and verifying the encrypted data every time the encrypted data is received by the communication unit, and determining that the reception of the encrypted data is interrupted, And an information erasure unit for erasing information stored in the memory when the verification of the encrypted data fails.

  According to one aspect of the present invention, in a device that holds confidential information (information management device), it is possible to reliably detect theft of the device and suppress leakage of confidential information during theft.

1 is a block diagram illustrating a configuration of an information management system according to Embodiment 1. FIG. FIG. 3 is a diagram illustrating a configuration example of a monitoring device according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a unique signal verification module of the security device according to the first embodiment. FIG. 3 is a diagram illustrating a hardware configuration example of the security device according to the first embodiment. FIG. 3 is a block diagram showing a configuration of an information management system according to a second embodiment. FIG. 4 is a block diagram illustrating a configuration of an information management system according to a third embodiment. FIG. 6 is a block diagram illustrating a configuration of an information management system according to a fourth embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration of an information management system 10 according to the present embodiment.

  In FIG. 1, the information management system 10 includes a security device 11 (an example of an information management device), a monitoring device 20 (an example of an external device), and an external power supply 30.

  The security device 11 is a device that controls a system that handles confidential information that should not be leaked to the outside, such as an electronic money system, an IC card application system, and a prepaid card system. The security device 11 includes a battery 12, a power switch 13, a communication unit 14, a unique signal verification module 15 (an example of an information erasure unit), and a volatile memory 16 (an example of a memory). Although not shown, the security device 11 has a functional unit for controlling a system such as an electronic money system, an IC card application system, and a prepaid card system.

  The battery 12 is connected to the external power source 30 by a power line 31. The battery 12 receives a power supply signal from the external power supply 30 via the power line 31 (receives power supply), and accumulates power. The external power supply 30 is deployed at a remote location such as a building away from the installation location of the security device 11. Note that the external power supply 30 may be a power supply facility (for example, a commercial power supply) provided at a place where the security device 11 is installed.

  Similarly to the battery 12, the power switch 13 is connected to the external power supply 30 and the power line 31. The power switch 13 receives a power supply signal from the external power supply 30 via the power line 31 (receives power supply). That is, the power switch 13 receives external power supply via the power line 31. The power switch 13 is also connected to the battery 12. The power switch 13 receives supply of electric power stored in the battery 12 when the external power supply 30 is powered off.

  The power switch 13 is operated manually, for example, and supplies power from the external power supply to the specific signal verification module 15 if the power switch 13 is ON (on), and stops power supply to the specific signal verification module 15 if it is OFF (off). . When a power failure occurs, the external power supply is cut off, so that the power switch 13 supplies power from the battery 12 to the specific signal verification module 15 if it is ON, and stops power supply to the specific signal verification module 15 if it is OFF. .

  When a power failure occurs, the power switch 13 does not switch the power supply source to the specific signal verification module 15 to the battery 12, but a power control unit (not shown) provided in the security device 11 separately from the power switch 13. ) May switch the power supply source. In this case, the power switch 13 does not need to be connected to the battery 12, and the power control unit may be connected to the battery 12 and the power switch 13. When the power switch 13 is ON and power is supplied from the power switch 13, the power supply control unit supplies externally supplied power (power supplied from the power switch 13) to the specific signal verification module 15. Further, in this case, the power supply control unit charges the battery 12 with electric power supplied from the outside. When the power switch 13 is ON and the power supply from the power switch 13 is cut off, the power control unit determines that a power failure has occurred and switches the power supply source to the specific signal verification module 15 to the battery 12. That is, in this case, the power supply control unit supplies power to the specific signal verification module 15 by the battery 12. When the power switch 13 is OFF, the power control unit stops power supply to the unique signal verification module 15 even if the battery 12 is charged.

