NO20190041A1 - System for responding to an alarm - Google Patents

Description

BACKGROUND

Technical area

[0001] The present invention relates to a system for reacting to an alarm, where the system has a user terminal capable of sending an alarm message to a system server.

Known technique

[0002] 'Security' includes 'personal security' and 'information security'. For example, an assistance center wants to help an elderly person who has fallen on the floor at home as quickly as possible, but does not want to monitor the elderly person continuously for reasons of privacy. The help center solves this by equipping the user with a 'safety alarm' to hang around the neck. The security alarm has a physical push button and a function to send an alarm signal to an emergency center so that he or she can notify if necessary, in this example after a fall. The help center otherwise does not monitor the person. It is generally important to prevent unauthorized persons from gaining access to sensitive data, for example home addresses of the help center's users.

[0003] In a violence alarm system, a person can be equipped with a similar alarm unit. In this example, it is not desirable to record where the user is at all times, only where he or she is when the alarm is triggered. In violence and robbery alarm systems, there is a general need for a hidden trigger which makes it difficult to detect that an alarm is being triggered.

[0004] Employees in certain organizations may be exposed to threats from frustrated clients, and employees with access to money or drugs may be exposed to robbery attempts. In banking premises, the need for a hidden trigger is traditionally covered by an alarm button hidden under a table top or similar. Such an alarm button is missing in most other premises. An employee on a trip or assignment may also be exposed to threats or attempted robberies, and consequently need to trigger an alarm, as in the example with a general violence alarm.

[0005] There is a general need for a system with a user who can trigger an alarm, responders who assist the user in an alarm situation and a central. The center can represent an employee's guardian in the organisation. In this document, 'system' is the same as 'information system', and the user, the responder and the switchboard are roles in a system to respond to an alarm.

[0006] The respondent represents a group with one or more people, for example a home help, colleagues who can assist an employee in the office or on travel, security guards, etc.

[0007] An help or call center coordinates resources and alerts responders close to the user to provide the fastest possible help. The center also contacts external resources when necessary, for example an ambulance or the police. A senior employee in an organization with potentially threatening clients has a similar function. The help center and the call center can be represented by an organization with employees.

[0008] A system for responding to an alarm contains a database application with the role 'user'. A corresponding user exists in all systems where a person logs in with a username and password. For reasons of readability, we do not strictly distinguish between person and role in what follows

[0009] US-2008/0284587 describes a system for managing personal security, where a mobile user terminal initiates and sends an alarm signal to a network in an emergency situation.

[0010] US-2008/0189162 A1 describes a web- and telephone-based crisis management system with integrated processes, communication devices and services, as well as a company database with relevant information. The system serves an organization's first responders, crisis management teams and other internal and external stakeholders.

[0011] A general client-server system has a server and a client that use services from each operating system to receive a message from a network, store files on disk, etc. The layer above the operating system is called an 'application layer', and messages between a server and a client in the application layer are transmitted in a corresponding application layer on a network. This can be SMS messages over a mobile network or e-mail messages over the internet.

[0012] A web server on a central computer is in the application layer, and a browser on a PC is a client in the same application layer. A database application on the central machine can exchange data with the web server so that a user or database administrator can access the database through a web interface in a browser. Some client-server systems have their own client applications that work in the same way as a web browser. A person can interact with the system through a graphical user interface (GUI) with on-screen buttons, menus and fields for entering data. Different client-server systems have different combinations of GUI in a browser, GUI in a separate 'app', screenshots from the server to the internet through a web interface and to large screens in a control room through a local interface.

[0013] We use here and in the following the word 'server' in the sense of 'service provider', not in the sense of 'central computer'. A 'system client' is software in the application layer, not a person. We call the latter 'potential aggressor' to avoid any misunderstandings. A 'terminal' is an end point in a network, not a device with a large screen in the exchange. For brevity, we use the expressions 'data online' for 'data in the application layer' and 'data on disk' for 'data in a database or file in a file system'. 'User data' is data associated with a user.

[0014] In the following, a personal computer or PC ('personal computer') is a computer with a personal OS user. This includes a smartphone, a tablet and other mobile or desktop computers. For reasons of readability and understanding, we use the terms interchangeably, but the common feature is 'personal'.

[0015] The security alarm in a previous example is a terminal in a network, and in addition a user terminal because it is personal. A smartphone has a unique IP address in the internet and a unique telephone number in a telecommunications network, including mobile phone networks. It is a terminal in several networks, and a user terminal if it is personal to a user in the system to respond to an alarm. The central computer is a terminal in the Internet because it has a unique IP address. In an information system with a telecommunications network, a person can be identified with a personal telephone number, e.g. a mobile number, and the control room with a switchboard number.

[0016] A user terminal has characteristics that are typical for the device in question. For example, the user can make calls and send SMS from a mobile phone or smartphone, but the phone does not necessarily have a client application with a GUI. A PC has a single-user operating system and a file system, and usually a web browser. A smartphone has a limited battery capacity and small screen, and therefore a different operating system, browser and web interface than corresponding software in a PC in the office. A smartphone can find its GPS coordinates and send them by SMS or e-mail to a system server, etc.

[0017] In addition to the general features above, the system proposed here has a user with user data, more specifically sound, image and position data online or on disk. 'Data on the Internet' are messages, calls, video streams, etc. that are transmitted through a telecommunications or data network. 'Data on disk' is data in a database or file. Data on 'network and disk' means in this document the same as 'data in real time and afterwards'.

[0018] A user is here a person who can trigger an alarm, and the organization may need to store an audio file with the conversation for later documentation, for example to clarify what was said by the user and personnel in the control room after a triggered alarm .

[0019] Correspondingly, the organization may wish to document an unwanted event after an employee has triggered an alarm. 'Authorisation' is related to 'need to know', and people in the control room may have a different authorization than a case manager. A group of people does not need to know what is happening in a confidential meeting, but is 'authorised for' a video recording if something dramatic happens or if the user triggers an alarm.

[0020] As in other alarm systems, there is a general need to silence a false alarm. In the organisation's access control system, this is done by the person who inadvertently triggered the alarm calling a monitoring center and entering a code word. In a digital system, the person enters a password or similar.

[0021] An employee traveling would like help from colleagues as soon as possible if she triggers an alarm, but would not want to be continuously monitored. For example, GPS data from the user's and colleagues' smartphones can show the employees' positions, and a digital system can send a message to nearby colleagues so that the user gets help as quickly as possible. However, the employees suspect that a curious person in a control room has unauthorized access to their positions in real time or after the fact, and therefore turn off GPS location for periods both while they are on assignment and while they are on a city trip after work. In this example, the digital system will not work as intended.

[0022] Positional data or locations are not limited to GPS data. GPS data is, for example, useless in an office building with several floors. The need for quick help for a user who triggers an alarm in the meeting room is the same as before. In this example, the system knows that the user is in the meeting room and can locate colleagues nearby using Bluetooth beacons. Beacons and equipment with a similar function are commercial goods that do not need a technical explanation here.

[0023] People in the control room need different screens and other functions than the individual user, for example a list of users, overview map, etc. A crisis management team may need to notify or check employees traveling in an area after an earthquake, a tsunami or a hurricane warning, You don't know what might happen, but know that it is useful to know approximately where employees are traveling to be able to assist in case something happens.

[0024] Organizations as described above have a general need to practice crisis situations in the broadest sense. In the help center the purpose may be to identify possible improvements in communication with home helpers and/or an ambulance service under general cost/benefit conditions. In another organization, the purpose may be to train a crisis management team so that all members of the team know their tasks when an unwanted event occurs. Since you cannot know what will happen, it should be possible to practice different scenarios. Cost/utility prohibits many scenarios with real people in the roles of 'user', here a person who can trigger an alarm, a 'first responder' who comes to the user's aid, etc. In this example, people are only needed for roles in the crisis management team.

[0025] Limited to digital information systems, there is a general need for a simulation system that can generate different scenarios for different organizations in a cost-effective way, especially without people in all roles in a scenario.

[0026] User, responders, control rooms, etc. are 'entities' in a system for responding to an alarm. Some general definitions and concepts related to the environment around the system are useful before we continue with the description of needs and problems in the alarm system.

[0027] A system owner in an organization 'owns' an information system, for example the alarm system here or another database application. She is part of the organization, not of the underlying system. The system owner decides on the use of the system, and knows all requirements for the system, including requirements from the organization and external authorities.

[0028] The system owner in a local network can be compared to the person Alice, who is the system owner of one or more personal computers. Alice's employer requires that disks on mobile devices be encrypted in case the device is lost or stolen. The person Alice meets these requirements by encrypting files and file systems in her smartphone and laptop. An operating system in each machine has the actual encryption and decryption functions. The OS hides cryptographic keys from everyone but OS user Alice, so that only OS user Alice can decrypt files and file systems. The person Alice is not a role in an operating system.

[0029] The following sections give some examples of external needs, requirements and rules that may mean something for a system that must safeguard privacy and digital information security [0030] Privacy. EU directive 2016/679 General Data Protection Directive (GDPR) sets requirements for proper storage of personal data, and is an example of a regional regulation. An organization in a European country can be fined for violating European rules, including privacy rules.

[0031] Need for documentation. National health authorities can require the help center to keep certain information for a certain period of time, typically a few years. Other authorities may make similar storage requirements for reasons of traceability.

[0032] Commercial and other external considerations. A company will lose customers and reputation if the public suspects that the company's employees are using webcams in customers' homes for peeping. It is an advantage for the company if the employees cannot be suspected of using cameras for real-time peeping, eavesdropping on audio files on disk, etc.

[0033] Internal security policy. This takes account of privacy regulations, laws and other external requirements, and adds its own. The organization typically has several grades or levels of confidentiality, but does not necessarily have a formal policy document. A role trusted for one level can 'read' information at the same level or lower. For example, a department manager has 'access to' information about employees in the department, but the employees do not have access to all information at department level. The system owner can prohibit audio and video recording of meetings at level 'Confidential', e.g. a business meeting, and allow recording of meetings at level 'Ungraded'.

Authorization, need to know, comes in addition. The head of department is not authorized for all confidential information just because he is head of department. All Unix and Windows-like systems follow a mathematical version of this model, a 'Bell-LaPadula' (BLP) model. We will return to this, but mention here that an OS administrator can have unauthorized access to an audio or image file. He or she can thus be suspected of eavesdropping.

[0034] Cost/benefit. In this context, there is a particular need to secure digital information sufficiently to prevent unauthorized access, and at the same time use the least possible resources to achieve the necessary information security.

[0035] The system owner knows the specific requirements that are set, and applies them to the extent that they matter for a system to react to an alarm. Requirements from the organization and external authorities need no further explanation here.

