JP5056481B2 - Data management method and apparatus - Google Patents

Description

  The present invention relates to a data management method used by a portable communication terminal such as a mobile phone, a portable communication terminal using data, a data management device, and a program for constructing the data management device by a computer.

2. Description of the Related Art Conventionally, there has been a data management system in which a mobile communication terminal having a communication function such as a mobile phone or a mobile computer is used to access a server storing data and perform data processing such as data browsing and modification. Has been developed.
In mobile communication terminals such as mobile phones, only mobile phone users can access (view / update / update) business-related phonebooks, e-mail, photo data such as photos, and business-related information that is referenced, entered, and updated on the terminal. Various data that should be managed so that others cannot access it are handled. Various security management techniques have been developed to protect the data (see, for example, Patent Documents 1 to 6).

In a conventional mobile phone, a terminal lock mechanism is prepared so that when a legitimate user loses the mobile phone or is stolen, others do not access internal data.
In practice, however, (1) you may forget to lock the lock manually even after you use it. (2) If you want the lock to automatically lock immediately after use, you may use the terminal from time to time. Because it is inconvenient when trying, it may be set so that it does not take a long time, such as 10 minutes after the last operation, (3) Even if it is used, leave it on the desk or from the pocket Others may access data in the terminal without being locked because it may fall into the hands of others.

  Even if it is lost and then returned to the user's possession by rediscovering / finding, it is uneasy because it is not known whether the data is being read by others. More specifically, a friend who may have leaked personal information from the phone book or data will be notified of the accident to change the address, and further, data leakage defined by rules such as personal information protection laws (other than the original authorized user) There is a problem that it is not possible to determine whether follow-up such as incident report processing of unauthorized access by another person) should be performed.

In order to respond to such a request, it is conceivable to place data on the server, perform access determination at any time, and record the access history, but such access is possible when the portable communication terminal is out of communication range. There is an inconvenience that management cannot be performed.
In data management systems such as those described above, data for handling precautions should not be leaked from portable communication terminals such as mobile phones, especially outside the communication range, in order to ensure compliance with information leakage of internal data for business purposes. There is a need for a mechanism that can verify this.

In Patent Document 1, the time from when the terminal is displayed until the terminal is accessed (operated) is managed to manage the access of the user terminal, and the portable communication terminal is in an out-of-communication state. It is not an invention for managing access when
Patent Document 2 also only allows dial lock and data erasure from a radio base station after the mobile terminal is lost, and performs access management when the mobile communication terminal is out of communication range. It is not an invention to be performed.

JP 2003-296234 A JP 2003-319453 A JP 2000-148276 A JP 2006-185116 A JP 2006-319432 A JP 2006-333345 A

  An object of the present invention is to make it possible to determine whether or not data leakage has occurred when the portable communication terminal is outside the communication range.

  According to the present invention, when the portable communication terminal receives a data access request, at least if the portable communication terminal is not connected to the server, access to the data in the portable communication terminal is permitted. , Recording information including the access execution time for each data, and transmitting the recorded information from the portable communication terminal to the server when the portable communication terminal is connected to the server. A data management method is provided.

  When the portable communication terminal receives a data access request, if at least the portable communication terminal is not connected to the server, access to the data in the portable communication terminal is permitted and the access execution time is Is recorded for each data, and when the portable communication terminal is connected to the server, the recorded information is transmitted from the portable communication terminal to the server.

Here, for each data, the server holds a data access management instruction including access prohibition together with an issuance time of the instruction, information including an execution time of access sent from the portable communication terminal, and the data access management instruction If the access execution time is later than the access management instruction issue time, this may be notified.
In addition, for each data in the portable communication terminal, the setting of the out-of-service valid time is held, and if the time when the portable communication terminal is not connected to the server exceeds the out-of-service valid time You may comprise so that data may be deleted.

Further, the access condition of the data may be stored in the portable communication terminal together with the data, and the access of the data may be made possible after confirming the establishment of the access condition when receiving the access request.
Further, the access condition may be changed even after the data arrives at the portable communication terminal, and whether or not access is possible may be determined based on the latest access condition.

Furthermore, information including the fact that is the basis for the data access permission determination in the portable communication terminal is recorded for each data, and the information is recorded when the portable communication terminal is connected to the server. Information may be transmitted from the portable communication terminal to the server.
Further, for each data, setting information relating to terminal lock for operation restriction in the portable communication terminal, setting information relating to authentication for releasing the terminal lock, and information relating to the execution content of the last authentication prior to data access. The information may be recorded and transmitted from the portable communication terminal to the server when the portable communication terminal is connected to the server.

  Furthermore, the input of biometric information at the time of data access is used as an access condition, the input biometric information is recorded for each data, and the recording is performed when the portable communication terminal is connected to the server. The information may be transmitted from the portable communication terminal to the server.

  Further, according to the present invention, a server having server-side storage means for storing data accessible from the portable communication terminal, terminal-side connection state determination means for determining whether or not the server is in a connection state, When it is determined that the terminal-side connection state determination means is not connected to the server when a data access request is received, it is obtained from the server and stored in the terminal-side storage means when connected to the server The access side data is permitted and information including the access execution time is stored for each data, and when the terminal side connection state determination unit determines that the connection state with the server has been established, the terminal side storage unit stores the information. There is provided a data management system comprising a portable communication terminal having terminal-side data processing means for transmitting stored information to the server. .