  The communication unit 14 is connected to the monitoring device 20 through a signal line 21 and communicates with the monitoring device 20 via a LAN (Local / Area / Network) or the like. The communication unit 14 receives a unique signal including encrypted data from the monitoring device 20 via the signal line 21. The monitoring device 20 repeatedly transmits a unique signal via the signal line 21 at a predetermined timing (for example, every fixed time such as 10 seconds, 30 seconds, 1 minute). The monitoring device 20 is a PC (personal computer), a server computer, or the like, and is installed at a remote location, like the external power supply 30. The monitoring device 20 may be installed at a location different from the external power supply 30, but is preferably installed at a location where it is difficult to steal together with the security device 11. For example, the monitoring device 20 may be built in a housing, a rack, or the like that houses the security device 11. In this case, the housing, the rack, or the like may be fixed to a floor or the like so that it cannot be taken out of a building. desirable. The security device 11 cannot be taken outside unless the signal line 21 is cut.

  The volatile memory 16 is, for example, an SRAM (Static / Random / Access / Memory), and stores confidential information (an example of information). The volatile memory 16 operates with external power supply during normal operation and power supplied by the battery 12 during a power failure. When the power supply is cut off, confidential information is lost from the volatile memory 16. The information stored in the volatile memory 16 is not limited to confidential information, and may be other arbitrary information.

  The unique signal verification module 15 monitors the reception status of the unique signal by the communication unit 14. Specifically, the unique signal verification module 15 monitors whether or not the communication unit 14 has repeatedly received the unique signal at the predetermined timing described above, and must have received the unique signal at the timing at which the communication unit 14 should receive the unique signal. If, for example, a certain time has elapsed since the previous reception, it is determined that the reception of the unique signal has been interrupted. When the unique signal verification module 15 determines that reception of the unique signal is interrupted, it erases confidential information stored in the volatile memory 16.

  The unique signal verification module 15 decrypts and verifies the encrypted data included in the unique signal every time the unique signal is received by the communication unit 14. If the data obtained by decrypting the encrypted data is regular data, the verification is successful. If the data is not regular data, the verification is unsuccessful. The unique signal verification module 15 erases the confidential information stored in the volatile memory 16 in the same manner as when it is determined that the reception of the unique signal is interrupted when the verification of the encrypted data fails.

  In the present embodiment, the battery 12 supplies power to the specific signal verification module 15 only at the time of a power failure, but power may be supplied to the specific signal verification module 15 also during normal times. In this case, if the power switch 13 is ON, power is supplied from the battery 12 to the specific signal verification module 15 regardless of the presence or absence of external power supply. This eliminates the need to switch the power supply source to the specific signal verification module 15 to the battery 12 in the event of a power failure, so that it is possible to reliably avoid a situation where confidential information is lost from the volatile memory 16 during this operation.

  FIG. 2 is a diagram illustrating a configuration example of the monitoring device 20.

  In FIG. 2, the monitoring device 20 includes a message generation unit 22, a hash function processing unit 23, a secret key holding unit 24, an encryption processing unit 25, and a unique signal transmission unit 26.

  The message generation unit 22 generates a message that is arbitrary digital data. This message is preferably different each time (for each transmission of the unique signal) so that it cannot be spoofed even if the unique signal is eavesdropped, and is synchronized with the unique signal verification module 15 of the security device 11 It is more desirable to include a counter value and time information.

  The hash function processing unit 23 calculates a hash value of the message generated by the message generation unit 22 using a predetermined hash function.

  The secret key holding unit 24 holds the secret key of the monitoring device 20 in a recording medium such as a ROM (Read / Only / Memory) in advance.

  The encryption processing unit 25 encrypts the hash value calculated by the hash function processing unit 23 with the secret key held by the secret key holding unit 24, thereby digitally signing the message generated by the message generation unit 22. Is generated.

  The unique signal transmission unit 26 transmits a unique signal obtained by adding the digital signature generated by the encryption processing unit 25 to the message generated by the message generation unit 22 to the security device 11 via the signal line 21.

  The digital signature in this example is an example of encrypted data included in the unique signal, and may be replaced with a digital signature generated by a method other than the above or other encrypted data.

