KR20010016202A - Computer Stealth Trace System & Method - Google Patents

Abstract

PURPOSE: A security system and method via location track and remote control are provided to find a lost computer by tracking the location of the lost computer, and to prevent the loss of a computer in a software manner by installing a theft control module in the computer. CONSTITUTION: A user computer(100), a manager server(105) and a police server(110) are connected to each other via wired and wireless communication networks. The theft control module is installed in the user computer(100) via an online way such as download or via offline means such as a CD-ROM. The theft control module can not be deleted, and can be performed while electric power is supplied to the computer. The manager server(105) compares the stored hardware information and IP address of the user computer(100) with those transmitted from the current user computer(100), and thereby determines if the user computer(100) has been lost. If the manager server(105) determines that user computer(100) has been lost, it stores the hardware information and IP address thereof, and then sends an e-mail for reporting the theft to the police server(110).

Description

Theft prevention system and method through location tracking and remote control {Computer Stealth Trace System ＆ Method}

The present invention relates to an anti-theft system and method through location tracking and remote control for recovering the stolen computer by tracking the location of the stolen computer and protecting the stored data according to the theft of the computer.

Recently, the demand for security of data stored in a computer of a company or an individual has been emphasized, and as theft incidents of a computer increase, the need for preventing theft of a computer is required.

Due to this necessity, in the past, government offices, educational institutions, and general enterprises have limited physical locks between computer tables and computers as necessary to prevent theft or to use personally authenticated passwords. Security forms are currently being proposed.

However, current anti-theft devices of computers generally have a problem in that theft of a computer may be possible at any time if there is a means for cutting the physical device by using a physical device.

In addition, when a physical device is installed to prevent theft of the computer, even if there is a minor mistake due to the device, the computer may have a problem such as a loss.

In addition, there is a problem that if a computer that is combined with a physical device to prevent theft is stolen, it may be impossible to recover the computer.

In addition, there is a problem that the security form through password authentication can be easily exposed due to the development of many current hacking techniques.

The present invention has been proposed to solve the above problems, and an object of the present invention is to protect the stored data according to computer theft and theft prevention system through location tracking and remote control for recovering the stolen computer by tracking the location of the stolen computer. And method.

It is another object of the present invention to provide an anti-theft system and method through location tracking and remote control that can prevent theft of a computer in advance by disclosing the existence of a tracking function to a stolen computer.

It is still another object of the present invention to provide an anti-theft system and method through location tracking and remote control that can prevent the loss of the computer due to the installation of a physical device by applying a software method to prevent theft of the computer. It is.

1 is a diagram showing the overall configuration of an anti-theft computer system via location tracking and remote control according to an embodiment of the present invention.

2 is a view showing a theft determination process according to the set theft control conditions according to an embodiment of the present invention.

3 is a view showing a process of performing a remote control function for a stolen computer according to an embodiment of the present invention.

4 is a flowchart of a case of performing a location tracking service for recovering a stolen computer according to an exemplary embodiment of the present invention.

5 is a diagram illustrating a screen for setting a transmission signal condition for theft determination according to an embodiment of the present invention.

6 is an exemplary screen illustrating a state in which hardware information and an IP address transmitted from a computer are received according to an exemplary embodiment of the present invention.

7 is a diagram illustrating a screen outputting geographic information according to an embodiment of the present invention.

<Explanation of symbols for main parts of drawing>

100: user computer 105: administrator server

110: police server

According to an aspect of the present invention for achieving the above object, in the system for preventing theft of a computer and recovering the stolen computer using a communication network, installed in the user computer to detect at least one of hardware information, IP address When at least one of the hardware information and the IP address is received from the theft control module and the user computer to transmit the information, and the theft of the user computer is confirmed through the application of a predetermined method, the remote control and the location tracking service for the user computer are performed. The anti-theft control module detects hardware information according to a power input signal of a user, detects an IP address when a user connects to a network, receives a session key predetermined for a remote control service from an administrator server, Above to change to protocol security state The anti-theft tracking and through a remote control system, a method, apparatus and recording media corresponding to the method is provided.

According to another aspect of the present invention, a method for transmitting computer information to an administrator server by a theft control module installed in a user computer, the at least one of hardware information, IP address is detected and transmitted to the administrator server, the transmitted Receives a remote control service request according to the determination of theft of the administrator server based on the change of at least one of the hardware information and the IP address, performs a corresponding service corresponding to the received remote control service request, and displays the result of the performed service. Provided are a method for preventing theft through location tracking and remote control for transmitting to an administrator server, an apparatus, a system, and a recording medium corresponding to the method.

According to a preferred embodiment, the detection of the hardware information can be repeatedly performed at a predetermined time interval until a network connection by the user is established, the detected hardware information until the network connection by the user is made Can be stored continuously with the detected time.

According to another preferred embodiment, the detection of the IP address may be made upon network connection of the user, and the predetermined time interval may be selected by the user.

According to another preferred embodiment, the hardware information includes at least one of a computer manufacturer, a computer serial number, a LAN card number, a user name, a transfer time, a Mac address, a hard disk number, a memory number, a CPU, a video card, and a SCSI card. can do.