[0036] In this document, we use 'adversary' for a threat to information security, while an 'aggressor' threatens personal security or property. The information value generally increases with the amount of data. For example, there are greater chances of finding 'useful' information in a collection of audio files on disk than in one conversation in real time. An adversary will generally use greater resources to gain access to larger amounts of data, but there are viruses and other malicious programs that obtain and/or change information without consideration of economic value.

[0037] A 'Mallory' is used to summarize several of the needs for the protection of information, so that the system owner only needs to deal with one adversary. Mallory can represent a curious person or hacker, an online criminal group and/or malware. Suspect and motive have no meaning in this context.

[0038] 'Security' has the aspects of 'confidentiality', 'integrity' and 'availability'.

Confidentiality generally means preventing unauthorized 'reading' in the broadest sense. In telecommunications networks, the term 'eavesdropping' is used for traditional reasons. Since the alarm system here lies over a computer network and a telecommunications network, we use 'reading', 'eavesdropping' etc. interchangeably. The meaning will be apparent from the context. Unauthorized 'reading' here involves the use of software to view the content of an audio or image file, etc. without authorization. Integrity primarily means preventing unauthorized changes to data. 'Unauthorized access' is the same as unauthorized reading and modification of data.

[0039] Within digital information security, confidentiality is ensured with encryption. A 'symmetric' key is used for both encryption and decryption, and must therefore be kept secret at all times. An asymmetric key pair consists of a private and a public key, and has the property that data encrypted with the public key can only be decrypted with the private key. Asymmetric keys were developed by the British GCHQ to reduce the cost of protecting a large number of symmetric keys in a headquarters, and the cost of distributing symmetric keys by courier to a large number of foreign stations and military departments.

[0040] Integrity can similarly be secured with a 'cryptographic checksum' called a hash. The hash is created using a cryptographic hash key, and changes a lot if the content of a message or file changes slightly. It can be faster to calculate a hash and compare with a hash from the web or disk than to compare two data sets byte by byte. The verb 'to hash' or 'hashing' means to calculate a 'cryptographic checksum' of a data amount in a message or file, and then 'store' the hash in an associated message or file.

[0041] Secure connections on the internet, for example to and from an HTTPS server, use asymmetric key pairs for encryption, and hashing to detect if a man-in-the-middle changes data en route to the network. If the man-in-the-middle is detected, he is 'stopped' by countermeasures.

[0042] Secure connections on the internet use TLS ('transport layer security') in a transport layer below the application layer. Keys used for disk encryption reside in an operating system below the layer with the server and client applications. Modern operating systems use hashing and other techniques to shut down or refuse to start processes when modification is attempted. Server and client in the application layer do not have access to keys in layers below the application layer.

[0043] It is generally an advantage to build security into the design phase of a digital system. For example, the need for anti-virus programs is eliminated if the operating system makes it impossible for viruses and other malware to read or modify digital data.

[0044] Integrity also includes 'authentication'. A document can be authenticated with a digital signature, which requires a personal certificate. In a system with username and password, a person is 'authenticated' when logging in. One-step authentication involves something the person can or has, such as a password or a magnetic card to swipe through a reader. Multi-step authentication involves something the person can and something the person has, and is used if data in the system is of high value. For example, an online bank may have three-step authentication with a password, a smart card and a PIN code. A smart card reader can be connected to a PC, for example with a USB cable.

[0045] 'Availability' generally means that information is available when it is needed. This includes backup solutions, such as backup equipment and alternative paths through a network. Such equipment is irrelevant to the alarm system here. Backup copies of data ('backup') can be important. Backup data usually includes several generations of 'offsite backup', which by definition must be stored outside the operating premises in case something happens.

[0046] Security must be balanced against user functionality, requirements from authorities and other considerations. In the following, security is relevant when it concerns a system for responding to an alarm.

[0047] An organization has a 'secure area' where unauthorized persons have no access, and information on paper and digital media can be stored and processed without risk of access. In the examples below, the secure area contains a meeting room and the offices of Alice and Bob. Limited to digital information security, the 'secure area' is a local area network where employees can store and process documents and other data in file systems depending on their administrative privileges. This simplifies data processing, and is an example of 'user functionality' in the broadest sense. Firewalls and similar equipment to isolate the local network from public networks are important for the organisation, but need no further explanation here.

[0048] The system owner must deal with data online and on disk in and outside the secure area. On the Internet, TLS is secured against adversaries with state-level resources. Public telecommunications networks are in principle secured against eavesdroppers with resources at state level. Data on disk outside the secure area may require additional protection, for example because government security authorities may require a supplier to hand over cryptographic keys 'in the interests of national security'. Whether this actually happens is of no interest from a security perspective. On a local network, single messages have little value. Data on disk in the local network has greater information value, and is therefore more susceptible to attacks from an adversary, a 'Mallory in the local network'.

[0049] The organization processes confidential papers 'carefully' regardless of which persons work or are visiting in a secure area during office hours, and regardless of shell security with locked doors, access cards and the like around the secure area. Confidential papers can routinely be locked in a security cabinet without regard to who an intruder is or how he entered the secure area. There is always a risk of a security breach, for example an employee forgetting confidential papers on the desk without supervision.

[0050] In the local area network, there is a corresponding need to protect information regardless of which employees or IT consultants have access to central computers, and regardless of firewalls and the like. Confidential information is well protected in modern operating and database systems regardless of who an adversary is or how she got into a secure area. There is always a risk of a security breach, for example that some anti-virus or other programs lack the latest security updates, or that an employee clicks on a toxic link despite a general prohibition.

[0051] Malicious software can spread from a multi-user machine to a PC and vice versa, but general anti-virus measures presumably prevent widespread spread. We are particularly interested in central machines in the local network, and assume that the users have PCs.

[0052] Assume that Mallory in the local network represents a rogue OS administrator, a hacker, and a malware. Mallory wants to read and modify all files. She has root access to all file systems in all central machines in the local network because a rogue administrator or hacker may have had or may gain root access to a central machine in the past or future. She has the skills of a skilled OS administrator for the same reason. Mallory takes cost/benefit into account in that it is an additional cost to break into a database or an additional operating system in a PC, but she does not take particular account of economic value. A spyware or malware does not necessarily have financial motives. Mallory can be stopped if she is detected, for example by an updated anti-virus program or by countermeasures if a calculated hash does not match an on-disk hash. Mallory is not detected in a system log because she never logs on.

[0053] By root access we mean access to the top user in an operating system and top level in a file system. In a Unix-like system, this is 'root' and '/'. Windows-like systems have a corresponding top user in the operating system and one or more top levels in the file system. A person with root access can read and modify all files, including system files. In a PC, the top user in the operating system is usually hidden from the OS user to avoid accidental damage.

[0054] The BLP model was originally published in 1973, and is formally uncertain for mathematical reasons. However, it is 'user friendly' for most organisations. Newer operating systems are 'hardened' against attacks with other techniques, for example with hashing as described in an earlier example. However, the 'hardening' only applies to one machine, and the local network contains several central machines. A modern database system at organizational level usually uses mathematical models other than BLP.

[0055] For example, RBAC, 'role based access control', is a mathematical model where 'role' has a different definition and function than a 'role' with grading and authorization in a BLP model. RBAC and other security models make enterprise-level database systems generally less vulnerable to attack than Unix- and Windows-like operating and file systems. A database system with a newer security model than BLP can be compared to a security cabinet in the office premises. It takes extra effort to break in. Database systems as such are outside the scope of the present invention.

[0056] The system owner presumably considers cost/benefit, for example the price of a database system with a built-in security model, e.g. RBAC, at organizational level against the utility value of a reliable system to react to an alarm.

[0057] Mallory in the local area network can be compared to an intruder in the office premises. The intruder will consider whether it is worth the effort to break into the security cabinet or locked offices where there is little likelihood of finding anything he might be interested in.

The intruder is not detected in an access control system because he slips in behind an employee or breaks open a door, but he can be stopped if he is detected.

[0058] The system owner has a general need to secure against attacks from Mallory because Mallory represents several adversaries regardless of suspect and motive. In this document, Mallory attacks file systems on the local network. If Mallory does not have access to a file, then a real person or OS user does not have access, regardless of what administrative privileges the OS user has on a file system. Mallory implicitly exempts organization and employees from suspicion.

In summary, the system owner needs to secure the system against Mallory in the local network. Mallory is an attacker outside the alarm system.

[0059] In the alarm system, there is a need to archive relevant data, for example an audio or video recording for the sake of documentation. For the alarm system, it is immaterial whether the need for archives is due to a law, the organisation's desire for recording in the event of an inspection, a case manager's need for notes or something else. 'Suspect and motive' is immaterial.

[0060] It is an advantage to be able to document the time and place of the recording, and that the corresponding sound or image files have not been changed while on disk.

[0061] Relevant data cannot depend on an alarm being triggered. A person can call the help desk and ask for help without first triggering an alarm. An aggressor can prevent an employee in the meeting room or traveling from being sent an alarm. A person at home, in the office or on a trip can call from a borrowed mobile phone, so the system should be able to identify the user without a pre-registered user terminal.

[0062] Many recordings are of no interest to posterity, and only incur costs for storage and security. There is a general need to delete redundant data as quickly as possible.

[0063] In comparison, a normal CCT system stores all video recordings for a fixed period, for example one month. All recordings are deleted or overwritten as soon as they are one month old. This fulfills neither the need for archiving nor the need for quick deletion.

[0064] It is generally desirable to automate archiving and deletion. Manual review of all recordings is expensive. A realistic server process has a risk of deleting relevant data too early and redundant data too late. It is desirable to reduce this risk.

[0065] In particular, some privacy regulations require that certain personal data be deleted upon request. If irrelevant user data is stored in a backup copy, an offsite backup or an archive, it may be problematic to comply with this requirement.

[0066] The aspect 'availability' here means that an alarm should be able to be triggered even if a user terminal is switched off or loses the ability to communicate. An application on a mobile device may become unavailable even if it is otherwise possible to communicate with the device. The reason is that some mobile device operating systems shut down applications in priority order as the battery's charge level drops below certain threshold values.

[0067] The purpose of the present invention is to provide an improved system for responding to an alarm. The system must take particular account of personal safety, privacy and digital information security. In general, the system must solve or reduce at least one of the above problems while retaining features and advantages from prior art.

SUMMARY

[0068] This is achieved with a system according to claim 1. Preferred embodiments are indicated in the independent claims. In the requirements, we follow the convention that the articles 'one', 'et' mean at least one or at least one, while the numerals one, one mean exactly one or one.

