Electronic devices

Abstract

A client device (1) comprises: a first processing circuit (401); a communication device (15) which is capable of communicating with a server device 2 via a communication line (6); a first storage device (13) which stores therein an operating system, an application program, and storage data including user data; and a non-volatile memory (403) which stores therein a first firmware program and first configuration information. Upon execution by the first processing circuit (401), the first firmware program controls the operation of the client device (1) on the basis of the first configuration information. Upon receiving, from the server (2), a first delete command instructing deletion of the storage data and the first configuration information, the first processing circuit (401) executes the first firmware program, and deletes the storage data from the first storage device (13) and the first configuration information from the non-volatile memory (403).

Description

[Technical Field]

[0001] The present disclosure relates to an electronic device, a system, and a method for erasing data stored on a storage device of an electronic device. [Background technology]

[0002] When an organization such as a company disposes of an electronic device such as a personal computer, it is required to erase the data stored in the storage device in order to prevent confidential business information from being leaked.

[0003] Patent Document 1 discloses a data erasure management method in which data is erased from a storage device in a terminal to be managed, and the execution results are recorded and managed in a management database for each terminal to be managed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 4493677 Summary of the Invention [Problem to be solved by the invention]

[0005] An electronic device stores firmware programs, such as a Unified Extensible Firmware Interface (UEFI) or Basic Input / Output System (BIOS) program, and configuration information, such as a supervisor password, separately from an operating system, multiple application programs, and user data. Conventionally, when erasing data stored in an electronic device, the operating system, multiple application programs, and user data are erased, but the configuration information of the firmware programs is not erased. Because the configuration information of the firmware programs may also contain confidential data, there is a need for a more reliable method of erasing data stored in an electronic device.

[0006] The present disclosure provides an electronic device that can erase stored data more reliably than conventional devices, a system including such an electronic device and a server device, and a method for erasing data stored in a storage device of the electronic device. [Means for solving the problem]

[0007] An electronic device according to one aspect of the present disclosure includes: a first processing circuit; a communication circuit capable of communicating with a server device via a communication line; a first storage device for storing stored data including an operating system, application programs, and user data; an electronic device comprising: a first firmware program; and a second storage device that stores first setting information; the first firmware program is executed by the first processing circuit to control the operation of the electronic device based on the first setting information; When the first processing circuit receives a first erasure command from the server device instructing the erasure of the stored data and the first setting information, it executes the first firmware program to erase the stored data from the first storage device and the first setting information from the second storage device. [Effects of the Invention]

[0008] According to an electronic device according to an aspect of the present disclosure, stored data can be erased more reliably than in the past. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a schematic diagram showing the configuration of a system 100 according to a first embodiment. [Figure 2] 2 is a block diagram showing the configuration of a client device 1 in FIG. 1. FIG. [Figure 3]FIG. 3 is a block diagram showing the configuration of a UEFI controller 14A in FIG. 2. [Figure 4] FIG. 3 is a block diagram showing the configuration of an auxiliary controller 14B in FIG. 2. [Figure 5] FIG. 3 is a block diagram showing the configuration of a TPM controller 14C in FIG. 2. [Figure 6] 2 is a block diagram showing the configuration of a server device 2 in FIG. 1. FIG. [Figure 7] FIG. 2 is a block diagram showing the configuration of an administrator device 3 in FIG. [Figure 8] FIG. 2 is a block diagram showing the configuration of a user terminal device 4 in FIG. [Figure 9] 4 is a schematic diagram showing the functional blocks of a firmware program 50 executed by the processing circuitry 401 of FIG. 3 and an erase application program 70 executed by the processor 11 of FIG. 2. [Figure 10] 3 is a flowchart showing a registration process by an erasure application program 70 executed by the processor 11 of FIG. 2. [Figure 11] 7 is a flowchart showing a registration process of the server device 2 executed by the processor 21 of FIG. 6. [Figure 12] 7 is a diagram showing exemplary contents of a management table 22a stored in the RAM 22 of FIG. 6. FIG. [Figure 13] 13 is a diagram showing exemplary contents of an erasure flag in the management table 22a of FIG. 12. FIG. [Figure 14] FIG. 13 is a diagram showing another exemplary content of the erasure flag in the management table 22a of FIG. [Figure 15] 3 is a flowchart showing an erasure process by an erasure application program 70 executed by the processor 11 of FIG. 2. [Figure 16] 4 is a flowchart showing an erasure process by the firmware program 50 executed by the processing circuit 401 of FIG. 3. [Figure 17] 7 is a flowchart showing an erasure process of the server device 2 executed by the processor 21 of FIG. 6. [Figure 18] FIG. 17 is a diagram showing the content displayed on the display device 16 of the client device 1 in step S39 of FIG. [Figure 19] 1. FIG. 4 is a sequence diagram showing the operation of the system 100 in the case where transmission of erasure result information via the communication line 6 in the system 100 of FIG. 1 is successful. [Figure 20] 1. FIG. 4 is a sequence diagram showing the operation of the system 100 in the case where transmission of erasure result information via the communication line 6 in the system 100 of FIG. [Figure 21] 10 is a flowchart showing the operation of the system according to the second embodiment, illustrating erasure and verification processing by the firmware program 50 executed by the processing circuit 401 of the client device 1. [Figure 22] 22 is a flowchart showing a subroutine of step S70 (verification process) of FIG. 21. [Figure 23] 10 is a flowchart showing the operation of the system according to the second embodiment, illustrating the erasure and verification process of the server device 2 executed by the processor 21. [Figure 24] FIG. 10 is a schematic diagram for explaining a first verification method for the storage device 13. [Figure 25] FIG. 10 is a schematic diagram for explaining a second verification method for the storage device 13. [Figure 26] FIG. 10 is a sequence diagram illustrating the operation of the system according to the second embodiment, showing the operation of the system 100 when the erasure result information and the verification result information are successfully transmitted via the communication line 6. [Figure 27] FIG. 10 is a sequence diagram illustrating the operation of the system according to the second embodiment, showing the operation of the system 100 when transmission of erasure result information and verification result information via the communication line 6 fails. [Figure 28] 10 is a flowchart showing the operation of a system according to a modified example of the second embodiment, illustrating a subroutine of step S70A (verification process) executed by the processing circuit 401 of the client device 1. [Figure 29]10 is a flowchart showing the operation of the system according to a modified example of the second embodiment, illustrating the erasure and verification process of the server device 2 executed by the processor 21. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, more detailed description than necessary may be omitted. For example, detailed description of well-known matters or redundant description of substantially identical configurations may be omitted. This is to avoid unnecessary redundancy in the following description and to facilitate understanding by those skilled in the art.

[0011] The inventors provide the accompanying drawings and the following description to enable those skilled in the art to fully understand the present disclosure, and do not intend for them to limit the subject matter described in the claims.

[0012] [First embodiment] [Configuration of the first embodiment] 1 is a schematic diagram showing the configuration of a system 100 according to the first embodiment. The system 100 in FIG. 1 includes a plurality of client devices 1-1 to 1-3, a server device 2, an administrator device 3, a user terminal device 4, a base station device 5, and a communication line 6.

[0013] The client devices 1-1 to 1-3 are communicably connected to the server device 2 via a communication line 6. The client devices 1-1 to 1-3 are electronic devices equipped with a storage device (described later), such as a personal computer or a mobile phone.

[0014] In this specification, the client devices 1-1 to 1-3 are also collectively referred to as "client device 1."

[0015] The server device 2 manages the erasure of data stored in the storage device of each client device 1.

[0016] The administrator device 3 is communicably connected to the server device 2 via a communication line 6. The administrator of each client device 1 uses the administrator device 3 to access the server device 2 and specify the storage device from which stored data should be erased.

[0017] The user terminal device 4 is an electronic device, such as a mobile phone, equipped with a camera 48 and a communication device. The user terminal device 4 is connected to the server device 2 via the base station device 5 so as to be able to communicate with the server device 2.

[0018] The communication line 6 is, for example, a local area network (LAN), the Internet, or a combination thereof.

[0019] For example, each client device 1 and administrator device 3 may be owned by an organization such as a company, while the server device 2 may be operated by a third party different from this organization. In this case, the organization that owns each client device 1 and administrator device 3 enters into a contract with the operator of server device 2 to manage the erasure of data stored in the storage device of each client device 1, and becomes a customer of this operator.

[0020] In this specification, "erasing" means making the original stored data unreadable. "Erasing" may mean, for example, making the original data unreadable by overwriting it with other data, such as "0," "1," or a random value, or it may mean making the original data unreadable by executing a command erasure function (e.g., a secure erase command) built into the firmware program of the storage device. Furthermore, if the storage device has a self-encryption function, "erasing" may also mean changing the encryption key (cryptographic erasure).

[0021] FIG. 2 is a block diagram showing the configuration of the client device 1 of FIG. 1. The client device 1 includes a bus 10, a processor 11, a random access memory (RAM) 12, a storage device 13, a Unified Extensible Firmware Interface (UEFI) controller 14A, an auxiliary controller 14B, a Trusted Platform Module (TPM) controller 14C, a communication device 15, a display device 16, and an input device 17. The processor 11 controls the overall operation of the client device 1. The RAM 12 temporarily stores programs and data necessary for the operation of the client device 1. The storage device 13 stores data including an operating system (OS), multiple application programs (APPs), and user data. The storage device 13 is a non-volatile storage medium such as a hard disk drive (HDD) or a solid-state drive (SSD). The UEFI controller 14A controls the operation of the client device 1, for example, by erasing data stored in the storage device 13. The auxiliary controller 14B enables the operation of the client device 1 to be controlled by an external device connected via a communication line 6. The TPM controller 14C encrypts and decrypts data stored in the storage device 13 and records encryption keys. The communication device 15 is communicatively connected to the server device 2 via a communication line 6. The display device 16 displays information related to the status of the client device 1, for example, an image including information related to erasure of data stored in the storage device 13. The input device 17 receives user input for controlling the operation of the client device 1, for example, user input related to erasure of data stored in the storage device 13. The input device 17 includes, for example, a keyboard and a pointing device. The processor 11, RAM 12, storage device 13, UEFI controller 14A, auxiliary controller 14B, TPM controller 14C, communication device 15, display device 16, and input device 17 are connected to one another via a bus 10.

[0022] FIG. 3 is a block diagram showing the configuration of the UEFI controller 14A in FIG. 2. The UEFI controller 14A includes a bus 400, a processing circuit 401, a volatile memory 402, a nonvolatile memory 403, and an input / output interface (I / F) 404. The processing circuit 401 controls the overall operation of the UEFI controller 14A. The volatile memory 402 temporarily stores programs and data necessary for the operation of the UEFI controller 14A. The nonvolatile memory 403 stores a firmware program for the UEFI controller 14A and its setting information. The firmware program for the UEFI controller 14A is executed by the processing circuit 401 to control the operation of the client device 1 based on the setting information. The setting information includes, for example, a password (supervisor password) that restricts changes to the setting information. The processing circuit 401, the volatile memory 402, the nonvolatile memory 403, and the input / output interface 404 are connected to one another via a bus 400. The bus 400 is connected to the bus 10 (see FIG. 2) of the client device 1 via the input / output interface 404.