According to another preferred embodiment, receiving the remote control service request may further include receiving a session key from an administrator server and changing the protocol security state based on the received session key.

According to another preferred embodiment, the transmitting of the result of the service to the administrator server may further include key log information of an illegal user, and the key log information may be used by an illegal user for an input / output device. It may include at least one of a command, a start time and an end time.

According to another preferred embodiment, the detected IP address may include at least one of a virtual IP address, a floating IP address, and a static IP address.

According to another aspect of the present invention, in performing a computer remote control and location tracking service using a communication network, the computer receives at least one of hardware information and an IP address from a user computer, and compares it with a preset theft control condition. If it is determined that theft is determined, a session key is generated and transmitted to the user computer for the authentication request. When authentication information according to the transmission is received, a predetermined remote control service is requested, and the result of the remote control service is accordingly determined. A method for preventing theft through receiving location tracking and remote control, apparatus, system and recording medium corresponding to the method are provided.

According to an exemplary embodiment, the anti-theft method through location tracking and remote control may further include a location tracking service for detecting at least one of location information and geographic information using the received IP address.

According to another preferred embodiment, the detected IP address may include at least one of a virtual IP address, a floating IP address, and a static IP address, and the user computer and the manager server may be connected using at least one of a wired network and a wireless communication network. Can be.

According to another preferred embodiment, the hardware information includes at least one of a computer manufacturer, a computer serial number, a LAN card number, a user name, a transfer time, a Mac address, a hard disk number, a memory number, a CPU, a video card, and a SCSI card. can do.

According to another preferred embodiment, the theft control conditions are among the computer manufacturer, computer serial number, LAN card number, user name, transmission time, Mac address, hard disk number, memory number, CPU, video card, SCSI card, IP address. At least one change may be determined as theft, and theft control condition may be set in advance by the user.

According to another preferred embodiment, the remote control service may include at least one of data deletion, data backup, data unavailable,

According to another preferred embodiment, the anti-theft method through the location tracking and remote control, after determining the theft of the user's computer, the fact that the user's computer is stolen in the email, voice message, text message to at least one of the insurance company, police At least one may be transmitted.

According to another preferred embodiment, the anti-theft method via location tracking and remote control may further receive key log information of an illegal user using a user computer.

According to another aspect of the present invention, in a method for determining whether a computer is stolen using a communication network, receiving at least one of hardware information and an IP address from a user computer, and among the received hardware information and the IP address A theft determining method of a computer, a device, a system, and a recording medium corresponding to the method for comparing the at least one with a preset theft control condition are determined.

According to another aspect of the present invention, when receiving the at least one of the hardware information, IP address from the user computer combined with the communication network to determine whether the theft compared to the preset theft control conditions, and as a result, the user computer is stolen The present invention provides a method for preventing theft through location tracking and remote control for performing a remote control service and a location tracking service for a corresponding user computer, an apparatus, a system, and a recording medium corresponding to the method.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing the overall configuration of the anti-theft user computer system via location tracking and remote control according to an embodiment of the present invention.

Referring to Figure 1, the anti-theft system through the location tracking and remote control is a user computer (100a, 100b, 100c, ..., 100n, hereinafter referred to as 100) installed the theft control module, administrator server 105 and police The server 110 is provided.

The user computer 100 (corresponding to the client) may be any personal user computer that can access the network, such as a notebook user computer, a desktop user computer, a laptop user computer, and a palmtop user computer. You may apply.

In addition, the user computer 100, the manager server 105, and the police server 110 are coupled to a wired or wireless communication network.

In addition, the manager server 105 may be classified into a web server, a control center server, and the like, but since there is no difference in function, the following description will be given as the manager server 105.

The present invention is briefly described as follows.

In the following description, an original user of the user computer 100 is referred to as a user, and a user who uses the stolen user computer 100 after the user is stolen (including lost) is called an illegal user. Shall be.

First, a theft control module is installed in the user computer 100 via online (for example, download) or offline (for example, CD-ROM). At this time, the theft control module is performed inside the computer.

In other words, when a general program starts, a process is registered in a process manager that manages the process, and the user can delete the registered process arbitrarily.

However, the theft control module is not registered with the process manager because it is written for the background (which can be applied through the coding of the program). Thus, the user cannot arbitrarily delete the theft control module, and the operation of the theft control module is only performed unless the computer is powered off.

Thereafter, the user computer 100 in which the theft control module is installed receives registration information including the user information, theft report option information, theft control condition, and the IP address from the user.

Here, the user information includes at least one of a name, social security number, e-mail address, residential address and telephone number, and theft report option information includes a remote control function (data backup, data deletion, remote control, etc.), automatic theft determination, It includes at least one of the police representative report, the theft control conditions include transmission signal conditions and theft judgment conditions.

Remote control among the theft report option information means to operate in a predetermined manual mode, such as data movement and data hiding.

The anti-theft control condition may include a transmission signal condition and an anti-theft determination condition. The transmission signal condition relates to what information (such as hardware information including user information) that the user computer 100 will transmit to the administrator server 105 (including transmission time and transmission period), and theft The judgment condition means that the manager server 105 sets in advance in what case the manager server 105 will determine that theft is based on the transmitted information.