[0069] More specifically, the invention relates to a system for reacting to an alarm, with a system client, a system server with a database, and a message between the system client and the system server in an application layer. The system is characterized by a system function and a reaction with at least one system function; an intermediate storage in a local area network with file systems where system functions in the system server have read and write access, and a user status, at least one of which is an alarm status. The system has at least one user, where each user has a unique asymmetric cryptographic key pair with one public key and one private key, as well as a personal object where the user's private key is hidden. The system functions include a recording function with sub-functions to obtain user data from a group consisting of sound, image, document and position data. An encryption function has subfunctions to encrypt and decrypt a user's user data with the user's asymmetric key pair. A storage function has subfunctions to store user data in the database or buffer. User data encrypted with the user's public key can thus only be decrypted by an encryption function with read access to the user's private key.

[0070] It is understood from the introduction that the message can be an SMS or e-mail, and that both the server and the client side have functions or processes for sending and receiving such messages.

[0071] A reaction is composed of one or more system functions, for example Notifying one or more responders with a situational pre-stored message and Marking a user on a system console.

[0072] The buffer is the subset of file systems in the local network that contain unencrypted and encrypted user data, where the system server has read and write access. The intermediate storage is not a separate physical unit. The file systems in the intermediate storage can be accessed on the same machine as the system server or through a file server in the local network. The buffer stores user data for a suitable period, for example a few days so that users can download encrypted files for notes and people in a control room can mark a file for archiving if the user cannot, does not want or dares to trigger an alarm. Later, we use 'remote storage' for corresponding file systems with backup data outside the secure area.

[0073] A database system is generally suitable for containing short data elements such as personal names, residential addresses, file names and location data. Longer data elements such as audio, image and document data may fit better in a file system in the intermediate storage.

[0074] A user status in the system is linked to a reaction. The system can have several alarm statuses, where each alarm status triggers an alarm reaction. An employee in the office or traveling requires two different alarm reactions depending on the situation.

[0075] User data includes sound, image, document and position data, Recording equipment for sound and image is respectively a microphone and a camera. By document data we mean files from a typical office application, e.g. a word processing document, a spreadsheet, etc. Position data can be obtained from a GPS function in a smartphone, from Bluetooth beacons, etc.

[0076] The keys must prevent an unauthorized person from being able to read the contents of an encrypted file using normal software. They 'are in the application layer'. The personal item can be one or more of the user's PCs, a smart card or a memory stick with a USB connector. Some memory sticks do not work without the user's fingerprint. Items without an electrical connection to a networked computer cannot be read by Mallory under any circumstances. In other contexts in the field of digital information security, this is called an 'air gap'.

[0077] User data encrypted with the user's public key can only be decrypted with the private key in the key pair. The encryption function can be run in a server application and/or in a client application on a PC or in a computer in the meeting room.

[0078] The system server has access to all public keys. Server encryption with a public key guarantees that no unauthorized person, here people without access to the private key in the key pair, can read data on disk. Client encryption with the public key guarantees that unauthorized persons, e.g. people in the control room, cannot read data online or on the disk. Similarly for an OS administrator. Without access, no one can be suspected of eavesdropping.

[0079] The user will decrypt after a real alarm, thus making the file readable by a limited group of authorized persons. An unauthorized manager or OS administrator does not see the content, and is thus also exempt from suspicion of eavesdropping.

[0080] Mallory has access to all keys in all file systems in the local network. She has no use for public keys because they cannot decrypt. It requires too much effort to break into many PCs, for example due to the high probability of updated anti-virus programs. The system is thus secured against Mallory as long as no private keys are located in a file system in the local network. It is the system owner's responsibility to ensure that no one stores private data in the local network for 'practical' or other reasons. This can be done with a routine search for system-specific key names.

[0081] Preferred embodiments have a hashing function and a hash key that combines the user's private and public key. The hash key should be unique to the user to document ownership of user data. Mallory has access to all public keys and can forge a hash. The hash key can therefore, for example, be the user's private key encrypted with the public key. No unauthorized person can decrypt using the public key, so the private key remains private while the hash key is unique to the user. Such a hash key can be sent securely over the Internet, but becomes public if it is stored in a file system on the local network.

[0082] In preferred embodiments, the system client has at least one user message, where each user message in the system client corresponds to a user status and a reaction in the system server.

[0083] Some messages, for example with GPS data or low battery level, can be sent from the system client without a person participating. Other messages can be sent using a GUI. A computer with a web camera in the meeting room does not need a GUI or multiple messages to encrypt a video stream to the intermediate storage, but it advantageously has a process for receiving the user's public key for use in the encryption.

[0084] Preferred embodiments with a message sent from the user have a corresponding 'quit' message which cancels the corresponding status of the user in the system server. This is particularly useful for ending user-defined periods. The user message can alternatively contain a time period, and then does not need a 'quit' message sent from the system client.

[0085] Some 'quit' messages require additional authentication by a person. For example, silencing a 'false' or accidental alarm in a digital system may require the user to enter a password in a GUI. Two-step personal authentication should preferably include something the person has and something the person can do. A variant used in other systems is to send a one-time code by SMS to a person's mobile phone, and require the person to enter the one-time code in a GUI. The alarm system here can use this and other known techniques for multi-step personal authentication.

[0086] In preferred embodiments, one of the user messages is a 'delayed alarm' message with a delay period. The system server's reaction is performed at the end of the delay period, unless the user changes the time for performing an associated reaction.

[0087] Preferred embodiments have a user-sent recording message, where the reaction is to activate the recording function for recording equipment close to the user. A recording of a telephone conversation does not require prior notification. User-triggered recording ensures against inappropriate monitoring, and thus safeguards the user's privacy. The user can end the recording period using the system client's GUI, for example with a screen button 'exit' or similar. A user-controlled recording period reduces the amount of redundant data on disk.

[0088] Preferred embodiments have a user sent standby message that leads to heightened attention from the system server. This reduces the response time in the event of an Alarm.

[0089] The delay period, the standby period, and the recording period are three separate periods that may, but may not, overlap.

[0090] Preferred embodiments further have a status for user data that overrides an automatic deletion function for data on disk. This status can be 'Archived' or 'For later use' and applies to user data, not the user. User data without such a status can be deleted after a period in the intermediate storage or database, for example after a few days. This period gives a person in the control room the opportunity to archive user data without a pre-sent alarm message.

[0091] In preferred embodiments, cancellation of some system functions may require additional authentication by the person requesting the cancellation. This may mean that Alice has to log in with a password to silence an alarm or delete a video file from disk, it is not always enough that she has a user terminal.

[0092] In some embodiments, the system server has a function to collate location data in a predetermined sequence with actual location data received from the system client. The sequence can represent a planned journey, a mission or an evening trip, and it can contain times or time intervals. Deviations can, for example, trigger a standby state and a message to the user to confirm that everything is OK. Failure to respond can here trigger an alarm condition as described for designs with a time delay. This increases the personal security of Alice when travelling.

[0093] Preferred embodiments have a system log with the time of when user data is created, read, changed or deleted, and a user ID that identifies the person who performed the action. Although Mallory can bypass the system log, it can be useful for Control or the system owner. The purpose is to link a person to an action and a possible sanction. For example, the employer can sanction an employee for unauthorized reading of an unencrypted file in the intermediate storage. BrukerID should therefore identify a person, not a group of people with access to a common administrator role.

[0094] Preferred embodiments have a routine for automatically backing up data in the buffer. This can be part of the organisation's ordinary backup routines. The purpose is to reduce the risk of premature deletion of user data. If data is accidentally deleted, it can be recovered from an offsite backup, which may be several months old. Encrypted user data ensures confidentiality and privacy also in backup data.

[0095] The system here can further comprise a scenario list with messages from a production version of the system and times for sending the messages, as well as a GUI with the possibility to select a scenario list. One or more scenario lists of messages play the roles of physical persons in a simulation version. A Game Master uses a GUI to select a scenario list.

BRIEF DESCRIPTION OF THE DRAWINGS

[0096] In the following detailed description, the invention is described by means of examples and with reference to the drawings, where:

Fig. 1 is an overview of a system in accordance with the invention;

Fig. 2 illustrates system functions and reactions;

Fig. 3 is a more detailed overview of components in the system;

Fig. 4 illustrates the system's location in various protocol stacks;

Fig. 5 is a simplified ER diagram with some entities and relationships in the system;

Fig. 6 illustrates a hidden trigger and a finite state machine;

Fig. 7 illustrates internal processes, signals and channels; and

Fig. 8 is a simplified sequence diagram with object-oriented dynamics.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

[0097] The attached drawings are schematic, and not to scale. Details known to those skilled in the art have been omitted for clarity in the illustrations.

[0098] Fig. 1 illustrates a system 100 according to the invention. A rectangle marks the system boundary. Graphical user interfaces (GUIs) on a system client 220 and a console 140 enable individuals represented by Alice, Bob, and Charlie to communicate with the system 100. A GUI has on-screen buttons, menus, and fields for entering data, and needs no detailed explanation here.

[0099] Alice represents a user in the system, ie a person who can trigger an alarm.

The person Alice may have one or more personal computers, e.g. a smartphone, a laptop and an office PC. It is unnecessary to repeat examples of personal computers in each example, so as mentioned we use the abbreviation 'PC' - 'personal computer' - to represent a desktop or laptop computer, a tablet, a smartphone and other computers with a personal OS- User. For reasons of readability, we use the designations interchangeably.

[0100] The ellipse 201 marks equipment that is close to the person Alice at a given time. Alice needs a PC, for example a smartphone 210, nearby to send an Alarm message 202 from a meeting room. Her office PC is relevant in other contexts.

[0101] Alice can use a GUI in the system client 220 to send the Alarm message 202 to a system server 120. The system server 120 can then set an Alarm status 120 on user Alice 200 in a database 121. Fig. 2 illustrates that an Alarm status 102 triggers an Alarm reaction 162 with one or more system functions. One of the system functions is Notification(list, message) 172, which sends a message to all people in the list. Processes in the system server 120 communicate with each other on internal channels with internal signals. The contents of 'list' and 'message' are maintained by one or more server processes. In this example, 'list' contains the mobile numbers of Bob and other of Alice's colleagues, and the Alarm message 202 is an SMS with 'Alarm, Alice, meeting room 123'.

[0102] The person Bob receives the Alert message 172, and provides assistance 20 to colleague Alice in meeting room 123. A threat to personal safety requires assistance 20 from a person. The system server 120 ensures a short response time, and thus increases Alice's personal security in relation to a system where a person is involved in the processing of Alice's Alarm message 202.

[0103] Bob represents a group of people with one or more members, for example a domestic worker, colleagues of Alice or a security patrol. Bob only needs a mobile phone, for example a smartphone 210, to receive a text message sent by SMS. He does not need the system client 220 for this. Bob can assist Alice in one situation, and Alice can assist colleague Bob in another. Bob's smartphone can therefore also have a system client 220 installed.