  A server having server-side storage means for storing data accessible from a portable communication terminal, a terminal-side connection state determination means for determining whether or not the server is connected, and a terminal-side data processing means include data When it is determined that the terminal-side connection status determination means is not connected to the server when receiving the access request, the data obtained from the server and stored in the terminal-side storage means when the server is connected to the server Information stored in the terminal-side storage means when access is permitted and information including the execution time of the access is stored for each data, and the terminal-side connection state determination means determines that the connection state with the server has been established. To the server.

  Here, the server stores a data access management instruction including an access prohibition for each data in the server-side storage unit together with an issuance time of the instruction, and information including an access execution time sent from the portable communication terminal And the data access management instruction, and if the access execution time is later than the access management instruction issuance time, a server-side data processing means for notifying this may be provided.

The terminal-side data processing means stores out-of-service valid time settings for each data in the portable communication terminal in the terminal-side storage means, and the portable communication terminal is not connected to the server. May be configured to delete the data when the valid time exceeds the out-of-service period.
Further, the terminal-side data processing means stores the access condition of the data together with the data in the terminal-side storage means, and enables data access after confirming that the access condition is satisfied when an access request is received. You may comprise as follows.

The access condition may be changed even after the data arrives at the portable communication terminal, and the terminal-side data processing means may be configured to determine whether access is possible based on the latest access condition. Good.
The terminal-side data processing means further records, for each data, information including facts that have become the basis for data access permission determination in the portable communication terminal, and the terminal-side communication means is connected to the server-side communication means. The recorded information may be transmitted from the terminal-side communication means to the server.

  The terminal-side data processing means further includes setting information relating to terminal lock for operation restriction in the portable communication terminal, setting information relating to authentication for releasing the terminal lock, and last authentication before data access. Information related to execution contents is recorded in the terminal-side storage means for each data, and when the terminal-side connection state determination means determines that the portable communication terminal is connected to the server, the terminal-side storage means The information recorded in the terminal may be configured to be transmitted from the terminal side communication means to the server.

  The terminal-side data processing means records the input biological information in the terminal-side storage means for each data, with the input of biometric information at the time of data access as an access condition, and the terminal-side connection state determination means However, when it is determined that the portable communication terminal is connected to the server, the recorded information may be transmitted from the terminal-side communication means to the server.

Further, according to the present invention, connection state determination means for determining whether or not the server is in a connection state,
When the connection state determination unit determines that the server is not connected to the server when receiving a data access request, access to the data obtained from the server and stored in the storage unit when connected to the server Information including the execution time of the access is stored for each data, and the information stored in the storage unit is transmitted to the server when the connection state determination unit determines that the connection state is established with the server. There is provided a portable communication terminal comprising a data processing means.

  When the data processing means determines that the connection state determination means is not connected to the server when receiving the data access request, the data processing means obtains data from the server and stores it in the storage means when connected to the server The information including the execution time of the access is stored for each data, and the information stored in the storage unit is stored when the connection state determination unit determines that the connection state is established with the server. Send to server.

Here, the data processing means stores an out-of-service valid time setting for each data in the portable communication terminal in the storage means, and the time when the portable communication terminal is not connected to the server is out of the service area. When the time valid time is exceeded, the data may be deleted.
Further, the data processing means is configured to store the access condition of the data together with the data in the storage means, and to enable data access after confirming that the access condition is satisfied when an access request is received. May be.

The access condition may be changed even after the data arrives at the portable communication terminal, and the data processing means may be configured to determine whether access is possible based on the latest access condition.
Further, the data processing means further records, for each data, information including a fact that is a basis for data access permission determination in the portable communication terminal, and when the communication means is connected to a server, The recorded information may be transmitted from the communication means to the server.

  Further, the data processing means further includes setting information relating to terminal lock for operation restriction in the portable communication terminal, setting information relating to authentication for releasing the terminal lock, and execution contents of the last authentication before data access Information is recorded in the storage unit for each data, and when the connection state determination unit determines that the portable communication terminal is connected to the server, the information recorded in the storage unit is transmitted from the communication unit. You may comprise so that it may transmit to the said server.

  In addition, the data processing means uses biometric information input as an access condition at the time of data access, records the inputted biometric information in the storage means for each data, and a connection state judging means is used for the portable communication terminal. The recorded information may be transmitted from the communication means to the server when it is determined that the server is connected.

  Further, according to the present invention, in a server having storage means for storing data accessible from the portable communication terminal, a data access management instruction including access prohibition for each data is stored in the storage means together with the time of issuing the instruction. Then, the information including the access execution time sent from the portable communication terminal is compared with the data access management instruction, and if the access execution time is later than the access management instruction issuance time, this is notified. A server characterized by comprising data processing means is provided.

  The data processing means stores a data access management instruction including access prohibition for each data in the storage means together with an issuance time of the instruction, and information including an access execution time sent from the portable communication terminal and the data access management instruction If the access execution time is later than the access management instruction issue time, this is notified.

  Further, according to the present invention, the computer stores a data access management instruction including access prohibition for each data in the storage means together with an issuance time of the instruction, and executes an access execution time sent from the portable communication terminal. There is provided a program characterized by comparing information contained therein and the data access management instruction, and when the access execution time is later than the access management instruction issuance time, the information processing function is notified. .