In the case of setting the above-mentioned theft judgment condition, it is in violation of the condition set by the user's selection (for example, various conditions such as changing at least one of hardware information, changing IP address, and user login problem can be applied). Only to judge theft.

The user computer 100 may store the registration information received from the user in the storage means and at the same time transmit and store the registration information to the administrator server 105. Preferably, the user accesses the corresponding website operated by the administrator server 105. You can also enter theft report option information, theft control conditions, and IP address.

First, as the user starts (powers on) the user computer 100, the theft control module in the user computer 100 operates.

Thereafter, as the user connects to the network, the user computer 100 receives hardware information including the serial numbers of various parts (e.g., a Mac address, a LAN card number, a hard disk number, a memory number, a CPU, etc.) through a registry of Windows. , Video card, SCSI card, etc.) and the IP address are detected and transmitted to the manager server 105.

The registry of the window contains information necessary for booting in operating systems such as Windows 95 or Windows 98 and Windows NT, such as what hardware is installed, system specifications or options, and how memory is set. It is a place to store.

Windows' registry is similar to the configuration file (.INI file) used in previous Windows systems, namely Windows 3.1, and can be understood as a replacement.

However, configuration files (.INI files) are still provided for compatibility with 16-bit applications running on older systems. Users can modify the registry indirectly using control panel tools (such as the Tweak UI), and the information stored in the registry is modified whenever the application is installed or deleted.

In a network environment, the system conditions of individuals or work groups can be centrally managed by storing the information stored in the registry on the server as described above.

Thus, the user computer 100 searches the registry of the window to extract the serial number of the part.

The hardware information may include a MAC address, a LAN card number, a hard disk number, a memory number, and the like, and may preferably include serial numbers of all components in the user's computer. In this way, the user computer 100, that is, a plurality of user computers, is distinguished by using a serial number of parts added during hardware manufacturing of the user computer that can be applied to each user computer 100.

Here, the MAC address is an address used by the MAC layer of the data link layer in a local area network and refers to a 48-bit hardware address of a network card, and is the same as an Ethernet address or a token ring address. The hardware address assigned by the network card manufacturer is a universally administered address (UAA), and every network card has a unique value.

Thereafter, the manager server 105 compares the hardware information and the IP address transmitted from the user computer 105 based on the hardware information and the IP address previously stored by the user, and then compares the user information with the user's computer 100 based on the set theft determination condition. ) To determine whether it has been stolen.

As a result of the determination of theft, the administrator server 105 stores the corresponding hardware information and IP address at the time of theft determination, and transmits an e-mail or the like to the police server 110, and based on the IP address, Identify the stolen user computer 100 using the Geographical Information System (GIS), that is, the location information of the user computer, and track the corresponding stolen computer 100, that is, the user computer, in connection with the police based on the identified location information. And recovery.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, the process of receiving and storing the installation and registration information of the site control module will be replaced with the above description, and the following will describe the theft determination process and the location tracking service in detail.

2 is a diagram illustrating a theft determination process according to the set theft control conditions according to an embodiment of the present invention.

Referring to FIG. 2, in step 200, as the user computer 100 is turned on by the user, the theft control module installed in the user computer 100 operates in step 205.

In operation 210, the user computer 100 detects hardware information including a LAN card number from the registry of the window and stores the hardware information detected in operation 215.

In step 220, the user computer 100 determines whether there is a connection request to the network by user selection (i.e., executing a web browser program such as Explorer or Netscape).

As a result of the determination, if there is a connection request to the network, the process proceeds to step 225, and if not, the process proceeds to step 210, and the steps 210 and 215 are repeatedly performed according to a preset condition.

That is, the repetition in steps 210 and 215 may be performed by a user for a predetermined time according to a preset condition of detecting the hardware information and storing the detected hardware information until the user computer 100 is connected to the network. It means to perform repeatedly at intervals (for example, 10 minutes).

At this time, preferably, the hardware information may be transmitted and stored in the manager server 105 without going through the storing step.

In operation 225, the user computer 100 detects an IP address currently used in the user computer 100 according to the determination that the user computer 100 is connected to the network.

In operation 230, the user computer 100 transmits the detected hardware information and the IP address to the manager server 105.

In operation 235, the manager server 105 receives the hardware information and the IP address transmitted from the user computer 100 in operation 230 and proceeds to operation 240.

In operation 240, the manager server 105 compares the hardware information and the IP address transmitted from the corresponding user computer 100 with the hardware information and the IP address, which are already stored, to determine whether the set control conditions are met.

As a result of the determination, if at least one of the hardware information and the IP address is changed, the process proceeds to step 245, otherwise proceeds to step 250.

In operation 245, the manager server 105 stores the newly received hardware information and the IP address according to the determination result that the already stored hardware information and the IP address match the received hardware information and the IP address in step 240.

When the user computer 100 detects and stores hardware information and an IP address, the user computer 100 may store time information corresponding to the detected information together. The stored time information may be transmitted together with the hardware information and the IP address to the manager server 105.

However, preferably, when the manager server 105 stores the received hardware information and the IP address, the manager server 105 applies time information (current time received) applied by the manager server 105 or time information transmitted from the user computer 100. May be applied, and may also be applied by storing all the time information from the user computer 100 and the administrator server 105.

