JP7777796B2 - Electronic device, system, and method for erasing data stored in a storage device of an electronic device - Google Patents

Description

The present disclosure relates to an electronic device, a system, and a method for erasing data stored in a storage device of an electronic device.

When a company or other organization disposes of electronic devices such as personal computers, it is required to erase the data stored on the storage device to prevent the leakage of confidential business information.

Patent Document 1 discloses a data erasure method in which a computer performs a data erasure process to erase data stored in a storage device of the computer, which is equipped with a storage device, a display device, an arithmetic processing unit, and an input device.

Japanese Patent Application Laid-Open No. 2018-136778

When an organization manages a large number of electronic devices, it may be required to report the results of the erasure of the storage devices to an administrator (e.g., a server device accessible by the administrator) after data erasure is complete. However, due to factors such as the status of the communication line between the electronic device containing the storage device to be erased and the server device, and the status of users who can access the electronic device containing the storage device to be erased, it is not always possible to guarantee that the erasure results will be notified to the server device. Therefore, there is a need to notify the server device of the erasure results more reliably than before.

The present disclosure provides a system for erasing data stored in a storage device of an electronic device, which can more reliably notify a server device of the results of erasure from the storage device than conventional systems. The present disclosure also provides a method for operating such a system. The present disclosure also provides an electronic device that can more reliably notify a server device of the results of erasure from the storage device than conventional systems.

A system according to one aspect of the present disclosure is a system for erasing data stored in a storage device of at least one electronic device, the system including at least one electronic device, a server device, and a terminal device. The electronic device includes a first storage device that stores data to be erased, a second storage device that stores a first keyword, a first display device, and a first input device. The server device includes a third storage device that stores a second keyword. The terminal device includes a photographing device and a second display device. The electronic device erases the data stored in the first storage device and displays a graphic code including erasure completion information indicating that erasure of the data stored in the first storage device has been completed on the first display device. The terminal device photographs the graphic code using the photographing device, extracts the erasure completion information from the graphic code, and transmits the erasure completion information to the server device. The server device receives the erasure completion information from the terminal device, reads the second keyword from the third storage device, and transmits the second keyword to the terminal device. The terminal device receives the second keyword from the server device and displays the keyword on the second display device. The electronic device acquires a second keyword input via the first input device, and shuts down the electronic device if the second keyword input via the first input device matches the first keyword stored in the second storage device.

A system according to one aspect of the present disclosure can more reliably notify a server device of the results of erasure from a storage device than conventional systems.

1 is a schematic diagram showing a configuration of a system 100 according to a first embodiment. FIG. 2 is a block diagram showing the configuration of a client device 1 in FIG. 1 . FIG. 2 is a block diagram showing the configuration of a server device 2 in FIG. 1 . FIG. 2 is a block diagram showing the configuration of an administrator device 3 in FIG. 1 . 2 is a block diagram showing the configuration of a user terminal device 4 of FIG. 1. 3 is a schematic diagram showing the functional blocks of a firmware program 50 and an erasure application program 70 executed by the processor 11 of FIG. 2. FIG. 2 is a schematic diagram for explaining distribution of keywords in the system 100 of FIG. 1. 3 is a flowchart showing a registration process of the client device 1 by an erasure application program 70 executed by the processor 11 of FIG. 2 . 4 is a flowchart showing a registration process of the server device 2 by an erasure application program 92 executed by the processor 21 of FIG. 3 . 4 is a diagram showing exemplary contents of a management table stored in the memory 22 or the storage device 23 of FIG. 3. FIG. 3 is a flowchart showing an erasure process of the client device 1 by an erasure application program 70 executed by the processor 11 of FIG. 2 . 3 is a flowchart showing an erasure process of the client device 1 by a firmware program 50 executed by the processor 11 of FIG. 2 . 4 is a flowchart showing an erasure process of the server device 2 by an erasure application program 92 executed by the processor 21 of FIG. 3 . FIG. 13 is a diagram showing the contents displayed on the display device 16 of the client device 1 in step S39 of FIG. 12. FIG. 14 is a diagram showing the content displayed on the display device 46 of the user terminal device 4 after the keyword is transmitted from the server device 2 to the user terminal device 4 in step S60 of FIG. 13. 1. FIG. 4 is a sequence diagram showing the operation of the system 100 in FIG. 1 when the transmission of erasure result information via the communication line 6 is successful. 1. FIG. 4 is a sequence diagram showing the operation of the system 100 in the case where transmission of erasure result information via the communication line 6 in the system 100 of FIG. 1 has failed. FIG. 10 is a schematic diagram for explaining distribution of keywords in the system 100 according to the second embodiment. 10 is a flowchart showing an erasure process of the client device 1 by an erasure application program 70 executed by the processor 11 of the client device 1 according to the second embodiment. 10 is a flowchart showing an erasure process of the client device 1 by the firmware program 50 executed by the processor 11 of the client device 1 according to the second embodiment. 10 is a flowchart showing an erasure process of the server device 2 by an erasure application program 92 executed by the processor 21 of the server device 2 according to the second embodiment. FIG. 10 is a sequence diagram showing the operation of the system 100 according to the second embodiment when the erasure result information is successfully transmitted via the communication line 6. FIG. 10 is a sequence diagram showing the operation of the system 100 according to the second embodiment when transmission of erasure result information via the communication line 6 fails. FIG. 10 is a schematic diagram for explaining distribution of keywords in the system 100 according to a first modified example of the second embodiment. FIG. 10 is a diagram showing the contents displayed on the display device 26 of the server device 2 according to the first modified example of the second embodiment. 10 is a flowchart showing an erasure process of the server device 2 by an erasure application program 92 executed by the processor 21 of the server device 2 according to a second modification of the second embodiment. FIG. 10 is a sequence diagram showing the operation of the system 100 according to the second modification of the second embodiment when the system 100 has successfully transmitted the erasure result information via the communication line 6. FIG. 10 is a sequence diagram showing the operation of the system 100 according to the second modification of the second embodiment when transmission of erasure result information via the communication line 6 fails. FIG. 10 is a diagram showing exemplary contents of a keyword table stored in the memory 22 or the storage device 23 of the server device 2 according to a second modified example of the second embodiment. FIG. 10 is a diagram showing another exemplary content of a keyword table stored in the memory 22 or the storage device 23 of the server device 2 according to the second modified example of the second embodiment. FIG. 10 is a schematic diagram for explaining distribution of keywords in the system 100 according to the third embodiment. 11 is a flowchart showing an erasure process of the client device 1 by an erasure application program 70 executed by the processor 11 of the client device 1 according to the third embodiment. 10 is a flowchart showing an erasure process of the server device 2 by an erasure application program 92 executed by the processor 21 of the server device 2 according to the third embodiment. FIG. 11 is a sequence diagram showing the operation of the system 100 according to the third embodiment when the erasure result information is successfully transmitted via the communication line 6. FIG. 11 is a sequence diagram showing the operation of the system 100 according to the third embodiment when transmission of erasure result information via the communication line 6 fails. FIG. 11 is a diagram showing exemplary contents of a keyword table stored in the memory 22 or storage device 23 of the server device 2 of the third embodiment. FIG. 13 is a schematic diagram for explaining distribution of keywords in the system 100 according to a first modified example of the third embodiment.

Embodiments will be described in detail below, with reference to the drawings as appropriate. However, more detailed explanations than necessary may be omitted. For example, detailed explanations of matters that are already well-known or duplicate explanations of substantially identical configurations may be omitted. This is to avoid unnecessary redundancy in the following explanation and to make it easier for those skilled in the art to understand.

The inventor(s) provide the accompanying drawings and the following description to enable those skilled in the art to fully understand the present disclosure, and are not intended to limit the subject matter described in the claims.

[First embodiment]
[Configuration of the first embodiment]

Figure 1 is a schematic diagram showing the configuration of a system 100 according to the first embodiment. The system 100 in Figure 1 includes multiple client devices 1-1 to 1-3, a server device 2, an administrator device 3, a user terminal device 4, a base station device 5, and a communication line 6.

Client devices 1-1 to 1-3 are communicatively connected to server device 2 via communication line 6. Client devices 1-1 to 1-3 are electronic devices equipped with a storage device (described below), such as personal computers or mobile phones. Client devices 1-1 to 1-3 are examples of electronic devices according to an embodiment.

In this specification, client devices 1-1 to 1-3 are collectively referred to as "client device 1."

The server device 2 manages the deletion of data stored in the storage device of each client device 1.

The administrator device 3 is connected to the server device 2 via a communication line 6 so that they can communicate with each other. The administrator of each client device 1 uses the administrator device 3 to access the server device 2 and specify the storage device from which stored data should be erased.

The user terminal device 4 is an electronic device, such as a mobile phone, equipped with a photographing device 48 and a communication device (described below). The user terminal device 4 is communicatively connected to the server device 2 via the base station device 5.

The communication line 6 may be, for example, a local area network (LAN), the Internet, or a combination thereof.

For example, each client device 1 and administrator device 3 may be owned by an organization such as a company, while the server device 2 may be operated by a third party different from this organization. In this case, the organization that owns each client device 1 and administrator device 3 enters into a contract with the operator of the server device 2 to manage the erasure of data stored in the storage device of each client device 1, and becomes a customer of this operator.

In this specification, "erase" means to overwrite the original stored data with other data, such as "0", "1", or random values, so that the original data cannot be read.

Figure 2 is a block diagram showing the configuration of the client device 1 of Figure 1. The client device 1 includes a bus 10, a processor 11, a memory 12, a storage device 13, a storage device 14, a communication device 15, a display device 16, and an input device 17. The processor 11 controls the overall operation of the client device 1 and, for example, erases data stored in the storage device 13. The memory 12 temporarily stores programs and data necessary for the operation of the client device 1. The storage device 13 stores data including an operating system (OS), multiple application programs (APPs), and user data. The storage device 13 is a non-volatile storage medium such as a hard disk drive (HDD) or a solid-state drive (SSD). The storage device 14 stores firmware programs for the client device 1, such as a UEFI (Unified Extensible Firmware Interface) or BIOS (Basic Input/Output System) program. The storage device 14 is a non-volatile storage medium such as a flash memory. The communication device 15 is communicably connected to the server device 2 via a communication line 6. The display device 16 displays information related to the status of the client device 1, for example, graphical symbols including information related to erasing data stored in the storage device 13. The input device 17 receives user input that controls the operation of the client device 1, for example, user input related to erasing data stored in the storage device 13. The input device 17 includes, for example, a keyboard and a pointing device. The processor 11, memory 12, storage device 13, storage device 14, communication device 15, display device 16, and input device 17 are connected to each other via the bus 10.