  FIG. 3 is a diagram illustrating a configuration example of the unique signal verification module 15 of the security device 11.

  In FIG. 3, the unique signal verification module 15 includes a message holding unit 41, a hash function processing unit 42, a digital signature holding unit 43, a public key holding unit 44, a decryption processing unit 45, a message comparison unit 46, and an electronic switch 47.

  The message holding unit 41 temporarily holds a message included in the unique signal received by the communication unit 14 in a recording medium such as a RAM (Random / Access / Memory).

  The hash function processing unit 42 calculates the hash value of the message held by the message holding unit 41 using the predetermined hash function described above.

  The digital signature holding unit 43 temporarily holds the digital signature included in the unique signal received by the communication unit 14 in a recording medium such as a RAM.

  The public key holding unit 44 holds the public key of the monitoring device 20 in a recording medium such as a ROM in advance.

  The decryption processing unit 45 obtains the original hash value (plain text data) by decrypting the digital signature held by the digital signature holding unit 43 with the public key held by the public key holding unit 44.

  The message comparison unit 46 compares the hash value calculated by the hash function processing unit 42 with the hash value acquired by the decryption processing unit 45, and turns on the electronic switch 47 if both hash values match. If they do not match, the electronic switch 47 is turned off (non-conducting).

  The electronic switch 47 is ON / OFF controlled by the message comparison unit 46 to switch between conduction / non-conduction between the power input from the power switch 13 and the power output to the volatile memory 16. If the electronic switch 47 is ON (conducting), the externally supplied power is normally supplied to the volatile memory 16 during a power failure and the battery 12 is supplied during a power failure. If the electronic switch 47 is OFF (non-conduction), the power supply to the volatile memory 16 is stopped. As a result, confidential information stored in the volatile memory 16 is lost. The initial value of the electronic switch 47 is ON, and is turned OFF when the message comparison unit 46 does not match.

  Although not shown, the unique signal verification module 15 further includes a timer for measuring time. This timer is reset every time the communication unit 14 receives a unique signal. By arranging data (bit string) for identifying the head of the message in the message portion of the unique signal, the unique signal verification module 15 can detect the timing when the communication unit 14 detects the unique signal. The unique signal verification module 15 also turns off the electronic switch 47 (non-conduction) even when the time measured by the timer reaches a certain time.

  As described above, in this embodiment, it is possible to reliably detect the theft of the security device 11 not only during normal times but also during power outages, and to prevent leakage of confidential information during theft.

  In the present embodiment, the volatile memory 16 stores confidential information, but a nonvolatile memory may be used instead of the volatile memory 16. In this case, when the unique signal verification module 15 determines that reception of the unique signal has been interrupted, and when verification of the encrypted data fails, the confidential information stored in the non-volatile memory is changed to another information (for example, confidential information). The information may be encrypted information or may be dummy information that is not related to confidential information). Alternatively, the nonvolatile memory is physically destroyed. Thereby, since the confidential information is substantially erased from the nonvolatile memory, leakage of the confidential information can be prevented.

  As described above, in the present embodiment, the security device 11 is a device that is used in a system that handles confidential information that should not be leaked to the outside, and that operates by receiving external power supply. The security device 11 includes a mechanism for backing up confidential information stored in the volatile memory 16 inside the device by the battery 12 in the event of a power failure. The security device 11 includes means for receiving a unique signal periodically transmitted from the monitoring device 20 outside the device and verifying that the unique signal is a signal transmitted from the monitoring device 20. The security device 11 detects theft of the device due to the failure of the verification of the unique signal, cuts off the power supply to the volatile memory 16 storing the confidential information, and erases the confidential information.

  Specifically, the security device 11 includes a unique signal verification module 15 that verifies the unique signal from the monitoring device 20. The unique signal verification module 15 has a function of erasing the confidential information by cutting off the power supply to the volatile memory 16 storing the confidential information when the unique signal is verified as a result of verifying the unique signal. .