[0104] Charlie represents a group of one or more people in a control room, for example in the help or guard center or the office of Control, the boss of Alice and Bob. Control has the authority to contact external resources, such as an ambulance or the police. Control has general responsibility for several employees, for example Alice, Bob and/or Charlier in the central office. Control and Charlie can be reached through a switchboard number, and the person Control can have a mobile number.

[0105] People and equipment are examples of 'entities' in the system 100 for responding to an alarm. Entities are connected by 'relationships'. For example, a user may have one or more personal computers and one or more files with user data. Fig. 5 is a simplified ER diagram showing some of the entities and relationships in the system 100. The system 100 also has system functions, e.g. for sending and receiving messages, for encryption and hashing, etc.

[0106] A simulation version of the system 100 includes a production version with the addition of predetermined messages that are sent at specific times and/or computer processes that play the roles of Alice, Bob, and/or Charlie. The simulation version uses messages and functions of the production version, so it is easy to build different scenarios. For realism, a human 'game master' can influence which messages are sent depending on how the game progresses. The simulation version makes it possible to train groups of people, such as users, helpers, people in a help desk or a crisis management team, without the cost of real people Alice, Bob and/or Charlie to play other roles.

[0107] In a general example, a meeting room has a camera 231. Before a meeting with a potential aggressor, Alice activates the camera 231, so that it sends user data 250, here a video stream, over a local network to the system server 120. A Reaction 161 to the video stream stores an image file in a buffer 130 and the file name in a database 121. This is user Alice's file, so the database 121 has a relationship between the user 200 and one or more user files.

[0108] Each user Alice 200 has an asymmetric key pair privA, pubA, with the property that data encrypted with a public key pubA can only be decrypted with a private key privA in the key pair. These are keys used to hide user data 250 from unauthorized persons, e.g. colleague Bob, Charlie at the exchange and Control. There are no keys that are used for encryption and hashing at a lower level, for example in a secure connection to and from an HTTPS server on the internet. Data transmitted with TLS is readable at both ends of the secure connection.

[0109] A system function 171 encrypts the video stream from camera 231 with Alice's public key pubA. Alice keeps privA hidden in a personal object, e.g. in a PC, a personal smart card or a memory stick with a USB connector. Only Alice can therefore decrypt the encrypted video file, for example to take notes or to archive a readable copy for later documentation of an unwanted event.

[0110] The encryption function 171 can run in the system server 120, the system client 220 or in a computer in the meeting room. Everyone has legal access to Alice's public key pubA. If Alice's user data 250 is encrypted in the meeting room, it can be sent over the LAN without an unauthorized Bob, Charlie or Control being able to see it in real time online or afterwards on disk 130.

[0111] Most meetings are undramatic, so Alice's user data 250 can be deleted automatically after a period in the intermediate storage 130, for example a few days. This gives Alice time to download the encrypted file to her office PC in case she wants to take notes from the meeting.

[0112] In the event that an aggressor prevented Alice from triggering an Alarm, Charlie or Control will hear about the incident afterwards. Alice will then decrypt the file so that a readable copy can be archived for later documentation. The decrypted file can be made available to people who 'need to know', e.g. Control, which was automatically authorized by the unwanted event. An OS administrator is not required to change the authorization of a readable file in a Unix or Windows system in the local network, so the contents of the file can be kept hidden even from an unauthorized OS administrator. This can be done safely with a so-called 'air gap', i.e. without electrical contact or mains connection. A USB stick can contain Alice's private key, and a removable disk can contain the decrypted file.

[0113] In practice, Control can insert a memory stick with the decrypted file into its office PC and archive it in a remote storage (400 in Fig. 3) without any OS administrator on the local network having the opportunity to see it. OS administrators have access to central machines, e.g. file servers, not to every PC in the local network. The decrypted file does not need to be stored in Alice's or Control's PC so that support or a hacker using services in the support application can see it. However, it is unlikely that a Mallory breaks into many PCs in the hope of finding something of interest, here Alice's decrypted video file, in one of them.

[0114] Alice senior can call 222 Charlie in the help desk without triggering an alarm first. For this she only needs a mobile phone 210, not necessarily an installed system client 220. Charlie at the switchboard must necessarily hear the conversation, so it is pointless to encrypt on the client side in this example. On the server side, the 171 conversation is advantageously encrypted with Charlie's public key pubC before an audio file with the conversation is stored in the buffer 130.

This means that unauthorized persons do not have access to the conversation on the disk afterwards. Charlie assesses whether the conversation has value later, and if so marks it for Archiving. 'Archived' is a status for user data 250, not for user 200, and may entail automatic encryption with Alice's public key and/or hashing with a hash key unique to Alice. Mallory can forge a hash, so pubA is unsuitable as a hash key.

[0115] The hash key can instead and as an example be the private key encrypted with the public one, i.e. privA*pubA automatically produced by Alice's system client 220. This key can be sent securely over the internet because no one but Alice can decrypt messages encrypted with pubA. It cannot be securely stored on disk because Mallory can forge a hash with keys she can read.

[0116] A database 121 with many private keys may require additional protection and cost. It may be prudent to store Charlie's privC in the database 121 provided it protects a limited amount of user data. Processes in the system server 120 can then decrypt files automatically. The amount of data should be limited to reduce harmful effects if privC is compromised for unknown reasons. Server encryption with Alice's pubA counteracts this.

[0117] Alice in the office can download, decrypt, and upload a file. Alice senior may need help. If decryption is centralized, for example by Charlie having a collection of memory sticks in a safe at the office, then Charlie is not exempt from unjustified suspicion of eavesdropping. Similarly, if a server process can start decryption in the system client 220. It does not help with a 'secure' authentication of the server process in the system client 220.

[0118] Alice senior will not be monitored by camera at home. She wants to take a bath, and selects a delay period of '1 hour' from a menu in the GUI of the system client 220. The system client 220 sends a 'delayed alarm', specifically a predetermined message called 'Alarm-T' in the following examples. The system server 120 waits for up to 1 hour before it triggers an alarm reaction, e.g. with Notification of home help Bob and Marking of Alice on Charlie's console 140. In most cases, Alice resets the senior Alarm-T status before the time delay '1 hour' has expired. She does this by activating a screen button 'Exit' in the GUI on the system client 220. A password is unnecessary for this.

[0119] One day Alice senior is unable to get out of the bath. The system server 120 then performs a 'delayed alarm' reaction after 1 hour. In this example, the alarm reaction starts recording from a microphone 232 in the bathroom, so that Alice can explain to Charlie at the switchboard what has happened. The system owner decides the use of the system 100, and thus whether Charlie at the switchboard should contact home help Bob, or whether home help Bob should be notified automatically by a process in the system server 120.

[0120] The system client 220 can send an Alarm-T message to the system server 120 about a low battery level regardless of the person Alice's involvement. If Alice is in the meeting room, the system client can send an Alarm-T message with D = '5 minutes' to give her reasonable time to plug in a charger. If Alice is travelling, another delay D ('delay') might be more suitable.

[0121] The 'delayed alarm' response may depend on an underlying status or condition. In one example, Alice is located in 'meeting room 123' when she swipes her access card through a card reader outside the door. Here, 'localisation' is the same as 'recording of position data'. This action can also put Alice in a standby state with heightened attention from the system server 120. Alice in this example is in the standby state during the period she is in the meeting room. An Alarm-T message about a low battery level while Alice is in standby mode can lead to a message to Bob: 'See what's happening in meeting room 123'. When Alice is not in standby mode, the Alarm-T low battery level message causes no reaction from the system server 120 at the end of the delay period D = '5 minutes'.

[0122] A delay period generally solves problems with equipment becoming unavailable for an unspecified reason, e.g. low battery level or Alice not being able, willing or daring to trigger an alarm.

[0123] A recording period in which recording equipment sends user data to disk, a standby period and a delay period are three different periods that can be combined in different ways. For example, the standby period in the previous example may coincide with video recording from the meeting room during a recording period. The previous example also illustrates a basic building block called a 'state machine' which is used to build the system 100. This is described in more detail with reference to Fig. 6.

[0124] Alice on a journey would also like to have help from colleagues as quickly as possible. Before the trip, she enters an itinerary from her office PC, for example a sequence of approximate positions 'London', 'Paris' and 'Kuala Lumpur' with expected times of arrival and departure. These are short data elements that fit in the database 121. Positional data is well protected in the organization's database 121 for reasons mentioned earlier.

[0125] Colleague Bob and other employees enter their itineraries when they are traveling. This way, their boss Control or a crisis management team knows who is traveling in an area, for example after an earthquake, tsunami or hurricane. If Alice is in the area where a natural disaster has occurred, for example in Southeast Asia or America, Control will spend resources on her, not on colleague Bob traveling in Europe. Similarly, a terrorist attack in one city applies if Alice and Bob are in different cities. You never know what might happen, but it's good to be able to act effectively if something does happen. For this purpose, Control has a console 140 with a large screen and more screens and functions in the GUI than a smartphone 210 with a system client 220.

[0126] Charlie's boss in the help center has a corresponding console 140 to keep track of elderly people's names and addresses in case he has to call for an ambulance. The response time is shortened if the system server 120 Marks Alice senior in a screenshot so that no person in the help center has to find Alice's address with a manual lookup.

[0127] Arrows 145 to and from the console 140 illustrate two-way communication with the system server 120. Communication between the system server 120 and the console 140 can for example go through a web interface on the internet and/or an interface on the local network.

[0128] Traveling Alice 'checks into' the system 100 when she arrives in a city, specifically by activating a screen button in the system client 220 GUI. The system client 220 retrieves a GPS position with a system call in the operating system, and sends the position and time in a message to the system server 220. A process 160 in the system server 120 receives the message from the system client 220, and distributes various components of the message to other processes with internal signals in internal channels. This is described in more detail with reference to Fig. 7.

[0129] Alice on assignment takes audio recordings and pictures with her smartphone and writes notes on the laptop for use in a later report. She encrypts the files with user data with her public key, more specifically by marking the files in a file reader in the system application 220, and selecting 'send encrypted' or equivalent in the GUI. Alice's sound files, image files and notes from the trip are thus safely stored in the intermediate storage 130 even if Alice's PC should be lost or stolen. The sound or image files are stored for a period in the intermediate storage 130 so that Alice can decrypt them when she is back in the office.

[0130] Alice or the system client 220 can mark audio files, image files and notes with a status of 'for later use'. This status is different from the 'Archives' status in a previous example, and illustrates that a data element can have several statuses. It is user data, not the user, which is 'for later use', and which should not be deleted or archived by an automatic process.