The reason for distinguishing the time information applied from the user computer 100 and the administrator server 105 is that the time applied from the user computer 100 can be manipulated by an illegal user.

More preferably, the stored information may be used to directly check whether the user's computer 100 has been stolen through online or offline, etc. after being transmitted to the user using an e-mail or the like.

In this case, it is assumed that the user knows in advance about the transmitted hardware information, IP address, and the like, and the user can check the contents of the email through confirmation of the email anytime, anywhere in the case of going out. In addition, preferably, a user may use a telephone, a text message, a voice message, etc. to confirm whether the theft is fast.

In operation 250, the manager server 105 determines whether the change meets a predetermined theft control condition according to the determination result that at least one of the hardware information and the IP address received in operation 240 is changed.

As a result of the determination, if at least one change of the hardware information and the IP address satisfies a preset theft control condition, the flow proceeds to step 245, otherwise proceeds to step 255.

In step 255, the manager server 105 determines that the user computer 100 has been stolen according to the determination result in step 250, and proceeds to step 260.

For example, steps 250 through 255 are described as follows.

Among theft control conditions preset by the user, the transmission signal conditions are 'Vender Name, Serial Number, MAC Address, LAN Card Number, Hard Disk Number, Memory Number, CPU, Video Card, Detects hardware information and IP address of the SCSI card and the like, and transmits the detected hardware information and IP address to the administrator server 105 at a time interval of 10 minutes. Suppose that at least one information change is set as 'theft'.

When the LAN card number is changed among the hardware information and the IP address transmitted from the user computer 100, the manager server 105 determines that the theft is theft according to the set theft judgment condition.

In such a case, unlike a general desktop computer among the computers applied as the user computer 100, in the case of a notebook computer, the change of the IP address may frequently change from place to place.

Therefore, in case of applying a portable computer, etc., which is portable to the user computer 100, theft judgment is performed based on the change of hardware information of the user computer. Of course, even in such a case, it may be determined as theft even when the IP address is changed according to the setting of the user's theft control condition.

The remote control and tracking service described below will be performed based on the IP address regardless of any of the above hardware information change and IP address change.

Preferably, when it is determined that theft is satisfied in accordance with the set theft control condition, an e-mail, a voice message, a text message, etc. may be transmitted to the corresponding user to confirm theft.

After that, if the remote control function and the tracking service function are set in advance from the user, the administrator server 105 may immediately perform the corresponding function, or the user's request after confirming whether the theft has been stolen through the user online or offline. It can also perform a remote control function and tracking service function.

In operation 260, the manager server 105 transmits a stolen determination signal to the stolen user computer 100.

In operation 265, the user computer 100 receives the theft determination signal transmitted in operation 260 and proceeds to operation 270.

Thereafter, in step 270, the user computer 100 stores key log information input by an illegal user.

Here, the key log information refers to a record of the work history of an illegal user, and the key log records all information about the operation of the user computer system, including information about who accesses where and when. When the illegal user uses the user computer 100, the key log information records the use time of the input / output device, the executed command, the start time and the end time, etc. over time.

In operation 275, the user computer 100 transmits the key log information stored in operation 270 to the manager server 105.

In operation 280, the manager server 105 receives and stores key log information transmitted from the user computer 100 in operation 275. The stored key log information may be reported using an analysis program or the like, and then provided to a related institution (eg, a police station or an insurance company).

3 is a view showing a process of performing a remote control function for a stolen computer according to an embodiment of the present invention.

Referring to FIG. 3, in step 300, the manager server 105 confirms theft of the user computer 100 through the theft determination process of FIG. 2, and proceeds to step 305.

In step 305 the administrator server 105 determines whether there was a remote control request from the user, and if yes, proceeds to step 315 and otherwise proceeds to step 310.

In other words, the manager server 105 determines whether a predetermined remote control (at least one of data backup, data deletion, and remote control functions) has been selected in advance when it is determined that the user computer 100 has been stolen.

In step 310, the manager server 105 receives the remote control request through the user or online or offline according to the determination result that the remote control function in step 310 is not selected in advance, and then proceeds to step 315. Perform control functions.

In operation 315, the manager server 105 generates a session key applying a predetermined encryption algorithm. Such a session key may preferably apply a particular bit (eg 128 bits).

In operation 320, the administrator server 105 transmits a session key to the user computer 100 to perform a remote control function.

It is for confirming from the user computer 100 that the place where the remote control function is performed through the session key is the administrator server 105.

Thereafter, in step 325, the user computer 100 receives the session key transmitted from the manager server 105 in step 320, and in step 320 the user computer 100 receives the session key from the manager server 105 through the session key. Confirm that there is an authentication request.

Specifically, steps 315 to 325 are described as follows.

An algorithm for distinguishing a session key is stored in the manager server 105 and the user computer 100 in advance, and the manager server 105 sends a certificate of the manager server 105 when the session key is sent to the user computer 100. Attach it.

The certificate of the manager server 105 includes information that encrypts the name of the server that can identify the server and the like, and a time stamp that can confirm the valid period. In addition, the user computer 100 confirms the certificate by using an algorithm for confirming previously stored encrypted information.