  When a power failure occurs and power supply from the external power supply 30 is interrupted, the power from the battery 12 is supplied by the power switch 13 to the volatile memory 16 that holds the confidential information via the unique signal verification module 15. Therefore, it is possible to prevent the confidential information from disappearing.

  When the security device 11 is stolen, the power line 31 to which the power supply signal is transmitted and the signal line 21 to which the unique signal is transmitted are disconnected, and power is not supplied to the volatile memory 16, so that confidential information is erased.

  Even if the signal line 21 is connected to another signal line prior to the security device 11 being stolen, the unique signal verification module 15 cuts off the power supply to the volatile memory 16 by temporarily stopping the reception of the unique signal. Therefore, confidential information is erased. Even if the signal line 21 is quickly switched to another signal line, it is extremely difficult to simulate the unique signal on that (other) signal line, and thus the confidential information is prevented from being erased. It is not possible.

  As described above, according to the present embodiment, when the security device 11 is stolen, by detecting the disconnection of the signal line 21 through which the unique signal is transmitted, it is possible to reliably detect that the device has been stolen and Leakage can be prevented. In addition, when the security device 11 is stolen, even if the signal line 21 through which the unique signal is transmitted is quickly switched to another signal line, the unique signal cannot be simulated on that (other) signal line. It is possible to reliably detect that the device has been stolen and prevent leakage of confidential information.

  FIG. 4 is a diagram illustrating a hardware configuration example of the security device 11. Note that a similar hardware configuration can be adopted for the monitoring device 20.

  In FIG. 4, the security device 11 is a computer, and includes an LCD 71 (Liquid / Crystal / Display), a keyboard 72 (K / B), a mouse 73, an FDD 74 (Flexible Disk / Drive), and a CDD 75 (Compact / Disk / Drive). , A hardware device such as a printer 76 is provided. These hardware devices are connected by cables and signal lines. Instead of the LCD 71, a CRT (Cathode / Ray / Tube) or other display device may be used. Instead of the mouse 73, a touch panel, a touch pad, a trackball, a pen tablet, or other pointing devices may be used.

  The security device 11 includes a CPU 81 (Central Processing Unit) that executes a program. The CPU 81 is an example of a processing device. The CPU 81 is connected to the ROM 83, the RAM 84, the communication board 85, the LCD 71, the keyboard 72, the mouse 73, the FDD 74, the CDD 75, the printer 76, and the HDD 90 (Hard / Disk / Drive) via the bus 82, and controls these hardware devices. To do. Instead of the HDD 90, a flash memory, an optical disk device, a memory card reader / writer, or other recording medium may be used.

  The RAM 84 is an example of the volatile memory 16. ROM83, FDD74, CDD75, HDD90 is an example of a non-volatile memory. These are examples of the storage device. The communication board 85, the keyboard 72, the mouse 73, the FDD 74, and the CDD 75 are examples of input devices. The communication board 85, the LCD 71, and the printer 76 are examples of output devices.

  The communication board 85 is connected to a LAN or the like. The communication board 85 is not limited to a LAN, but is an IP-VPN (Internet, Protocol, Private, Network), a wide area LAN, an ATM (Asynchronous / Transfer / Mode) network, a WAN (Wide / Area / Network), or the Internet. It does not matter if it is connected to. LAN, WAN, and the Internet are examples of networks.

  The HDD 90 stores an operating system 91 (OS), a window system 92, a program group 93, and a file group 94. The programs in the program group 93 are executed by the CPU 81, the operating system 91, and the window system 92. The program group 93 includes a program for executing a function described as “˜unit” in the description of the present embodiment. The program is read and executed by the CPU 81. The file group 94 includes data, information, and signal values described as “˜data”, “˜information”, “˜ID (identifier)”, “˜flag”, and “˜result” in the description of the present embodiment. And variable values and parameters are included as items of “˜file”, “˜database”, and “˜table”. The “˜file”, “˜database”, and “˜table” are stored in a recording medium such as the RAM 84 or the HDD 90. Data, information, signal values, variable values, and parameters stored in a recording medium such as the RAM 84 and the HDD 90 are read out to the main memory and the cache memory by the CPU 81 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. It is used for processing (operation) of the CPU 81 such as calculation, control, output, printing, and display. During processing of the CPU 81 such as extraction, search, reference, comparison, calculation, calculation, control, output, printing, and display, data, information, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory. Remembered.