[0023] FIG. 4 is a block diagram showing the configuration of the auxiliary controller 14B of FIG. 2. The auxiliary controller 14B includes a bus 410, a processing circuit 411, a volatile memory 412, a nonvolatile memory 413, and an input / output interface 414. The processing circuit 411 controls the overall operation of the auxiliary controller 14B. The volatile memory 412 temporarily stores programs and data necessary for the operation of the auxiliary controller 14B. The nonvolatile memory 413 stores the firmware program of the auxiliary controller 14B and its setting information. The firmware program of the auxiliary controller 14B, when executed by the processing circuit 411, enables an external device connected via the communication line 6 to control the operation of the client device 1 based on the setting information. The setting information includes, for example, whether or not control by the external device is enabled. The processing circuit 411, the volatile memory 412, the nonvolatile memory 413, and the input / output interface 414 are connected to one another via a bus 410. The bus 410 is connected to the bus 10 of the client device 1 (see FIG. 2) via the input / output interface 414.

[0024] The firmware program of the auxiliary controller 14B may be, for example, the Intel® Management Engine BIOS Extension (MEBx) provided by Intel Corporation. MEBx, together with Intel Advanced Management Technology (AMT) and the Intel AMT High Level Application Programming Interface (HLAPI) provided by Intel Corporation, allows remote access from the outside even when the operating system is not available or the device is powered off.

[0025] FIG. 5 is a block diagram showing the configuration of the TPM controller 14C in FIG. 2. The TPM controller 14C includes a bus 420, a processing circuit 421, a volatile memory 422, a nonvolatile memory 423, and an input / output interface 424. The processing circuit 421 controls the overall operation of the TPM controller 14C. The volatile memory 422 temporarily stores programs and data necessary for the operation of the TPM controller 14C. The nonvolatile memory 423 stores the firmware program of the TPM controller 14C and its setting information. The firmware program of the TPM controller 14C is executed by the processing circuit 421 to encrypt and decrypt data stored in the storage device 13 based on the setting information. The setting information includes, for example, an encryption key. The processing circuit 421, the volatile memory 422, the nonvolatile memory 423, and the input / output interface 424 are connected to one another via a bus 420. The bus 420 is connected to the bus 10 (see FIG. 2) of the client device 1 via the input / output interface 424.

[0026] When executed by the processing circuit 401, the firmware program of the UEFI controller 14A according to the embodiment erases stored data from the storage device 13, erases the setting information of the UEFI controller 14A from the non-volatile memory 403, erases the setting information of the auxiliary controller 14B from the non-volatile memory 413, and erases the setting information of the TPM controller 14C from the non-volatile memory 423.

[0027] FIG. 6 is a block diagram showing the configuration of the server device 2 of FIG. 1. The server device 2 includes a bus 20, a processor 21, a RAM 22, a storage device 23, and a communication device 25. The processor 21 controls the overall operation of the server device 2 and also manages the deletion of stored data and setting information of each client device 1. The RAM 22 temporarily stores programs and data necessary for the operation of the server device 2. For example, the RAM 22 stores a management table 22a for managing the deletion of stored data and setting information of each client device 1. The storage device 23 is a non-volatile storage medium that stores programs necessary for the operation of the server device 2. The communication device 25 is communicably connected to each client device 1 and the administrator device 3 via a communication line 6. The processor 21, the RAM 22, the storage device 23, and the communication device 25 are connected to one another via a bus 20.

[0028] FIG. 7 is a block diagram showing the configuration of the administrator device 3 in FIG. 1. The administrator device 3 includes a bus 30, a processor 31, a RAM 32, a storage device 33, a communication device 35, a display device 36, and an input device 37. The processor 31 controls the overall operation of the administrator device 3. The RAM 32 temporarily stores programs and data necessary for the operation of the administrator device 3. The storage device 33 is a non-volatile storage medium that stores programs necessary for the operation of the administrator device 3. The communication device 35 is communicably connected to the server device 2 via a communication line 6. The display device 36 displays information related to the status of the administrator device 3. The input device 37 receives user input to control the operation of the administrator device 3. The input device 37 includes, for example, a keyboard and a pointing device. The processor 31, RAM 32, storage device 33, communication device 35, display device 36, and input device 37 are connected to one another via a bus 30.

[0029] The server device 2 provides an interface, for example, a web page-based interface, accessible by the administrator device 3 to manage the erasure of data stored in the storage device of each client device 1. In this case, the server device 2 executes a web server application program, and the administrator device 3 executes a web browser application program to access the web server of the server device 2.

[0030] FIG. 8 is a block diagram showing the configuration of the user terminal device 4 of FIG. 1. The user terminal device 4 includes a bus 40, a processor 41, a RAM 42, a storage device 43, a communication device 45, a display device 46, an input device 47, and a camera 48. The processor 41 controls the overall operation of the user terminal device 4. The RAM 42 temporarily stores programs and data necessary for the operation of the user terminal device 4. The storage device 43 is a non-volatile storage medium that stores programs necessary for the operation of the user terminal device 4. The communication device 45 is communicably connected to the server device 2 via the base station device 5. The display device 46 displays information related to the status of the user terminal device 4. The input device 47 receives user input that controls the operation of the user terminal device 4. The input device 47 includes, for example, a switch and a touch panel. The camera 48 captures an image displayed on the display device 16 of the client device 1, for example. As will be described later, the display device 16 of the client device 1 may display an image (e.g., a two-dimensional barcode) containing information related to erasing the stored data and setting information of the client device 1. In this case, the user terminal device 4 transmits the contents of the captured image to the server device 2 via the base station device 5. The processor 41, RAM 42, storage device 43, communication device 45, display device 46, input device 47, and camera 48 are connected to one another via a bus 40.

[0031] [Operation of the first embodiment] When reusing the client device 1 after erasing the data stored in the storage device 13, various problems may arise if the old setting information of the UEFI controller 14A, the auxiliary controller 14B, and the TPM controller 14C remains undeleted. For example, if the setting information of the UEFI controller 14A, particularly a supervisor password, is set, the setting information of the UEFI controller 14A cannot be changed, and the supervisor password itself cannot be reset. Furthermore, if the setting information of the auxiliary controller 14B, particularly control by an external device, is enabled, the client device 1 may be remotely controlled by a third party. Furthermore, if the setting information of the TPM controller 14C remains undeleted, there is a risk of the encryption key being leaked. Conventionally, the setting information of the UEFI controller 14A, the auxiliary controller 14B, and the TPM controller 14C cannot be erased using existing erasure programs, and an administrator must manually erase the setting information separately from the data stored in the storage device 13. Therefore, it is required to erase the data stored in the storage device 13, and also erase the setting information of the UEFI controller 14A, the auxiliary controller 14B, and the TPM controller 14C.

[0032] As described above, in the client device 1, the storage device 13 stores an operating system and multiple application programs, the nonvolatile memory 403 stores a firmware program for the UEFI controller 14A, the nonvolatile memory 413 stores a firmware program for the auxiliary controller 14B, and the nonvolatile memory 423 stores a firmware program for the TPM controller 14C. The operating system and each application program are executed by the processor 11. The firmware program for the UEFI controller 14A is executed by the processing circuit 401, the firmware program for the auxiliary controller 14B is executed by the processing circuit 411, and the firmware program for the TPM controller 14C is executed by the processing circuit 421. Generally, when the client device 1 starts up, the firmware program for the UEFI controller 14A is executed first, and then the operating system is called from the firmware program. Application programs are executed on the operating system. The application programs access each hardware device (storage device 13, communication device 15, display device 16, and input device 17) of the client device 1 via the operating system. One of the application programs is an erasure application program for erasing data stored in the storage device 13. On the other hand, the firmware programs of the UEFI controller 14A, the auxiliary controller 14B, and the TPM controller 14C directly access each hardware device of the client device 1 without going through the operating system. The client device 1 is configured to erase data stored in the storage device 13, erase setting information of the UEFI controller 14A stored in the nonvolatile memory 403, erase setting information of the auxiliary controller 14B stored in the nonvolatile memory 413, and erase setting information of the TPM controller 14C stored in the nonvolatile memory 423, by executing an erasure application program and a firmware program of the UEFI controller 14A.

[0033] FIG. 9 is a schematic diagram showing the functional blocks of the firmware program 50 executed by the processing circuitry 401 of FIG. 3 and the erase application program 70 executed by the processor 11 of FIG.

[0034] The firmware program 50 of the UEFI controller 14A includes, as its functional blocks, a core control unit 51, an erasure control unit 52, a data encoding unit 53, and a two-dimensional barcode generation unit 54. The core control unit 51 controls the other functional blocks of the firmware program 50, controls data input / output between the functional blocks, and controls data input / output to / from the firmware program 50. The erasure control unit 52 controls erasure of data stored in the storage device 13, the setting information of the UEFI controller 14A stored in the nonvolatile memory 403, the setting information of the auxiliary controller 14B stored in the nonvolatile memory 413, and / or the setting information of the TPM controller 14C stored in the nonvolatile memory 423. The data encoding unit 53 encodes erasure result information indicating whether the erasure of the stored data and setting information was successful or not using a predetermined encoding method. The two-dimensional barcode generation unit 54 generates a two-dimensional barcode including erasure result information indicating whether the erasure of the stored data and setting information was successful or not (including erasure completion information if the data erasure was successful).

[0035] The operating system 60 provides interfaces for each hardware device (storage device 13, communication device 15, display device 16, and input device 17) of the client device 1 to the erasure application program 70 and other application programs (not shown). The operating system 60 includes, as its functional blocks, a device information monitor 61 and a power management unit 62. The device information monitor 61 acquires information about the client device 1 from the client device 1 and also acquires information about various components of the client device 1 from the components. The example of FIG. 9 shows a case where the device information monitor 61 acquires information about the storage device 13 of the client device 1. The information about the client device 1 includes, for example, the manufacturer, model, serial number, and UUID (Universally Unique Identifier) ​​of the client device 1. The information about the storage device 13 includes, for example, the manufacturer, model, serial number, UUID, and capacity of the storage device 13. The power management unit 62 controls the stopping, suspending, hibernation, and restarting of the client device 1.

[0036] The storage devices 13 of each client device 1 under the management of a certain server device 2 can be identified from one another using at least some of the manufacturer of the client device 1, the model of the client device 1, the serial number of the client device 1, the UUID of the client device 1, the manufacturer of the storage device 13, the model of the storage device 13, the serial number of the storage device 13, the UUID of the storage device 13, and the capacity of the storage device 13. Therefore, at least some of the manufacturer of the client device 1, the model of the client device 1, the serial number of the client device 1, the UUID of the client device 1, the manufacturer of the storage device 13, the model of the storage device 13, the serial number of the storage device 13, the UUID of the storage device 13, and the capacity of the storage device 13 can be used as identification information that uniquely identifies the storage device 13.

[0037] The erasure application program 70 includes, as its functional blocks, for example, a core control unit 71. The core control unit 71 controls other functional blocks (not shown) of the erasure application program 70, controls input and output of data between the functional blocks, and controls input and output of data from and to the outside of the erasure application program 70.

