Software reliability management device and software reliability management method

Abstract

To provide a software reliability management device and a software reliability management method, capable of determining a security measure considering a terminal environment in which software operates, and of protecting a business continuation.SOLUTION: A software reliability management device includes a processor and a storage unit. The storage unit stores software that serves as a management object. According to information on a terminal environment in which the software operates, the processor calculates a reliability for one or more items to the software stored in the storage unit, compares, by each item, the reliability and a reliability threshold value corresponding to each of one or more items of the reliability, and determines that a reliability improvement measure is required to the item of the software according to a result from the comparison.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a software reliability management device and a software reliability management method, and more particularly to a trust management technique for a control system. [Background technology]

[0002] As disclosed in Patent Document 1, a version update technique has been proposed for software in operation in a control system, taking into account trial histories on other terminals. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-157732 Summary of the Invention [Problem to be solved by the invention]

[0004] In control systems, business continuity is the top priority, making it difficult to simply implement security measures for software in operation. Configuration changes based on these measures often require a formal process. Here, business continuity refers to a broader concept that encompasses availability, integrity, and confidentiality, all of which are commonly known security attributes. Conventional technologies determine the need for updates solely by comparing version information, which can potentially compromise business continuity. Therefore, the challenge is to determine security measures that take into account the terminal environment in which the software runs, and ensure business continuity. The terminal environment refers to the software's importance in the control system, OS information, the presence or absence of a configuration change process, and other factors. [Means for solving the problem]

[0005] According to a first aspect of the present invention that solves the above-mentioned problems, there is provided a software reliability management device as described below. This software reliability management device includes a processor and a storage device. The storage device stores software to be managed. The processor calculates the reliability of one or more items for the software stored in the storage device based on information about the terminal environment in which the software runs, compares the reliability with a reliability threshold corresponding to each of the one or more reliability items for each item, and determines, based on the comparison result, that reliability improvement measures are required for the software items.

[0006] According to a second aspect of the present invention that solves the above-mentioned problems, there is provided a software reliability management method as follows. This software reliability management method is a method performed using a processor and a storage device. This method includes the steps of: calculating, by the processor, the reliability of one or more items of software to be managed, based on information about the terminal environment in which the software runs, the reliability of the software stored in the storage device; comparing, for each item, the reliability with a reliability threshold corresponding to each of the one or more reliability items; and determining, based on the comparison result, that reliability improvement measures are required for the software items. [Effects of the Invention]

[0007] According to the present invention, security measures are determined taking into consideration the terminal environment in which the software operates, making it possible to protect business continuity. Note that problems, configurations, and effects other than those described above will become clear from the following description of the preferred embodiment of the invention. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of an overall system configuration according to a first embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the hardware configuration of a software reliability management device, an installer, and a field device according to the first embodiment. [Figure 3]10 is an example of a sequence diagram showing a process from determining a reliability improvement measure for managed software to applying the measure in the first embodiment; [Figure 4] 3A and 3B are diagrams illustrating an example of a data table of environment information, configuration information, and external information in the first embodiment. [Figure 5] FIG. 4 is a diagram illustrating an example of the relationship between reliability, a reliability threshold, and reliability improvement measures in the first embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of the hardware configuration of a software reliability management device, an installer, and a field device according to a second embodiment. [Figure 7] 3A to 3C are diagrams showing examples of user screens in the first and second embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment is an example for explaining the present invention, and for clarity of explanation, appropriate omissions and simplifications have been made. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural. In order to facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not necessarily limited to the position, size, shape, range, etc. disclosed in the drawings. Examples of information may be described using expressions such as "table," "list," and "queue," but information may also be expressed using other data structures. For example, information such as "XX table," "XX list," and "XX queue" may be expressed as "XX information." When describing identification information, expressions such as "identification information," "identifier," "name," "ID," and "number" are used, but these are interchangeable. When there are multiple components with the same or similar functions, they may be described using the same reference numeral with different subscripts. When there is no need to distinguish between these multiple components, the subscripts may be omitted. In the embodiments, processing performed by executing a program may be described. Here, a computer executes the program using a processor (e.g., a CPU or a GPU) and performs processing defined by the program using storage resources (e.g., a memory) and interface devices (e.g., a communication port). Therefore, the entity performing the processing by executing the program may be the processor. Similarly, the entity performing the processing by executing the program may be a controller, device, system, computer, or node having a processor. The entity performing the processing by executing the program may be any computing unit, and may include a dedicated circuit that performs specific processing. Here, the dedicated circuit may be, for example, an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), or a CPLD (Complex Programmable Logic Device). A program may be installed on a computer from a program source. The program source may be, for example, a program distribution server or a computer-readable storage medium. When the program source is a program distribution server, the program distribution server may include a processor and storage resources for storing the program to be distributed, and the processor of the program distribution server may distribute the program to be distributed to other computers. In addition, in an embodiment, two or more programs may be realized as one program, or one program may be realized as two or more programs.