Figure 3 is a block diagram showing the configuration of the server device 2 in Figure 1. The server device 2 includes a bus 20, a processor 21, a memory 22, a storage device 23, a communication device 25, a display device 26, and an input device 27. The processor 21 controls the overall operation of the server device 2 and also manages the deletion of data stored in the storage device 13 of each client device 1. The memory 22 temporarily stores programs and data necessary for the operation of the server device 2. The storage device 23 is a non-volatile storage medium that stores programs necessary for the operation of the server device 2. The communication device 25 is communicatively connected to each client device 1 and the administrator device 3 via a communication line 6. The display device 26 displays information related to the status of the server device 2. The input device 27 receives user input that controls the operation of the server device 2. The input device 27 includes, for example, a keyboard and a pointing device. The processor 21, memory 22, storage device 23, communication device 25, display device 26, and input device 27 are connected to each other via the bus 20.

Figure 4 is a block diagram showing the configuration of the administrator device 3 in Figure 1. The administrator device 3 includes a bus 30, a processor 31, a memory 32, a storage device 33, a communication device 35, a display device 36, and an input device 37. The processor 31 controls the overall operation of the administrator device 3. The memory 32 temporarily stores programs and data necessary for the operation of the administrator device 3. The storage device 33 is a non-volatile storage medium that stores programs necessary for the operation of the administrator device 3. The communication device 35 is communicatively connected to the server device 2 via the communication line 6. The display device 36 displays information related to the status of the administrator device 3. The input device 37 receives user input that controls the operation of the administrator device 3. The input device 37 includes, for example, a keyboard and a pointing device. The processor 31, memory 32, storage device 33, communication device 35, display device 36, and input device 37 are connected to each other via the bus 30.

The server device 2 provides an interface, such as a web page-based interface, accessible by the administrator device 3 to manage the erasure of data stored in the storage device of each client device 1. In this case, the server device 2 executes a web server application program, and the administrator device 3 executes a web browser application program to access the web server of the server device 2.

Figure 5 is a block diagram showing the configuration of the user terminal device 4 of Figure 1. The user terminal device 4 comprises a bus 40, a processor 41, a memory 42, a storage device 43, a communication device 45, a display device 46, an input device 47, and a photographing device 48. The processor 41 controls the overall operation of the user terminal device 4. The memory 42 temporarily stores programs and data necessary for the operation of the user terminal device 4. The storage device 43 is a non-volatile storage medium that stores programs necessary for the operation of the user terminal device 4. The communication device 45 is communicatively connected to the server device 2 via the base station device 5. The display device 46 displays information related to the status of the user terminal device 4 and also displays information related to the erasure of data stored in the storage device 13 of the client device 1. The input device 47 receives user input that controls the operation of the user terminal device 4. The input device 47 includes, for example, a switch and a touch panel. The photographing device 48, for example, photographs an image displayed on the display device 16 of the client device 1. As described below, the display device 16 of the client device 1 may display a graphic code (e.g., a two-dimensional barcode) containing information related to the deletion of data stored in the memory device 13 of the client device 1. In this case, the user terminal device 4 transmits the contents of the photographed graphic code to the server device 2 via the base station device 5. The processor 41, memory 42, memory device 43, communication device 45, display device 46, input device 47, and photographing device 48 are connected to each other via a bus 40.

As described above, in the client device 1, the storage device 13 stores an operating system and multiple application programs, and the storage device 14 stores a firmware program. The operating system, each application program, and the firmware program are executed by the processor 11. Generally, when the client device 1 starts up, the firmware program is executed first, and then the operating system is called from the firmware program. The application programs are executed on the operating system. The application programs access each hardware device of the client device 1 (storage device 13, storage device 14, communication device 15, display device 16, and input device 17) via the operating system. On the other hand, the firmware program accesses each hardware device of the client device 1 directly, without going through the operating system. One of the application programs is an erasure application program for erasing data stored in the storage device 13. The client device 1 is configured to erase data stored in the storage device 13 by executing the erasure application program and the firmware program.

Figure 6 is a schematic diagram showing the functional blocks of the firmware program 50 and the erasure application program 70 executed by the processor 11 of Figure 2.

The firmware program 50 includes, as its functional blocks, a core control unit 51, an erasure control unit 52, a data encoding unit 53, and a two-dimensional barcode generation unit 54, for example. The core control unit 51 controls the other functional blocks of the firmware program 50, controls the input and output of data between the functional blocks, and controls the input and output of data to and from the outside of the firmware program 50. The erasure control unit 52 controls the erasure of data stored in the storage device 13. The data encoding unit 53 encodes erasure result information indicating whether all data stored in the storage device 13 has been successfully erased using a predetermined encoding method. The two-dimensional barcode generation unit 54 generates a two-dimensional barcode including erasure result information indicating whether all data stored in the storage device 13 has been successfully erased.

The operating system 60 provides interfaces for each hardware device (storage device 13, storage device 14, communication device 15, display device 16, and input device 17) of the client device 1 to the erasure application program 70 and other application programs (not shown). The operating system 60 includes, as its functional blocks, a device information monitor 61 and a power management unit 62. The device information monitor 61 acquires information about the client device 1 from the client device 1 and also acquires information about the various components of the client device 1 from those components. The example in Figure 6 shows the case where the device information monitor 61 acquires information about the storage device 13. The information about the client device 1 includes, for example, the manufacturer, model, serial number, and UUID (Universally Unique Identifier) of the client device 1. The information about the storage device 13 includes, for example, the manufacturer, model, serial number, UUID, and capacity of the storage device 13. The power management unit 62 controls the stopping, suspending, hibernation, and restarting of the client device 1.

The storage devices of each client device 1 under the management of a certain server device 2 can be identified from one another using at least a portion of the client device 1 manufacturer, client device 1 model, client device 1 serial number, client device 1 UUID, storage device 13 manufacturer, storage device 13 model, storage device 13 serial number, storage device 13 UUID, and storage device 13 capacity. Therefore, at least a portion of the client device 1 manufacturer, client device 1 model, client device 1 serial number, client device 1 UUID, storage device 13 manufacturer, storage device 13 model, storage device 13 serial number, storage device 13 UUID, and storage device 13 capacity can be used as identification information to uniquely identify the storage device 13.

The erasure application program 70 includes, for example, a core control unit 71 as one of its functional blocks. The core control unit 71 controls the other functional blocks (not shown) of the erasure application program 70, controls the input and output of data between the functional blocks, and controls the input and output of data from and to external devices in the erasure application program 70.

The storage device 13 also executes a firmware program including the functional blocks shown in FIG. 6. The firmware program of the storage device 13 includes, as its functional blocks, a core control unit 81, a reading unit 82, a writing unit 83, and an erasing unit 84, for example. The core control unit 81 controls the other functional blocks of the storage device 13 and controls the input and output of data between the functional blocks. The reading unit 82 reads data from a storage medium (not shown) of the storage device 13. The writing unit 83 writes data to the storage medium of the storage device 13. The erasing unit 84 erases data from the storage medium of the storage device 13.

The operation of the client device 1 will be explained below with reference to the functional blocks in Figure 6, and the operation of the server device 2 will also be explained.

[Operation of the first embodiment]
In the system 100 of FIG. 1 , when erasing data stored in the storage device 13 of a client device 1, the administrator of each client device 1 first accesses the server device 2 via the administrator device 3 and registers the storage device 13 to be erased with the server device 2. Each client device 1 periodically accesses the server device 2 to check whether the storage device 13 of that client device 1 is registered as an erase target. If registered as an erase target, the client device 1 erases the data stored in the storage device 13. The client device 1 then transmits the erasure results of the data stored in the storage device 13 to the server device 2 via the communication line 6. If the erasure results cannot be transmitted from the client device 1 to the server device 2, for example, if the client device 1 does not receive an acknowledgment signal for the erasure results, the client device 1 generates a graphical code containing the erasure results, such as a two-dimensional barcode such as a QR Code (registered trademark), and displays it on the display device 26. This allows a user or administrator with access to the client device 1 to photograph the two-dimensional barcode using the user terminal device 4 and transmit the erasure results contained in the two-dimensional barcode from the user terminal device 4 to the server device 2. The user or administrator uses the user terminal device 4 to transmit the deletion result to the server device 2 and then shuts down the client device 1 .

However, in conventional systems that use two-dimensional barcodes containing erasure results, it is not necessarily guaranteed that the erasure results will be sent from the user terminal device to the server device before the client device is shut down. For example, once a two-dimensional barcode displayed on a client device is cleared by a user or administrator, it may never be displayed again. In this case, the server device cannot obtain the erasure results for the storage device 13 to be erased. Therefore, in systems that use two-dimensional barcodes containing erasure results, it is necessary to send the erasure results to the server device more reliably than in conventional systems.

As described below, the system 100 according to each embodiment of the present disclosure reliably transmits the erasure results to the server device 2 using keywords pre-distributed to the client device 1 and the server device 2.

7 is a schematic diagram illustrating the distribution of keywords in the system 100 of FIG. 1. In the first embodiment, the same keywords are pre-distributed to the client device 1 and the server device 2. As described with reference to FIG. 6, the client device 1 executes the firmware program 50, operating system 60, and erasure application program 70 via the processor 11. The keywords are pre-stored in the storage device 14 of the client device 1. For example, the keywords may be written to the storage device 14 when the client device 1 is manufactured. Alternatively, the keywords may be pre-embedded in the firmware program 50 and installed in the storage device 14 together with the firmware program 50. Alternatively, the keywords may be pre-embedded in the erasure application program 70 and installed in the storage device 13 together with the erasure application program 70, and then written to the storage device 14 by executing the erasure application program 70. The server device 2 executes the operating system 91 and erasure application program 92 via the processor 21. The keywords are pre-stored in the memory 22 or the storage device 23 of the server device 2. For example, the keywords may be pre-written in the storage device 23 and read from the storage device 23 to the memory 22 by executing the erasure application program 92. As a result, the same keywords are distributed in advance to the client device 1 and the server device 2 before executing the deletion process described below with reference to Figures 11 to 13, for example.