[0038] The storage device 13 of the client device 1 executes a firmware program including the functional blocks shown in FIG. 9. The storage device 13 includes, as its functional blocks, a core control unit 81, a reading unit 82, a writing unit 83, and an erasing unit 84, for example. The core control unit 81 controls the other functional blocks of the storage device 13 and controls the input and output of data between the functional blocks. The reading unit 82 reads data from a storage medium (not shown) of the storage device 13. The writing unit 83 writes data to the storage medium of the storage device 13 (including erasing original data by overwriting with "0", "1", random values, etc.). The erasing unit 84 erases data from the storage medium of the storage device 13 (including erasing data by executing a secure erase command incorporated in the firmware program).

[0039] The operation of the client device 1 will be described below with reference to each functional block in FIG. 9, and the operation of the server device 2 will also be described.

[0040] Fig. 10 is a flowchart showing the registration process of the client device 1 by the erasure application program 70 executed by the processor 11 of Fig. 2. Fig. 11 is a flowchart showing the registration process of the server device 2 executed by the processor 21 of Fig. 6.

[0041] If the organization that owns each client device 1 is not registered with the server device 2, before performing the registration process of Figure 10, an administrator or other person in charge of the organization that owns each client device 1 obtains the following information from the server device 2. Server device 2 account information (customer ID and password) - URL (Uniform Resource Locator) of the erasure application program 70 Customer number (a serial number assigned to each customer and associated with their account information) The customer number is generated for each customer, that is, for each contract that governs the erasure of data stored in the storage device of each client device 1, and is therefore not identification information for each client device 1 or storage device 13.

[0042] Each client device 1 accesses the URL of the erasure application program 70, downloads the erasure application program 70, and installs it. After installation, the erasure application program 70 is started automatically or manually. After the erasure application program 70 is started, the processor 11 executes the registration process of FIG. 10 to register the storage device 13 of the client device 1 with the server device 2.

[0043] 10, the core control unit 71 of the client device 1 displays a dialog box on the display device 16 prompting the user to enter a customer number assigned to the organization that owns the client device 1. The user of the client device 1 follows the dialog box to enter the customer number using the input device 17. The core control unit 71 acquires the customer number from the user via the input device 17.

[0044] In step S2, the core control unit 71 of the client device 1 acquires information about the client device 1 and information about the storage device 13 from the device information monitor 61 of the operating system 60.

[0045] In step S3, the core control unit 71 of the client device 1 uses the communication device 15 to transmit the customer number, the information of the client device 1, and the information of the storage device 13 to the server device 2.

[0046] 11, the server device 2 receives the customer number, information about the client device 1, and information about the storage device 13. In step S12, the server device 2 registers the client device 1 and its storage device 13 in the management table 22a as new management targets. When the client device 1 and its storage device 13 have been registered, the server device 2 transmits an acknowledgement signal to the client device 1 in step S13.

[0047] In step S4 of FIG. 10, the core control unit 71 of the client device 1 determines whether or not an acknowledgment signal has been received from the server device 2, and if YES, ends the process, and if NO, returns to step S3.

[0048] 10 and 11, the storage device 13 of the client device 1 is registered in the management table 22a of the server device 2 as a new management target. According to the registration process of Figures 10 and 11, the user of the client device 1 only needs to input the customer number using the input device 17, and information about the client device 1 and information about the storage device 13 are automatically transmitted from the client device 1 to the server device 2. According to the registration process of Figures 10 and 11, the user of the client device 1 does not need to be aware of the organization to which he or she belongs (or the organization that owns the client device 1), and the server device 2 automatically classifies the registered storage devices 13 by customer based on the customer number.

[0049] After the storage devices 13 of each client device 1 are registered with the server device 2, an administrator of the organization that owns each client device 1 registers with the server device 2, as necessary, a request to erase the data (stored data) stored in the storage devices 13, the setting information of the UEFI controller 14A stored in the nonvolatile memory 403, the setting information of the auxiliary controller 14B stored in the nonvolatile memory 413, and / or the setting information of the TPM controller 14C stored in the nonvolatile memory 423. To do this, the administrator first uses the administrator device 3 to access the server device 2 and logs in to the server device 2 using account information. Next, while viewing the list of storage devices 13 registered in the management table 22a, the administrator sets an erase flag for one or more storage devices 13 indicating that the stored data and setting information should be erased.

[0050] Fig. 12 is a diagram showing exemplary contents of the management table 22a stored in the RAM 22 of Fig. 6. The management table 22a includes, for each client device 1 or storage device 13 to be managed, for example, a customer number, a group number, information about the client device 1, information about the storage device 13, an erasure flag, a processing number, an erasure start time, and an erasure end time.

[0051] As described above, a customer number is assigned to each customer. A group number is assigned to any sub-organization (group) that is part of the customer's organization. For example, if the customer is a company, a group may be a department or section of the company. As described above, the information about the client device 1 includes, for example, the manufacturer, model, serial number, and UUID of the client device 1. As described above, the information about the storage device 13 includes, for example, the manufacturer, model, serial number, UUID, and capacity of the storage device 13. As described above, the erasure flag indicates that stored data and setting information should be erased. A processing number is issued for each client device 1 whose erasure flag indicates that stored data and setting information should be erased. The erasure start time and erasure end time indicate the actual start and end times of erasure of data stored in the storage device 13.

[0052] Fig. 13 is a diagram showing exemplary contents of the erasure flag in the management table 22a of Fig. 12. The erasure flag may indicate, for each client device 1 to be managed, which of five options (a) to (e), each including a different number of items to be erased, is used to erase the stored data and setting information. As shown in Fig. 13, the erasure flag may be set so that the number of items to be erased increases in stages.

[0053] Fig. 14 is a diagram showing another example of the contents of the erasure flag in the management table 22a of Fig. 12. The erasure flag may indicate whether erasure is permitted or not for each of the stored data, the setting information of the UEFI controller 14A, the setting information of the auxiliary controller 14B, and the setting information of the TPM controller 14C.

[0054] The customer number is provided by the server device 2. The group number, information about the client device 1, and information about the storage device 13 are provided by the client device 1. The erasure flag is set by the administrator of the organization that owns each client device 1 using the administrator device 3. The processing number is provided by the server device when the erasure flag is set, indicating that the stored data and setting information should be erased. The erasure start time and erasure end time are obtained when the stored data and setting information are actually erased.

[0055] Based on the management table 22a, the server device 2 may generate a status report indicating the status of each client device 1 and each storage device 13. The status report indicates, for example, which of the following states each of the data stored in each storage device 13, the setting information of the UEFI controller 14A stored in the nonvolatile memory 403, the setting information of the auxiliary controller 14B stored in the nonvolatile memory 413, and the setting information of the TPM controller 14C stored in the nonvolatile memory 423 is in: -Flag for deletion set Erasing -Erasing completed -Erasure completed and erasure certificate issued ·Erase failed The certificate of erasure will be described later.

[0056] The status report may also include the following information: Date and time the deletion flag was set Approval of deletion Start date and time of erasure ·Erase completion date and time ·Elimination method The manufacturer, model, and serial number of the client device 1 The manufacturer, model, serial number, and capacity of the storage device 13 The administrator can view the status report by accessing the server device 2 using the administrator device 3.

[0057] Fig. 15 is a flowchart showing the erasure processing by the erasure application program 70 executed by the processor 11 of Fig. 2. Fig. 16 is a flowchart showing the erasure processing by the firmware program 50 executed by the processing circuit 401 of Fig. 3. Fig. 17 is a flowchart showing the erasure processing of the server device 2 executed by the processor 21 of Fig. 6.

[0058] 17, the server device 2 determines whether the administrator device 3 has designated the storage device 13, nonvolatile memory 403, nonvolatile memory 413, and / or nonvolatile memory 423 as the data to be erased, and if the determination is YES, the server device 2 proceeds to step S52, and if the determination is NO, the server device 2 repeats step S51. In step S52, as described with reference to FIG. 13 or 14, the server device 2 sets an erasure flag in the management table 22a for the storage device 13, nonvolatile memory 403, nonvolatile memory 413, and / or nonvolatile memory 423 designated as the data to be erased, and updates the status report of this storage device 13.

[0059] After the client device 1 is started, the erasure application program 70 is started automatically or manually.

[0060] In step S21 of Figure 15, the core control unit 71 of the client device 1 inquires of the server device 2 using the communication device 15 whether an erasure flag is registered in the management table 22a of the server device 2 for the client device 1 that is executing the erasure process of Figure 15.

[0061] 17, the server device 2 determines whether or not an inquiry about the deletion flag has been received from the client device 1, and if the answer is YES, the process proceeds to step S54, and if the answer is NO, the process returns to step S51. In step S54, the server device 2 returns to the client device 1 information about the presence or absence of the deletion flag for each of the information to be deleted, i.e., the storage device 13, the nonvolatile memory 403, the nonvolatile memory 413, and the nonvolatile memory 423.

[0062] In step S22 of Figure 15, the core control unit 71 of the client device 1 determines whether or not an erasure flag is registered in the management table 22a of the server device 2 for the storage device 13, non-volatile memory 403, non-volatile memory 413, and non-volatile memory 423 of the client device 1 that is performing the erasure process of Figure 15, and if the answer is YES, proceed to step S23, and if the answer is NO, return to step S21.

[0063] In step S23, the core control unit 71 of the client device 1 uses the communication device 15 to transmit information about the client device 1 and information about the storage device 13 to the server device 2.

[0064] In step S55 of FIG. 17, the server device 2 determines whether or not the information on the client device 1 and the storage device 13 has been received, and if YES, the process proceeds to step S56, and if NO, the process returns to step S51.

[0065] If the information about the client device 1 and the storage device 13 received by the server device 2 matches the information about the client device 1 and the storage device 13 registered in the management table 22a by the registration process of FIG. 10, in step S56, the server device 2 generates a processing number for the storage device 13 of the client device 1 that is executing the erasure process of FIG. 15 and transmits it to the client device 1. If the server device 2 cannot identify the storage device 13 based on the received information about the client device 1 and the storage device 13, or if the erasure flag is not set, the server device 2 returns an error response. Even if the server device 2 can identify the storage device 13 based on the received information about the client device 1 and the storage device 13, if the erasure flag is not set or the identification information of the storage device 13 is different, the server device 2 may return a response indicating that the data is different. In this case, since the processing number is not returned, the client device 1 cannot erase the stored data and setting information.

[0066] In step S24 of FIG. 15, the core control unit 71 of the client device 1 determines whether or not a processing number for erasure has been received in response to the information sent in step S23, and if YES, proceeds to step S25, and if NO, returns to step S23.

[0067] In step S25, the core control unit 71 of the client device 1 displays a dialog box on the display device 16 to confirm whether or not to erase the stored data and setting information. The user of the client device 1 follows the dialog box to input whether or not to erase the stored data and setting information using the input device 17. The core control unit 71 acquires the information on whether or not to erase the stored data and setting information via the input device 17.

[0068] In step S26, the core control unit 71 of the client device 1 determines whether or not the user has consented to the erasure of the stored data and setting information, and if YES, proceeds to step S27, and if NO, ends the process.