[0131] Fig. 2 illustrates that a Reaction depends on a status and consists of one or more system functions. An Alarm reaction 162 responds to an Alarm 102, and contains the system functions Alert(list, message) 172, Mark(Alarm, console) 173, which marks Alice on Charlie's console 140, etc. A Delayed Alarm reaction 163 responds to a delayed alarm-status Alarm-T 103, and waits a delay period D before it performs other system functions, e.g. Alert(list, message) 172.

[0132] During the delay period D, the system server 120 waits for an optional change message 204 from the user 200. Traveling Alice wants to go on a city trip after the end of working hours, and uses the GUI in the system client 220 to enter T = '2200', the time she expects ̈to be back at the hotel. Neither colleague Bob nor Charlie at the switchboard need to know where she is. She is delayed, and sends a change message 204 with a new time T = '2300'. She is back at the hotel at 2230 and turns off the delayed alarm. For this, she must enter a password.

[0133] If the user message Alarm-T contains a delay period D, then the alarm is triggered at time T = (now D). If the message contains a time T, the system server will trigger the alarm at T, and the delay period is implicitly D = (T – now). It does not matter if the Alarm-T message contains D or T, as long as server and client agree on which format is used.

[0134] A set alarm changes the status of user Alice in the system 100. A system function Authenticate (person) can require that Alice enter a password before the period D ends. An aggressor cannot therefore turn off the alarm. In one variant, Alice can enter a password, e.g. 'Help', instead of a password and thus trigger an immediate alarm.

[0135] In this example, the alarm reaction can be to obtain Alice's GPS position and notify all colleagues who are traveling with Alice. You don't need your colleagues' exact GPS positions for this. Whoever reaches Alice first assists her. Messages are not sent to all of Alice's colleagues, only to the colleagues on the 'list' in a system function corresponding to Notification(list, message) 172 in previous examples. For Alice in the office, a server process might start by identifying colleagues who are at work before trying to find a more accurate location, e.g. colleagues on the same floor as meeting room 123. GPS data can be swapped with other location data, etc. in similar examples .

[0136] In summary, the system client 220 may send a predetermined user message, for example to set a recording, standby or delay period. The message can optionally be sent by a person using a GUI in the system client 220. The person/user can specify the period in the user message or end the period with a 'Quit' message. In an Alarm T message, the delay period D or an equivalent time T is mandatory. The periods may overlap as described above.

[0137] Fig. 3 shows several details of the system 100.

[0138] A dashed line 101 illustrates the secure area of digital data under the system owner's control as described. The secure area 101 contains a central computer 110 which runs the system server 120. The system server 120 also has the database 121 with information about Alice, Bob, Charlie and other entities.

[0139] A database system is generally best suited to contain short data elements, for example personal names, residential addresses, telephone numbers and file names. A file system is generally better suited to storing longer data items, such as an audio or image file. The system server 120 therefore has read and write access 125 to file system(s) in an intermediate storage 130. A file system in the intermediate storage 130 can be located on disk in the central computer 110, or be accessible through a file server in the local network. The database 121 preferably only contains file names, which depends on whether the local file system is Unix-like, Windows-like, or something else.

[0140] GPS coordinates and other location data can be conveniently stored in the database 121 because they are short data items. However, it is entirely possible to store them in a file in the intermediate storage 130. It is similarly possible to store sound and image files in the database 121. In the examples here, we follow common practice, which is to store short data elements in the database 121 and longer data elements in a file system. Here, the 'longer data elements' are the users' sound and image files in the intermediate storage 130. The intermediate storage 130 are file systems in the local network that contain user data and to which the system server 120 has read and write access. The intermediate storage 130 is not necessarily a separate physical unit in the secure area 101.

[0141] The system server 120 is preferably a database application fronted by an HTTPS server to the internet, so that the system server 120 is accessible to a console 140 through a secure web interface. The system server 120 can additionally or alternatively have an interface to a console 140 on the local network. The console 140 is used by Charlie at the exchange and Control. These can typically change some of the content of the database 121, e.g. create, change and delete a user role, but not change the database structure, lists of statuses, etc.

[0142] A system administrator Admin is here one of Control's subordinates in the organization with a similar function to an OS administrator in an operating system or a database administrator in a database system. Admin takes instructions from the system's 100 system owners, and maintains lists of statuses, etc. He can, for example, add new card readers outside meeting rooms if and when they become available from the access control system's system owner. Admin also uses a console 140, but has different functions and screens in the GUI than Control.

[0143] The network 150 illustrates a data or telecommunications network, for example the Internet, a mobile network or a local area network. A 'terminal' is here an end point in the network 150. A security alarm to hang around the neck has a physical push button 211 to send an alarm signal to the system server 120 and is a terminal. It is a user terminal 210 because it is personally associated with a user 200. Other user terminals 210 are a smartphone, a tablet, a laptop, etc.

The common feature with these machines is, as mentioned, that they have a personal OS user.

[0144] Some user terminals 210 have an installed system client 220 with a GUI where the user 200 can send a predetermined message to the system server 120 by activating a screen button 221. Alice in the office can use a hidden screen button 222 to send an alarm message without calling attention from a potential aggressor. For example, she can touch or swipe over a field on the screen that has no visible graphic icons. The GUI in the system client 220 additionally has menus, fields for entering data, etc.

[0145] The dotted ellipse 201 illustrates, as in Fig. 1, user terminals 210 and recording equipment 230 - 232 in the vicinity of the user 200. The ellipse 201 does not illustrate a communication network, for example Bluetooth connections to and from a smartphone.

The recording equipment may comprise a specially made unit 230 with an embedded ('embedded') processor of the type used to stream video signals to a television. Such a device or another computer can be connected to the camera 231 and/or the microphone 232.

[0146] The camera 231 and the microphone 232 are not necessarily associated with the user 200 at all times. Alice and colleague Bob use the same meeting room at different times, and a camera 231 in the meeting room is the source of different image files for Alice and Bob in the intermediate storage 130. The camera 231 is only relevant for Alice when it streams Alice's user data, correspondingly for Bob. In both cases, the camera 231 is 'close' to the user 200 in the meeting room.

[0147] A computer in the meeting room, for example device 230, can receive Alice's or Bob's respective public keys pubA from the system server 120 or their respective user terminals 210 in the meeting room, and use the public keys to encrypt user data as described above. The same applies to sound data from a microphone, and to recording equipment in a home or elsewhere.

[0148] Positional data, for example GPS coordinates from a smartphone, are also only relevant when the smartphone is close to the user 200. Alice on a trip has a laptop at the hotel, but positional data from the laptop is of no particular interest when the purpose of the system 100 is to provide assistance 20 to Alice on a city trip as quickly as possible. Position data from colleague Bob's smartphone is relevant when it is near Bob and receives signals from Bluetooth beacons in the office building.

[0149] A remote storage 400 contains archived data for later documentation and/or backup copies ('backup data'). The remote storage 400 represents file systems in the local network or on the Internet. As described earlier, redundant data should be deleted from the buffer 130 as quickly as possible. Preferred embodiments archive user data encrypted with the user's public key pubA in the remote storage 400 automatically after an alarm is triggered. In the event of an erroneously triggered alarm, the user's 200 user data 250 thus remains unreadable to unauthorized persons. This meets requirements for proper storage of personal data, and people's property rights to their own data set out in certain privacy regulations.

[0150] Preferred embodiments have a routine for automatically backing up data in the intermediate storage 130, for example to the remote storage 400. The backup can be part of the organization's ordinary backup routines. The purpose is to reduce the risk of premature deletion of user data 250. If data is deleted by mistake, it can be retrieved from an offsite backup, which may be several months old. Encrypted user data ensures confidentiality and privacy also in backup data.

[0151] Large amounts of data in a remote storage 400 on the Internet may require additional protection. This can be done by encrypting with the public key pubS in an asymmetric key pair [privS, pubS] belonging to the system server 120. The key pubS can advantageously be longer than the corresponding pubA and pubC, correspondingly for the respective private keys.

[0152] A national security agency has the resources to crack 1024 bit keys, and can attack 512 bit keys with mathematical methods. See, for example, https://weakdh.org. Such an opponent can alternatively and more cheaply demand that a supplier hand over keys 'for the sake of the nation's security'. In this example, the supplier can deliver cloud storage on the internet, an operating system with a back door 'in case the OS user forgets the password to their encrypted disks' or be a certificate issuing CA - 'certificate authority'. Such suppliers exist in reality. Whether state authorities pressure them is of no interest here. A Mallory without a specified 'suspect and motive' is common. Security authorities in China, Russia or the USA will not, in principle, trust a cloud provider or CA from one of the other two countries.

[0153] For these and similar reasons, it is common to recommend 4096 bit keys to protect production data on disk over the Internet. Commercial and non-commercial software for generating 4096 b key pairs are available online. Correspondingly shorter keys are used for secure email. Open source software has the advantage that no commercial or government actor can insert back doors. An online search for 'secure email' or the standard 'OpenPGP' provides more details and references. Certain countries have a maximum permitted length of keys, and prohibit certain algorithms 'for reasons of national security'. The system owner knows this.

[0154] A common web search and social media illustrates that there are statistical algorithms to identify data relevant to a specific user in a large amount of data in a matter of seconds or less. Such algorithms are available to other actors on the internet with state-level resources. Short occasional messages with the content 'S20022200' or similar are incomprehensible to outsiders, and do not provide a statistical basis for any statistical algorithm. They can therefore be sent openly over a mobile network or the internet without an eavesdropper with state-level resources being able to interpret the content. We will return to this.

[0155] In systems with private keys in system-specific files, the system server can store a hashed private key privS where a predetermined byte has been changed with an exclusive or with a security byte. For example, byte no 383 could be 10101010. An exclusive-or (XOR) with a security byte changes digits where the security byte has a '1' and does not change at a '0', so (1010 1010) XOR (11110000) = (01011010) . A new XOR with the security byte returns byte no. 383 to its original value.

[0156] Suppose Mallory sees such a privS that cannot decrypt. Only the system server 120 knows that (byte 383) XOR (security byte) must be performed before privS will work. Mallory doesn't know which byte has changed, and of course the security byte doesn't have to be 1111 0000. A 64b OS performs an XOR of 8 bytes in one instruction, and a hash protects against change. Such an algorithm is thus a cheap protection against Mallory. Applying the XOR algorithm to users' private keys may be impractical because it requires additional and non-standard code in commercial and non-commercial software for end-to-end server-client protection.

[0157] A hash of user data, username and a time stamp proves ownership and origin of data. In the example of Alice's video file, only Alice can reproduce a hash over an encrypted and archived video file if the hash key is unique to Alice. The key can be privA*pubA as in a previous example. Many hash keys in the database 121 require additional protection, which can be expensive in relation to the utility value.