Figure 8 is a flowchart showing the registration process for the client device 1 by the erasure application program 70 executed by the processor 11 in Figure 2. Figure 9 is a flowchart showing the registration process for the server device 2 by the erasure application program 92 executed by the processor 21 in Figure 3.

If the organization that owns each client device 1 is not registered with the server device 2, before performing the registration process in FIG. 8, an administrator or other person in charge of the organization that owns each client device 1 obtains the following information from the server device 2.

Account information of the server device 2 (customer ID and password)
URL (Uniform Resource Locator) of the erasure application program 70
Customer number (a serial number assigned to each customer and associated with their account information)

The customer number is generated for each customer, i.e., for each contract governing the erasure of data stored in the memory device of each client device 1, and is therefore not identification information for each client device 1 or memory device 13.

Each client device 1 accesses the URL of the erasure application program 70, downloads the erasure application program 70, and installs it. After installation, the erasure application program 70 is launched automatically or manually. After the erasure application program 70 is launched, the processor 11 executes the registration process shown in Figure 8 to register the memory device 13 of the client device 1 with the server device 2.

In step S1 of FIG. 8, the core control unit 71 of the client device 1 displays a dialog box on the display device 16 prompting the user to enter the customer number assigned to the organization that owns the client device 1. The user of the client device 1 follows the dialog box and enters the customer number using the input device 17. The core control unit 71 acquires the customer number from the user via the input device 17.

In step S2, the core control unit 71 of the client device 1 obtains information about the client device 1 and information about the storage device 13 from the device information monitor 61 of the operating system 60.

In step S3, the core control unit 71 of the client device 1 uses the communication device 15 to send the customer number, information about the client device 1, and information from the storage device 13 to the server device 2.

In step S11 of FIG. 9, the server device 2 receives the customer number, information about the client device 1, and information about the storage device 13. The server device 2 stores in memory 22 or storage device 23 a management table for managing the erasure of data stored in the storage device 13 of each client device 1. In step S12, the server device 2 registers the client device 1 and its storage device 13 in the management table as new management targets. When the client device 1 and its storage device 13 have been registered, in step S13 the server device 2 sends an acknowledgement signal to the client device 1.

In step S4 of FIG. 8, the core control unit 71 of the client device 1 determines whether or not an affirmative response signal has been received from the server device 2; if YES, the process ends; if NO, the process returns to step S3.

By executing the registration process of Figures 8 and 9, the storage device 13 of the client device 1 is registered in the management table of the server device 2 as a new management target. According to the registration process of Figures 8 and 9, the user of the client device 1 simply inputs their customer number using the input device 17, and information about the client device 1 and the storage device 13 is automatically sent from the client device 1 to the server device 2. According to the registration process of Figures 8 and 9, the user of the client device 1 does not need to be aware of the organization to which they belong (or the organization that owns the client device 1), and the server device 2 automatically classifies the registered storage devices 13 by customer based on the customer number.

After the storage devices 13 of each client device 1 are registered with the server device 2, the administrator of the organization that owns each client device 1 registers with the server device 2, if necessary, that the data stored in the storage devices 13 should be erased. To do this, the administrator first accesses the server device 2 using the administrator device 3 and logs in to the server device 2 using account information. Next, while viewing the list of storage devices 13 registered in the management table of the server device 2, the administrator sets an erase flag for one or more storage devices 13 indicating that the stored data should be erased.

Figure 10 shows exemplary contents of a management table stored in the memory 22 or storage device 23 of Figure 3. For each client device 1 or storage device 13 to be managed, the management table includes, for example, a customer number, group number, client device 1 information, storage device 13 information, erasure flag, processing number, erasure start time, and erasure end time.

As mentioned above, a customer number is assigned to each customer. A group number is assigned to any sub-organization (group) that is part of the customer's organization. For example, if the customer is a company, a group may be a department or section of that company. As mentioned above, the client device 1 information includes, for example, the manufacturer, model, serial number, and UUID of the client device 1. As mentioned above, the storage device 13 information includes, for example, the manufacturer, model, serial number, UUID, and capacity of the storage device 13. As mentioned above, the erasure flag indicates that data stored in the storage device 13 should be erased. A processing number is issued for each storage device 13 for which the erasure flag indicates that data stored in the storage device 13 should be erased. The erasure start time and erasure end time indicate the actual start and end times of erasure of data stored in the storage device 13.

The customer number is provided by the server device 2. The group number, client device 1 information, and storage device 13 information are provided by the client device 1. The erasure flag is set using the administrator device 3 by the administrator of the organization that owns each client device 1. The processing number is provided by the server device when the erasure flag is set, indicating that stored data should be erased. The erasure start time and erasure end time are obtained when the data stored in the storage device 13 is actually erased.

The server device 2 may generate a status report indicating the status of each client device 1 and each storage device 13 based on the management table. The status report indicates, for example, which of the following states each storage device 13 is in.

・Erase flag set ・Erase in progress ・Erase completed ・Erase completed and erasure certificate issued ・Erase failed

More information about erasure certificates will be discussed later.

The status report may also include the following information:

Date and time when the erasure flag was set; Approval person for erasure; Date and time when erasure started; Date and time when erasure was completed; Erasure method; Manufacturer, model, and serial number of the client device 1; Manufacturer, model, serial number, and capacity of the storage device 13

The administrator can view the status report by accessing the server device 2 using the administrator device 3.

Figure 11 is a flowchart showing the erasure process of the client device 1 by the erasure application program 70 executed by the processor 11 of Figure 2. Figure 12 is a flowchart showing the erasure process of the client device 1 by the firmware program 50 executed by the processor 11 of Figure 2. Figure 13 is a flowchart showing the erasure process of the server device 2 by the erasure application program 92 executed by the processor 21 of Figure 3.

First, in step S51 of FIG. 13, the server device 2 determines whether the administrator device 3 has specified a storage device 13 to be erased. If the determination is YES, the server device 2 proceeds to step S52; if the determination is NO, the server device 2 repeats step S51. In step S52, the server device 2 sets an erasure flag in the management table for the storage device 13 specified as the storage device to be erased, and updates the status report for this storage device 13.

Furthermore, after the client device 1 is started, the erasure application program 70 is started automatically or manually.

In step S21 of FIG. 11, the core control unit 71 of the client device 1 inquires of the server device 2 using the communication device 15 whether an erasure flag is registered in the management table of the server device 2 for the storage device 13 of the client device 1 that is performing the erasure process of FIG. 11.

In step S53 of FIG. 13, the server device 2 determines whether or not it has received an inquiry about the deletion flag from the client device 1. If the answer is YES, the server device 2 proceeds to step S54; if the answer is NO, the server device 2 returns to step S51. In step S54, the server device 2 replies to the client device 1 about the presence or absence of the deletion flag.

In step S22 of FIG. 11, the core control unit 71 of the client device 1 determines whether an erasure flag is registered in the management table of the server device 2 for the storage device 13 of the client device 1 that is performing the erasure process of FIG. 11; if the answer is YES, the process proceeds to step S23; if the answer is NO, the process returns to step S21.

In step S23, the core control unit 71 of the client device 1 uses the communication device 15 to send information about the client device 1 and information about the storage device 13 to the server device 2.

In step S55 of FIG. 13, the server device 2 determines whether it has received information about the client device 1 and the storage device 13 from the client device 1; if YES, it proceeds to step S56; if NO, it returns to step S51.

If the client device 1 information and storage device 13 information received by the server device 2 in step S55 matches the client device 1 information and storage device 13 information registered in the server device 2's management table by the registration process of FIG. 8, in step S56 the server device 2 generates a processing number for the storage device 13 of the client device 1 performing the erasure process of FIG. 11 and sends it to the client device 1. If the server device 2 cannot identify the storage device 13 based on the received client device 1 information and storage device 13 information, or if the erasure flag is not set, it returns an error response. If the server device 2 can identify the storage device 13 based on the received client device 1 information and storage device 13 information, but the erasure flag is not set or the identification information of the storage device 13 is different, it may return a response indicating that the information is different. In this case, because no processing number is returned, the client device 1 cannot erase the data stored in the storage device.

In step S24 of FIG. 11, the core control unit 71 of the client device 1 determines whether or not a processing number for deletion has been received from the server device 2 in response to the information sent in step S23. If the answer is YES, the process proceeds to step S25; if the answer is NO, the process returns to step S23.

In step S25, the core control unit 71 of the client device 1 displays a dialog box on the display device 16 to confirm whether or not to erase the data stored in the storage device 13. The user of the client device 1 uses the input device 17 to input whether or not to erase the data stored in the storage device 13 in accordance with the dialog box. The core control unit 71 obtains the information on whether or not to erase the data stored in the storage device 13 via the input device 17.

In step S26, the core control unit 71 of the client device 1 determines whether the user has consented to the erasure of data stored in the storage device 13; if YES, the process proceeds to step S27; if NO, the process ends.

In step S27, the core control unit 71 of the client device 1 sends the UUID of the storage device 13, the processing number, the address of the server device 2, and information on the erasure method to the firmware program 50. The information on the erasure method includes, for example, secure erase, overwrite and erase three times, overwrite and erase once, and failure.

The core control unit 51 of the firmware program 50 stores the UUID of the storage device 13, the processing number, the address of the server device 2, and the erasure method information obtained from the erasure application program 70 in the storage device 14 (see step S31 in Figure 12). When the core control unit 51 obtains and stores the UUID of the storage device 13, the processing number, the address of the server device 2, and the erasure method information, it sends an acknowledgement signal to the erasure application program 70 (see step S32 in Figure 12).

In step S28, the core control unit 71 of the client device 1 determines whether or not an affirmative response signal has been received from the firmware program 50; if YES, the process proceeds to step S29; if NO, the process returns to step S27.