[0010] <Overall system configuration> 1 is a diagram showing an example of the overall system configuration in the first embodiment. In FIG. 1, a software reliability management device 10, an installer 20, and one or more field devices 30 are connected to a network 40. i is connected.

[0011] The software reliability management device 10 includes a reliability calculation unit 101, a reliability threshold calculation unit 102, a parameter calculation unit 103, a reliability improvement measure determination unit 104, a screen output unit 105, an operation input unit 106, and a communication unit 107. The reliability calculation unit 101 calculates a reliability consisting of one or more items. The reliability threshold calculation unit 102 calculates a reliability threshold consisting of one or more items. The parameter calculation unit 103 calculates parameters associated with the reliability improvement measure. The reliability improvement measure determination unit 104 determines the necessity of a reliability improvement measure for each item based on the reliability and the reliability threshold, determines the priority of the reliability improvement measure based on the parameters, and determines whether the measure is applicable based on the results of operational verification. The screen output unit 105 displays the processing results. The communication unit 107 communicates with the operation input unit 106, which accepts operations from a user, and with other devices.

[0012] The software reliability management device 10 also includes an environmental information storage unit 108, a configuration information storage unit 109, an external information storage unit 110, a reliability storage unit 111, a reliability threshold storage unit 112, a reliability improvement measure storage unit 113, and a managed software storage unit 114. The environmental information storage unit 108 stores information on the terminal environment of the managed software. The configuration information storage unit 109 stores configuration information of the managed software. The external information storage unit 110 stores information related to the managed software collected from outside. The reliability storage unit 111 stores the reliability. The reliability threshold storage unit 112 stores the reliability threshold. The reliability improvement measure storage unit 113 stores the reliability improvement measures. The managed software storage unit 114 stores a list of managed software.

[0013] The installer 20 includes a communication unit 201, an operation verification unit 202, and a verification result determination unit 203. The communication unit 201 communicates with other devices. The operation verification unit 202 verifies reliability improvement measures taking into account the terminal environment. The verification result determination unit 203 determines applicability based on the results of the operation verification. In addition, the on-site device 30 on which the managed software runs is also verified. i a communication unit 301 for communicating with other devices;i The configuration includes:

[0014] The software reliability management device 10 having such functions, the installer 20, and the field device 30 i can be realized by a general information processing device 50 having an input device 501, an output device 502, a memory 503, a storage device 504, a CPU (CENTRAL PROCESSING UNIT) 505 (processor), and an I / F (INTERFACE) 506, as shown in FIG.

[0015] The software reliability management device 10 includes a reliability calculation unit 101, a reliability threshold calculation unit 102, a parameter output unit 103, a reliability improvement measure determination unit 104, a screen output unit 105, an operation input unit 106, and a communication unit 107, and the installer 20 includes a communication unit 201, an operation verification unit 202, and a field device 30. i Communications Department 301 i are embodied on each device by the CPU 505 executing a program stored in the memory 503. Some or all of these computer programs and data may be stored in advance in a storage device 504 such as a hard disk, or may be stored in the storage device 504 on the information processing device 50 via the I / F 506 from a non-transitory storage device of another device connected via a network or from a non-transitory storage medium, as necessary.

[0016] In addition, the environmental information storage unit 108, configuration information storage unit 109, external information storage unit 110, reliability storage unit 111, reliability threshold storage unit 112, and reliability improvement measure storage unit 113 of the software reliability management device 10 are embodied on the memory 503 or the storage device 504.