The session key is a key value used for protocol encryption of the administrator server 105 and the user computer 100, and is generated using standard encryption techniques (eg, RSA, ASA, etc.).

After confirming that the authentication request is made through the session key, the user computer 100 changes to the protocol security state in step 335. That is, it means that both the administrator server 105 and the user computer 100 encrypts and exchanges information using the same password.

In operation 340, the user computer 100 transmits the authentication information to the manager server 105 to confirm that the user has changed the protocol security state based on the received session key.

In step 345, the manager server 100 receives the authentication information transmitted from the user computer 100 in step 340, and in step 350, the manager server 105 requests a remote control function previously selected in step 305.

The remote control request is to request the user computer 100 to perform a predetermined remote control function in a predetermined form, such as data deletion, data backup, and out of control.

In step 355, the user computer 100 receives the request for the remote control function transmitted in step 350, and in step 360, the user computer 100 performs the remote control function based on the received request.

That is, the user computer 100 that receives a request for performing a predetermined predetermined type of remote control function such as data deletion and data backup transmitted from the administrator server 105 may delete data, backup data, or the like based on the request. Perform remote control functions such as remote control.

At this time, the data backup means storing the data transmitted by the theft control module operating in the user computer 100 in the manager server 105.

The remote control function may be set in advance by the user before theft determination of the user computer 100, and may be set through communication with the user after theft determination.

In step 365, the user computer 100 determines whether the remote control function is completed. As a result of the determination, the user computer 100 proceeds to step 370 if the execution of the remote control function is completed, otherwise proceeds to step 360.

For example, it is determined whether a remote control function such as data deletion, data backup, remote control, etc. is normally performed due to an error. If the remote control function is not normally performed, the process proceeds to step 360 to re-execute the remote control function.

In operation 370, the user computer 100 transmits a result of performing the remote control function to the manager server 105.

In operation 375, the manager server 105 receives a result of performing a remote control function transmitted from the user computer 100.

4 is a flowchart of a case of performing a location tracking service for recovering a stolen user computer according to an exemplary embodiment of the present invention.

Referring to FIG. 4, in step 400, the manager server 105 detects the IP address of the corresponding user computer 100 determined as theft, and proceeds to step 405.

In operation 405, the manager server 105 determines whether the actual residence address exists using the corresponding location information database where the actual residence address exists based on the IP address detected in operation 400.

Here, the location information database is stored information as follows.

If the IP address of the user computer 100 is '211.60.28.20', the location information database stores location information including an actual residence address of '258-1 Yeoksam 1-dong, Gangnam-gu, Seoul, Korea'. Doing.

Accordingly, as a result of determining whether the location information exists based on the detected IP address, the flow proceeds to step 415 if the location information exists, and to step 410 otherwise.

In step 410, the manager server 105 processes the theft report to the police in accordance with the determination result that there is no location information in step 405 and ends the process. In this case, the key log information may be continuously received and stored from the user computer 100.

In operation 415, the manager server 105 detects location information corresponding to the corresponding IP address according to the determination result in operation 405 and proceeds to operation 420.

In operation 420, the manager server 105 searches for geographic information corresponding to a corresponding residence address through a geographic information system (GIS) based on the location information detected in operation 415.

In geographic information systems, geographic information is depicted in the form of geographic coordinates (such as latitude and longitude or grid coordinates of a country) or in implicit forms such as road addresses, postal codes, and forest locations. And geographic information systems have the ability to translate implicit data such as street addresses into clear map locations.

The data of the geographic information system may be stored in a vector or raster format. Using vector format, two-dimensional data is stored in the form of x and y coordinates. A road or river can be described as a series of x and y coordinate points. Nonlinear shapes, such as the boundaries of the downtown district, can be stored as closed curves of coordinates.

Vector models are good for representing outlines. The raster data format can represent data in which the grid cells change continuously. Raster models can draw sensitive changes, such as soil geometry, over an area. And the geographic information system can use both types of data.

In step 425, the manager server 105 transmits the location information and the geographic information retrieved in step 420 to the police server 110. Preferably, when linked with an insurance company, the information and geographic information may also be transmitted to the insurance company.

In step 430, the police server 110 receives the location information and the geographic information transmitted from the manager server 105 in step 425, and proceeds to step 435.

Thereafter, in step 435, the police server 110 instructs tracking to recover the stolen user computer 100 using the received location information and geographic information.

5 is a diagram illustrating a screen for setting a transmission signal condition for theft determination according to an exemplary embodiment of the present invention.

Referring to FIG. 5, the transmission signal condition input screen 600 includes a module operation check region and a transmission signal condition setting region.

The module operation check area is for determining whether the anti-theft control module installed in the user computer 100 is operated by the user. If the user inputs a certain check in the module presence check region, the theft control module is operated. If the constant check is not entered, the theft control module does not operate.

The transmission signal condition setting area includes items such as vendor name, IP address, user computer number (serial number), Mac address, computer name, time, and transmission time. do.

The user computer 100 operates the theft control module through the module operation check area and then transmits information (the information of the corresponding item) for theft determination for the item set by the user in the transmission signal condition setting area.

The user computer 100 receives time interval information for determining whether to transmit the item information at regular time intervals through a transmission time item from a user.