In step S29, the core control unit 71 of the client device 1 restarts the client device 1 by sending a control signal to the power management unit 62 of the operating system 60.

Steps S31 to S33 in Figure 12 correspond to steps S27 to S29 in Figure 11.

In step S31 of FIG. 12, the core control unit 51 of the client device 1 stores the UUID of the storage device 13, the processing number, the address of the server device 2, and the erasure method information obtained from the erasure application program 70 in the storage device 14.

In step S32, when the core control unit 51 of the client device 1 acquires and stores the UUID of the storage device 13, the processing number, the address of the server device 2, and the erasure method information, it sends an affirmative response signal to the erasure application program 70.

In step S33, the erasure application program 70 restarts the client device 1.

After rebooting, the firmware program 50 continues the erasure process shown in Figure 12 without calling the operating system 60.

In step S34, the core control unit 51 of the client device 1 uses the erasure control unit 52 to erase all data stored in the storage device 13 using the specified erasure method. The erasure control unit 52 may use the secure erase command of the storage device. After the erasure is complete, the core control unit 51 stores data indicating the erasure results, including the erasure start time, erasure end time, and erasure method, in the storage device 14.

In step S35, the core control unit 51 of the client device 1 reads data indicating the erasure result from the storage device 14 and uses the data encoding unit 53 to encode the data indicating the erasure result using a predetermined encoding method. The core control unit 51 stores the encoded data in the storage device 14.

Encoding the data indicating the encoded erasure result is performed, for example, by the following steps:

(1) The UUID, processing number, erasure start time, erasure end time, and erasure method are arranged serially. These parameters may be arranged in CSV format, for example.
(2) The character string related to the parameter in step (1) is converted into a half-width character string such as BCD. At this point, a character string may be added.
(3) Calculate the hash value of the string from step (2).
(4) The character string in step (2) and the hash value in step (3) are converted into a format that can be transmitted via the communication line 6. If necessary, URL encoding is performed, for example.
(5) The data from step (4) is sent to the address of the server device 2 as the destination.

In step S36, the core control unit 51 of the client device 1 reads the encoded data indicating the deletion result from the storage device 14 and transmits the encoded data indicating the deletion result to the server device 2 using the communication device 15.

In step S57 of FIG. 13, the server device 2 determines whether or not it has received an erasure result from the client device 1; if YES, it proceeds to step S58; if NO, it proceeds to step S59.

In step S58, the server device 2 sends an acknowledgement signal for the deletion result to the client device 1.

In step S37 of FIG. 12, the core control unit 51 of the client device 1 determines whether or not it has received an acknowledgment signal from the server device 2 within a predetermined period of time since transmitting the erasure result; if YES, it proceeds to step S43; if NO, it proceeds to step S38.

In step S38, the core control unit 51 of the client device 1 reads data indicating the erasure result from the storage device 14 and generates a two-dimensional barcode from the data indicating the erasure result using the two-dimensional barcode generation unit 54. The core control unit 51 stores the generated two-dimensional barcode in the storage device 14.

In step S39, the core control unit 51 of the client device 1 reads the two-dimensional barcode from the storage device 14 and displays the two-dimensional barcode on the display device 16.

Figure 14 is a diagram showing the content displayed on the display device 16 of the client device 1 in step S39 of Figure 12. The display screen 200 displayed on the display device 16 includes, for example, a two-dimensional barcode 201 and an input field 202. The user photographs the two-dimensional barcode 201 using the photographing device 48 of the user terminal device 4. The user terminal device 4 decodes the two-dimensional barcode 201, extracts data indicating the deletion result, and transmits this data to the server device 2. The two-dimensional barcode 201 may include, for example, the URL of the server device 2. In this case, the user terminal device 4 may launch a web browser and access the server device 2 via HTTPS communication.

In step S59 of FIG. 13, the server device 2 determines whether or not it has received an erasure result from the user terminal device 4; if YES, it proceeds to step S60; if NO, it returns to step S57.

In step S60, the server device 2 reads the keyword from the memory 22 or the storage device 23 and transmits it to the user terminal device 4.

The user terminal device 4 receives the keywords sent from the server device 2 in step S60 of FIG. 13 and displays the keywords on the display device 46.

Figure 15 is a diagram showing the content displayed on the display device 46 of the user terminal device 4 after the keyword is sent from the server device 2 to the user terminal device 4 in step S60 of Figure 13. The user terminal device 4 displays the keyword 211 received from the server device 2 ("TWEraseEnd" in the example of Figure 15) on the display device 46. If the user terminal device 4 that captured the two-dimensional barcode launches a web browser, the keyword 211 may be displayed in the web browser. The user enters the displayed keyword 211 into the input field 202 of the client device 1 using the input device 17 and presses the Enter key.

In step S40 of FIG. 12, the core control unit 51 of the client device 1 determines whether a keyword has been input from the input device 17; if YES, the process proceeds to step S41; if NO, the process repeats step S40.

In step S41, the core control unit 51 of the client device 1 determines whether the keyword entered from the input device 17 matches a keyword previously stored in the storage device 14; if YES, the process proceeds to step S42; if NO, the process returns to step S40.

According to the process shown in Figures 12 and 13, the erasure results are first transmitted from the client device 1 to the server device 2 via the communication line 6 in step S36. If a failure or other problem occurs on the communication line 6, i.e., if an acknowledgment signal for the erasure results is not received in step S37, the erasure results are transmitted to the server device 2 via the user terminal device 4 by executing steps S38 to S42.

Referring to FIG. 13, after step S58 or S60 is executed, in step S61, the server device 2 stores the erasure results in the management table and updates the status report.

In step S62, the server device 2 issues an erasure certificate based on the erasure results.

In step S43 of FIG. 12, the core control unit 51 of the client device 1 performs post-processing and shuts down the client device 1.

Figure 16 is a sequence diagram showing the operation of system 100 in Figure 1 when transmission of erasure result information via communication line 6 in system 100 is successful. Figure 17 is a sequence diagram showing the operation of system 100 in Figure 1 when transmission of erasure result information via communication line 6 in system 100 is unsuccessful.

For simplicity's sake, Figures 16 and 17 show only the main steps described with reference to Figures 8-9 and Figures 11-13, omitting the others. Furthermore, Figure 16 shows both the registration process of Figures 8-9 and the deletion process of Figures 11-13. Since the registration process is the same in both Figures 16 and 17, Figure 17 omits the registration process and shows only the deletion process.

Referring to FIG. 16, in step S1, the client device 1 acquires a customer number from the user. Next, the client device 1 transmits the customer number, information about the client device 1, and information from the storage device 13 to the server device 2.

In step S11, the server device 2 registers the memory device 13 of the client device 1 as a new management target based on the customer number, information about the client device 1, and information about the memory device 13.

In the first embodiment, as described above, the same keywords are pre-distributed to the client device 1 and the server device 2 before the erasure process is performed.

Then, in step S101, the administrator device 3 sends account information to the server device 2 and logs in to the server device 2. The administrator device 3 specifies the storage device 13 to be erased, i.e., the storage device 13 from which the stored data should be erased.

In step S52, the server device 2 stores the deletion flag in the management table so that it corresponds to the storage device 13 specified in step S101.

After that, client device 1 periodically inquires of server device 2 as to whether an erasure flag has been set in the server device 2's management table corresponding to the client device 1's storage device. If, in response to the erasure flag inquiry, server device 2 responds with a response signal indicating that an erasure flag has been set in the server device 2's management table, client device 1 transmits information about client device 1 and storage device 13 to server device 2. If the information about client device 1 and storage device 13 received by server device 2 matches the information about client device 1 and storage device 13 registered in the server device 2's management table, server device 2 generates a processing number for client device 1's storage device 13 and transmits it to client device 1.

Then, in step S25, the client device 1 displays a dialog box on the display device 16 to confirm whether or not to erase the data stored in the storage device 13. If the user agrees to erase the data stored in the storage device 13, in step S29, the client device 1 restarts. Then, in step S34, the client device 1 erases all data stored in the storage device 13.

After the erasure is complete, the client device 1 sends erasure result information to the server device 2. If a response signal to the erasure result information is received from the server device 2 within a predetermined timeout period, the client device 1 shuts down in step S43.

In step S61, the server device 2 stores the erasure result included in the erasure result signal in a management table. In step S62, the server device 2 issues an erasure certificate based on the erasure result included in the erasure result signal.

On the other hand, as shown in FIG. 17, if the erasure result information sent by the client device 1 does not reach the server device 2, or if a response signal to the erasure result information is not received, the client device 1 displays a two-dimensional barcode on the display device 16 in step S39.

In step S111, the user of client device 1 uses the user terminal device 4 to capture a picture of the two-dimensional barcode displayed on the display device 16 of client device 1. The user terminal device 4 decodes the two-dimensional barcode, extracts data indicating the deletion result, and transmits this data to the server device 2.

When the server device 2 receives data indicating the deletion result from the user terminal device 4, it reads the keyword from the memory 22 or the storage device 23 and transmits it to the user terminal device 4.

In step S112, the user terminal device 4 displays the keywords received from the server device 2 on the display device 46. The user inputs the keywords displayed on the display device 46 into the client device 1.

In step S40, the client device 1 acquires the input keyword. In step S41, the client device 1 determines whether the input keyword matches a keyword previously stored in the storage device 14. If the keyword matches, in step S42, the client device 1 clears the display content of the display device 16. Thereafter, in step S43, the client device 1 shuts down.

[Certificate of erasure]
For example, when data stored in a storage device is erased using erasure software or an erasure process certified by a third-party certification body such as the Association of Data Erase Certification (ADEC), a certificate can be issued to indicate that proper erasure of data has been performed. The certificate includes, for example, the following information:

(1) Information on the client device 1: manufacturer, model, serial number; (2) Information on the storage device 13: manufacturer, model, serial number, capacity; (3) Erasure information: erasure company information (company ID, company name, rating)
- Erasure software information (vendor name, software name, certification number, erasure method)
- Erase execution date and time (erasure start time, erasure end time)
・Erasure results

As mentioned above, information about the client device 1 and information about the storage device 13 is sent from the client device 1 to the server device 2 by the erasure application program 70. Furthermore, among the erasure information, the business ID, business name, vendor name, and software name must be applied for and certified in advance by a certification authority. Once the erasure software is certified, an authentication number is issued. Furthermore, the date and time of erasure and the erasure results are sent from the client device 1 to the server device 2 by the firmware program 50. In this way, the information required to issue an erasure certificate can be automatically sent from the client device 1 to the server device 2, making it easy to issue an erasure certificate.