[0069] In step S27, the core control unit 71 of the client device 1 sends the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and information on the data to be erased to the firmware program 50. The information on the erasure method includes, for example, secure erase (an example of command erasure), overwrite erase three times (overwrite content: either "0", "1", or a random value), overwrite erase once (overwrite content: either "0", "1", or a random value), failure, etc.

[0070] The core control unit 51 of the firmware program 50 stores the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and the information on the erasure target, which are acquired from the erasure application program 70, in the non-volatile memory 403 (see step S31 in FIG. 16). When the core control unit 51 has acquired and stored the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and the information on the erasure target, it sends an acknowledgement signal to the erasure application program 70 (see step S32 in FIG. 16).

[0071] In step S28 of FIG. 15, the core control unit 71 of the client device 1 determines whether or not an acknowledgment signal has been received from the firmware program 50, and if YES, proceeds to step S29, and if NO, returns to step S27.

[0072] In step S29, the core control unit 71 of the client device 1 sends a control signal to the power management unit 62 of the operating system 60 to restart the client device 1.

[0073] Steps S31 to S33 in FIG. 16 correspond to steps S27 to S29 in FIG.

[0074] In step S31 of Figure 16, the core control unit 51 of the client device 1 stores the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and the information to be erased, which are obtained from the erasure application program 70, in the non-volatile memory 403.

[0075] In step S32, when the core control unit 51 of the client device 1 acquires and stores the UUID of the storage device 13, the processing number, the address of the server device 2, the erasure method, and the information on the erasure target, it sends an affirmative response signal to the erasure application program 70.

[0076] In step S33, the erasure application program 70 restarts the client device 1.

[0077] After rebooting, the firmware program 50 continues the erasure process of FIG. 16 without calling the operating system 60.

[0078] In step S34, the core control unit 51 of the client device 1 uses the erasure control unit 52 to erase all data stored in the storage device 13 using the specified erasure method. The erasure control unit 52 may erase data (command erasure) using a secure erase command of the storage device. Also, in step S34, the core control unit 51 of the client device 1 uses the erasure control unit 52 to erase other specified erasure targets, namely, the setting information of the UEFI controller 14A stored in the non-volatile memory 403, the setting information of the auxiliary controller 14B stored in the non-volatile memory 413, and / or the setting information of the TPM controller 14C stored in the non-volatile memory 423.

[0079] After the erasure is completed, the core control unit 51 stores data indicative of the erasure result, including the erasure start time, erasure end time, erasure method, and erasure target, in the nonvolatile memory 403.

[0080] The result of erasing the stored data may be expressed, for example, as follows: "2": Erased successfully using the secure erase command "1"... Successfully erased using one overwrite operation "0": Successful erasure using one-time overwrite erasure "8" - Storage device 13 detection failed “9”…Erase failed

[0081] When the stored data and the setting information of the UEFI controller 14A are erased (option (b) in FIG. 13), the result of erasing the setting information may be expressed, for example, as follows: "0" - UEFI controller 14A setting information was successfully erased "1"...Failed to erase the setting information of UEFI controller 14A

[0082] When the stored data, the setting information of the UEFI controller 14A, and the setting information of the auxiliary controller 14B are erased (option (c) in FIG. 13), the result of erasing the setting information may be expressed, for example, as follows: "0": The setting information of the UEFI controller 14A was successfully erased, and the setting information of the auxiliary controller 14B was also successfully erased. "1"...Erasing the setting information of the UEFI controller 14A was successful, and erasing the setting information of the auxiliary controller 14B failed. "2"...Failed to erase the setting information of the UEFI controller 14A, and succeeded in erasing the setting information of the auxiliary controller 14B. "3"...Failed to erase the setting information of the UEFI controller 14A and failed to erase the setting information of the auxiliary controller 14B.

[0083] When erasing the stored data, the setting information of the UEFI controller 14A, the setting information of the auxiliary controller 14B, and the setting information of the TPM controller 14C (option (d) in Figure 13), the result of erasing the setting information may be expressed, for example, as follows. "0"... The setting information of the UEFI controller 14A was successfully erased, the setting information of the auxiliary controller 14B was successfully erased, and the setting information of the TPM controller 14C was successfully erased. "1"...Erasing of the setting information of the UEFI controller 14A was successful, erasing of the setting information of the auxiliary controller 14B was successful, and erasing of the setting information of the TPM controller 14C failed. "2"...Erasing the setting information of the UEFI controller 14A was successful, erasing the setting information of the auxiliary controller 14B failed, and erasing the setting information of the TPM controller 14C was successful "3": The setting information of the UEFI controller 14A was successfully erased, the setting information of the auxiliary controller 14B was not erased, and the setting information of the TPM controller 14C was not erased. "4"...Failed to erase the setting information of the UEFI controller 14A, succeeded in erasing the setting information of the auxiliary controller 14B, and succeeded in erasing the setting information of the TPM controller 14C. "5"...Failed to erase the setting information of the UEFI controller 14A, succeeded in erasing the setting information of the auxiliary controller 14B, and failed to erase the setting information of the TPM controller 14C. "6"...Failed to erase the setting information of the UEFI controller 14A, failed to erase the setting information of the auxiliary controller 14B, and succeeded in erasing the setting information of the TPM controller 14C. "7"...Failed to erase the setting information of the UEFI controller 14A, failed to erase the setting information of the auxiliary controller 14B, and failed to erase the setting information of the TPM controller 14C.

[0084] In step S35, the core control unit 51 of the client device 1 reads the data indicating the deletion result from the nonvolatile memory 403, and encodes the data indicating the deletion result using a predetermined encoding method using the data encoding unit 53. The core control unit 51 stores the encoded data in the nonvolatile memory 403.

[0085] The encoding of the data indicating the encoded erasure result is performed, for example, in the following steps. (1) These parameters, which serially arrange the UUID, processing number, erasure start time, erasure end time, erasure method, and erasure target, may be arranged in, for example, a CSV format. (2) The character string related to the parameter in step (1) is converted to a half-width character string such as BCD. Here, a character string may be added. (3) Calculate the hash value of the string from step (2). (4) The character string in step (2) and the hash value in step (3) are converted into a format that can be transmitted via the communication line 6. If necessary, for example, URL encoding is performed. (5) The data from step (4) is sent to the address of the server device 2 as the destination.

[0086] In step S36, the core control unit 51 of the client device 1 reads the encoded data indicating the erasure result from the non-volatile memory 403, and uses the communication device 15 to transmit the encoded data indicating the erasure result to the server device 2.

[0087] In step S57 of FIG. 17, the server device 2 determines whether or not it has received an erasure result from the client device 1, and if YES, the process proceeds to step S58, and if NO, the process returns to step S51.

[0088] In step S58, the server device 2 transmits to the client device 1 an acknowledgement signal for the result of erasure.

[0089] In step S37 of FIG. 16, the core control unit 51 of the client device 1 determines whether or not an acknowledgment signal has been received from the server device 2, and if YES, proceeds to step S41, and if NO, proceeds to step S38.

[0090] In step S38, the core control unit 51 of the client device 1 reads the data indicating the erasure result from the nonvolatile memory 403, and generates a two-dimensional barcode from the data indicating the erasure result using the two-dimensional barcode generation unit 54. The core control unit 51 stores the generated two-dimensional barcode in the nonvolatile memory 403.

[0091] In step S39, the core control unit 51 of the client device 1 reads the two-dimensional barcode from the nonvolatile memory 403 and displays the two-dimensional barcode on the display device 16.

[0092] 18 is a diagram showing the content displayed on the display device 16 of the client device 1 in step S39 of Fig. 16. The display screen 200 displayed on the display device 16 includes, for example, a two-dimensional barcode 201, a keyword 202, and an input field 203. The user can operate the user terminal device 4 so that the camera 48 of the user terminal device 4 photographs the two-dimensional barcode 201, the processor 41 of the user terminal device 4 decodes the two-dimensional barcode 201, extracts data indicating the deletion result, and transmits this data to the server device 2.

[0093] 16, the core control unit 51 of the client device 1 determines whether the keyword displayed on the display device 16 has been input from the input device 17. If the result is YES, the process proceeds to step S41. If the result is NO, the process repeats step S40. Here, the image of the two-dimensional barcode 201 may not be erased by a simple process such as turning off the power. For example, the core control unit 51 may display, along with the two-dimensional barcode 201, a message on the display device 16 prompting the user to input a predetermined keyword 202 ("End1207" in the example of FIG. 18). When the keyword 202 is entered in the input field 203 and the Enter key is pressed, the process proceeds to step S41. If a different keyword is entered or the power switch is operated, the same screen is displayed again.

[0094] 16, the erasure result is first transmitted from client device 1 to server device 2 via communication line 6 in step S36. If a failure or the like occurs on communication line 6, that is, if an acknowledgment signal for the erasure result is not received in step S37, the erasure result is transmitted to server device 2 via user terminal device 4 by executing steps S38 to S39. Therefore, in step S57 of FIG. 17, server device 2 may receive the erasure result from client device 1 via communication line 6, or may receive the erasure result via user terminal device 4.

[0095] Referring to FIG. 17, after executing step S58, in step S59, the server device 2 stores the erase result in the management table 22a and updates the status report.

[0096] In step S60, the server device 2 issues an erasure certificate based on the erasure result.

[0097] In step S41 of FIG. 16, the core control unit 51 of the client device 1 performs post-processing and shuts down the client device 1.

[0098] Fig. 19 is a sequence diagram showing the operation of the system 100 in Fig. 1 when the system 100 has succeeded in transmitting the erasure result information via the communication line 6. Fig. 20 is a sequence diagram showing the operation of the system 100 in Fig. 1 when the system 100 has failed in transmitting the erasure result information via the communication line 6.

[0099] 19 and 20, for the sake of simplicity, only the main steps among those described with reference to FIGS. 10, 11, and 15 to 17 are shown, and the others are omitted.

[0100] 19, the client device 1 acquires a customer number from the user in step S1. Then, the client device 1 transmits the customer number, information about the client device 1, and information about the storage device 13 to the server device 2.

[0101] In step S12, the server device 2 registers the storage device 13 of the client device 1 as a new management target based on the customer number, the information of the client device 1, and the information of the storage device 13.

[0102] Thereafter, the administrator device 3 transmits account information to the server device 2 to log in to the server device 2, and in step S101, specifies the storage device 13, nonvolatile memory 403, nonvolatile memory 413, and / or nonvolatile memory 423 to be erased.

[0103] In step S52, the server device 2 stores the erasure flag in the management table 22a so as to correspond to the storage device 13 designated in step S101.

[0104] Thereafter, the client device 1 periodically inquires of the server device 2 as to whether or not an erasure flag has been set in the management table 22a corresponding to the storage device 13 of the client device 1. When the client device 1 receives a response signal from the server device 2 in response to the erasure flag inquiry indicating that an erasure flag has been set in the management table 22a, the client device 1 transmits information about the client device 1 and information about the storage device 13 to the server device 2. When the information about the client device 1 and the storage device 13 received by the server device 2 matches the information about the client device 1 and the information about the storage device 13 registered in the management table 22a, the server device 2 generates a processing number for the client device 1 and transmits it to the client device 1.