  By executing the program, the computer stores a data access management instruction including access prohibition for each data in the storage unit together with an issuance time of the instruction, and includes an access execution time sent from the portable communication terminal. It functions as data processing means for comparing information and the data access management instruction, and notifying if the access execution time is later than the access management instruction issuance time.

According to the data management method and data management system of the present invention, it is possible to determine whether or not data leakage has occurred when the portable communication terminal is outside the communication range.
Further, according to the present invention, it is possible to provide a data management apparatus and a portable communication terminal suitable for the data management method and data management system.
Further, according to the present invention, it is possible to provide a program capable of constructing the data management device using a computer.

First, an outline of a data management method, a data management system, a data management device, and a portable communication terminal according to an embodiment of the present invention will be described.
In the embodiment of the present invention, the data management system includes a portable communication terminal such as a mobile phone that is held and used by a user, and a server that holds the substance of data to be managed.
When a user normally tries to access data through the portable communication terminal when the portable communication terminal and the server are in a connected state, the user actually makes a request to the server, and the server sends the data to the recipient terminal for access. I am doing so.

  In preparation for the disconnection outside the communication range, when the connection is established, the management target data is sent from the server in advance to the portable communication terminal and held in the portable communication terminal. Keep the two in sync as long as they are in the connected state (when the portable communication terminal is connected, record access access to the server data. As auxiliary information, also record the user authentication method, time since authentication, etc. To do.)

  The access of the management target data in a non-connected state (out of communication range) with the server logs the access date and time and the access operation (access / update / local copy, etc.). As auxiliary information, the user authentication method in the portable communication terminal, time since authentication, and the like are also recorded. When the portable communication terminal returns to the communication range, the local data access record is notified to the server, so that the data creator and the manager can also confirm whether there is data leakage.

Thus, in this embodiment, in a data management system using a portable communication terminal such as a cellular phone, for example, to ensure compliance with respect to information leakage of internal data for business use, the portable communication terminal can be used even when out of service area. A system that can verify that handling data has not been leaked is implemented.
In addition, information (eg business files such as phone books, e-mails, photos, and documents) accessed by a portable communication terminal is basically placed on the server, and the portable communication terminal is out of communication range (not connected to the communication path) A copy (cache) is placed on the portable communication terminal in preparation for a situation. As long as it is in a connected state, both are synchronized.

When the server is not connected (out of communication range), data in the terminal is accessed. This data access is performed by logging the access date and time and the access operation (viewing / updating / copying etc.) in the terminal. As auxiliary information, the user authentication method and the time since authentication at the terminal are also recorded.
When the terminal returns to the in-range state, the data creator / administrator can also check whether there is data leakage by notifying the server of the data access record in the terminal during the out-of-service period. Thereafter, the data and the like are synchronized according to the server information.

Hereinafter, embodiments of the present invention will be described in detail. In addition, the same code | symbol is attached | subjected to the same part and description is abbreviate | omitted.
FIG. 1 is a block diagram showing a basic configuration of a data management system used for a data management method according to an embodiment of the present invention.
FIG. 1 is a block diagram showing a basic configuration of Embodiment 1 of the invention. The data management system is pre-registered for the user P to access data, and the mobile phone terminal (hereinafter referred to as “P terminal”) 101, which is a portable communication terminal that the user P normally holds and uses, and a communication channel A server 102 connected via a public line (for example, a public line) is provided.

The mobile phone terminal 101 includes an access history management unit 103, a terminal data processing unit 104, a connection state determination unit 105, a terminal data storage unit 106, a user interface unit 107, and a communication unit 108.
The server 102 includes a remote management unit 111, an access verification unit 112, a server data processing unit 113, a server data storage unit 114, a connection state determination unit 115, and a communication unit 116.

  The server 102 holds and manages contract user data, and provides a function of managing and recording access to the data. In order to hold and manage data for each user, the server 102 prepares terminal data 201 including a data management table TP1 and the like as shown in FIG. 2, and updates it as necessary.

  The user interface unit 107 of the mobile phone terminal 101 receives input from the user through a key input unit such as a numeric keypad, and displays output to the user on a display unit such as a screen. When a user accesses data created by himself or others with his / her terminal 101, access data is prepared by referring to the terminal data storage unit 106 from the terminal data processing unit 104, and the user through the user interface unit 107 This operation can be accessed by the user.

  The data structure of the terminal data storage unit 106 is shown in FIG. For each data item, data type / management information (data sensitivity, range of accessible users, access policy such as whether access is possible on a terminal outside the service area, whether copying is possible, data, etc. In addition to data creation / administrator information, creation date / time, file name, size, etc.) and data body (main body) for creating and managing data, information on access history is held.

  As described later, the access history is recorded by the mobile phone terminal 101 when the mobile phone terminal 101 is out of the communication range, and is managed and updated by the access history management unit 103. And the type of access such as read and update (in FIG. 2, read = read, update = write). The “table last update date and time TP2” is the date and time when the access history column of the table TP1 was last updated (as will be described later, this is the last data when the terminal 101 is out of communication range. "Synchronization date and time TP3" holds the date and time when the data synchronization operation was last performed with the server 102.