[summary]
The client device 1 cannot complete the erasure operation unless it receives an acknowledgment signal for the erasure result from the server device 2, or enters into the client device 1 the keyword returned from the server device 2 to the user terminal device 4 after the user terminal device 4 transmits the erasure result to the server device 2 from the user terminal device 4. The client device 1 may be configured to display the display content of FIG. 14 on the display device 16 each time the power is turned on if the erasure operation is not completed successfully. This ensures that, if the erasure result cannot be transmitted from the client device 1 to the server device 2, the user is urged to transmit the erasure result to the server device 2 using the user terminal device 4. Therefore, the system according to the first embodiment can more reliably notify the server device 2 of the erasure result of the storage device 13 by using keywords, i.e., by distributing the keywords between the client device 1 and the server device 2 and transmitting the keywords from the server device 2 to the user terminal device 4.

If the client device 1 is shut down normally after erasing the data stored in the memory device 13 of the client device 1 (i.e., the screen in Figure 14 does not appear when the client device 1 is turned on), it means that the data has been erased successfully and the erasure results have been sent to the server device 2.

Even if a keyword displayed on the user terminal device 4 is accidentally deleted before the keyword is entered into the client device 1 (for example, if the web browser displaying the keyword is closed), the keyword can be redisplayed by capturing a photo of the two-dimensional barcode using the user terminal device 4.

Keywords may be determined in common for each company, department, or contract. In this case, a firmware program 50 or erasure application program 70 with a keyword pre-embedded may be installed on multiple client devices 1 belonging to the same company, department, or contract.

The keyword may be entered into the client device 1 by an end user of the client device 1 or by an administrator with access to the client device 1. The administrator with access to the client device 1 may be the same as or different from the administrator with access to the server device 2.

Furthermore, according to the system of the first embodiment, an administrator accesses the server device 2 and sets an erasure flag indicating that data stored in the storage device 13 of each client device 1 should be erased. The client device then inquires of the server device 2 about the presence or absence of the erasure flag, without sending an erasure command or the like from the server device 2 to the client device 1. This makes it possible to accurately identify and easily set the storage device 13 to be erased. No signal is sent from the server device 2 to the client device 1 when erasure begins; the user of the client device 1 simply connects the client device 1 to the communication line 6 when erasure begins. Therefore, data can be erased at a time that suits the user's convenience. This makes it possible to accurately identify and easily erase data stored in the storage device 13.

Performing the erasure process using not only the erasure application program 70 but also a combination of the erasure application program 70 and the firmware program 50 has the following advantages. The erasure application program 70, which runs on the operating system 60, resides on the storage device 13. Similarly, the UEFI application program, which runs on the firmware program 50, resides on the storage device 13. Therefore, when data stored on the storage device 13 is erased by the erasure application program 70 or the UEFI application program, the area on the storage device 13 where the program resides cannot be deleted. Furthermore, the erasure application program 70 or the UEFI application program cannot communicate with the server device 2 via the communication line 6 after the data erasure is complete. Furthermore, because the erasure application program 70 or the UEFI application program cannot operate after the data erasure is complete, it cannot obtain information indicating the erasure results (e.g., the erasure start time, the erasure end time, and the erasure method). According to the system 100 of the first embodiment, by executing the firmware program 50, all data stored on the storage device 13 can be erased. After the data erasure is complete, communication with the server device 2 can be established via the communication line 6, and after the data erasure is complete, information indicating the erasure results can be obtained.

For example, it is possible to outsource the erasure of data stored in the storage device 13 to a contractor. However, transporting a client device equipped with a storage device from which data is to be erased to the contractor's business premises poses security risks. Using a highly secure shipping method increases costs. Furthermore, a lot of work is required for the erasure and subsequent checks. Furthermore, erasing data takes a long time, for example, half a day. With the system 100 according to the first embodiment, data stored in the storage device 13 of the client device 1 can be erased without moving the device, allowing for easy data erasure with high security and at low cost.

[Advantages of the first embodiment]
According to one aspect of the present disclosure, a system 100 for erasing data stored in a storage device of at least one client device 1 is provided. The system 100 includes at least one client device 1, a server device 2, and a user terminal device 4. The client device 1 includes a first storage device 13 for storing data to be erased, a second storage device 14 for storing a first keyword, a first display device 16, and a first input device 17. The server device 2 includes a memory 22 or a storage device 23 for storing a second keyword. The user terminal device 4 includes a photographing device 48 and a second display device 46. The client device 1 erases the data stored in the first storage device 13 and displays on the first display device 16 a graphical code including erasure completion information indicating that the erasure of the data stored in the first storage device 13 has been completed. The user terminal device 4 photographs the graphical code using the photographing device 48, extracts the erasure completion information from the graphical code, and transmits the erasure completion information to the server device 2. The server device 2 receives the erasure completion information from the user terminal device 4, reads the second keyword from the memory 22 or the storage device 23, and transmits the second keyword to the user terminal device 4. The user terminal device 4 receives the second keyword from the server device 2 and displays the keyword on the second display device 46. The client device 1 acquires the second keyword input via the first input device 17, and if the second keyword input via the first input device 17 matches the first keyword stored in the second storage device 14, shuts down the client device 1.

This allows the server device 2 to be notified of the results of erasure of the storage device 13 more reliably than before.

According to one aspect of the present disclosure, the first storage device 13 may store data including an operating system, application programs, and user data, and the second storage device 14 may further store a firmware program. In this case, the client device 1 erases all data stored in the first storage device 13 by executing the firmware program.

This allows you to erase all data stored on the storage device 13, including the operating system.

According to one aspect of the present disclosure, the first keyword may be pre-embedded in the firmware program.

This allows the same keywords to be distributed in advance to the client device 1 and the server device 2.

According to one aspect of the present disclosure, the graphic code may be a two-dimensional barcode.

This allows the results of erasure of the storage device 13 to be sent from the user terminal device 4 to the server device 2.

According to one aspect of the present disclosure, the client device 1 may erase data stored in the first storage device 13 and then transmit erasure completion information to the server device 2. In this case, if an acknowledgment signal for the transmitted erasure completion information is received from the server device 2 within a predetermined period, the client device 1 shuts down without displaying a graphic code on the first display device 16. On the other hand, if an acknowledgment signal is not received from the server device 2 within the predetermined period, the graphic code is displayed on the first display device 16.

This allows the client device 1 to notify the server device 2 of the results of erasure of the storage device 13 more reliably than before, even if the client device 1 cannot communicate with the server device 2.

According to one aspect of the present disclosure, the server device 2 may obtain erasure completion information from the client device 1 and, based on the erasure completion information, issue an erasure certificate certifying that erasure of data stored in the first storage device 13 has been completed.

This allows us to issue a certificate of erasure that proves that all data stored on the storage device has been completely erased.

According to one aspect of the present disclosure, an electronic device for processing information includes a first storage device (13) that stores data to be erased, a second storage device (14) that stores a first keyword, a first display device (16) that displays information, a first input device (17) that accepts input from a user of the electronic device (1), and a processor (11) that controls the electronic device (1). The processor (11) erases the data stored in the first storage device (13). The processor (11) displays on the first display device (16) a graphic code containing erasure completion information indicating that erasure of the data stored in the first storage device (13) has been completed. The processor (11) acquires, via the first input device (17), a second keyword obtained when the user sends the erasure completion information contained in the graphic code to the server device (2). The processor (11) compares the second keyword with the first keyword stored in the second storage device (14) and, if they match, shuts down the electronic device (1).

This allows the server device 2 to be notified of the results of erasure of the storage device 13 more reliably than before.

According to one aspect of the present disclosure, a method for operating a system 100 for erasing data stored in a storage device of at least one client device 1 is provided. The system 100 includes at least one client device 1, a server device 2, and a user terminal device 4. The client device 1 includes a first storage device 13 for storing data to be erased, a second storage device 14 for storing a first keyword, a first display device 16, and a first input device 17. The server device 2 includes a memory 22 or a storage device 23 for storing a second keyword. The user terminal device 4 includes a photographing device 48 and a second display device 46. The method includes the steps of erasing, by the client device 1, the data stored in the first storage device 13 and displaying, on the first display device 16, a graphic code including erasure completion information indicating that erasure of the data stored in the first storage device 13 has been completed. The method includes the steps of, by the user terminal device 4, photographing the graphic code using the photographing device 48, extracting the erasure completion information from the graphic code, and transmitting the erasure completion information to the server device 2. This method includes the steps of the server device 2 receiving erasure completion information from the user terminal device 4, reading a second keyword from the memory 22 or the storage device 23, and transmitting the second keyword to the user terminal device 4. This method also includes the steps of the user terminal device 4 receiving the second keyword from the server device 2 and displaying the keyword on the second display device 46. This method also includes the steps of the client device 1 acquiring the second keyword input via the first input device 17, and shutting down the client device 1 if the second keyword input via the first input device 17 matches the first keyword stored in the second storage device 14.

This allows the server device 2 to be notified of the results of erasure of the storage device 13 more reliably than before.

Second Embodiment
In the first embodiment, a case where a keyword is pre-allocated to the client device 1 and the server device 2 before the erasure process is executed is described. On the other hand, in the second embodiment, a case where the server device 2 sets a keyword and sends the keyword from the server device 2 to the client device 1 during the erasure process is described.

[Configuration of the second embodiment]
The configuration of the system 100 according to the second embodiment is the same as the configuration of the system 100 according to the first embodiment described with reference to FIGS. 1 to 5 and the like.