[0105] Thereafter, in step S25, the client device 1 displays a dialog box on the display device 16 to confirm whether or not to erase the stored data and setting information. If the user agrees to erase the stored data and setting information, in step S29, the client device 1 restarts. Thereafter, in step S34, the client device 1 erases the stored data and setting information.

[0106] After the erasure is completed, the client device 1 transmits erasure result information to the server device 2. If a response signal to the erasure result information is received from the server device 2 within a predetermined timeout period, the client device 1 ends the process.

[0107] In step S59, the server device 2 stores the erasure result included in the erasure result signal in the management table 22a. In step S60, the server device 2 issues an erasure certificate based on the erasure result included in the erasure result signal.

[0108] On the other hand, as shown in FIG. 20, if the erasure result information sent by the client device 1 does not reach the server device 2, or if a response signal to the erasure result information is not received, the client device 1 displays a two-dimensional barcode on the display device 16 in step S39.

[0109] In step S111, the user of client device 1 uses user terminal device 4 to capture an image of the two-dimensional barcode displayed on display device 16 of client device 1. Processor 41 of user terminal device 4 decodes the two-dimensional barcode to extract data indicating the deletion result, and transmits this data to server device 2. Thereafter, steps S59 to S60 in FIG. 20 are the same as the corresponding steps in FIG. 19.

[0110] [Certificate of erasure] For example, when data stored in a storage device is erased using erasure software or an erasure process certified by a third-party certification body such as the Association of Data Erase Certification Council (ADEC), a certificate can be issued to indicate that proper erasure of data has been performed. The certificate includes, for example, the following information: (1) Information on client device 1 ·Manufacturer Model Serial number (2) Information on storage device 13 ·Manufacturer Model Serial number ·capacity (3) Information to be deleted - Information about the company to be deleted (company ID, company name, rating) - Erasure software information (vendor name, software name, certification number, erasure method) - Erase execution date and time (erasure start time, erasure end time) Erasing results As described above, information about the client device 1 and information about the storage device 13 are sent from the client device 1 to the server device 2 by the erasure application program 70. Of the erasure information, the business ID, business name, vendor name, and software name must be applied for and certified in advance by a certification authority. Once the erasure software is certified, an authentication number is issued. The firmware program 50 also sends the erasure execution date and time and the erasure result from the client device 1 to the server device 2. In this way, the information required to issue an erasure certificate can be automatically sent from the client device 1 to the server device 2, making it easy to issue an erasure certificate.

[0111] [summary] As described above, the system according to the first embodiment can erase data stored in the storage device 13, as well as erase the setting information of the UEFI controller 14A stored in the nonvolatile memory 403, the setting information of the auxiliary controller 14B stored in the nonvolatile memory 413, and / or the setting information of the TPM controller 14C stored in the nonvolatile memory 423. This makes it possible to erase data stored in the client device 1 more reliably than in the past.

[0112] According to the system of the first embodiment, an administrator does not need to manually erase the setting information of each client device 1, thereby simplifying the management of a large number of client devices 1. For example, if a company is using client devices 1 loaned from an external vendor, after erasing the stored data and setting information of the client devices 1, the client devices 1 may be shipped directly to the original vendor without requiring any additional erasure procedures.

[0113] Furthermore, according to the system of the first embodiment, an administrator accesses the server device 2 and sets an erasure flag indicating that data stored in the storage device 13 of each client device 1 should be erased. The client device then inquires of the server device 2 about the presence or absence of the erasure flag, without transmitting an erasure command or the like from the server device 2 to the client device 1. This allows the storage device 13 to be erased to be identified without error and easily set. No signal is sent from the server device 2 to the client device 1 when erasure begins; the user of the client device 1 simply connects the client device 1 to the communication line 6 when erasure begins. Therefore, data can be erased at the user's convenience. This allows the data stored in the storage device 13 to be identified without error and easily erased.

[0114] Performing the erasure process not only by the erasure application program 70 but also by a combination of the erasure application program 70 and the firmware program 50 has the following advantages. The erasure application program 70, which runs on the operating system 60, resides in the storage device 13. Similarly, the UEFI application program, which runs on the firmware program 50, resides in the storage device 13. Therefore, when data stored in the storage device 13 is erased by the erasure application program 70 or the UEFI application program, the area of ​​the storage device 13 where the program resides cannot be deleted. Furthermore, the erasure application program 70 or the UEFI application program cannot communicate with the server device 2 via a communication line after the data erasure is complete. Furthermore, since the erasure application program 70 or the UEFI application program cannot operate after the data erasure is complete, it cannot obtain information indicating the erasure result (e.g., the erasure start time, the erasure end time, and the erasure method). According to the system 100 of the first embodiment, by executing the firmware program 50, all data stored in the storage device 13 can be erased. After the data erasure is complete, communication with the server device 2 can be performed via a communication line, and after the data erasure is complete, information indicating the erasure result can be obtained.

[0115] For example, it is conceivable to outsource the erasure of data stored in the storage device 13 to a service provider. However, transporting a client device equipped with a storage device from which data is to be erased to the service provider's business premises poses security risks. Using a highly secure delivery method increases costs. Furthermore, a lot of work is required for the erasure and subsequent checks. Furthermore, erasing data takes a long time, for example, half a day. According to the system 100 of the first embodiment, data stored in the storage device 13 can be erased without moving the client device 1, enabling data to be erased easily, with high security, and at low cost.

[0116] Here, some examples of use of the system according to the first embodiment will be described.

[0117] [Usage example 1] First, consider the case where all client devices 1 corresponding to a certain user group (for example, one department in a company) are to be disposed of, but these client devices 1 are not managed as a group. Each user registers their corresponding client device 1 in the server device 2. The system administrator checks all of the client devices 1 to be disposed of (for all members of the group) and sets an erasure flag in the management table 22a of the server device 2. Each user then erases the data stored in the storage device 13. The administrator checks that the erasure has been completed; if the administrator can confirm this, erasure can be certified, but if the administrator cannot confirm this, the administrator urges the user to erase the data. If necessary, the administrator obtains an ADEC erasure certificate.

[0118] [Usage example 2] Next, consider the case where all client devices 1 corresponding to a certain user group (for example, a department in a company) are to be disposed of and these client devices 1 are to be managed as a group. Most of the administrator's tasks are undertaken by the person in charge of the group (for example, the department manager). The administrator sets up the group. Each user sets up and registers their corresponding client devices 1 in the server device 2 as a group. The person in charge checks all of the client devices 1 to be disposed of (for all members of the group) and sets an erasure flag in the management table 22a of the server device 2. Then, each user erases the data stored in the storage device 13. The person in charge checks that the erasure has been completed; if the person in charge can confirm this, erasure can be certified, but if the person in charge cannot confirm this, the person in charge urges the user to erase the data. The person in charge requests the issuance of an ADEC erasure certificate. The administrator obtains the ADEC erasure certificate.

[0119] [Usage example 3] Also, consider the case where all client devices 1 corresponding to a certain user group (for example, one department in a company) are to be disposed of and these client devices 1 are to be managed as a group. The administrator sets up a group. Each user sets up and registers their corresponding client devices 1 in the server device 2 as a group. The person in charge confirms all of the client devices 1 to be disposed of (for all members of the group) and contacts the administrator. The administrator sets an erasure flag in the management table 22a of the server device 2. Then, each user erases the data stored in the storage device 13. The person in charge confirms that the erasure has been completed; if the person in charge can confirm this, erasure can be certified, but if the person in charge cannot confirm this, the person in charge urges the user to erase the data. The person in charge requests the issuance of an ADEC erasure certificate. The administrator obtains the ADEC erasure certificate.

[0120] In any of the use examples 1 to 3, data stored in the storage device 13 can be identified without error and easily erased.

[0121] [Advantages of the first embodiment] According to the first embodiment, the client device 1 includes a first processing circuit 401, a communication device 15 capable of communicating with the server device 2 via a communication line 6, a first storage device 13 that stores stored data including an operating system, application programs, and user data, and a non-volatile memory 403 that stores a first firmware program and first setting information. The first firmware program is executed by the first processing circuit 401 to control the operation of the client device 1 based on the first setting information. When the first processing circuit 401 receives a first erase command from the server device 2 instructing the erase of the stored data and the first setting information, the first processing circuit 401 executes the first firmware program to erase the stored data from the first storage device 13 and the first setting information from the non-volatile memory 403.

[0122] This configuration makes it possible to erase data stored in the client device 1, such as setting information of the UEFI controller 14A, more reliably than ever before.

[0123] According to the first embodiment, the first setting information may include a password that restricts changes to the first setting information.

[0124] With this configuration, the supervisor password of the client device 1 can be reliably erased.

[0125] According to the first embodiment, after the erasure of the stored data and the first setting information is completed, the first processing circuit 401 may execute a firmware program to send a first result signal to the server device 2 indicating that the erasure of the stored data and the first setting information has been completed.

[0126] This configuration allows the administrator to know when the deletion of the stored data and the first setting information has been completed.

[0127] According to the first embodiment, the client device 1 may further include a second processing circuit 411 and a non-volatile memory 413 that stores a second firmware program and second setting information. The second firmware program may be executed by the second processing circuit 411 to enable an external device connected via the communication line 6 to control the operation of the client device 1 based on the second setting information. In this case, when the first processing circuit 401 receives a second deletion command from the server device 2 instructing the deletion of the stored data and the second setting information, the first processing circuit 401 executes the first firmware program to delete the stored data from the first storage device 13 and the second setting information from the non-volatile memory 413.

[0128] This configuration makes it possible to erase data stored in the client device 1, such as the setting information of the auxiliary controller 14B, more reliably than ever before.

[0129] According to the first embodiment, after the erasure of the stored data and the second setting information is completed, the first processing circuit 401 may execute a firmware program to send a second result signal to the server device 2 indicating that the erasure of the stored data and the second setting information has been completed.

[0130] This configuration allows the administrator to know when the deletion of the stored data and the second setting information has been completed.

[0131] According to the first embodiment, the client device 1 may further include a third processing circuit 421 and a non-volatile memory 423 that stores a third firmware program and third setting information. The third firmware program may be executed by the third processing circuit 421 to encrypt and decrypt stored data based on the third setting information. In this case, when the first processing circuit 401 receives a third erase command from the server device 2 instructing the erase of the stored data and the third setting information, the first processing circuit 401 executes the first firmware program to erase the stored data from the first storage device 13 and the third setting information from the non-volatile memory 423.

[0132] This configuration makes it possible to erase data stored in the client device 1, such as the setting information of the TPM controller 14C, more reliably than ever before.

[0133] According to the first embodiment, after the erasure of the stored data and the third setting information is completed, the first processing circuit 401 may execute a firmware program to send a third result signal to the server device 2 indicating that the erasure of the stored data and the third setting information has been completed.

[0134] This configuration allows the administrator to know when the deletion of the stored data and the third setting information has been completed.

[0135] According to the first embodiment, the system includes a plurality of client devices 1 and a server device 2.

[0136] This configuration makes it possible to erase data stored in the client device 1 more reliably than before.