  Of the data in the terminal data storage unit 106 described above, the part other than the access history is basically sent from the server 102, while the access history information generated and updated by the access history management unit 103 of the terminal 101 is Sent from the terminal 101 to the server 102. These communications are performed via the communication units 108 and 116. The connection state determination unit 105 is not in a connected state because the terminal 101 and the server 102 are currently in a connected state so that data can be exchanged over a public line or the like, for example, the terminal 101 is out of the radio wave range ( The above communication is possible when in a connected state.

  The server data storage unit 114 managed by the server data processing unit 113 of the server 102 holds the data body (original data) of the terminal data storage unit 106. The configuration of the server data 301 stored in the server data storage unit 114 is shown in FIG. However, the configuration of the data management table TP1S is basically the same as that of the data management table TP1 of the terminal 101, but there is a column for holding information related to a data management instruction, which will be described later, instead of the access history column. The “table last update date and time TP2” is the date and time when the table TP1S on the server 102 was last updated, and the “synchronization date and time TP3” is the date and time when the registered terminal and the server 102 last performed the data synchronization operation. Hold.

  The remote management unit 111 receives an instruction for data management such as deleting data in the terminal 101 from each data creator or manager, and sends this to the terminal 101. The access verification unit 112 compares the access policy defined for each data with the access history, detects an access that violates the policy, and activates a prescribed action such as notifying the file creator / manager when detected.

  The access history management unit 103 and the terminal data processing unit 104 constitute terminal side data processing means. The remote management unit 111, the access verification unit 112, and the server data processing unit 113 constitute server side data processing means. The connection state determination units 105 and 115 constitute a terminal side connection state determination unit and a server side connection state determination unit, respectively. The terminal data storage unit 106 and the server data storage unit 114 constitute a terminal side storage unit and a server side storage unit, respectively. The communication units 108 and 116 constitute a terminal side communication unit and a server side communication unit, respectively.

FIG. 4 is a flowchart showing the processing in the present embodiment, and is a diagram for explaining the flow of operations in the server 102 when new data Pn is written to the server 102.
First, a request for writing new data to the server 102 arrives at the server 102 (step S401).

  At this time, when the creator of the data is the terminal user P (for example, when creating a document on the terminal or saving a photograph taken by the terminal 101), the data created by another creator is the terminal user. When P is received by the terminal 101 and written from the terminal 101 to the server 102 (when another person's created file is received by e-mail to the terminal 101, or when a file other than the server such as WLAN is accepted by the terminal 101) The write request arrives at the server 102 from the terminal 101. On the other hand, for example, business mail may be written to the server 102 without going through the terminal 101 as in the case where the business mail is directly delivered to the server 102.

  When a request for writing new data Pn to the server 102 arrives at the server data processing unit 113 of the server 102 in this way, the server data processing unit 113 stores the data management table of the user P in the server data storage unit 114 of the server 102. One line is added to TP1, and an entry corresponding to Pn is created (step S402). The entry corresponds to each row of TP1 in FIG. 2, and stores a serial number, data type, management information, and data body. At this point, the access history is blank. As described above, when the server data processing unit 113 writes new data and completes the data update of the server 102, the table last update date / time TP2 is updated to the time stamp value of the date / time (step S403).

  Subsequently, the connection state determination unit 115 of the server 102 determines whether or not the terminal 102 (hereinafter referred to as “P terminal”) 101 that the user P has registered in advance to read data and the server 102 are in a connection state. (IF1, step S404) If there is a connection state, the server data processing unit 113 transmits update data (new data Pn and latest table TP1) to the terminal 101 via the communication unit 113 (C4, step S405). The terminal data processing unit 104 receives the update data via the communication unit 108, and updates the data information in the P terminal 101 stored in the terminal data storage unit 106 so as to be synchronized with that of the server 102 (step S406).

  This can be done by sending the entire table TP1 of the server 102 to the terminal 101 and overwriting the relevant part of the terminal data storage unit 106 of the terminal 101, but only sending the new part by looking at the difference information from the previous time. It can also be realized by overwriting. After the synchronization with the terminal 101 is completed, the table synchronization date and time TP3 is updated to the time stamp value of that date and time.

  On the other hand, if the connection state determination unit 115 determines in step S404 that the terminal 101 is out of service, such as being out of service, the connection state determination unit 115 records that the corresponding row is not synchronized in the state holding unit of the data Pn (step S407). ), Indicating that a new synchronous update of the terminal 101 is necessary. When there is an unupdated row in this way, the table last update date / time TP2 is newer than the synchronization date / time TP3, and the state SS1 is required to be synchronized.

FIG. 5 is a flowchart for explaining an operation flow in the mobile phone terminal when the user requests access to certain data in the mobile phone terminal.
In this case, when the user requests access to certain data via the user interface unit 107 in the mobile phone terminal (step S501), the terminal data processing unit 104 first refers to the table TP1 in the terminal data storage unit 106 ( In step S502), if the information of the row corresponding to the data exists and is accessible from there, the data body is provided for user access via the terminal data processing unit 104 and the user interface unit 107 (step S502). S503).

  Next, the connection state determination unit 105 of the terminal 101 determines whether or not the terminal 101 and the server 102 are in a connected state (IF2, step S504). If the terminal 101 is in a connected state, details of this access (for example, access history) Is notified to the server 102 (C5, step S505, see FIG. 9 for the operation on the server 102 side).