  The arrows in the block diagrams and flowcharts used in the description of this embodiment mainly indicate input / output of data and signals. Data and signals are recorded in a memory such as RAM 84, FDD 74 flexible disk (FD), CDD 75 compact disk (CD), HDD 90 magnetic disk, optical disk, DVD (Digital Versatile Disc), or other recording media. Is done. Data and signals are transmitted by a bus 82, signal lines, cables, or other transmission media.

  In the description of the present embodiment, what is described as “to part” may be “to circuit”, “to device”, “to device”, and “to step”, “to process”, “to”. ~ Procedure "," ~ process ". That is, what is described as “˜unit” may be realized by firmware stored in the ROM 83. Alternatively, what is described as “˜unit” may be realized only by software, or only by hardware such as an element, a device, a board, and wiring. Alternatively, what is described as “to part” may be realized by a combination of software and hardware, or a combination of software, hardware and firmware. Firmware and software are stored as programs in a recording medium such as a flexible disk, a compact disk, a magnetic disk, an optical disk, and a DVD. The program is read by the CPU 81 and executed by the CPU 81. That is, the program causes the computer to function as “to part” described in the description of the present embodiment. Or a program makes a computer perform the procedure and method of "-part" described by description of this Embodiment.

Embodiment 2. FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  FIG. 5 is a block diagram showing the configuration of the information management system 10 according to the present embodiment.

  In FIG. 5, the battery 12 is provided as a backup power source at the same remote location as the monitoring device 20 and the external power source 30 instead of being provided inside the security device 11. The battery 12 may be installed at a location different from the monitoring device 20 and the external power supply 30.

  The power switch 13 is connected to the battery 12 by a power line 32. The power switch 13 receives a power supply signal from the battery 12 via the power line 32 at the time of a power failure of the external power supply 30. That is, when a power failure occurs, the power switch 13 receives supply of power stored in the external battery 12 via the power line 32.

  In the present embodiment, a battery 12 may be provided inside the security device 11 as in the first embodiment. That is, the battery 12 may be provided both inside and outside the security device 11.

Embodiment 3 FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  FIG. 6 is a block diagram showing a configuration of the information management system 10 according to the present embodiment.

  In FIG. 6, the information management system 10 further includes a signal superposition control unit 33. The security device 11 further includes a signal separation control unit 17.

  The battery 12 and the power switch 13 are not directly connected to the external power source 30. Further, the communication unit 14 is not directly connected to the monitoring device 20. In the present embodiment, the signal separation control unit 17 is connected to the signal superposition control unit 33 by the power line 31.

  The signal superposition control unit 33 transmits a power supply signal via the power line 31. The signal separation control unit 17 receives the power supply signal from the signal superposition control unit 33. At the timing when the unique signal is transmitted from the monitoring device 20, the signal superimposing control unit 33 superimposes the unique signal transmitted from the monitoring device 20 on the power supply signal from the external power supply 30. Then, the signal superimposing control unit 33 transmits a power supply signal on which the unique signal is superimposed via the power line 31. In this case, the signal separation control unit 17 receives the power supply signal on which the unique signal is superimposed from the signal superposition control unit 33.

  When receiving the power supply signal on which the unique signal is not superimposed, the signal separation control unit 17 inputs the received power supply signal to the power switch 13. When a power supply signal is input, the power switch 13 operates in the same manner as in the first embodiment and charges the battery 12.

  When receiving the power supply signal on which the unique signal is superimposed, the signal separation control unit 17 separates the unique signal from the received power supply signal and then inputs the power supply signal to the power switch 13. When a power supply signal is input, the power switch 13 operates in the same manner as in the first embodiment and charges the battery 12. The signal separation control unit 17 inputs a unique signal separated from the power supply signal to the communication unit 14. When a unique signal is input, communication unit 14 operates in the same manner as in the first embodiment.