[Operation of the second embodiment]
FIG. 18 is a schematic diagram illustrating the distribution of keywords in the system 100 according to the second embodiment. In the second embodiment, as described above, the server device 2 sets keywords and transmits them to the client device 1 during the erasure process. The server device 2 sets the keywords, for example, by executing the erasure application program 92 to generate the keywords internally. In this case, the server device 2 may randomly generate the keywords. The set keywords are stored in the memory 22 or storage device 23 of the server device 2. The server device 2 also transmits the set keywords to the client device 1 having the storage device 13 to be erased. The client device 1 receives the keywords transmitted from the server device 2 using the erasure application program 70 and writes them to the storage device 14. Alternatively, the client device 1 may receive the keywords transmitted from the server device 2 using the erasure application program 70, temporarily transmit them to the firmware program 50, and then write them to the storage device 14 using the firmware program 50. This distributes the same keywords to the client device 1 and the server device 2.

Figure 19 is a flowchart showing erasure processing of the client device 1 by an erasure application program 70 executed by the processor 11 of the client device 1 according to the second embodiment. Figure 20 is a flowchart showing erasure processing of the client device 1 by a firmware program 50 executed by the processor 11 of the client device 1 according to the second embodiment. Figure 21 is a flowchart showing erasure processing of the server device 2 by an erasure application program 92 executed by the processor 21 of the server device 2 according to the second embodiment.

Referring to FIG. 21, after step S52 is executed, processing proceeds to step S121. In step S121, the server device 2 sets a keyword. As described above, the server device 2 sets a keyword, for example, by generating the keyword internally. After step S121 is executed, processing proceeds to step S53. Thereafter, when information about the client device 1 and the storage device 13 is received in step S55, the server device 2 executes step S56A instead of step S56. In step S56A, the server device 2 generates a processing number and transmits the processing number and keyword to the client device 1.

Referring to FIG. 19, the client device 1 executes step S24A instead of step S24. In step S24A, the core control unit 71 of the erasure application program 70 determines whether a processing number and keyword have been received from the server device 2 in response to the information sent in step S23. If YES, the process proceeds to step S25; if NO, the process returns to step S23. Thereafter, if the user agrees to the erasure of data stored in the storage device 13 in step S26, the client device 1 executes step S27A instead of step S27. In step S27A, the core control unit 71 sends information to the firmware program 50 about the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and the keyword.

Referring to FIG. 20, the client device 1 executes step S31A instead of step S31. In step S31A, the core control unit 51 of the firmware program 50 stores the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and keyword information obtained from the erasure application program 70 in the storage device 14.

Figure 22 is a sequence diagram showing the operation of the system 100 according to the second embodiment when the transmission of erasure result information via the communication line 6 is successful. Figure 23 is a sequence diagram showing the operation of the system 100 according to the second embodiment when the transmission of erasure result information via the communication line 6 is unsuccessful. After executing step S52, the server device 2 sets a keyword in step S121. The server device 2 then transmits the keyword along with the processing number to the client device 1.

The client device 1 and server device 2 then perform the remaining steps of the erasure process, as in the first embodiment.

In the system according to the second embodiment, the server device 2 sets a keyword and sends it to the client device 1 during the erasure process, eliminating the need to distribute the keyword in advance to the client device 1 and the server device 2. Therefore, it is no longer necessary to provide a special firmware program or application program with an embedded keyword in advance for the client device 1 equipped with the storage device 13 to be erased.

In the second embodiment, the server device 2 may set keywords individually for each client device 1.

[First Modification of the Second Embodiment]
24 is a schematic diagram for explaining distribution of keywords in the system 100 according to the first modification of the second embodiment. The server device 2 may set keywords by acquiring them from an external source, for example, from an administrator, instead of generating the keywords internally.

Figure 25 is a diagram showing the content displayed on the display device 26 of the server device 2 according to the first variant of the second embodiment. In step S121 of Figure 21, the server device 2 may display the window 220 of Figure 25 on the display device 26 to prompt the administrator to enter a keyword. The administrator uses the input device 27 of the server device 2 to enter a keyword in the input field 221 and presses the Enter key or the Apply button on the screen. Also, if the administrator is accessing the server device 2 using the administrator device 3, the server device 2 may display the window 220 of Figure 25 on the display device 36 of the administrator device 3. In this case, the administrator enters a keyword using the input device 37 of the administrator device 3.

Even if the server device 2 acquires keywords from an external source, the deletion process is performed in the same manner as in Figures 19 to 23.

In this variant, the administrator may set keywords individually for each client device 1, or may set common keywords for each company, department, or contract.

[Second Modification of the Second Embodiment]
Keywords may need to be updated periodically for security purposes, etc. Therefore, the server device 2 may set multiple keywords associated with multiple erasure operations performed at different times. Note that data stored in the storage device 13 is not necessarily erased immediately after the server device 2 transmits a keyword to the client device 1; a new keyword may be set before the data erasure is complete. Furthermore, the erasure results are not necessarily transmitted to the server device 2 immediately after the data erasure is complete; a new keyword may be set before the server device receives the erasure results. The server device 2 manages a keyword history in order to send an appropriate keyword to the user terminal device 4 when transmission of erasure result information via the communication line 6 fails.

For this reason, the server device 2 stores a keyword table containing the set keywords in the memory 22 or the storage device 23. Each keyword has a different usage period, and is therefore associated with multiple erasure operations performed at different times.

Figure 26 is a flowchart showing the erasure process of the server device 2 by the erasure application program 92 executed by the processor 21 of the server device 2 according to the second variant of the second embodiment.

After step S121 is executed, processing proceeds to step S122. In step S122, the server device 2 adds the newly set keywords in step S121 to the keyword table and updates the keyword table. After step S122 is executed, processing proceeds to step S53.

In step S56A, as described above, the server device 2 generates a processing number and transmits the processing number and keywords to the client device 1. Here, the server device 2 transmits the most recent keywords contained in the keyword table to the client device.

If an erasure result is received from the user terminal device 4 in step S59, processing proceeds to step S123. In step S123, the server device 2 compares the keywords contained in the keyword table based on the erasure result and selects the keyword associated with the current erasure operation being performed by the client device 1, i.e., the same keyword as the keyword transmitted in step S56A. For example, the server device 2 selects the keyword that was in use at the time the erasure operation of the data stored in the storage device 13 of the client device 1 was initiated, based on the erasure start time contained in the erasure result. After executing step S123, processing proceeds to step S60, where the server device 2 reads the selected keyword from the memory 22 or storage device 23 and transmits it to the user terminal device 4.

In this modified example, the client device 1 operates in the same manner as in Figures 19 and 20.

Figure 27 is a sequence diagram showing the operation of system 100 according to the second modification of the second embodiment when transmission of erasure result information via communication line 6 is successful. Figure 28 is a sequence diagram showing the operation of system 100 according to the second modification of the second embodiment when transmission of erasure result information via communication line 6 is unsuccessful.

Referring to FIG. 27, after executing step S52, the server device 2 sets a keyword in step S121. Next, in step S122, the server device 2 adds the newly set keyword to the keyword table and updates the keyword table. The server device 2 then transmits the latest keyword along with the processing number to the client device 1. If the transmission of the erasure result information via the communication line 6 is successful, the client device 1 and server device 2 operate in the same manner as in FIGS. 16 and 22.

On the other hand, if transmission of the erasure result information via the communication line 6 fails, as shown in FIG. 28, in step S123, the server device 2 compares the keywords contained in the keyword table based on the erasure result and selects the keyword associated with the current erasure operation being performed by the client device 1. The server device 2 then transmits the selected keyword to the user terminal device 4.

The client device 1 and server device 2 then perform the remaining steps of the erasure process, as in the first embodiment.

Figure 29 is a diagram showing exemplary contents of a keyword table stored in the memory 22 or storage device 23 of the server device 2 according to the second variant of the second embodiment. The keyword table in Figure 29 includes four keywords with different usage periods (i.e., combinations of usage start date and time and usage end date and time). As described above, the server device 2 can select the keyword that was in use at the time the erasure operation for data stored in the storage device 13 of the client device 1 was started, based on the erasure start time included in the erasure result.

Figure 30 is a diagram showing another example of the contents of a keyword table stored in the memory 22 or storage device 23 of the server device 2 according to the second variant of the second embodiment. The keyword table in Figure 30 includes the processing number transmitted together with the keyword in step S56A. In this case, the server device 2 can select the keyword that was in use at the time the erasure operation for data stored in the storage device 13 of the client device 1 was initiated, based on the processing number included in the erasure result.

In this modified example, the multiple keywords may be generated internally in the server device 2, or may be obtained from outside the server device 2. In the former case, the server device 2 may periodically generate new keywords by executing the erasure application program 92. In the latter case, the server device 2 may periodically display window 220 in FIG. 25 on the display device 26 or 36 to prompt the administrator to input new keywords.

According to this modification, even if keywords are updated periodically for security or other purposes, appropriate keywords associated with the current erasure operation being performed by the client device 1 can be sent to the user terminal device 4.

[Advantages of the second embodiment]
According to one aspect of the present disclosure, the server device 2 may internally generate a keyword. In this case, the server device 2 transmits the generated keyword to the client device 1 as a first keyword and stores the generated keyword in the memory 22 or the storage device 23 as a second keyword.

This eliminates the need to pre-distribute keywords to the client device 1 and server device 2.

According to one aspect of the present disclosure, the server device 2 may further include a second input device 27 or 37 that acquires keywords from an external device. In this case, the server device 2 transmits the acquired keywords to the client device 1 as first keywords and stores the acquired keywords in the memory 22 or the storage device 23 as second keywords.

This eliminates the need to pre-distribute keywords to the client device 1 and server device 2.

According to one aspect of the present disclosure, the memory 22 or storage device 23 may store multiple second keywords associated with multiple erasure operations performed at different times. In this case, the erasure completion information includes the erasure start time. Based on the erasure start time included in the erasure completion information received from the user terminal device 4, the server device 2 reads the second keyword associated with the current erasure operation from the memory 22 or storage device 23 and transmits it to the user terminal device 4.

This allows the appropriate keyword associated with the current erasure operation to be sent to the user terminal device 4, even if the keyword is updated periodically for security or other purposes.