  On the other hand, when the terminal 101 and the server 102 are not connected in processing step S504 (IF2), the access history management unit 103 records and updates the details of this access in the “access history” column of the data management table TP1. (Step S506). What is recorded includes the access date and time. This information is used to determine the presence or absence of a data leak accident, the investigation of the person who executed the access, and the cause. Subsequently, the access history management unit 103 also updates the table last update date / time TP2 with the date / time information so as to indicate that the access history is updated by executing the access in the terminal 101 in the disconnected state (step S507). .

FIG. 6 is a flowchart for explaining an operation flow in the server 102 when a data management instruction regarding data already handled in the server 102 arrives at the server 102 from the outside.
The data management instruction means that, for example, when the original user loses the terminal 101, the data in the terminal 101 is deleted, and the subsequent user of the terminal 101 (this is highly likely not an authorized user) ) Is an instruction to prevent access to this.

  Alternatively, it is also used when updating an access policy or the like under which conditions of the existing data entity part or management information part may be accessed. Such a data management instruction is issued by an individual data creator or manager, or a manager of the terminal 101 other than the user of the terminal 101, and arrives at the remote management unit 111 of the server 102. .

In FIG. 6, when the remote management unit 111 of the server 102 receives a data update instruction addressed to the terminal 101 of the user P (step S601), the server data processing unit 113 first causes the user P of the server data storage unit 114 of the server 102 to This is held in the data management instruction column of the entry corresponding to the data in the reception data table TP1, and the management information, the data body, etc. are updated to reflect this change as necessary (step S602).
When the data management instruction message arrives and the server 102 finishes updating the data, the server data processing unit 113 updates the table last update date and time TP2 to the time stamp value of that date and time (step S603).

Subsequently, it is determined whether or not the connection state determination unit 115 of the server 102 is connected to the terminal 101 (step S604). If the connection state is determined, the server data processing unit 113 performs data management on the P terminal 101. An instruction is sent (C4, step S605).
After the synchronization with the terminal 101 is completed, the server data processing unit 113 updates the table synchronization date and time TP3 to the time stamp value of that date and time (S606).

On the other hand, if the connection is not established in the processing step S604 (the terminal is out of service area), the server data processing unit 113 records that it is not synchronized in the data management instruction column, and this line has been updated after the previous synchronization. Indicates that the terminal 102 needs to be updated synchronously (step S607).
As can be seen from the above description, as long as the server 102 and the terminal 101 are in the connected state, the terminal 101 and the server 102 are synchronized, and the terminal 101 holds the same data as the server 102 and arrives at the server 102. The data management instruction is sent to the terminal 101 and reflected in the data in the terminal 101.

For example, if an instruction to delete the data of the terminal 101 or change the access policy has arrived at the server 102, this is executed by the terminal 101.
Furthermore, access information of terminal data stored in the terminal data storage unit 106 is sent to the server 102. At this time, the synchronization date / time TP3 is newer than the last update date / time TP2 of both tables. In this flowchart, the server 102 is in the SS0 state and the terminal 101 is in the TS0 state.

  On the other hand, if new data or a data management instruction arrives at the server 102 while in the disconnected state, these should be sent to the terminal 101 as soon as the connected state is reached. This fact is recorded in the management instruction column, and the table last update date TP2 is newer than the synchronization date TP3 on the server 102 side. At this time, the server 102 is in the SS1 state.

  Further, if data access is performed at the terminal 101 while in the disconnected state, this access history should be notified to the server 102 as soon as the connected state is reached, and the access history of unreported data is used to indicate this state. This is recorded in the column, and the table last update date TP2 is newer than the synchronization date TP3 in the terminal 101. At this time, the terminal 101 is in the TS1 state.

FIG. 7 is a flowchart for explaining an operation flow in the terminal 101 when the P terminal 101 receives new data or a data management instruction from the server 102.
As shown on the right side of the figure, the connection state determination unit 105 of the terminal 101 performs polling until the terminal 101 and the server 102 return to the connected state (steps S803, IF2, and S804).

When returning to the connected state, a signal C3 notifying the return of the terminal 101 within the range is transmitted from the connection state determining unit 105 to the server 102 via the communication unit 108 (step S805).
Next, when the terminal data processing unit 104 is in the TS1 state, that is, when the table last update date / time TP2 is newer than the synchronization date / time TP3 in the terminal 101 and there is an access history to be notified to the server 102, all such access histories are displayed. Send to server 102. In addition, the terminal data processing unit 104 initializes the sent history information after transmission, and also updates the synchronization date and time (step S806).

As will be described with reference to the flowchart of FIG. 8, when the server data processing unit 113 of the server 102 receives the in-area return signal C3 of the terminal 101 (step S701), if there is an unupdated new data or an unsynchronized data management instruction, (Step S702), these are sent to the terminal 101 (Step S703, C4), and the synchronization date TP3 is updated (Step S704).
The terminal 101 uses the access history management unit 103 and the terminal data processing unit 104 to update data in the terminal data storage unit 106. That is, the access history management unit 103 and the terminal data processing unit 104 delete data if the data management instruction indicates data deletion, for example, and rewrite it if the management unit is updated.

  FIG. 8 is a flowchart for explaining an operation flow in the server 102 when the terminal P receives the return signal C3 within the range. When the server data processing unit 113 receives the within-area return signal C3 of the terminal P via the communication unit 116 (step S701), the server data processing unit 113 compares the synchronization date and time TP3 with the value of the table last update date and time TP2 (step S702) and performs the last update. If the date and time TP2 is new, there is an unsynchronized data or unsent data management instruction, so information for this update is sent from the server 102 to the terminal 101 (step S703), and the terminal 101 is synchronized with the latest state. After the synchronization with the terminal 101 is completed, the server data processing unit 113 updates the table synchronization date / time TP3 to the time stamp value of that date / time.