[0137] According to the first embodiment, the client device 1 may register the client device 1 to the server device 2 by transmitting a first signal including identification information that uniquely identifies the first storage device 13 to the server device 2, and may then transmit a second signal including identification information of the first storage device 13 to the server device 2, inquiring whether the server device 2 is registered to erase data stored in the first storage device 13. In this case, the server device 2 transmits a first erase command to the client device 1 if the identification information of the first storage device 13 included in the second signal matches the identification information of the first storage device 13 included in the first signal and the server device 2 is registered to erase the stored data and first setting information.

[0138] This configuration allows data stored in the storage device 13 to be easily identified and erased without error.

[0139] According to the first embodiment, the server device 2 may obtain erasure completion information from the client device 1 indicating that the erasure of the stored data has been completed, and may issue an erasure certificate certifying that the erasure of the stored data has been completed based on the erasure completion information.

[0140] With this configuration, after all data stored in the storage device, including the operating system, has been erased, the information required to create an erasure certificate can be transmitted to the server device.

[0141] According to the first embodiment, there is provided a method for erasing data stored in a client device 1. The client device 1 includes a first processing circuit 401, a communication device 15 capable of communicating with a server device 2 via a communication line 6, a first storage device 13 that stores stored data including an operating system, application programs, and user data, and a non-volatile memory 403 that stores a first firmware program and first setting information. The first firmware program is executed by the first processing circuit 401 to control the operation of the client device 1 based on the first setting information, and the method includes, when a first erasure command instructing the erasure of the stored data and the first setting information is received from the server device 2, executing the first firmware program by the processing circuit to erase the stored data from the first storage device 13 and the first setting information from the non-volatile memory 403.

[0142] This configuration makes it possible to erase data stored in the client device 1 more reliably than before.

[0143] [Second embodiment] After erasing data stored in a storage device of an electronic device, it may be necessary to verify that the data has been erased. Just as erasing data requires writing a fixed bit value (such as a zero value) or a random bit value to all storage areas of the storage device, verifying the erasure generally requires reading the bit values ​​from all storage areas of the storage device. For example, if a 1TB SSD is overwritten three times and the erasure result is verified, the erasure takes approximately two hours (40 minutes x 3), and the erasure verification takes another 40 minutes. This means that it takes a very long time to know the results of the erasure and verification, causing users and administrators of the electronic device to wait.

[0144] In the second embodiment, an electronic device and system are provided in which erasure verification does not keep users and administrators waiting long, and usability is less likely to be reduced than when erasure verification is not performed.

[0145] [Configuration of the second embodiment] The system according to the second embodiment is configured in the same manner as the system 100 according to the first embodiment, which includes a client device 1, a server device 2, an administrator device 3, and a user terminal device 4, as described with reference to Figures 1 to 9.

[0146] 9, in the system according to the second embodiment, the erasure control unit 52, data encoding unit 53, and two-dimensional barcode generation unit 54 of the firmware program 50 are configured to perform the following operations in addition to the operations described above. The erasure control unit 52 further controls verification that data stored in the storage device 13 has been erased. The data encoding unit 53 further encodes, using a predetermined encoding method, verification result information indicating whether or not verification that the data stored in the storage device 13 has been erased has been successful. The two-dimensional barcode generation unit 54 further generates a two-dimensional barcode including verification result information indicating whether or not verification that the data stored in the storage device 13 has been erased has been successful (including verification completion information if verification is successful).

[0147] The operations of the client device 1, the server device 2, the administrator device 3, and the user terminal device 4 will be described below.

[0148] [Operation of the second embodiment] Fig. 21 is a flowchart showing the operation of the system according to the second embodiment, which is an erasure and verification process by the firmware program 50 executed by the processing circuit 401 of the client device 1. Fig. 22 is a flowchart showing a subroutine of step S70 (verification process) in Fig. 21. Fig. 23 is a flowchart showing the operation of the system according to the second embodiment, which is an erasure and verification process of the server device 2 executed by the processor 21.

[0149] The process of Fig. 21 includes a verification process of step S70 in addition to the steps of Fig. 16, in which it is verified that the data stored in the storage device 13 has been erased. Moreover, the process of Fig. 23 further includes steps S91 to S93 in addition to the steps of Fig. 17.

[0150] If step S37 in FIG. 21 is YES or if step S40 is YES, the core control unit 51 of the client device 1 proceeds to the verification process of step S70.

[0151] 22, the core control unit 51 of the client device 1 uses the erasure control unit 52 to verify that the data stored in the storage device 13 has been erased using a specified verification method. For example, when erasing data by writing zero values ​​to a storage area of ​​the storage device 13, the erasure may be verified by reading the bit values ​​of the storage area of ​​the storage device 13 and confirming that each bit is a zero value. After the verification is completed, the core control unit 51 stores data indicating the verification result in the non-volatile memory 403.

[0152] 24 is a schematic diagram for explaining a first verification method for the memory device 13. Erasure verification may be performed by reading and checking the bit values ​​of all memory areas of the memory device 13.

[0153] 25 is a schematic diagram illustrating a second verification method for the memory device 13. Erasure verification may be performed by reading and checking bit values ​​of a predetermined number of partial areas randomly extracted from a plurality of partial areas obtained by dividing the entire memory area of ​​the memory device 13. In the example of FIG. 25, the entire memory area of ​​the memory device 13 includes a plurality of (e.g., 1000) medium areas 301, and each of the medium areas 301 includes a plurality of (e.g., 20) small areas 302. Erasure verification may be performed by reading and checking bit values ​​of at least some (e.g., two randomly extracted) small areas 302 in each of the medium areas 301.

[0154] 22, the core control unit 51 of the client device 1 reads data indicating the verification result from the nonvolatile memory 403, and encodes the data indicating the verification result using a predetermined encoding method using the data encoding unit 53. The core control unit 51 stores the encoded data in the nonvolatile memory 403.

[0155] In step S73, the core control unit 51 of the client device 1 reads out data indicating the encoded verification result from the non-volatile memory 403, and uses the communication device 15 to transmit the data indicating the encoded verification result to the server device 2.

[0156] In step S91 of FIG. 23, the server device 2 determines whether or not the verification result has been received from the client device 1, and if YES, the process proceeds to step S92, and if NO, the process returns to step S51.

[0157] In step S92, the server device 2 transmits to the client device 1 an affirmative response signal in response to the verification result.

[0158] In step S74 of Figure 22, the core control unit 51 of the client device 1 determines whether or not an acknowledgment signal has been received from the server device 2, and if YES, proceeds to step S41 of Figure 21, and if NO, proceeds to step S75 of Figure 22.

[0159] In step S75, the core control unit 51 of the client device 1 reads data indicating the verification result from the nonvolatile memory 403, and generates a two-dimensional barcode from the data indicating the verification result using the two-dimensional barcode generation unit 54. The core control unit 51 stores the generated two-dimensional barcode in the nonvolatile memory 403.

[0160] In step S76, the core control unit 51 of the client device 1 reads the two-dimensional barcode from the non-volatile memory 403 and displays the two-dimensional barcode together with the keyword and input field on the display device 16. The two-dimensional barcode, keyword, and input field displayed in step S76 are similar to, for example, the two-dimensional barcode 201, keyword 202, and input field 203 shown in FIG.

[0161] In step S77, the core control unit 51 of the client device 1 determines whether the keyword displayed on the display device 16 has been input from the input device 17, and if YES, proceeds to step S41 in Figure 21, and if NO, repeats step S77.

[0162] Referring to FIG. 23, after executing step S92, in step S93, the server device 2 stores the verification result in the management table 22a and updates the status report.

[0163] In the second embodiment, the status report indicates, for example, which of the following states each storage device 13 is in. -Flag for deletion set Erasing -Erasing completed · Erasure completed but erasure certificate cannot be issued (provisional) -Erasing completed and erasure certificate can be issued -Erasure completed and erasure certificate issued - Erasure failed and erasure certificate cannot be issued After steps S59 and S93 are executed, in step S60A, the server device 2 issues an erasure certificate based on the erasure result and the verification result.

[0164] Referring to FIG. 21, after step S70 is executed, the core control unit 51 of the client device 1 performs post-processing and shuts down the client device 1 in step S41.

[0165] Fig. 26 is a sequence diagram showing the operation of the system according to the second embodiment, which is the operation of the system 100 when the erasure result information and the verification result information are successfully transmitted via the communication line 6. Fig. 27 is a sequence diagram showing the operation of the system according to the second embodiment, which is the operation of the system 100 when the erasure result information and the verification result information are unsuccessfully transmitted via the communication line 6.

[0166] The operations in steps S1 to S59 in FIG. 26 are the same as those described with reference to FIG.

[0167] In step S34, all data stored in the storage device 13 is erased, and then erasure result information is sent to the server device 2. If a response signal is received from the server device 2, the client device 1 verifies in step S71 that the data stored in the storage device 13 has been erased.

[0168] After the verification is completed, the client device 1 transmits the verification result information to the server device 2. If a response signal to the verification result information is received from the server device 2 within a predetermined timeout period, the client device 1 ends the process.

[0169] In step S93, the server device 2 stores the verification result included in the verification result signal in the management table 22a. In step S60A, the server device 2 issues an erasure certificate based on the erasure result included in the erasure result signal and the verification result included in the verification result signal.

[0170] On the other hand, as shown in FIG. 27, if the verification result information sent by the client device 1 does not reach the server device 2, or if a response signal to the verification result information is not received, the client device 1 displays a two-dimensional barcode on the display device 16 in step S76.

[0171] In step S112, the user of client device 1 uses user terminal device 4 to capture an image of the two-dimensional barcode displayed on display device 16 of client device 1. Processor 41 of user terminal device 4 decodes the two-dimensional barcode to extract data indicating the verification result, and transmits this data to server device 2. Thereafter, steps S93 and S60A in FIG. 27 are the same as the corresponding steps in FIG. 26.

[0172] [summary] According to the system of the second embodiment, like the system of the first embodiment, data stored in the storage device 13 can be identified without error and easily erased. Furthermore, according to the system of the second embodiment, the server device 2 is notified of the erasure result at the time when erasure of data stored in the storage device 13 is completed, so that the administrator can quickly recognize the status of the storage device 13. As a result, even if erasure verification is performed, the user and administrator do not have to wait long, and usability is less likely to deteriorate than when erasure verification is not performed.

[0173] For example, if data stored in the storage device 13 is successfully erased and the verification result indicates successful erasure, the system operates as follows. First, after the erasure is complete, the client device 1 does not display the erasure result on the display device 16, but transmits the erasure result to the server device 2 using the communication device 15. If the erasure result is successfully transmitted, the client device 1 displays nothing on the display device 16. If the erasure result transmission fails, the client device 1 displays a two-dimensional barcode on the display device 16. At this point, the status report becomes "Erasure completed and erasure certificate cannot be issued (provisional)." After that, after the verification is complete, the client device 1 does not display the verification result on the display device 16, but transmits the verification result to the server device 2 using the communication device 15. If the verification result transmission is successful, the client device 1 displays nothing on the display device 16. If the verification result transmission fails, the client device 1 displays a two-dimensional barcode on the display device 16. At this point, the status report becomes "Erasure completed and erasure certificate can be issued."