According to one aspect of the present disclosure, the memory 22 or storage device 23 may store multiple process numbers and multiple second keywords associated with multiple erasure operations performed at multiple different times. In this case, the erasure completion information includes the process number. Based on the process number included in the erasure completion information received from the user terminal device 4, the server device 2 reads the second keyword associated with the current erasure operation from the memory 22 or storage device 23 and transmits it to the user terminal device 4.

This allows the appropriate keyword associated with the current erasure operation to be sent to the user terminal device 4, even if the keyword is updated periodically for security or other purposes.

[Third embodiment]
In the second embodiment, a case has been described in which the server device 2 sets a keyword and sends the keyword from the server device 2 to the client device 1 during execution of the erasure process. On the other hand, in the third embodiment, a case has been described in which the client device 1 sets a keyword and sends the keyword from the client device 1 to the server device 2 during execution of the erasure process.

[Configuration of the third embodiment]
The configuration of the system 100 according to the third embodiment is the same as the configuration of the system 100 according to the first embodiment described with reference to FIGS. 1 to 5 and the like.

[Operation of the third embodiment]
FIG. 31 is a schematic diagram illustrating the distribution of keywords in the system 100 according to the third embodiment. In the third embodiment, as described above, the client device 1 sets a keyword and sends it to the server device 2 during the erasure process. The client device 1 sets the keyword, for example, by executing the erasure application program 70 to generate the keyword internally. In this case, the client device 1 may randomly generate the keyword. The set keyword is stored in the storage device 14 of the client device 1. The client device 1 also transmits the set keyword to the server device 2. The server device 2 receives the keyword transmitted from the client device 1 using the erasure application program 92 and writes it to the memory 22 or the storage device 23. As a result, the same keyword is distributed to the server device 2 and the client device 1.

The server device 2 may receive keywords generated by each of the multiple client devices 1 from the multiple client devices 1. The server device 2 manages the multiple keywords received from each of the multiple client devices 1 in an identifiable manner, in order to send an appropriate keyword to the user terminal device 4 when transmission of erasure result information via the communication line 6 fails. To this end, the server device 2 stores in the memory 22 or storage device 23 a keyword table containing the multiple keywords received from each of the multiple client devices 1. The keyword table associates the keyword generated by the client device 1 that includes the storage device 13 to be erased with, for example, the identification information of the storage device 13 to be erased, the identification information of the client device 1 that includes the storage device 13 to be erased, or a process number associated with the erasure operation to be performed on the storage device 13 to be erased.

Figure 32 is a flowchart showing erasure processing of a client device 1 by an erasure application program 70 executed by the processor 11 of the client device 1 according to the third embodiment. Figure 33 is a flowchart showing erasure processing of a server device 2 by an erasure application program 92 executed by the processor 21 of the server device 2 according to the third embodiment.

Referring to FIG. 32, if it is determined in step S22 that an erasure flag has been registered, the client device 1 executes step S131. In step S131, the core control unit 71 of the erasure application program 70 sets a keyword. As described above, the core control unit 71 sets the keyword, for example, by generating the keyword internally in the client device 1. After executing step S131, the client device 1 executes step S23A instead of step S23. In step S23A, the core control unit 71 uses the communication device 15 to transmit information about the client device 1, information about the storage device 13, and the keyword to the server device 2. After executing step S23A, processing proceeds to step S24.

Referring to FIG. 33, the server device 2 executes step S55A instead of step S55. In step S55A, the server device 2 determines whether it has received information about the client device 1, information about the storage device 13, and keywords from the client device 1. If the answer is YES, the server device 2 proceeds to step S56; if the answer is NO, the server device 2 returns to step S51.

In step S56, the server device 2 generates a processing number and sends it to the client device 1. Next, in step S141, the server device 2 updates the keyword table by adding the keyword received in step S55A and the processing number generated in step S56 to the keyword table. After step S141 is executed, processing proceeds to step S57.

After that, if an erasure result is received from the user terminal device 4 in step S59, processing proceeds to step S142. In step S142, the server device 2 compares the keywords contained in the keyword table based on the erasure result and selects the keyword associated with the current erasure operation being performed by the client device 1, i.e., the keyword received in step S55A. After executing step S142, processing proceeds to step S60, where the server device 2 reads the selected keyword from the memory 22 or storage device 23 and transmits it to the user terminal device 4.

Figure 34 is a sequence diagram showing the operation of the system 100 according to the third embodiment when the transmission of erasure result information via the communication line 6 is successful. Figure 35 is a sequence diagram showing the operation of the system 100 according to the third embodiment when the transmission of erasure result information via the communication line 6 is unsuccessful.

Referring to FIG. 34, after receiving a response signal from the server device 2 in response to the erasure flag inquiry, the client device 1 sets a keyword in step S131. The client device 1 then transmits the keyword to the server device 2 along with the client device 1 information and storage device 13 information. If the client device 1 information and storage device 13 information received by the server device 2 matches the client device 1 information and storage device 13 information registered in the server device 2's management table, the server device 2 generates a processing number for the client device 1's storage device 13 and transmits it to the client device 1. Furthermore, the server device 2 adds the keyword and processing number to the keyword table to update it. If transmission of the erasure result information via the communication line 6 is successful, the client device 1 and server device 2 operate in the same manner as in FIGS. 16, 22, and 27.

On the other hand, if transmission of the erasure result information via the communication line 6 fails, as shown in FIG. 35, in step S142, the server device 2 compares the keywords contained in the keyword table based on the erasure result and selects the keyword associated with the current erasure operation being performed by the client device 1. The server device 2 then transmits the selected keyword to the user terminal device 4.

The client device 1 and server device 2 then perform the remaining steps of the erasure process, as in the first embodiment.

36 is a diagram showing exemplary contents of a keyword table stored in the memory 22 or storage device 23 of the server device 2 in the third embodiment. The keyword table in FIG. 36 includes a process number associated with the erasure operation to be performed on the storage device 13 to be erased and a keyword generated by the client device 1 including the storage device 13 to be erased. In this case, the server device 2 can select the keyword generated by the client device 1 including the storage device 13 to be erased based on the process number included in the erasure result. The keyword table may include identification information for the storage device 13 to be erased or identification information for the client device 1 including the storage device 13 to be erased, for example, information identical to at least part of the information about the client device 1 and the storage device included in the management table in FIG. 10. While FIG. 36 shows a case in which the keyword table includes the UUID of the client device 1, it may also include other information about the client device 1 or the storage device. This allows the server device 2 to transmit to the user terminal device 4 the appropriate keyword associated with the current erasure operation being performed by the client device 1, even when receiving keywords from multiple client devices 1.

In the system according to the third embodiment, the client device 1 sets a keyword and sends it to the server device 2 during the erasure process. This eliminates the need to distribute the keyword in advance to the client device 1 and the server device 2, as in the system according to the second embodiment. Therefore, it is no longer necessary to provide a special firmware program or application program with an embedded keyword in advance for the client device 1 equipped with the storage device 13 to be erased.

[Modification of the third embodiment]
FIG. 37 is a schematic diagram for explaining the distribution of keywords in the system 100 according to the first modification of the third embodiment. Instead of generating keywords internally, the client device 1 may set keywords by acquiring them externally, for example, from a user. In step S131 of FIG. 32, the client device 1 may display the window 220 of FIG. 25 on the display device 16 to prompt the user to input a keyword. The user inputs a keyword using the input device 17 of the client device 1. Even when the client device 1 acquires a keyword externally, the deletion process is performed in the same manner as in the cases of FIGS. 32 to 35.

[Advantages of the third embodiment]
According to one aspect of the present disclosure, the client device 1 may internally generate a keyword, store the generated keyword in the second storage device 14 as a first keyword, and transmit the generated keyword to the server device 2 as a second keyword.

This eliminates the need to pre-distribute keywords to the client device 1 and server device 2.

According to one aspect of the present disclosure, the client device 1 may acquire keywords from an external source using the first input device 17. In this case, the client device 1 stores the acquired keywords in the second storage device 14 as first keywords and transmits the acquired keywords to the server device 2 as second keywords.

This eliminates the need to pre-distribute keywords to the client device 1 and server device 2.

Other Embodiments
As described above, the embodiments have been described as examples of the technology disclosed in this application. However, the technology in this disclosure is not limited to these, and can be applied to embodiments in which appropriate modifications, substitutions, additions, omissions, etc. are made. Furthermore, it is also possible to combine the components described in the above embodiments to create new embodiments.

Therefore, other embodiments are illustrated below.

In the second embodiment, a case was described in which the server device 2 sets a keyword before receiving an inquiry about the deletion flag from the client device 1. Alternatively, the server device 2 may randomly generate a keyword after receiving an inquiry about the deletion flag from the client device 1.

If the administrator accesses the server device 2 via the administrator device 3, the display device 26 and input device 27 of the server device 2 may be omitted.

After erasing the data stored in the storage device 13, the client device 1 may verify that the data has been erased. The client device 1 transmits the verification results to the server device 2 via the communication line 6. However, if the verification results cannot be transmitted from the client device 1 to the server device 2, the client device 1 may generate a two-dimensional barcode containing the verification results and display it on the display device 26. This allows a user or administrator with access to the client device 1 to photograph the two-dimensional barcode using the user terminal device 4 and transmit the verification results contained in the two-dimensional barcode from the user terminal device 4 to the server device 2. When generating a two-dimensional barcode containing verification results, a keyword can be used to ensure that the verification results are transmitted to the server device 2, just as when generating a two-dimensional barcode containing erasure completion information.

When issuing an erasure permit, it may be possible to issue it by specifying the model. In addition to the model, user information may be entered in the notes so that if a user has a model other than the specified model, an erasure permit for the specified model is issued. The specified models may be displayed in a list so that the administrator can issue an erasure permit. This has the effect of allowing the client device 1 to be managed in a way that reflects the user's intentions, such as discarding models that have predetermined features or models that do not have predetermined features (for example, discarding models that do not have both the form of a notebook computer and a tablet computer (so-called "2-in-1")). This has the effect of allowing, for example, older models to be discarded first.

Alternatively, erasure authorization may be issued by specifying the manufacturer of the storage device 13. This has the effect of eliminating client devices 1 supplied by manufacturers that are prone to malfunctions.