[0158] Fig. 4 illustrates the system server 120 as a server application on an operating system (OS) in the central computer 110, and the system client 220 as a corresponding client application on an OS in a user terminal 210. The system server 120 and the system client 220 communicate in the application layer 150. Server - and the client applications use services from the underlying operating systems, for example to read and write data from and to a file system. The system client 220 has a messaging function that uses functions from underlying layers, for example to encrypt, find the machine's GPS position or retrieve information about battery level. The system client may have a GUI. The computer in the meeting room can encrypt, but does not need a GUI.

[0159] Each computer, in this example 110 and 210, can be simply described as a stack of hardware (HW) at the bottom, an operating system (OS) above the hardware and an application layer with one or more applications above the operating system. The hardware comprises a processor, memory and network card for wired or wireless connection to a network. A specially made user terminal 210 can have a so-called 'embedded' processor with a very small operating system and limited functionality, for example just enough to call a help desk. A smartphone has a slightly larger processor designed to use the least possible power. A desktop PC usually has an even larger and faster processor with more cores, and the central computer 110 can be a cluster of several physical machines so that the system server 120 does not go down even if one of the physical machines in the cluster fails.

[0160] Apart from special operating systems for 'embedded' processors, the operating systems are most often Unix or Windows-like systems adapted to the processor in the individual computer, here 110, 210. Unix-like OS have local file systems with top level '/', and Windows -like file systems system has local file system with top level C:\, D:\ or similar. A local file server fs1 may present a file as fs1:/dir/filename or FS1\dir\filename depending on the operating system under the server application. Some organizations use NFS - 'Network File System', and some organizations use Virtual Private Networks (VPN) instead of Ethernet or WiFi. There are several other variants.

[0161] It is impossible to provide a complete overview of all combinations of processors, operating systems and file systems now and in the future. Operating and file systems are of particular interest in the system 100 because the system server 120 and the system client 220 should be adapted to the most common operating systems. Today, this can be iOS, OS-X or Android on single-user machines and a corresponding Linux variant with several OS users in the central machine 110. These are Unix-like operating systems with associated file systems. Windows-like operating and file systems for PCs and the central computer 110 are also common.

[0162] A network can similarly be simply described as a stack of hardware at the bottom, a protocol stack above the hardware and an application layer 150 at the top. One thinks that communication takes place internally in each layer. For example, a PC can have a network card with a cable to a local Ethernet and/or a network card with a radio connection to a WiFi network. These networks are at a low level in the stack along with repeaters, base stations and other equipment on public networks. At a higher layer, each computer can be identified with an IP address, and each telephone with a telephone number. Underlying equipment and protocols are irrelevant for communication between devices using IP addresses or telephone numbers.

[0163] In the TCP/IP stack used on the internet, TCP ('transport control protocol') defines 'ports' on the individual IP address, The ports make it possible to define several services on the same IP address, for example email on one port and web services on another. TCP assumes that a connection has been established at the IP layer, and is otherwise independent of the IP layer.

[0164] Secure services on the internet, for example an HTTPS server, send data to TLS ('transport layer security'), which encrypts and hashes data before it is sent through the transport layer. At the opposite end of the transport layer, TLS ensures that the data is decrypted and that the hashes are checked. TLS then sends readable data to the application layer. Here, 'readable data' can represent a web page and/or other structured data, e.g. in XML format, which cannot or should not be interpreted by a browser. The effect on the application layer 150 is anyway that readable data is sent over a secure connection. What happens at the transport layer and the layers below is of no interest to the system 100. The purpose of the keys in the system 100 is for data in the application layer 150 to be unreadable by unauthorized persons, in the examples here represented by Bob and Charlie who sometimes need to see Alice's data, other times not.

[0165] More generally, the OSI model describes a stack with seven layers used in public networks, including 3G, 4G and 5G mobile networks. Layer 7 in the OSI model is called the 'application layer', and Fig. 2 schematically shows a stack of OSI layers 1-6 below the application layer. Details can be found in textbooks and online. A local area network has a corresponding protocol stack.

[0166] It is impossible to give a complete description of equipment and protocols on existing and future networks, especially on layers below the application layer. This is not necessary either, as we specify that communication in the network 150 takes place in the application layer. For the same reason, a more detailed description of the HW and OS layers on the individual computers is unnecessary here. The application layer 150 in Fig. 2 is informal, and lies over both the Internet (TCP/IP), a public telephone network and a local network.

[0167] TLS resists Mallory with state-level resources, so lack of security at the transport layer is not an issue. The asymmetric keys in the system 100 encrypt end-to-end in the application layer 150 to prevent access by unauthorized persons. Keys and software preferably follow an open standard, eg OpenPGP. Email on the internet, SMTP, lacks a secure variant that uses TLS. End-to-end keys are also used for secure email. A number of commercial and non-commercial software packages are available online.

[0168] Keys at the application layer do not require a trusted CA. In comparison, all machines on the Internet contain certificates with keys issued by the operating system vendor for use in TLS.

[0169] Figure 4 shows only a small selection of protocol stacks to illustrate the principle with an application layer. There are corresponding 'stacks' for local area networks, file systems, etc. For the system 100, it is particularly relevant that a recording function in the application layer can use partial functions in an underlying layer to obtain sound, image and position data. 'Position data' can further be divided into data from a GPS function or Bluetooth function in a smartphone. There are several possible alternative techniques for finding a position or location, e.g. NFC, RFID, etc.

[0170] As mentioned, Alice can be located in the meeting room when she swipes her access card through a card reader outside the door. This requires permission from the access control system's system owner, and can at the same time authenticate the person Alice in the system 100. With these prerequisites, the system server 120 can send Alice's public key pubA to the computer in the meeting room through a WiFi network, and start a video recording. The computer in the meeting room encrypts the video recording with pubA before the video stream is stored as an encrypted file in the intermediate storage 130. Alice does not need to bring her smartphone or laptop to the meeting. There are many possible combinations.

[0171] Fig. 5 is a simplified ER diagram of some entities and relationships in the system 100. The database 121 may be, but need not be, a relational database (RDB). We use an RDB as an example here because an entity can easily be illustrated with a table in an RDB. A system for handling a database, for example an RDBMS, is outside the scope of the present invention, i.e. of no interest in system 100. Crow's foot means 'one or more', and dashed stem means 'may have'.

[0172] A Person 301 in this example has the attributes 'Name' and 'Number'. Asterisk '*' in front of Name means that this attribute is mandatory. A database management system, e.g. an RDBMS enforces the rule so that no one can create a Person 301 without a Name.

[0173] In an RDB, the entity Person 301 corresponds to a table 311 with a column where all the rows have a Name, and some have a Number. A potential aggressor, A. Gressor, is missing a mobile number in table 311. An RDBMS assigns a unique user ID to each name. User ID is illustrated with a number in the leftmost column in table 311.

[0174] The table Person 311 can be thought of as having a column 'Status' where many of the rows are empty, and the rows that have a value have one of the values from the list in Status 303. However, the relationship between Person 301 and Status 303 is a many -to-many relationships since each Person 301 can have several statuses, and each Status 303 can be assigned to several people. We explain in more detail in the description of the resolution 306 between a person P and a role R.

[0175] A Person 301 can send a user message 302 to set a user status 303 in the database 121. The system 100 has messages for Bob that have been sent from the system server 120, and which are therefore not messages from Person Alice to the system server 120. User messages 302 and user statuses 303 are subsets of the system's messages and statuses. A potentially useful convention is to use similar names for user messages, statuses and reactions that belong together. With this convention, an Alarm message gives an Alarm status, an Alarm-T message an Alarm-T status, a Standby message a Standby status, etc. Furthermore, each status has a Reaction with the same prefix, Alarm, Alarm-T etc. As shown in Fig. 2, the system server 120 has a reaction with one or more system functions for each status.

[0176] The system 100 has a relatively short list of possible user statuses, and a correspondingly short list of predetermined user messages that should be stored in the system client 220. Each user status has a status ID. In this example, an Alarm has status ID S1, and a time-delayed alarm Alarm-T has status ID S2. A delayed alarm triggers a reaction from the system server 120 at a time T at the end of a delay period as described above. The occasional message 'S20022200' is interpreted in this example by the system server 120 as an S2 = Alarm-T sent by user ID 002, Alice A. Tacked, with T = at 2200, the time Alice on a city trip expects to be back at the hotel. The system server 120 does not depend on Alice's mobile number to find user ID 002, and all of Alice's PCs can contain her user ID.

[0177] User messages to trigger an alarm, start a delayed alarm, a standby period and a recording period with corresponding user statuses and a 'Quit' message are described above. We do not repeat the description here, but emphasize that a user message enables the user 200 to set the status himself. Furthermore, the system server 120 can set an alarm status on the user 200 without the user 200 having sent an alarm message.

[0178] The entity Equipment 304 contains information about hardware that is relevant in the system 100. This can be a system console 140, a user terminal 210 and/or recording equipment 230 - 232. Crow's foot with dotted stem means 'may have one or more'.

[0179] The system console 140 is needed to show Charlie an overview of several users 200, for example a short list of users with Standby status. A person 301 can have one or more system consoles 140, for example with a web interface to the internet and/or an interface to the local network.

[0180] Each Person 301 may also have one or more user terminals 210, and one or more objects 230 - 232 to obtain sound, image and positional data.

[0181] A user terminal 210 in a telecommunications network has a permanent telephone number. A user terminal 210 on the internet has an IP address which can be changed from connection to connection or which can be hidden behind the IP address of a WiFi router. The purpose of the application layer over TCP/IP is to hide such details from applications such as the system 100. The user terminal UT ('user terminal') is therefore linked to a user ID as in the left column of table 311, not to a machine address. The same applies to a specially made device 230, a camera 231, a microphone 232, and in a local network with a protocol stack different from TCP/IP.

[0182] The entity Role 305 is a short list of roles a person or group of people can have in the system 100. Charlie or Control can select Role for a Person from a menu of Roles. Admin creates and maintains the list of Roles 305 according to instructions from the system owner.

[0183] Charlie represents a group of people, and has a switchboard number. In previous examples, Alice has the role R1 = user, defined as a person who can trigger an alarm. Bob has had the role R2 = 'helper' in the sense of 'first responder' or 'assistant' for Alice in need. Charlie has had the R3 role of an aid or guard center, and R4 is an optional aggressor role.

[0184] Alice may have role R1 in one situation and help colleague Bob in another. Colleague Bob can have the role R2 as in previous examples, but can be the user with role R1 in a different situation. In general, a Person 301 can have one or more roles 305, and a role 305 can be assigned to one or more Persons 301. The entity P/R 306 with associated crow's feet resolves the many-to-many relationship between Person P and Role R.