FIG. 9 is a diagram for explaining the flow of operations in the server 102 when the data access information in the terminal 101 in the connected state or the access history information during the non-connected state arrives at the server 102 from the terminal 101 It is a flowchart.
When data access information from the terminal 101 or access history information during the disconnected state arrives at the server 102 (step S901), the access verification unit 112 receives the access information or the access history during the disconnected time period, The data management instruction received by the remote management unit 111 is compared and verified (step S902), and a necessary action is taken (step S903).

  For example, the terminal 101 has been lost and a data management instruction has arrived indicating that certain or all of the data in the terminal 101 should be deleted. However, since the terminal 101 is in a disconnected state, it is not sent to the terminal 101. If the terminal 101 accesses the data while it is not being executed, the data creator / manager and the terminal manager are notified that this is inappropriate access.

  As described above, according to the present embodiment, the original user loses the terminal 101 and before the data deletion command is sent and executed in order to prevent leakage of data in the terminal 101, or the terminal When the remote command is not executed without arriving at the terminal 101 because the terminal 101 is out of service area, the data leakage (originally) is performed before the terminal 101 returns to the connected state and the data deletion command is executed again. It is possible to know whether or not unauthorized access by another person other than the authorized user has occurred) from the saved and notified record, and it is possible to take necessary post-reaction measures.

Next, a second embodiment of the present invention will be described.
By using the first embodiment described above, when the original user loses the terminal 101, a terminal in a connected state is sent by sending a data deletion command from the server 102 in order to prevent leakage of data in the terminal 101. 101 data can be deleted, and even when temporarily out of service area, remote deletion is executed when the connection is restored, and access until the execution is recorded and notified. It is possible to know the presence / absence of (unauthorized access by someone other than the original authorized user) and take action.

However, with this alone, the terminal 101 is left out of range for a long time, and a sufficient amount of time is taken during this period to try brute force PINs, or to read and interpret data by disassembly or electronic reading of the internal memory. there is a possibility.
In order to prevent this, it is possible to set to delete data when the non-connection state continues for a certain time or more as follows.

As an example for realizing this, there is a second embodiment shown in FIGS.
Here, the data creator / manager or the manager of the terminal 101 can set in advance an expiration date within the terminal 101 for each data when the terminal 101 is continuously out of service. This expiration date is specified to be in the “out-of-service time limit” of the data management table TP1 of data shown in FIG. 10, and is sent from the server 102 and held in the terminal 101 together with the data, and is updated by a data management instruction. The
Here, this column shows the length of time that the data should be deleted internally if the terminal 101 is continuously out of range. For example, 10 m is 10 minutes, 6 h is 6 hours, 3 d is 3 The day, 30s indicates 30 seconds. Other configurations are basically the same as those of the first embodiment.

As the operation, as shown in the flowchart explaining the flow of the operation in the terminal 101 in the out-of-service state, the connection state determination unit 105 of the terminal 101 performs polling until the terminal 101 and the server 102 return to the connected state. In the data management table in which the synchronization operation with the server 102 (which should have been sent at this time if there was a data management instruction for remote data deletion) is performed periodically when in a disconnected state. The elapsed time from the synchronization date and time TP3 to the current time is calculated, and this is compared with the out-of-service time limit of each data, and data whose elapsed time has exceeded the out-of-service time limit is deleted (step S1101). Other operations are the same as in the previous embodiment.
As a result, the data deletion function and the data access history notification function based on the synchronization operation with the server can be complemented, and the risk of data leakage when the disconnected state is maintained for a long time can be reduced.

Next, a third embodiment of the present invention will be described.
Conventionally, the data creator creates data (for example, an estimate or a technical document that can be seen only by business partners), passes it to the viewing-permitted partner (recipient), and the receiver stores it in his terminal. Then, the recipient can freely view it at any time, and the sender cannot manage and control the viewing method and usage.

  On the other hand, for some types of data, the usage pattern is “I want to send this technical document for business partners to the recipient for reference. Therefore, there is a need such as “I want to be able to browse only once” or “I want to send an estimate, but I want to make browsing impossible before X days or after Y days”. A system for realizing this will be described.

FIG. 12 is a block diagram of a data management system according to the third embodiment of the present invention.
The third embodiment basically includes an access condition determining unit 1201 in addition to the same configuration as that of the first embodiment. Further, the data management table TP1 of the terminal data 1301 has a configuration as shown in FIG. 13, and each data has an access condition column. The access history management unit 103, the terminal data processing unit 104, and the access condition determination unit 1201 constitute terminal side data processing means.

  For example, if the access condition is “only once”, this data can be browsed only once, and thereafter cannot be browsed. If “up to Y day”, the data cannot be browsed after Y day. It ’s like that. This table TP1 is originally in the server 102, written from the server 102, exists in the terminal 101, and has the same value in synchronization as long as it is connected to the server 102.