[0174] If the erasure of data stored in the storage device 13 is complete but the verification result indicates a failure of the erasure, the system operates as follows. First, after the erasure is complete, the client device 1 does not display the erasure result on the display device 16, but transmits the erasure result to the server device 2 using the communication device 15. If the transmission of the erasure result is successful, the client device 1 displays nothing on the display device 16. If the transmission of the erasure result is unsuccessful, the client device 1 displays a two-dimensional barcode on the display device 16. At this point, the status report becomes "Erasure completed and erasure certificate cannot be issued (provisional)." After that, after the verification is complete, the client device 1 displays the verification result on the display device 16 and transmits the verification result to the server device 2 using the communication device 15. If the transmission of the verification result is successful, the client device 1 displays nothing on the display device 16. If the transmission of the verification result is unsuccessful, the client device 1 displays a two-dimensional barcode on the display device 16. At this point, the status report becomes "Erasure failed and erasure certificate cannot be issued."

[0175] If erasure of data stored in the storage device 13 fails, the system operates as follows. First, after the erasure is complete, the client device 1 displays the erasure result on the display device 16 and transmits the erasure result to the server device 2 using the communication device 15. If the transmission of the erasure result is successful, the client device 1 displays nothing on the display device 16, but if the transmission of the erasure result fails, the client device 1 displays a two-dimensional barcode on the display device 16. At this point, the status report will read "Erasure failed and erasure certificate cannot be issued." Verification of the erasure is not performed.

[0176] When erasing data stored in the storage device 13, the client device 1 may display "erasing" on the display device 16. When verifying the erasure, the client device 1 may display "verifying" on the display device 16.

[0177] Even if the transmission of the erasure result or verification result fails due to a fault in the communication line 6 and the two-dimensional barcode is displayed on the display device 16, when the communication line 6 is restored, the erasure result and verification result are retransmitted and the display of the two-dimensional barcode is stopped.

[0178] The system according to the second embodiment is useful when it is necessary to erase data stored in the storage device 13, such as when the client device 1 is disposed of or when the client device 1 is stolen. In particular, when the client device 1 is stolen, the administrator can erase the data stored in the storage device 13 and verify the erasure, thereby quickly grasping the status of the storage device 13.

[0179] [Modification of the second embodiment] As mentioned above, erasure verification takes a long time. Therefore, in the system according to the second embodiment, erasure verification may be performed in stages. This allows the user or administrator to recognize the progress of erasure verification.

[0180] Fig. 28 is a flowchart showing the operation of a system according to a modification of the second embodiment, which is a subroutine of step S70A (verification process) executed by the processing circuit 401 of the client device 1. Fig. 29 is a flowchart showing the operation of a system according to a modification of the second embodiment, which is a subroutine of step S70A (verification process) executed by the processor 21 to erase and verify the server device 2.

[0181] The process in Fig. 28 is executed in place of step S70 in Fig. 21. Moreover, the process in Fig. 29 includes steps S91A to S93A and S94 in place of steps S91 to S93 in Fig. 23.

[0182] In this case, a plurality of checkpoints are set in advance, each of which indicates the progress of the erase verification.

[0183] In step S81 of FIG. 28, the core control unit 51 of the client device 1 uses the erasure control unit 52 to verify that the data stored in the storage device 13 has been erased using the specified verification method.

[0184] In step S82, the core control unit 51 of the client device 1 determines whether the verification of erasure has reached a predetermined checkpoint, and if YES, proceeds to step S83, and if NO, repeats step S82.

[0185] In step S83, the core control unit 51 of the client device 1 uses the data encoding unit 53 to encode the data indicating the verification result and the progress thereof in a predetermined encoding method.

[0186] In step S84, the core control unit 51 of the client device 1 uses the communication device 15 to transmit to the server device 2 the coded verification result and data indicating the progress of the verification.

[0187] In step S91A of FIG. 29, the server device 2 determines whether or not the verification result and its progress have been received from the client device 1, and if YES, proceeds to step S92A, and if NO, returns to step S51.

[0188] In step S92A, the server device 2 transmits to the client device 1 a positive response signal for the verification result and the progress of the verification.

[0189] In step S85 of FIG. 28, the core control unit 51 of the client device 1 determines whether or not all areas to be processed out of the total storage area of ​​the storage device 13 have been verified, and if YES, proceed to step S41 of FIG. 21, and if NO, proceed to step S86 of FIG. 28.

[0190] In step S86, the core control unit 51 of the client device 1 sets the next checkpoint, and then repeats steps S82 to S86.

[0191] Referring to FIG. 29, after executing step S92A, in step S93A, the server device 2 stores the verification result and the degree of progress in the management table 22a, and updates the status report.

[0192] In step S94, the server device 2 determines whether or not the final verification result has been received, and if YES, the process proceeds to step S60A, and if NO, the process returns to step S51.

[0193] As a result, the client device 1 transmits to the server device 2 a plurality of signals each indicating that the verification of erasure has been completed to one of a plurality of different degrees of progress.

[0194] When erasure verification is performed as shown in FIG. 24 , the client device 1 may transmit to the server device 2 a plurality of signals each indicating that erasure verification has been completed up to a plurality of predetermined percentages of the total storage area of ​​the storage device 13. In this case, the plurality of checkpoints each indicating the progress of erasure verification are the percentages of the total storage area of ​​the storage device 13 for which erasure verification has been completed, for example, 10%, 20%, 30%, ..., 90%, and 100%. Furthermore, when erasure verification is performed as shown in FIG. 25 , the client device 1 may transmit to the server device 2 a plurality of signals each indicating that erasure verification has been completed up to a predetermined number of partial areas randomly extracted from a plurality of partial areas obtained by dividing the total storage area of ​​the storage device 13. In this case, the plurality of checkpoints each indicating the progress of erasure verification are the numbers of small areas 302 extracted from each medium area 301, for example, 1, 2, 3, ..., 9, and 10.

[0195] 28, if the client device 1 does not receive an acknowledgment signal from the server device 2, the client device 1 may display a two-dimensional barcode including information about the verification result and the progress on the display device 16, similar to the verification process of Fig. 22. The user of the client device 1 can transmit data indicating the verification result and the progress to the server device 2 by photographing the displayed two-dimensional barcode using the user terminal device 4.

[0196] According to the processes of Figures 28 and 29, by performing verification of erasure in stages, the administrator can recognize the state of the storage device 13 at an early stage, and as time passes, the administrator can recognize more accurate verification results.

[0197] [Advantages of the second embodiment] According to the second embodiment, the processing circuit 401 verifies the erasure of the stored data by executing a firmware program, and during or after the verification of the erasure, sends at least one fourth result signal to the server device 2 indicating that the verification of the erasure of the stored data has been at least partially completed.

[0198] With this configuration, even if erasure verification is performed, the user and administrator do not have to wait too long, and usability is less likely to be reduced than when erasure verification is not performed.

[0199] [Other embodiments] As described above, the embodiments have been described as examples of the technology disclosed in this application. However, the technology in this disclosure is not limited to these, and can be applied to embodiments in which appropriate modifications, substitutions, additions, omissions, etc. are made. Furthermore, it is also possible to combine the components described in the above embodiments to create new embodiments.

[0200] Therefore, other embodiments will be exemplified below.

[0201] When issuing an erasure permit, it may be possible to issue it by specifying the model. In addition to the model, user information may be entered in the notes so that if a user has a model other than the specified model, an erasure permit for the specified model may be issued. The specified models may be displayed in a list so that the administrator can issue an erasure permit. This has the effect of allowing the client device 1 to be managed in a way that reflects the user's intentions, such as discarding models that have predetermined features or discarding models that do not have predetermined features (for example, discarding models that do not have both the form of a notebook computer and a tablet computer (so-called "2-in-1")). This has the effect of allowing, for example, older models to be discarded first.

[0202] Furthermore, erasure authorization may be issued by specifying the manufacturer of the storage device 13. This has the effect of eliminating client devices 1 supplied by manufacturers that tend to cause malfunctions.

[0203] The management table 22a may also have a remarks field in which any character string can be entered. By entering user information in the remarks field, it is possible to list users who use multiple client devices 1 and issue erasure authorizations to them. This has the effect of reducing the total number of client devices 1. Furthermore, by entering user information in the remarks field, it becomes easier to handle multiple client devices 1 in units such as departments or sections.

[0204] Furthermore, by transmitting SMART (Self-Monitoring Analysis and Reporting Technology) information of the client device 1 to the server device 2, a client device 1 in poor condition may be discovered and erasure permission may be issued based on that information. To evaluate the status of the storage device 13 based on the SMART information, for example, the number of sectors that have been replaced, the number of power-on times, the error rate caused by impact, the length of use time, the temperature, the increase in the above parameters as seen by the server device 2, or a combination thereof may be used. The client device 1 may calculate the status of the client device 1 based on the SMART information and transmit the status as remarks to the server device 2. Registered client devices 1 may periodically send SMART information to the server device 2 so that the server device 2 can grasp the status of all client devices 1. Registered client devices 1 may periodically calculate the status of the client device 1 based on the SMART information of the client device 1 and transmit the status as remarks to the server device 2 so that the server device 2 can grasp the status of all client devices 1. This has the effect of enabling client devices 1 in poor condition to be discarded first.

[0205] Furthermore, by sending the usage time of the client device 1 to the server device 2, a client device 1 in poor condition may be discovered and erasure permission may be issued based on that information. The usage time of the client device 1 may also be sent as remark information to the server device 2. This has the effect of enabling client devices 1 with long usage times to be discarded first.

[0206] Furthermore, stress information of the client device 1 may be sent to the server device 2 to discover client devices 1 in poor condition and issue deletion permission based on that information. The stress of the client device 1 may be sent as remark information to the server device 2. This has the effect of making it possible to discard client devices 1 that have been used in high-load environments.

[0207] 15, 17, 19, and 20, the client device 1 inquires about the deletion flag and transmits information about the client device 1 and the storage device 13 to the server device 2 separately, but these communications may be performed simultaneously. When the server device 2 receives the information about the client device 1 and the storage device 13 from the client device 1, the server device 2 may consider that it has received an inquiry about the deletion flag.

[0208] 15 to 17, 19, and 20 have been described with reference to the examples where the client device 1 is restarted to transition from erasure processing using a combination of the erasure application program 70 and the firmware program 50 to erasure processing using only the firmware program 50. However, the client device 1 may be configured to transition from erasure processing using a combination of the erasure application program 70 and the firmware program 50 to erasure processing using only the firmware program 50 without restarting.

[0209] In the example of Fig. 2, the client device 1 is described as having only one storage device 13 from which stored data is to be erased, but the client device 1 may also have multiple storage devices 13 from which stored data is to be erased. The multiple storage devices 13 may be configured as a RAID (Redundant Array of Inexpensive Disks) device, for example. In this case, the multiple storage devices 13 are treated as a unified device, the data stored therein is erased as a unified device, and the erasure results are verified as a unified device. Alternatively, the multiple storage devices 13 may be treated individually, the data stored therein is erased as a unified device, and the erasure results are verified as a unified device.

[0210] In the second embodiment, the user or administrator may be allowed to select whether or not to verify the erasure. If verification of the erasure is not performed, the processing can be completed in the same time as in the first embodiment.