[0185] Table 316 illustrates the entity 306 in an RDB table 316 with the heading 'P R'. In the first data row, user ID 1, Alice Aged, is linked to the role R1 = user. The next rows associate userID 2, Alice A. Tacked, with roles that use R1 and help R2. The table 316 can be sorted by user ID P and provide a list of which roles R a Person 301 has. Alternatively, the table 316 can be sorted by role R, and provide a list of Persons 301 who have role R1, R2, etc.

[0186] Generally, a resolution of a many-to-many relationship may provide lists that may be displayed in a GUI on the system console 140. For example, a web interface with a GUI may display the user Alice A. in a row in a list of users in Standby status, and mark the row for Alice A. with flashing red text as Alice A. is set to Alarm status. Charlie at the switchboard does not need to monitor all users equally closely, and reacts immediately to Alice's alarm status. This reduces Charlie's response time and improves Alice's personal safety. The system server 120 can additionally send a Notification message to Bob and other colleagues near Alice without waiting for Charlie. As shown in Fig. 2, a Reaction in the system server 120 includes one or more system functions, e.g. Notifying Bob and Marking Alice on the system console 140.

[0187] Fig. 5 is an example with a few entities. A slightly larger version could show that a user 200 can have one or more files, each with a file status of 'encrypted', 'archived', etc. Furthermore, each Person 301 can have one or more locations, some of which may represent a travel route. Of course, a real ER diagram can also have more elements in the lists, for example an archiver role for a person who reviews unencrypted files in the intermediate storage 130 and marks files to be archived. A detailed ER diagram with associated system rules and functions must be left to the expert who knows the specific application area for the system 100.

[0188] Fig. 6 illustrates a hidden trigger 240 and a state machine. The purpose of hidden triggers is generally to prevent an aggressor from discovering that the user 200 triggers an alarm.

Hidden triggers are generally redundant in a system 100 designed for a call center. A delayed alarm, Alarm-T in the examples above, also reduces the need for hidden triggers.

[0189] Fig. 6 shows in particular an innocent object 241 on a table 24 in a meeting room. The object 241 contains a permanent magnet 242 with an associated magnetic field 243. A coil or Hall detector 244 detects the magnetic field 243. When the object 241 is moved on the table 24, a current is induced in the coil 244. This leads to an electrical control signal, e.g. in the range mA and mV or lower, is passed through a line 245 to the base of a transistor 246, so that the transistor 246 begins to conduct from collector to emitter Thus a drive current, e.g. 5 V direct current, passes through an electrical circuit 247 with a transmitter 248. The transmitter 248 can represent a network card in a computer, a separate device 230 with an 'embedded' processor or other known technique for sending data as described above. If the transmitter 248 has a power supply with a built-in transformer, the transistor 246 can be replaced with a relay or a thyristor, and the current source 249 be a normal supply network with 240 V alternating current.

[0190] In the system 100, the object 241 can be temporarily associated with Alice and/or Bob. Given that the user 200 has Standby status as described, an aggressor is unlikely to react to an innocent object 241 being pushed aside by Alice or Bob. One can also think of hidden triggers 240 based on other known technology, eg RFID or voice control where a code word triggers the alarm. The technique depends on what is available, such as reliable voice control.

[0191] Standby status is here a prerequisite for an alarm message to be valid: It must be possible to clear the table 24 without triggering an alarm. A '(finite) state machine' can generally be described with a list of 'stimuli' and a (finite) number of 'actions' per stimulus. Table 1 shows extracts from such a list.

Table 1: Example of a state machine in list format

[0192] The excerpt in Table 1 covers both item 241 in Fig. 6, a previous example where Alice in the office located herself by swiping her access card and an example where Alice on a city trip uses a GUI to set a standby status.

[0193] A system, including the system 100, can generally be described as an 'agent' consisting of a block with one or more processes. The agent' performs one or more '(re)actions', and may contain other blocks with other processes. The system server 120 in Fig. 1 is such a block/agent. The lowest level agent in this model is a state machine.

[0194] It is possible to recognize features from UML, more specifically a usage model in Fig. 1 and an ER diagram in Fig. 5. Fig. 8 is an informal sequence diagram. This document is not a system design and we do not use formal specifications or diagrams. The point here is that there are several 'views' of a system, and that a system designer can use a standardized tool, not necessarily a UML tool, to build a real system 100.

[0195] Fig. 7 illustrates a receiver process 160 mentioned in previous examples with graphic elements used in the design of telecom systems and machines with a built-in processor. Open arrow from left to process 160 means 'asynchronous', ie the message can arrive at any time. A black dot at the end of the arrow means 'external' in the sense of 'from a source outside the diagram'. The system server 120, the system client 220 and the computer 230 in the meeting room can have such a receiver process 160.

[0196] The process 160 communicates with other processes through internal channels 701 using signals or messages 702. More specifically, the process 160 distributes tasks to other processes 703, 704, 705 depending on the received message, status of user and user data, type of user data, etc. In the system server 120, the processes 703-705 can implement one or more reactions 161, 162, 163 and/or system functions; 171, 172, 173 mentioned above, or the processes 703 - 705 may represent completely different server processes.

[0197] In this description and the patent claims, 'messages' means the same as 'external messages' in the application layer between server and client. We will use 'signals' about 'internal messages' 702. Each internal channel 701 has a 'delay' which is of no interest here, and which should not be confused with the delay period in an Alarm-T message described earlier.

[0198] Fig. 8 is an informal sequence diagram where open arrow with dot means the same as in Fig. 7. Rectangles with text in the first row represent 'objects' in the sense of 'things with data and methods for handling themselves and their own data '. A Receiver 160 represents a process in the system server 120, the system client 220 or the computer 230 as in Fig. 7.

[0199] A User 200 is here an 'object', and not the same as a role in the ER diagram in Fig. 5. The object in Fig. 8 can have internal user statuses 'Alarm', 'Alarm-T', 'Recording' and 'Standby' taken from a short list in the database 121 and previous examples. The object 200 in Fig. 8 also has methods for creating, changing and deleting a user status after a 'stimulus' or an internal signal 702.

[0200] A User File 250 represents user data 250 online and on disk plus methods for creating, changing and deleting own data statuses such as 'Archives', 'For later use' etc. It has other data elements or 'attributes', and basically methods for to create, modify and delete attributes.

[0201] An Object 800 is a general object with attributes and methods. The attributes are not the same as in the ER diagram of Fig. 5, and objects 800 typically have more methods than those needed to create, modify, and delete attributes. Object-oriented design and programming make it possible to change data and methods in an object without affecting other parts of the system. In comparison, large monolithic programs with routines and subroutines are inflexible and difficult to maintain. It will be clear that the system functions 171 - 173, and consequently the reactions 161 - 163, mentioned earlier can be realized with objects.

[0202] The notation 'a Receiver' 160, 'a User' 200 etc. is chosen to illustrate that the objects are different from the entities of Fig. 5 and the processes of Fig. 7. In a real embodiment, the objects 160, 200, 250 and 800 in Fig. 8 instances of respective classes with common features. A system designer knows how a real sequence diagram for an OO system is built up, that the objects in Fig. 8 can be replaced with other objects, and that flow diagrams are better suited to illustrate algorithms with branches and loops. This is outside the scope of the invention.

[0203] A vertical dashed line below each object represents the 'lifetime' of the object, and rectangles along the dashed lines illustrate when the object is 'active', eg in the memory of the underlying computer 110, 210, etc. Horizontal arrows represent signals, ie .

'internal messages' 702. These depend on other processes in the diagram, are 'synchronous' and are represented by filled arrows. Dashed arrows represent return messages.

[0204] Specifically, Fig. 8 illustrates an asynchronous Message to a receiver from a source outside the diagram. As mentioned, the diagram can represent objects in one of several computers.

[0205] The message may imply that user data 250 is to be encrypted and stored. A Receiver 160 asks 801 a User 200 for the public key pubA. The object 'a User' 200 may have pubA stored in an attribute, a method for finding pubA or the like. The essential thing for a Receiver 160 is that it can request a User 200 for a key, and have it sent in a return message.

[0206] The object 'a Recipient' 160 then addresses the object 'a User File' 250 with the signal 802: 'Encrypt with pubA and save'. Objects have the concept 'me' or equivalent, so 'a User File' 250 sends the signal 803 'Encrypt Me' and then 804 'Save Me' to 'an Object' 800. The signals 803, 804 each receive their acknowledgments, and 'a User File' 250 receipts back to 'a Recipient' 160.

[0207] The message to 'a Recipient' 160 may alternatively or additionally imply that user data 250 is to be hashed and archived. A method in 'a User' 200 returns privA*pubA upon request 805 from 'a Receiver' 160. A further request 806 is sent to 'a User File' 250, which acknowledges when the job is done. The message 806 can be considered as input or stimulus to an 'agent' which performs the actions 807 'Hash me' and 808 'Archive me'. As mentioned, there are several 'views' of the system 100 which complement each other and are useful for each of their purposes. A 'syn' here is the same as 'view' in a representative English-language design or model tool.

[0208] An important point here is that objects 800 in the system 100 can be secured with hashing and closing processes in a similar way as system files and processes are secured in a modern OS. The database 121 only needs to contain user names, file names, etc. as mentioned earlier. It does not need to be further secured with database-specific RBAC or other techniques. This reduces the system owner's costs and maintains their utility.

[0209] Positional data generally has a short lifetime and thus a limited need for encryption and hashing. They can therefore usually be stored 'open' in an ordinary database, but they can of course be encrypted and hashed like other user data if the system owner so wishes.

[0210] A system log in the system 100 preferably contains a user ID and time for who created, changed or deleted user data in the system. User ID should be linked to a person, not to a shared administrator role. It is thus generally possible to identify who has done what, and prevent unwanted behavior with a possible sanction from the employer. In the example with a ban on recording in the meeting room, Control or the system owner can find out who recorded a video of a business meeting (created data). Further details are left to the system designer.

[0211] For easy reference, we list system functions mentioned above:

Table 2: Examples of system functions

[0212] It is understood that the system functions in Table 2 and other system functions in the system 100 can advantageously be realized with objects as shown in Fig. 8 to facilitate later maintenance of software and adaptation to new technology as it becomes available. We finish with some examples where we use the convention of having arguments in parentheses after the function name.