6 is an exemplary view illustrating a state in which hardware information and an IP address transmitted from a user computer are received according to an exemplary embodiment of the present invention.

Referring to FIG. 6, the status report 600 may include items such as a reception number, a serial number, a user computer name, a MAC address, a manufacturer, a transmission IP address, a destination IP address, a transmission time, and a reception time.

The following describes the transmission IP address and the destination IP address.

In general, a large organization, such as a business or school, does not have as many IP addresses as the number of computers used by its personnel. This is because the number of IP addresses, the only value in the world, is limited.

Thus, most organizations are assigned a limited number of IP addresses from Internet service providers. In addition, any one of a plurality of allocated IP addresses is selected and used as a static IP address, and the remaining IP addresses are allocated in real time according to a user's request using a computer to access the Internet.

At this time, an IP address assigned in real time to access the Internet is called a floating IP. The static IP address and the dynamic IP address are both IP addresses (actual IP addresses) that are actually assigned and exist.

For example, suppose a company with 20 computers uses 10 real IP addresses.

The company then uses one of the 10 real IP addresses as a static IP address and applies the remaining 9 real IP addresses as floating IPs. In other words, if 15 users use a computer for internet connection, the nine real IP addresses are assigned to the computer used by the user requesting the internet connection. That is, according to the order of the user's request in real time by using nine real IP addresses assigned to the user's computer in real time to enable Internet access. In this case, the concept applied to the actual IP address is called a floating IP address.

In addition, as described above, there is a virtual IP address in a symmetrical manner to an IP address that is actually allocated, and the meaning of the virtual IP address is as follows.

Organizations with large numbers of people allocate dynamic IP addresses in real time according to user needs. However, in spite of such an allocation method, when a large number of people use the Internet service, there is a problem in allocating a floating IP address to meet all the access needs of many Internet users.

Therefore, when accessing the Internet used as an alternative to the above problem, the virtual IP address is used instead of the actual IP address.

Virtual IP addresses can have virtually any number of addresses within a given range of addresses, so virtual IP addresses are generally used when there are large Internet users.

Even if the user uses the virtual IP address, the server providing the virtual IP address has information such as when and to which computer the virtual IP address is assigned.

The transmission IP and the destination IP shown in FIG. 6 based on the static IP address, the dynamic IP address, and the virtual IP address described above are as follows.

If the source IP and destination IP are the same, then the IP address assigned to the user's computer is either a static IP address or a dynamic IP address. Then, at least one of the forwarding IP address and the destination IP address can be used to know where the user currently using the computer is located.

And if the transport IP and destination IP are different, the transport IP is a virtual IP address assigned to the computer used by the user, and the destination IP is the IP address (fixed or floating IP address) of the server that assigns the virtual IP address to the user's computer. IP address).

At this time, the administrator server 105 can roughly grasp (eg, which school, etc.) the location of the user's computer using the destination IP, and specifically which place is using the transmission IP. You can see when it was used (in what department, how many lectures, etc.).

For example, the reception number 151 is 0092875123 as the serial number (corresponding to the serial number of the user computer 100), and the user computer 100 name is Hong Gil-dong, and the MAC address. Is 00-11-08-9A-51-7F, the manufacturer (corresponding to supplier) is COMPAQ, the forwarding IP address is 10.10.23.2, the destination IP address is 211.60.28.30, and the transmission time is 08 / 24/00 (August 24, 2000), 17:00:23 (5:23 pm), and the reception time is 08/24/00 (August 24, 2000), 20:29:06 ( 8: 29: 6 pm).

Here, the destination IP address is different from the destination IP address, where the destination IP address is a virtual IP address, and the destination IP address corresponds to a real IP address (a floating IP address or a static IP address).

The manager server 105 can use the destination IP address (actual IP address) to track the place and user corresponding to the sending IP address (virtual IP address).

In other words, assume that a server named A has a real IP address (211.60.28.30) and assigns a virtual IP address of 10.10.23.2 to a computer used by user Hong Gil-dong. Here, server A stores a record of when, to whom, and what virtual IP address was assigned.

When a user named Hong Gil-dong connects to a specific web site using the assigned virtual IP address, the virtual IP address 10.10.23.2 assigned to the user computer 100 includes the actual IP address (211.60.28.30). An IP address assignment server converts the actual IP address and then asks the data for that particular Web site.

Subsequently, when the user computer 100 receives data requested by Hong Gil-dong, a user from a specific website, the real IP address 211.60.28.30 and the virtual IP address 10.10.23.2 are received. .

At this time, the theft control module installed in the user computer 100 detects the IP address (including the actual / virtual IP address) and transmits it to the manager server 105.

Then, the manager server 105 registers a value corresponding to the virtual IP address in the transmission IP and the actual IP address in the destination IP.

In this case, the transmission time is the time when the corresponding information is transmitted from the user computer 100 to the manager server 105, and the reception time is the time when the manager server 105 receives the information transmitted from the user computer 100.

Preferably, the time information is stored in the user computer 100, the server having the actual IP address (211.60.28.30), the time information when the user connected to the Internet, respectively, and the stored time information is stored in the administrator server ( 105).