  As described above, in the present embodiment, the communication unit 14 receives (indirectly) a unique signal including encrypted data from the monitoring device 20 via the power line 31. Therefore, the signal line 21 in Embodiment 1 is not necessary.

  As described above, in the present embodiment, the unique signal periodically transmitted from the monitoring device 20 outside the device is transmitted to the security device 11 while being superimposed on the power supply signal from the outside. As a result, the number of cables required for laying the information management system 10 is reduced, and installation and relocation is reduced.

Embodiment 4 FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  FIG. 7 is a block diagram showing a configuration of the information management system 10 according to the present embodiment.

  In FIG. 7, the communication unit 14 of the security device 11 includes an antenna 18.

  The communication unit 14 performs wireless communication with the monitoring device 20 via the antenna 18 instead of being connected to the monitoring device 20 by wire. The monitoring device 20 repeatedly transmits a unique signal wirelessly at a predetermined timing (for example, every fixed time such as 10 seconds, 30 seconds, 1 minute). The communication unit 14 wirelessly receives a unique signal including encrypted data from the monitoring device 20. Therefore, the signal line 21 in Embodiment 1 is not necessary.

Embodiment 5 FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  The configuration of the information management system 10 according to the present embodiment is the same as that of the first embodiment shown in FIG.

  The monitoring device 20 transmits notification data for notifying that transmission of the unique signal is interrupted at an arbitrary timing (for example, prior to the relocation of the security device 11, communication data is transmitted according to an input instruction from the administrator). To do). The notification data includes information indicating a period during which the transmission of the unique signal is interrupted (for example, a period for moving the security device 11). Note that the monitoring device 20 may transmit the notification data as one of the unique signals. That is, the monitoring device 20 may include the notification data in the unique signal message.

  Notification data transmitted from the monitoring device 20 is received by the communication unit 14 of the security device 11 via the signal line 21. When the notification data is received by the communication unit 14, the specific signal verification module 15 may apply a predetermined period (which may be determined in advance or the period notified by the notification data as described above as it is. However, the confidential information stored in the volatile memory 16 is not erased even if the unique signal is not received by the communication unit 14. However, if the reception of the unique signal is stopped after the period has elapsed, the confidential information stored in the volatile memory 16 is erased.

  According to the present embodiment, the security device 11 can be moved, inspected, etc. while the confidential information stored in the volatile memory 16 is retained.

  As mentioned above, although embodiment of this invention was described, you may implement in combination of 2 or more among these embodiment. Alternatively, one of these embodiments may be partially implemented. Alternatively, two or more of these embodiments may be partially combined. In addition, this invention is not limited to these embodiment, A various change is possible as needed.

  DESCRIPTION OF SYMBOLS 10 Information management system, 11 Security apparatus, 12 Battery, 13 Power switch, 14 Communication part, 15 Specific signal verification module, 16 Volatile memory, 17 Signal separation control part, 18 Antenna, 20 Monitoring apparatus, 21 Signal line, 22 Message Generation unit, 23 Hash function processing unit, 24 Secret key holding unit, 25 Cryptographic processing unit, 26 Eigen signal transmission unit, 30 External power supply, 31 Power line, 32 Power line, 33 Signal superposition control unit, 41 Message holding unit, 42 Hash function Processing unit, 43 Digital signature holding unit, 44 Public key holding unit, 45 Decryption processing unit, 46 Message comparison unit, 47 Electronic switch, 71 LCD, 72 Keyboard, 73 Mouse, 74 FDD, 75 CDD, 76 Printer, 81 CPU, 82 bus, 83 ROM, 84 RA , 85 communication board, 90 HDD, 91 operating system, 92 window system, 93 programs, 94 files.