[0211] When erasing data stored in the storage device 13, if secure erase is specified as the erasure method but fails, and triple overwrite erase is performed as an alternative and is successful, "triple overwrite erase" is recorded as the erasure result information. The firmware program 50 presets an alternative process to be performed in the event of an erase failure. For example, each time an erase fails, the erase method may be changed in the following order: secure erase → triple overwrite erase → single overwrite erase.

[0212] As described above, the embodiments have been described as examples of the technology in the present disclosure, and for that purpose, the accompanying drawings and detailed description have been provided.

[0213] Therefore, the components shown in the accompanying drawings and detailed description may include not only essential components for solving the problem, but also components that are not essential for solving the problem in order to illustrate the above technology. Therefore, the fact that these non-essential components are shown in the accompanying drawings or detailed description should not be interpreted as immediately indicating that these non-essential components are essential.

[0214] Furthermore, since the above-described embodiments are intended to illustrate the technology of the present disclosure, various modifications, substitutions, additions, omissions, etc. may be made within the scope of the claims or their equivalents.

[0215] Summary of this disclosure An electronic device according to a first aspect of the present disclosure includes: a first processing circuit; a communication circuit capable of communicating with a server device via a communication line; a first storage device for storing stored data including an operating system, application programs, and user data; an electronic device comprising: a first firmware program; and a second storage device that stores first setting information; the first firmware program is executed by the first processing circuit to control the operation of the electronic device based on the first setting information; When the first processing circuit receives a first erasure command from the server device instructing the erasure of the stored data and the first setting information, it executes the first firmware program to erase the stored data from the first storage device and the first setting information from the second storage device.

[0216] According to the electronic device according to the second aspect of the present disclosure, in the electronic device according to the first aspect, The first setting information includes a password that restricts changes to the first setting information.

[0217] According to the electronic device according to the third aspect of the present disclosure, in the electronic device according to the first or second aspect, After the erasure of the stored data and the first setting information is completed, the first processing circuit executes the firmware program to send a first result signal to the server device indicating that the erasure of the stored data and the first setting information has been completed.

[0218] According to the electronic device according to the fourth aspect of the present disclosure, in the electronic device according to one of the first to third aspects, The electronic device is a second processing circuit; a third storage device that stores a second firmware program and second setting information; the second firmware program, when executed by the second processing circuit, enables an external device connected via the communication line to control an operation of the electronic device based on the second setting information; When the first processing circuit receives a second erase command from the server device instructing it to erase the stored data and the second setting information, it executes the first firmware program to erase the stored data from the first storage device and erase the second setting information from the third storage device.

[0219] According to the electronic device according to the fifth aspect of the present disclosure, in the electronic device according to the fourth aspect, After the erasure of the stored data and the second setting information is completed, the first processing circuit executes the firmware program to send a second result signal to the server device indicating that the erasure of the stored data and the second setting information has been completed.

[0220] According to the electronic device according to the sixth aspect of the present disclosure, in the electronic device according to one of the first to fifth aspects, The electronic device is a third processing circuit; a fourth storage device that stores a third firmware program and third setting information; the third firmware program is executed by the third processing circuit to encrypt and decrypt the stored data based on the third setting information; When the first processing circuit receives a third erase command from the server device instructing it to erase the stored data and the third setting information, it executes the first firmware program to erase the stored data from the first storage device and erase the third setting information from the fourth storage device.

[0221] According to the seventh aspect of the present disclosure, in the electronic device according to the sixth aspect, After the erasure of the stored data and the third setting information is completed, the first processing circuit executes the firmware program to send a third result signal to the server device indicating that the erasure of the stored data and the third setting information has been completed.

[0222] According to an electronic device according to an eighth aspect of the present disclosure, in the electronic device according to one of the first to seventh aspects, The first processing circuit executes the firmware program, verifying said erasure of said stored data; During or after the verification of the erasure, at least one fourth result signal is sent to the server device indicating that the verification of the erasure of the stored data has at least partially completed.

[0223] A system according to a ninth aspect of the present disclosure includes: a plurality of electronic devices, each of which is an electronic device according to one of the first to eighth aspects; The server device.

[0224] According to a system according to a tenth aspect of the present disclosure, in the system according to the ninth aspect, The electronic device is registering the electronic device with the server device by transmitting a first signal including identification information that uniquely identifies the first storage device; transmitting a second signal including the identification information of the first storage device to the server device, the second signal inquiring whether the server device is registered to erase data stored in the first storage device; The server device sends the first erase command to the electronic device if the identification information of the first storage device included in the second signal matches the identification information of the first storage device included in the first signal and the stored data and the first setting information are registered in the server device to be erased.

[0225] According to the system according to the eleventh aspect of the present disclosure, in the system according to the ninth or tenth aspect, The server device obtaining erasure completion information from the electronic device, the information indicating that erasure of the stored data has been completed; Based on the erasure completion information, an erasure certificate is issued to certify that the erasure of the stored data has been completed.

[0226] According to a method for erasing data stored in an electronic device according to a twelfth aspect of the present disclosure, The electronic device is a first processing circuit; a communication circuit capable of communicating with a server device via a communication line; a first storage device for storing stored data including an operating system, application programs, and user data; a second storage device that stores a first firmware program and first setting information; the first firmware program is executed by the first processing circuit to control the operation of the electronic device based on the first setting information; The method includes, when a first erasure command instructing erasure of the stored data and the first setting information is received from the server device, executing the first firmware program by the processing circuit to erase the stored data from the first storage device and erase the first setting information from the second storage device. [Industrial Applicability]

[0227] An electronic device according to one aspect of the present disclosure is useful for erasing data stored in a storage device. [Explanation of symbols]

[0228] 1,1-1~1-3 Client device 2. Server device 3 Administrator device 4. User terminal equipment 5 Base station equipment 6. Communication lines 10 Bus 11 processors 12 RAM 13 Storage device 14A UEFI controller 14B Auxiliary Controller 14C TPM controller 15. Communications equipment 16 Display device 17 Input Devices 20 Bus 21 processors 22 RAM 23 Storage device 25 Communication equipment 30 Bus 31 processors 32 RAM 33 Storage device 35 Communication equipment 36 Display device 37 Input Devices 40 Bus 41 processors 42 RAM 43 Storage device 45 Communication equipment 46 Display device 47 Input Devices 48 Camera 50 Firmware Program 51 Core control unit 52 Erase control section 53 Data Encoding Unit 54 Two-dimensional barcode generator 60 Operating Systems 61 Device Information Monitor 62 Power management section 70 Erasure Application Program 71 Core control unit 81 Core control unit 82 Readout section 83 Writing section 84 Eraser 100 systems 200 display screen 201 Two-dimensional barcode 202 Keywords 203 Input field 301 Medium area 302 small area 400 Bus 401 Processing Circuit 402 Volatile Memory 403 Non-volatile memory 404 Input / Output Interface (I / F) 410 Bus 411 Processing Circuit 412 Volatile Memory 413 Non-volatile memory 414 Input / Output Interface (I / F) 420 Bus 421 Processing Circuit 422 Volatile Memory 423 Non-volatile memory 424 Input / Output Interface (I / F)

Claims

1. a first processing circuit; a second processing circuit; a communication circuit capable of communicating with a server device via a communication line; a first storage device for storing stored data including an operating system, application programs, and user data; a second storage device that stores a first firmware program and first setting information; a third storage device that stores a second firmware program and second setting information, the first firmware program is executed by the first processing circuit to control the operation of the electronic device based on the first setting information; the second firmware program, when executed by the second processing circuit, enables an external device connected via the communication line to control an operation of the electronic device based on the second setting information; The first processing circuit when a first erasure command instructing erasure of the stored data and the first setting information is received from the server device, executing the first firmware program to erase the stored data from the first storage device and erase the first setting information from the second storage device; when a second erasure command instructing erasure of the stored data and the second setting information is received from the server device, executing the first firmware program to erase the stored data from the first storage device and erase the second setting information from the third storage device; electronic equipment.

2. the first setting information includes a password that restricts changes to the first setting information; The electronic device of claim 1 .

3. After the erasure of the stored data and the first setting information is completed, the first processing circuit executes the firmware program to transmit a first result signal to the server device, the first result signal indicating that the erasure of the stored data and the first setting information is completed. The electronic device of claim 1 .

4. (delete)

5. After the erasure of the stored data and the second setting information is completed, the first processing circuit executes the firmware program to transmit a second result signal to the server device, the second result signal indicating that the erasure of the stored data and the second setting information is completed. The electronic device of claim 1 .

6. The electronic device is a third processing circuit; and a fourth storage device that stores a third firmware program and third setting information; the third firmware program is executed by the third processing circuit to encrypt and decrypt the stored data based on the third setting information; when the first processing circuit receives a third erase command from the server device instructing erasure of the stored data and the third setting information, the first processing circuit executes the first firmware program to erase the stored data from the first storage device and the third setting information from the fourth storage device; The electronic device of claim 1 .

7. After the erasure of the stored data and the third setting information is completed, the first processing circuit executes the firmware program to transmit a third result signal to the server device, the third result signal indicating that the erasure of the stored data and the third setting information is completed.

7. The electronic device of claim 6.

8. The first processing circuit executes the firmware program, verifying said erasure of said stored data; during or after the verification of the erasure, sending at least one fourth result signal to the server device indicating that the verification of the erasure of the stored data has at least partially completed; The electronic device of claim 1 .

9. a plurality of electronic devices, each of which is an electronic device according to any one of claims 1 to 3 and 5 to 8; the server device, system.

10. The electronic device is registering the electronic device with the server device by transmitting a first signal including identification information that uniquely identifies the first storage device; transmitting a second signal including the identification information of the first storage device to the server device, the second signal inquiring whether the server device is registered to erase data stored in the first storage device; the server device, when the identification information of the first storage device included in the second signal matches the identification information of the first storage device included in the first signal, and when the stored data and the first setting information are registered in the server device to be erased, transmits the first erase command to the electronic device; The system of claim 9.

11. The server device obtaining erasure completion information from the electronic device, the information indicating that erasure of the stored data has been completed; issuing an erasure certificate that certifies that the erasure of the stored data has been completed based on the erasure completion information; The system of claim 9.

12. 1. A method for erasing data stored in an electronic device, comprising: The electronic device is a first processing circuit; a second processing circuit; a communication circuit capable of communicating with a server device via a communication line; a first storage device for storing stored data including an operating system, application programs, and user data; a second storage device that stores a first firmware program and first setting information; a third storage device that stores a second firmware program and second setting information; the first firmware program is executed by the first processing circuit to control the operation of the electronic device based on the first setting information; the second firmware program, when executed by the second processing circuit, enables an external device connected via the communication line to control an operation of the electronic device based on the second setting information; The method comprises: When a first erasure command instructing erasure of the stored data and the first setting information is received from the server device, the first processing circuit executes the first firmware program to erase the stored data from the first storage device and the second storage device. erasing the first setting information from the device; when a second erasure command instructing erasure of the stored data and the second setting information is received from the server device, executing the first firmware program by the first processing circuit to erase the stored data from the first storage device and erase the second setting information from the third storage device; method.

Images