  This access condition is determined when the data creator creates and distributes data, and is stored together with the data in the server 102 and the terminal 101. The data creator / manager can change this after distribution. . This change instruction is issued in the same manner as the management instruction such as data deletion in the previous embodiment, and management is performed in the server 102 and the terminal 101 after reception. For example, change the access condition of the data which has been set to “unconditional browsing possible” to “temporarily stop browsing until the browsing resume message arrives”, or set “3 times browsing possible” and “you can browse until Y day” to “ For example, change to “once” and “until Z day T time”.

The operation when the user requests access to data is shown in the flowchart of FIG.
In addition to the conventional procedure, the access condition determination unit 1201 determines whether or not the access condition specified in the access condition column has been established based on the access history and current time information so far (step S1401). Access is permitted only when the condition is satisfied (step S1402), otherwise access is denied (step S1403), and “data cannot be referred to” is displayed to the user.

  When the terminal 101 is in a disconnected state, the management instruction arriving at the server 102 is immediately reflected in the management table TP1 of the terminal 101. Therefore, the change instruction of the data creator is reflected and implemented without delay. When 101 is in the out-of-service (non-connected) state, the access condition is determined based on the old condition when it is in the last connected state.

  In order to complement this, as shown in FIG. 14, in the process step S506, when accessing in the unconnected state, the access condition determination record of the access condition determination unit 1201 at that time is also recorded in the history. This is what condition is set when the condition at that time is, and what is the basis of the state at the time of access request at the time of out-of-service based on whether access is permitted or denied.

  This information is sent to the server 102 when the connection is restored as in FIG. 7, and the validity of the determination is verified as in FIG. 9, for example, an instruction that the data creator should deny access. However, if access is made after that time despite the fact that it was issued, the data creator / administrator and terminal administrator are deemed to be inappropriate access. You will be notified.

  As a result, even if the file creator sets a policy for access for each file and wants to change it after distribution, it ensures compliance with the recipient's terminal access while connected, and it is convenient when out of service In order to improve performance, access is permitted based on local judgment, but if this judgment is actually contrary to the intention of the data creator, it is verified and fraud that violates the policy set by the data creator and changes from time to time. Whether or not access has occurred can be known from the stored or notified record, and necessary post-action measures can be taken.

In other embodiments, in each of the above embodiments, as long as the server and the terminal are in a connected state, all data on the server is placed on the server and simultaneously synchronized with the terminal. Is controlled. However, as with normal computer caching, it is also possible to perform control to copy and hold the data item to the terminal at the first access.
As a result, communication traffic can be reduced especially when the amount of data with low access frequency and usage rate is large, and the storage capacity (memory hardware amount) required in advance on the terminal side can be reduced.

Still another embodiment will be described.
Mobile phone terminals should normally be used only by authorized users, but it is a problem that others use them due to loss, theft, etc. Information on whether the data access on the terminal is the person himself or the risk of others is high It is important when verifying whether or not unauthorized access or information leakage has occurred, and what the cause is.

In other embodiments, the date and time of access at a terminal is recorded as an access history in each of the above embodiments. In this embodiment, information on lock / authentication of the terminal is used at this time. Is also recorded.
More specifically, regarding the locked state in which the terminal cannot be used and the access operation is prohibited, the terminal is not automatically locked or is set to be closed when it is closed with a foldable mobile phone. Whether this is the setting after X minutes.

Also, regarding unlocking, how many digits of PIN code, unlocking by biometric authentication such as face authentication, etc., and what the actual data access was made from the last unlocking Minutes later, the last release includes what kind of authentication, when it was made, and how many times the wrong number was entered.
This records the facts to analyze whether the access was made by a legitimate user, whether it was likely to have been done by someone else, and how much the legitimate user had terminal specifications and data management errors. Can be verified.

Still another embodiment will be described.
When recording information related to authentication in each of the above embodiments, the inner camera of the mobile phone is activated to capture a face image, which is recorded and sent to the server. Face authentication of whether or not the user is a regular user can be performed using the face image thus captured. For particularly important data, such face recording and face authentication can be set to be indispensable conditions for data access.

Of course, the biometric information used here is not limited to a face image, but may be other personal information such as an iris image, a fingerprint, or a vein.
By taking and recording images with personality like a face in this way, the possibility of unauthorized data access is reduced to increase safety, and deterrence to the actions of others trying to access data illegally It becomes.

  In each of the above-described embodiments, the portable communication terminal has been described as an example of a mobile phone. However, PHS (Personal Handyphone System), PDA (Personal Data Assistance, Personal Digital Assistants), etc. The present invention can be applied to a portable communication terminal having a data processing function and a communication function. The present invention is also applicable to a portable communication terminal using a wireless local area network (LAN).

  Suitable for mobile phone, PHS, PDA, portable personal computer, data management method, data management system, data management method and data management system using portable communication terminal and server having data processing function and communication function It can be used for various portable communication terminals and servers.