Claims (11)

A memory for storing information;
A communication unit that receives encrypted data repeatedly transmitted from an external device and receives notification data for notifying that transmission of the encrypted data is interrupted from the external device ;
When monitoring the reception status of the encrypted data by the communication unit, decrypting and verifying the encrypted data every time the encrypted data is received by the communication unit, and determining that the reception of the encrypted data is interrupted, When the verification of the encrypted data fails, the information stored in the memory is deleted, and when the notification data is received by the communication unit, the encrypted data is received by the communication unit within a predetermined period. And an information erasing unit that does not erase the information stored in the memory even if it is not received . The communication unit receives, as the notification data, notification data for notifying a period during which transmission of the encrypted data is interrupted,
The information erasure unit, when the notification data is received by the communication unit, as the predetermined period, even if the encryption data is not received by the communication unit within the period notified by the notification data, 2. The information management apparatus according to claim 1 , wherein the information stored in the memory is not erased.   The information management apparatus according to claim 1, wherein the communication unit receives data obtained by encrypting the notification data as one of the encrypted data. The information management device is connected to the external device via a power line,
The memory may be any information management apparatus of claims 1 to 3, characterized in that said external device is a volatile memory which is operated by power supplied through the power line. An information management device connected to an external device via a power line,
A volatile memory that operates by power supplied from the external device via the power line ;
A communication unit for receiving encrypted data transmitted repeatedly from said external device,
When monitoring the reception status of the encrypted data by the communication unit, decrypting and verifying the encrypted data every time the encrypted data is received by the communication unit, and determining that the reception of the encrypted data is interrupted, And an information erasing unit for erasing information stored in the volatile memory when the verification of the encrypted data fails. 6. The information management apparatus according to claim 4 , wherein the communication unit receives the encrypted data from the external apparatus via the power line. An information management device according to any one of claims 1 to 6,
An information management system comprising the external device. In an information management method using an information management apparatus having a memory for storing information,
The communication unit of the information management device receives encrypted data repeatedly transmitted from an external device, and also receives notification data notifying that transmission of the encrypted data is interrupted from the external device ,
The information erasure unit of the information management device monitors the reception status of the encrypted data by the communication unit, decrypts and verifies the encrypted data every time the encrypted data is received by the communication unit, and When it is determined that reception of data has been interrupted, and when verification of the encrypted data fails, information stored in the memory is erased, and when the notification data is received by the communication unit, a predetermined period of time The information management method is characterized in that the information stored in the memory is not erased even if the encrypted data is not received by the communication unit . Have a volatile memory which is operated by power supplied through the power line from the external device, the information management method using the information management apparatus connected through the power line and the external device,
The communication unit of the information management apparatus receives the encrypted data originating repeatedly from said external device,
The information erasure unit of the information management device monitors the reception status of the encrypted data by the communication unit, decrypts and verifies the encrypted data every time the encrypted data is received by the communication unit, and An information management method comprising: erasing information stored in the volatile memory when it is determined that reception of data is interrupted and when verification of the encrypted data fails. A computer having a memory for storing information;
A communication unit that receives encrypted data repeatedly transmitted from an external device and receives notification data for notifying that transmission of the encrypted data is interrupted from the external device ;
When monitoring the reception status of the encrypted data by the communication unit, decrypting and verifying the encrypted data every time the encrypted data is received by the communication unit, and determining that the reception of the encrypted data is interrupted, When the verification of the encrypted data fails, the information stored in the memory is deleted, and when the notification data is received by the communication unit, the encrypted data is received by the communication unit within a predetermined period. A program for functioning as an information erasure unit that does not erase information stored in the memory even if no information is received . Have a volatile memory which is operated by power supplied through the power line from the external device, a computer connected to the said power line and said external device,
A communication unit for receiving encrypted data transmitted repeatedly from said external device,
When monitoring the reception status of the encrypted data by the communication unit, decrypting and verifying the encrypted data every time the encrypted data is received by the communication unit, and determining that the reception of the encrypted data is interrupted, And the program for functioning as an information erasure | elimination part which erase | eliminates the information memorize | stored in the said volatile memory when verification of the said encryption data fails.

Images