Example 1: Home and office alarm

[0213] Alice has a home alarm system with a web camera. She has 'standby status' while she is out of the house. During the standby period, motion sensors, 'hidden triggers', can start the webcam and send a video stream to the monitoring center. Outside the standby period, the webcam does not work. Alice can silence a false alarm with a password, 'Authentication(person)', as in other alarm systems for a home or an office building. System functions Recording and encryption in a system client 220 can encrypt a video stream so that Charlie at the exchange cannot see the content. After a real hack, Alice can download the encrypted video file, decrypt and upload a readable version in a regular web interface with https:// address. TLS in the transport layer hashes, encrypts etc without affecting Alice and Charlie. Charlie can now read the contents of the file with normal software.

Example 2: Immediate alarm

[0214] Alice in the office or traveling sets a 'standby status' via a GUI on one of her PCs, preferably a smartphone she carries with her. The smartphone can be identified from its mobile number or because the system client 220 sends Alice's user ID = 002 in the Standby message to the system server 120. The standby message(s) can also contain GPS coordinates, 'meeting room no 123' and other information that can shorten the response time from Bob or Charlie. Alice's location or position data can be stored in the database 121 without any human needing to see them. When Alice sends an Alarm, the system server 120 has all the information needed to notify Bob and other nearby colleagues with one message, Alice's boss Control with another message and possibly mark Alice in the system console 140. Charlie is in this example processes in the system server 120, not a natural person.

Example 3: Time-delayed alarm

[0215] Alice's system client has a pre-stored Alarm-T message and an address to the system server (120), for example a telephone number for an SMS message and/or an email address. The user message Alarm-T about a time-delayed alarm requires a time T for when the system server 120 is to perform an alarm reaction. Alice at home selects a preset delay period of 1 hour from a menu, T = now 1 hour. Alice on a journey enters T = '2200', the time she expects to be back at the hotel. Alice can use the GUI to enter relevant information about where she is going, etc. Alice's GPS position or that Alice is in meeting room 123 can be obtained without the person Alice using the GUI, for example by the system client 220 obtaining GPS data and sending a message automatic. Messages with relevant positions are stored in the database 121 without any human needing to see them.

[0216] Before time T, Alice can extend the Alarm-T period with a new Alarm-T or cancel the Alarm-T with an End message. Shutdown may require authentication (person), and deletes all data associated with Alarm-T, typically position data in the database 121. At time T, the system server performs a predetermined alarm reaction regardless of whether Alice's PC is available or not. The system server then has all the information needed to notify Bob and Control as above. Charlie is again preferably processes in the system server 120.

Example 4: Itinerary with check-out

[0217] Alice creates a travel plan where the destination, expected arrival time and information about the journey are entered. Alice's guardian, Control, will benefit from this information if something happens in the area Alice is in or has specified as a destination.

[0218] When Alice sets out on her journey, she will be able to activate automatic check-out at the desired interval. The message can be entered via the GUI with menu selection and/or entering the interval in the same way as in the Alarm-T message above. Alice on travel can also choose to check in manually with comments, etc. Some comments can be sent as encrypted audio or image files with recordings from Alice's smartphone.

[0219] Checkout sends a GPS position to the system server 120, where it is stored without any human needing to see it. Alice can deliberately disable GPS tracking through the GUI. Alice's guardian, Control, can nevertheless proactively and without loss of time deny or confirm whether Alice has been exposed to unwanted incidents because he has access to the planned itinerary and Alice's approximate position.

[0220] Most journeys proceed without unwanted incidents, so the system server 120 can delete data from the journey automatically after a suitable stay in the database 121 and/or the intermediate storage 130. Alice can, for example, benefit from sound or image data from the journey. Alice can delete data herself as described above. Alice often has access to confidential information, for example about potential aggressors, to which the individuals Bob, Charlie and Control are not authorized.

Example 5: Threats in the office premises

[0221] One embodiment is intended for use in premises where a potential aggressor may threaten employees, the public or property. The system server 120 can be used to notify internally as well as externally. The organization can limit the authority to contact the police or other external resources, in this example to Control. In this example, the system server 120 ('Charlie') checks which of Alice's colleagues are at work before an attempt is made to find Bob with Bluetooth beacons. As mentioned, GPS will not give a correct position in an office building with several floors. It is generally desirable for a person to be located in the office building without registering manually, for example through a GUI in the system client.

[0222] It is Admin's job, not Control's, to add new card readers outside meeting rooms if and when they become available from the access control system. Admin also maintains lists of statuses, which attributes are mandatory and other general system information. Alice, Charlie and Control typically have responsibility for the content of the system 100, and may, for example, have administrative privileges to create a new Person 301 with a mandatory name. If the database 121 is a relational database, it is an RDBMS that refuses Alice or Control to register an unnamed user. In an RDB, there is also an RDBMS that denies unauthorized persons access to Alice's position or location data.

[0223] Alice can activate a screen button 'record' before she meets a potential aggressor in the meeting room. In this example, the system server 120 automatically sets Alice to standby status, and knows she is in the meeting room without Alice needing to use the GUI to state where she is. As mentioned, pubA to an Encryption on the computer in the meeting room can come from the system client 220 or the system server 120. The system server 120 can notify Bob in the neighboring office to pay extra attention.

[0224] Most meetings proceed without incident, and Alice ends the recording. This also ends the standby period. The standby period limits the amount of redundant data on disk. The encrypted video file from Alice's meeting can be deleted after a short stay on disk. The same applies to information in database 121 about when Alice was in the meeting room.

[0225] The organization's security policy may prohibit video recording of certain meetings in the room, eg business meetings. If 'recording' is started by mistake, the system log contains information about who started the recording and consequently who has the private key for decryption.

[0226] In some encounters, the aggressor ceases to be potential, and Alice raises an alarm. Then the system server sends a new message to Bob, who reacts quickly because he has been notified in advance. If the aggressor prevents Alice from triggering the alarm, Bob will not come to the rescue.

Charlie nevertheless hears about the incident afterwards, and archives the video file from the meeting.

Example 6: Alarm control

[0227] A typical hierarchy has the system owner at the top. She decides how the system is to be used, and gives the necessary instructions to Admin and Control. Control can typically choose between alternative ways of being notified. For example, it can be practical to get a screen shot on the office PC in one situation, and to receive an SMS in another.

[0228] In a preferred embodiment, Charlie is one or more processes in the system server 120 that receive alarms from the system client 220 or other server processes, for example at the expiration of a time-delayed alarm. A role in the organization, system owner and/or Control, determines who is to be notified when and with which message, any marking on the system console 140, etc. The desired reactions are stored in the system server 120. The system 100 does not depend on a physical person keeping a cool head in an emergency situation. Predefined reactions are performed automatically by the system server 120.

Example 7: Travel control

[0229] Control has an overview of people traveling in a 'Travel Control'. This is a subset of the server application with a suitable amount of screens and system functions. In ReiseKontroll, Control can see where the individual user is, the user's destination and other data the user has made available. Control can search for users who have checked in at a specific location or who have the location as their destination. This enables notification of users who are in an area. As before, the screens can be made available through a web interface and/or through a system console 140 in the local network.

[0230] A system console 140 with a large screen usually provides more information and a better overview than a typical smartphone application. For example, a large screen can display larger parts of a map with legible names than a small screen. A larger system console also provides easier access to system functions with associated arguments than an application for a smartphone. On a large screen, it is easy to call in all users in a larger area, for example after an earthquake, tsunami or hurricane warning. You don't know in advance what might happen, but you want to notify or check if something happens. In comparison, the system server 120 can automatically notify all three colleagues who are traveling with Alice when Alice triggers an alarm. Whoever arrives first helps Alice. For this, the system server 120 does not need any GPS information from the colleagues, but it may need a list of the mobile numbers of the colleagues who are traveling with Alice and an SMS message that Control has written in advance.

Example 8: Simulation

The organization will train an administrative team, which in this example includes the person Control. A simulation version of the system 100 has lists of predetermined messages and times for when they are to be sent. The messages are taken from a real implementation of the system 100, a production version The lists in this example play the roles of Alice and Bob, and constitute sub-scenarios. A Game Master uses a console 140 with a GUI to keep track of the progress of the game, selecting sub-scenarios as the game progresses.

[0231] The system 100 is described by means of examples which can be modified without inventive effort. The scope of the invention is defined in the subsequent patent claims.

Claims (15)

Patent claims 1. System (100) for responding to an alarm, with a system client (220), a system server (120) with a database (121), and a message between the system client (220) and the system server (120) in an application layer (150) ), characterized by - a system function and a reaction with at least one system function; - an intermediate storage (130) in a local area network with file systems where system functions in the system server (220) have read and write access, - a user status, of which at least one is an alarm status, - at least one user, where each user has a unique asymmetric cryptographic key pair with one public key and one private key, as well as a personal item where the user's (200) private key is hidden, where the system functions include - a recording function with sub-functions to obtain user data from a group consisting of audio, image, document and location data, - an encryption function with subfunctions to encrypt and decrypt a user's user data with the user's (200) asymmetric key pair, and - a storage function with partial functions for storing user data in the database (121) and the buffer (130), whereby user data encrypted with the user's public key can only be decrypted by an encryption function with read access to the user's private key. 2. System according to claim 1, further comprising a hashing function and a hash key that combines the user's private and public key. 3. System according to claim 1 or 2, where the system client (220) has at least one user message, where each user message in the system client (220) corresponds to a user status and a reaction in the system server (120). 4. System according to claim 3, where the user message has a corresponding 'quit' message which cancels the corresponding user status in the system server (120). 5. System according to claim 3, where the user message contains a time period. 6. System according to one of claims 3 - 5, where the user message is a 'delayed alarm' with a delay period, where an alarm reaction is performed at the end of the delay period. 7. System according to claim 6, further comprising a user message 'changed alarm' with a new time for when the system server (102) is to perform the 'delayed alarm' reaction so that the 'delayed alarm' reaction is accelerated or delayed. 8. System according to one of claims 3 - 7, where the user message is a recording message and a recording reaction comprises activating the recording function for recording equipment (230-232) close to the user (200). 9. System according to one of the claims 3 - 8, where the user message is a standby message that leads to increased attention from the system server 120. 10. System according to one of the preceding claims, further comprising a status for user data that overrides an automatic deletion function for data on disk. 11. System according to one of the preceding claims, where cancellation of a system function requires additional authentication of the person requesting cancellation. 12. System according to one of the preceding claims, where the system server (120) has a function for comparing location data in a predetermined sequence with actual position data received from the system client (220). 13. System according to one of the preceding claims, further comprising a system log with the time of when user data is created, read, changed or deleted, and a user ID that identifies the person who performed the action. 14. System according to one of the preceding claims, further comprising a routine for automatically backing up data in the intermediate storage. 15. System according to one of the preceding claims, further comprising a scenario list with messages from a production version of the system (100) and times for sending the messages, as well as a GUI with the possibility of selecting a scenario list.