It is a block diagram which shows the basic composition of the data management system used for the data management method which concerns on the 1st Embodiment of this invention. It is a figure which shows the table used for the 1st Embodiment of this invention. It is a figure which shows the table used for the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a figure which shows the table used for the 2nd Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 2nd Embodiment of this invention. It is a block diagram which shows the basic composition of the data management system used for the data management method which concerns on the 3rd Embodiment of this invention. It is a figure which shows the table used for the 3rd Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 3rd Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 ... Mobile phone terminal 102 ... Server 103 ... Access history management part 104 ... Terminal data processing part 105 ... Connection state determination part 106 ... Terminal data storage part 107 ... User interface Unit 108 ... communication unit 111 ... remote management unit 112 ... access verification unit 113 ... server data processing unit 114 ... server data storage unit 115 ... connection state determination unit 116 ... communication Unit 1201... Access condition determination unit

Claims (16)

When the portable communication terminal receives a data access request, if at least the portable communication terminal is not connected to the server, access to the data in the portable communication terminal is permitted and the access execution time is For each data, and when the portable communication terminal is connected to the server, the recorded information is transmitted from the portable communication terminal to the server ,
The server holds, for each data, a data access management instruction including access prohibition together with an issuance time of the instruction, and compares the data access management instruction with information including an access execution time sent from the portable communication terminal. A data management method of notifying when an access execution time is later than an access management instruction issuance time . For each data in the portable communication terminal, the setting of the out-of-service valid time is held, and when the time during which the portable communication terminal is not connected to the server exceeds the out-of-service valid time, the data is stored. The data management method according to claim 1 , wherein the data management method is deleted. The access condition of the data stored in the portable communication in the terminal with the data, according to claim 1 or 2, after confirming the establishment of the access condition when receiving an access request, characterized in that to enable access data The data management method described. 4. The data management method according to claim 3 , wherein the access condition can be changed even after the data arrives at the portable communication terminal, and whether access is possible is determined based on the latest access condition. In addition, information including facts that are the basis for data access permission determination in the portable communication terminal is recorded for each data, and when the portable communication terminal is connected to the server, the recorded information is recorded. The data management method according to claim 1 , wherein the data is transmitted from the portable communication terminal to the server. Further, setting information related to terminal lock for operation restriction in the portable communication terminal, setting information related to authentication for releasing the terminal lock, and information related to execution contents of the last authentication before data access are recorded for each data. , when the mobile communication terminal is in a connected state with the server, the data management method according to claim 1, wherein the transmitting the recorded information from the portable communication terminal to the server. Furthermore, the input of biometric information at the time of data access is used as an access condition, the input biometric information is recorded for each data, and the recorded information is recorded when the portable communication terminal is connected to the server. the data management method according to claim 1, wherein the transmitting to the server from the portable communication terminal. A server having server-side storage means for storing data accessible from the portable communication terminal;
A terminal-side connection state determination unit that determines whether or not the server is in a connection state; and when the terminal-side connection state determination unit determines that the server is not in a connection state when receiving a data access request, Allowing access to data obtained from the server and stored in the terminal-side storage means when connected to the server, and storing information including the execution time of the access for each data, and determining the terminal-side connection state when the unit is determined to have a connected state with the server, Ri formed by a mobile communication terminal having a terminal side data processing means for transmitting information stored in the terminal side storing unit to the server,
The server stores a data access management instruction including access prohibition for each data in the server-side storage unit together with an issuance time of the instruction, and information including an access execution time sent from the portable communication terminal and the data A data management system comprising server-side data processing means for comparing access management instructions and notifying when the access execution time is later than the access management instruction issuance time . The terminal-side data processing means stores out-of-service valid time settings for each data in the portable communication terminal in the terminal-side storage means, and the time when the portable communication terminal is not connected to the server is 9. The data management system according to claim 8, wherein the data is deleted when the valid time outside the service area is exceeded. The terminal-side data processing means stores the access condition of the data together with the data in the terminal-side storage means, and enables data access after confirming that the access condition is satisfied when an access request is received. 10. A data management system according to claim 8 or 9, characterized in that: Wherein the access condition can be changed the data even the portable communication terminal after arrival, the terminal side data processing unit, according to claim 10, wherein determining based on the propriety of access to the latest access conditions The data management system described. The terminal-side data processing means further records, for each data, information including facts that have become a basis for data access permission determination in the portable communication terminal, and the terminal-side communication means is in a connection state with the server-side communication means. 9. The data management system according to claim 8 , wherein the recorded information is transmitted from the terminal side communication means to the server. The terminal-side data processing means further includes setting information relating to terminal lock for operation restriction in the portable communication terminal, setting information relating to authentication for releasing the terminal lock, and execution contents of the last authentication before data access For each data is recorded in the terminal-side storage means, and when the terminal-side connection state determination means determines that the portable communication terminal is connected to the server, the information is recorded in the terminal-side storage means 9. The data management system according to claim 8 , wherein the received information is transmitted from the terminal side communication means to the server. The terminal-side data processing means uses the input of biometric information at the time of data access as an access condition, records the input biometric information in the terminal-side storage means for each data, and the terminal-side connection status determination means 9. The data management system according to claim 8 , wherein the portable communication terminal transmits the recorded information from the terminal-side communication means to the server when it is determined that the portable communication terminal is connected to the server. In a server having storage means for storing data accessible from a portable communication terminal,
A data access management instruction including access prohibition for each data is stored in the storage unit together with an issue time of the instruction, and information including an access execution time sent from the portable communication terminal is compared with the data access management instruction. A server comprising data processing means for notifying when the access execution time is later than the access management instruction issuance time. Computer
A data access management instruction including access prohibition for each data is stored in the storage unit together with an issue time of the instruction, and information including an access execution time sent from the portable communication terminal is compared with the data access management instruction. When the access execution time is later than the access management instruction issuance time, the program functions as a data processing means for notifying this.

Images