The management table of the server device 2 may also have a notes field in which any character string can be entered. By entering user information in the notes field, users who use multiple client devices 1 can be listed and erasure authorization can be issued. This has the effect of reducing the total number of client devices 1. Furthermore, by entering user information in the notes field, it becomes easier to handle multiple client devices 1 as units such as departments or sections.

Also, by sending the client device 1's S.M.A.R.T. information (Self-Monitoring Analysis and Reporting Technology) to the server device 2, client devices 1 in poor condition may be discovered and erasure authorization may be issued based on that information. To evaluate the status of the storage device 13 based on S.M.A.R.T. information, for example, the number of sectors that have been replaced, the number of power-on cycles, the error rate caused by impact, the length of use time, temperature, the increase in the above parameters as seen by the server device 2, or a combination of these may be used. The client device 1 may calculate the status of the client device 1 based on the S.M.A.R.T. information and send that status to the server device 2 as remarks. Registered client devices 1 may periodically send S.M.A.R.T. information to the server device 2, allowing the server device 2 to grasp the status of all client devices 1. Registered client devices 1 may periodically check the S.M.A.R.T. of their client devices 1. The status of the client device 1 can be calculated based on the information and sent to the server device 2 as remarks, allowing the server device 2 to grasp the status of all client devices 1. This has the effect of allowing client devices 1 in poor condition to be discarded first.

Also, by sending the usage time of the client device 1 to the server device 2, client devices 1 in poor condition can be discovered and erasure permission can be issued based on that information. The usage time of the client device 1 can also be sent to the server device 2 as remark information. This has the effect of allowing client devices 1 with long usage times to be discarded first.

In addition, stress information from the client device 1 can be sent to the server device 2 to identify client devices 1 in poor condition and issue deletion permission based on that information. The stress of the client device 1 can also be sent to the server device 2 as remark information. This has the effect of making it possible to discard client devices 1 that have been used in high-load environments.

In the examples shown in Figures 11, 13, 16, and 17, the client device 1 inquires about the deletion flag and sends information about the client device 1 and the storage device 13 to the server device 2 separately, but these communications may also be performed simultaneously. The server device 2 may consider that it has received an inquiry about the deletion flag when it receives information about the client device 1 and the storage device 13 from the client device 1.

In the examples of Figures 11 to 13, 16, and 17, the client device 1 is restarted to transition from erasure processing using a combination of the application program 70 and the firmware program 50 to erasure processing using only the firmware program 50. However, the client device 1 may also be configured to transition from erasure processing using a combination of the application program 70 and the firmware program 50 to erasure processing using only the firmware program 50 without restarting.

In the example of Figure 2, the client device 1 is described as having only one storage device 13 from which stored data is to be erased, but the client device 1 may also have multiple storage devices 13 from which stored data is to be erased. The multiple storage devices 13 may be configured as a RAID (Redundant Array of Inexpensive Disks) device, for example. In this case, the multiple storage devices 13 are treated as a single device, and the data stored therein is erased as a single device. Alternatively, the multiple storage devices 13 may be treated individually, and the data stored therein may be erased individually.

When erasing data stored on the storage device 13, if secure erase is specified as the erasure method but fails, and triple overwrite erase is performed as an alternative and is successful, "triple overwrite erase" will be recorded as the erasure result information. The firmware program 50 pre-sets the alternative process to be performed in the event of an erase failure. For example, each time an erase fails, the erasure method may be changed in the following order: secure erase → triple overwrite erase → single overwrite erase.

As described above, the embodiments have been described as examples of the technology disclosed herein. For this purpose, the accompanying drawings and detailed description have been provided.

Therefore, the components shown in the attached drawings and detailed description may include not only components essential for solving the problem, but also components that are not essential for solving the problem in order to illustrate the above technology. Therefore, the fact that these non-essential components are shown in the attached drawings or detailed description should not be interpreted as immediately indicating that these non-essential components are essential.

Furthermore, the above-described embodiments are intended to illustrate the technology disclosed herein, and various modifications, substitutions, additions, omissions, etc. may be made within the scope of the claims or their equivalents.

An electronic device according to one aspect of the present disclosure is useful for erasing data stored in a storage device.

1, 1-1 to 1-3 Client device 2 Server device 3 Administrator device 4 User terminal device 5 Base station device 6 Communication line 10 Bus 11 Processor 12 Memory 13 Storage device 14 Storage device 15 Communication device 16 Display device 17 Input device 20 Bus 21 Processor 22 Memory 23 Storage device 25 Communication device 26 Display device 27 Input device 30 Bus 31 Processor 32 Memory 33 Storage device 35 Communication device 36 Display device 37 Input device 40 Bus 41 Processor 42 Memory 43 Storage device 45 Communication device 46 Display device 47 Input device 48 Photography device 50 Firmware program 51 Core control unit 52 Erasure control unit 53 Data encoding unit 54 Two-dimensional barcode generation unit 60 Operating system 61 Device information monitor 62 Power management unit 70 Erasure application program 71 Core control unit 81 Core control unit 82 Reading unit 83 Writing unit 84 Erasure unit 91 Operating system 92 Erasure application program 100 System 200 Display screen 201 Two-dimensional barcode 202 Input field 211 Keyword 220 Window 221 Input field

Claims (14)

1. A system for erasing data stored on a storage device of at least one electronic device, comprising:
the system includes the at least one electronic device, a server device, and a terminal device;
the electronic device includes a first storage device that stores data to be erased, a second storage device that stores a first keyword, a first display device, and a first input device;
the server device includes a third storage device that stores a second keyword;
the terminal device includes an imaging device and a second display device;
the electronic device erases the data stored in the first storage device, and displays on the first display device a graphic code including erasure completion information indicating that erasure of the data stored in the first storage device has been completed;
the terminal device photographs the graphic code using the photographing device, extracts the erasure completion information from the graphic code, and transmits the erasure completion information to the server device;
the server device receives the erasure completion information from the terminal device, reads the second keyword from the third storage device, and transmits the second keyword to the terminal device;
the terminal device receives the second keyword from the server device and displays the keyword on the second display device;
the electronic device acquires the second keyword input via the first input device, and shuts down the electronic device if the second keyword input via the first input device matches the first keyword stored in the second storage device;
system. the first storage device stores data including an operating system, application programs, and user data;
the second storage device further stores a firmware program;
the electronic device erases all data stored in the first storage device by executing the firmware program;
The system of claim 1 . The first keyword is embedded in the firmware program in advance.
The system of claim 2. the server device internally generates a keyword, transmits the generated keyword to the electronic device as the first keyword, and stores the generated keyword in the third storage device as the second keyword;
The system of claim 1 . the server device further includes a second input device (27 or 37) that acquires a keyword from the outside, transmits the acquired keyword to the electronic device as the first keyword, and stores the acquired keyword in the third storage device as the second keyword;
The system of claim 1 . the third storage device stores a plurality of second keywords respectively associated with a plurality of erasure operations executed at a plurality of different times;
the erasure completion information includes an erasure start time,
the server device reads a second keyword associated with the current erasure operation from the third storage device based on the erasure start time included in the erasure completion information received from the terminal device, and transmits the second keyword to the terminal device;
6. A system according to claim 4 or 5. the third storage device stores a plurality of process numbers and a plurality of second keywords respectively associated with a plurality of erasure operations executed at a plurality of different times;
the erasure completion information includes the processing number,
the server device reads a second keyword associated with the current erasure operation from the third storage device based on a processing number included in the erasure completion information received from the terminal device, and transmits the second keyword to the terminal device;
6. A system according to claim 4 or 5. the electronic device internally generates a keyword, stores the generated keyword in the second storage device as the first keyword, and transmits the generated keyword to the server device as the second keyword;
The system of claim 1 . the electronic device externally acquires a keyword using the first input device, stores the acquired keyword in the second storage device as the first keyword, and transmits the acquired keyword to the server device as the second keyword;
The system of claim 1 . The graphic code is a two-dimensional bar code.
The system of claim 1 . The electronic device is
After erasing the data stored in the first storage device, transmitting the erasure completion information to the server device;
If an acknowledgement signal for the transmitted erasure completion information is received from the server device within a predetermined period of time, the electronic device is shut down without displaying the graphic code on the first display device;
if the acknowledgement signal is not received from the server device within the predetermined period of time, displaying the graphic symbol on the first display device.
The system of claim 1 . The server device
obtaining the erasure completion information from the electronic device;
issuing an erasure certificate that certifies that erasure of the data stored in the first storage device has been completed based on the erasure completion information;
11. The system of claim 1 or 10. An electronic device for processing information, comprising:
a first storage device that stores data to be erased;
a second storage device for storing the first keyword;
a first display device for displaying information;
a first input device for accepting input from a user of the electronic device;
a processor for controlling the electronic device;
The processor:
erasing the data stored in the first storage device;
displaying on the first display device a graphic code including erasure completion information indicating that erasure of the data stored in the first storage device has been completed;
acquiring, via the first input device, a second keyword obtained by the user transmitting erasure completion information included in the graphic code to a server device;
comparing the second keyword with the first keyword stored in the second storage device and shutting down the electronic device if a match is found;
electronic equipment. 1. A method of operating a system for erasing data stored on a storage device of at least one electronic device, comprising:
the system includes the at least one electronic device, a server device, and a terminal device;
the electronic device includes a first storage device that stores data to be erased, a second storage device that stores a first keyword, a first display device, and a first input device;
the server device includes a third storage device that stores a second keyword;
the terminal device includes an imaging device and a second display device;
The operating method includes:
erasing the data stored in the first storage device by the electronic device, and displaying on the first display device a graphic code including erasure completion information indicating that erasure of the data stored in the first storage device has been completed;
a step of taking an image of the graphic code using the photographing device by the terminal device, extracting the erasure completion information from the graphic code, and transmitting the erasure completion information to the server device;
receiving, by the server device, the erasure completion information from the terminal device, reading the second keyword from the third storage device, and transmitting the second keyword to the terminal device;
receiving the second keyword from the server device by the terminal device and displaying the keyword on the second display device;
acquiring, by the electronic device, the second keyword input via the first input device, and shutting down the electronic device if the second keyword input via the first input device matches the first keyword stored in the second storage device.
How it works.