Of course, the manager server 105 checks and stores time information separately from the transmitted time information.

7 is a diagram illustrating a screen on which geographic information is output according to an exemplary embodiment of the present invention.

Referring to FIG. 7, the tracking service screen 700 retrieves geographic information based on a geographic information system using the detected IP address. For example, if the IP address is 168.126.197.21, the geography corresponding to the IP address is determined. Information can be Yonsei University (specific lecture hall).

In addition, it is possible to track illegal users and stolen computers by utilizing various information (see FIG. 6) of the user computer 100 using the IP address in the university.

The present invention is not limited to the above embodiments, and many variations are possible by those skilled in the art within the spirit of the present invention.

By installing theft tracking software on a computer in accordance with the present invention, it is possible to have a theft warning function, which can prevent theft of the computer from originating from theft of the computer.

The stolen computer can be recovered through the location tracking and remote control of the stolen computer by protecting the stored data and tracking the location of the stolen computer.

In addition, by installing a semi-permanent software, such as the anti-theft program to the computer, it is possible to significantly reduce the cost than to apply the physical device to prevent theft.

In addition, by remotely controlling the stolen computer, it is possible to guarantee the confidentiality and the safety of the data by backing up or deleting important data.

In addition, when confirming whether the computer has been stolen, the fact that theft is automatically sent to the police and insurance companies, etc., may increase the recovery rate of the stolen computer.

In addition, the buyer of the computer can give a sense of stability and confidence to the computer to which the anti-theft function is added, the seller can increase the sales rate based on this stability and confidence.

In addition, by reporting various information related to theft and providing it to related agencies such as police and insurance companies, it is possible to prepare a countermeasure against a theft event which will be generated later.

Claims (33)

A system for preventing theft of a computer and recovering a stolen computer using a communication network, the system comprising: An anti-theft control module installed in a user computer to detect and transmit at least one of hardware information and an IP address; And Receiving at least one of the hardware information, the IP address from the user computer and if the theft of the user computer is confirmed through the application of a predetermined method, the administrator server for performing a remote control and location tracking service for the user computer But The anti-theft control module detects the hardware information according to the power input signal of the user, detects the IP address when the user accesses the network, receives a pre-designated session key for a remote control service from the administrator server, and provides a protocol. Changing to a secure state Anti-theft system through location tracking and remote control, characterized in that. In the method for transmitting computer information to the administrator server by theft control module installed in the user computer, Detecting at least one of hardware information and an IP address and transmitting the same to the manager server; Receiving a remote control service request according to the theft determination of an administrator server based on a change of at least one of the transmitted hardware information and the IP address; Performing a corresponding service corresponding to the received remote control service request; Transmitting the performed service result to the manager server; Method of preventing theft through location tracking and remote control, comprising a. The method of claim 2, The detection of the hardware information is repeatedly performed at predetermined time intervals until a network connection is made by a user. Theft prevention method through location tracking and remote control, characterized in that. The method of claim 3, The detected hardware information is continuously stored with the detected time until the network connection by the user is established. Theft prevention method through location tracking and remote control, characterized in that. The method of claim 2, The IP address is detected when the user connects to the network. Theft prevention method through location tracking and remote control, characterized in that. The method of claim 3, The predetermined time interval is selected by the user Theft prevention method through location tracking and remote control, characterized in that. The method of claim 2, The hardware information is at least one of a computer manufacturer, computer serial number, LAN card number, user name, transmission time, Mac address, hard disk number, memory number, CPU, video card, SCSI card Theft prevention method through location tracking and remote control, characterized in that. The method of claim 2, Receiving the remote control service request Receiving a session key from an administrator server; Changing to a protocol security state based on the received session key Theft prevention method through location tracking and remote control, characterized in that it further comprises. The method of claim 2, The step of transmitting the performed service result to the manager server Further including key log information of illegal users Theft prevention method through location tracking and remote control, characterized in that. The method of claim 9, The key log information is at least one of a use time of an input / output device by an illegal user, a command executed, a start time and an end time. Theft prevention method through location tracking and remote control, characterized in that. The method of claim 2, Wherein the detected IP address is at least one of a virtual IP address, a floating IP address, and a static IP address Theft prevention method through location tracking and remote control, characterized in that. In performing computer remote control and location tracking service using a communication network, Receiving at least one of hardware information and an IP address from a user computer to determine whether the theft is compared with a preset theft control condition; If it is determined that theft is determined, generating a session key for the authentication request and transmitting the session key to the user computer; Requesting a predetermined remote control service when authentication information according to the transmission is received; Receiving a remote control service result according to the request Method of preventing theft through location tracking and remote control, comprising a. The method of claim 12, The anti-theft method through the location tracking and remote control further comprises a location tracking service for detecting at least one of location information, geographic information using the received IP address. Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, The detected IP address is at least one of a virtual IP address, a floating IP address, and a static IP address Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, The user computer and the manager server is connected using at least one of a wired communication network, a wireless communication network Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, The hardware information is at least one of a computer manufacturer, computer serial number, LAN card number, user name, transmission time, Mac address, hard disk number, memory number, CPU, video card, SCSI card Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, The theft control condition is stolen when the computer manufacturer, computer serial number, LAN card number, user name, transmission time, Mac address, hard disk number, memory number, CPU, video card, SCSI card, IP address at least one change To judge Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, The theft control condition is preset by the user Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, The remote control service includes at least one of data deletion, data backup, and data unavailability Theft prevention method through location tracking and remote control, characterized in that. The method of claim 12, Theft prevention method through the location tracking and remote control After determining that the user's computer is stolen, transmitting the fact that the user's computer is stolen to at least one of an insurance company and a police officer using at least one of an email, a voice message, and a text message. Theft prevention method through location tracking and remote control, characterized in that it further comprises. The method of claim 11, Theft prevention method through the location tracking and remote control Receiving key log information of an illegal user using the user computer Theft prevention method through location tracking and remote control, characterized in that it further comprises. In the method of determining whether the computer is stolen using a communication network, Receiving at least one of hardware information and an IP address from a user computer; Comparing at least one of the received hardware information and the IP address with a preset theft control condition to determine whether the theft Theft determination method of a computer comprising a. The method of claim 22, The hardware information is at least one of a computer manufacturer, computer serial number, LAN card number, user name, transmission time, Mac address, hard disk number, memory number, CPU, video card, SCSI card Theft judgment method of the computer, characterized in that. The method of claim 22, Determination of whether the user's computer is stolen is based on a condition preset by the user Theft prevention method through location tracking and remote control, characterized in that. The method of claim 24, The preset condition is stolen when at least one of a computer manufacturer, a computer serial number, a LAN card number, a user name, a transmission time, a Mac address, a hard disk number, a memory number, an IP address, a CPU, a video card, and a SCSI card is changed. To judge Theft prevention method through location tracking and remote control, characterized in that. A memory in which a program is stored; A processor coupled to the memory to execute the program Including but not limited to: The processor by the program, In transmitting the computer information to the administrator server by theft control module installed in the user's computer, Detecting at least one of hardware information and an IP address and transmitting the same to the manager server; Receiving a remote control service request according to the theft determination of an administrator server based on a change of at least one of the transmitted hardware information and the IP address; Performing a corresponding service corresponding to the received remote control service request; Transmitting the performed service result to the manager server; Anti-theft device via a location tracking and remote control, characterized in that for executing. In the system for transmitting computer information to the administrator server by theft control module installed in the user computer, Means for detecting at least one of hardware information and an IP address and transmitting it to the manager server; Means for receiving a remote control service request according to a stolen determination decision of an administrator server based on a change of at least one of the transmitted hardware information and the IP address; Means for performing a corresponding service corresponding to the received remote control service request Provided with The means for transmitting further transmits the performed service result to the manager server. Anti-theft system through location tracking and remote control, comprising a. In order to perform a method of transmitting computer information to an administrator server by a theft control module installed in a user's computer, a program of instructions that can be executed by the digital processing device is tangibly embodied and can be read by the digital processing device. To Detecting at least one of hardware information and an IP address and transmitting the same to the manager server; Receiving a remote control service request according to the theft determination of an administrator server based on a change of at least one of the transmitted hardware information and the IP address; Performing a corresponding service corresponding to the received remote control service request; Transmitting the performed service result to the manager server; Recording medium comprising a. A memory in which a program is stored; A processor coupled to the memory to execute the program Including but not limited to: The processor by the program, In performing computer remote control and location tracking service using a communication network, Receiving at least one of hardware information and an IP address from a user computer to determine whether the theft is compared with a preset theft control condition; If it is determined that theft is determined, generating a session key for the authentication request and transmitting the session key to the user computer; Requesting a predetermined remote control service when authentication information according to the transmission is received; Receiving a remote control service result according to the request Anti-theft device via a location tracking and remote control, characterized in that for executing. In performing computer remote control and location tracking service using a communication network, Means for receiving at least one of hardware information and an IP address from a user computer to determine whether theft is compared with a preset theft control condition; Means for generating a session key for the authentication request and transmitting it to the user computer when it is determined that theft is determined as the result of the determination; Means for requesting a predetermined remote control service when authentication information according to the transmission is received; Means for receiving a remote control service result according to the request Anti-theft system through location tracking and remote control, comprising a. A recording medium tangibly embodied in a program that can be executed by a digital processing device to perform a method of performing a computer remote control and a location tracking service using a communication network, wherein the recording medium can be read by the digital processing device. Receiving at least one of hardware information and an IP address from a user computer to determine whether the theft is compared with a preset theft control condition; If it is determined that theft is determined, generating a session key for the authentication request and transmitting the session key to the user computer; Requesting a predetermined remote control service when authentication information according to the transmission is received; Receiving a remote control service result according to the request Recording medium comprising a. Receiving at least one of hardware information and an IP address from a user computer coupled to a communication network, and determining whether theft is compared with a preset theft control condition; If the user computer is stolen, performing a remote control service and a location tracking service on the user computer; Method of preventing theft through location tracking and remote control, comprising a. Means for receiving at least one of hardware information and an IP address from a user computer coupled to a communication network and determining whether theft is compared with a preset theft control condition; Means for performing a remote control service and a location tracking service for the user computer if the user computer is stolen as a result of the determination; Anti-theft system through location tracking and remote control, comprising a.