[0017] Instructions and inputs from the user of the software reliability management device 10 are input to an input device 501 such as a keyboard, mouse, or touch panel that accepts inputs, and the processing results are output to an output device 502 such as a liquid crystal display device or an organic EL (Electro Luminescence) display. i can be configured on an information processing device 50 connected by an internal communication line 507 such as a bus.

[0018] <Example of processing procedure> The procedure in the first embodiment will be described below with reference to the drawings. The various operations described below are performed by the software reliability management device 10, the installer 20, and the field device 30. i are realized by programs that are read into the memory 503 and executed.

[0019] FIG. 3 is an example of a sequence diagram showing a process from determining a reliability improvement measure for managed software to applying the measure in the first embodiment.

[0020] The software reliability management device 10 receives an operation input from the user, starts a reliability improvement measure application process (step S701), and selects software X from a list of software to be managed (step S702). Environmental information, configuration information, and external information (hereinafter, these three types of information will be collectively referred to as various information) corresponding to the software X are read from the environmental information storage unit 108, the configuration information storage unit 109, and the external information storage unit 110, respectively (step S703).

[0021] 4 shows an example of the data table 60 for the various types of information. The various types of information may be output as the data table 60 to a screen via the screen output unit 105 of the software reliability management device 10 so that the user can check them as needed. Alternatively, the various types of information may be input by a user via the operation input unit 106 of the software reliability management device 10, or may be stored in the environment information storage unit 108, configuration information storage unit 109, or external information storage unit 110 of the software reliability management device 10 from a non-transitory storage device or a non-transitory storage medium of another device connected via a network via the I / F 506.

[0022] Next, the software reliability management device 10 sets n to 1 (step S704), and then calculates the reliability n of the software X in item n and the reliability threshold n from the various information, and stores them in the reliability storage unit 111 and the reliability threshold storage unit 112, respectively (steps S705 and S706). Note that steps S705 and S706 can be performed in any order. Here, the reliability n can be considered as a value for evaluating business continuity.

[0023] There are various possible methods for calculating the reliability and the reliability threshold. For example, they may be calculated in accordance with the ISMS evaluation criteria, or by interpreting the CVSS evaluation parameters. By calculating the reliability threshold from various pieces of information in this way, it becomes possible to consider the importance of the software X in the control system. However, the threshold may be a fixed value in advance, or may be input by the user.

[0024] Next, the software reliability management device 10 reads the reliability n and the reliability threshold n from the reliability storage unit 111 and the reliability threshold storage unit 112, respectively, and determines whether the reliability n is equal to or greater than the reliability threshold n (step S707). If the determination result shows that the reliability n is equal to or greater than the reliability threshold n, n is incremented by 1 (step S708), and the process returns to step S705.

[0025] On the other hand, if the reliability n is less than the reliability threshold n as a result of the determination, parameters for each reliability improvement measure are calculated from the various information and the m reliability improvement measures corresponding to the item n read from the reliability improvement measure storage unit 113 (step S709). Here, in this embodiment, the parameters for each reliability improvement measure include post-application reliability and application cost. An example of the relationship between reliability, reliability threshold, and reliability improvement measures including parameters is shown in Figure 5.

[0026] Next, the software reliability management device 10 determines a priority from 1 to m for each reliability improvement measure from the parameters associated with each reliability improvement measure calculated in step S709 (step S710). As an example of a method for determining the priority, in this embodiment, the priority is determined by the value of post-application reliability - application cost.

[0027] Next, the software reliability management device 10 transmits the various types of information to the installer 20 (step S711). Here, the various types of information may be written in an extension field of an electronic certificate such as X.509, and the electronic certificate may be transmitted to the installer 20. Alternatively, the various types of information may be written in a file such as text, and the file may be transmitted to the installer 20, or the information may be transmitted to the installer 20 as stream data. Alternatively, the various types of information may be transmitted to the installer 20 using a cryptographic protocol such as IPSec, TLS, or SSH, or may be transmitted to the installer 20 with tamper detection information such as a hash value, a message digest, a message authentication code, or a digital signature added, or may be transmitted in combination with encryption and tamper detection information.

[0028] Next, the installer 20 receives the various pieces of information from the software reliability management device 10 (step S712).

[0029] Next, the software reliability management device 10 sets the priority k to 1 (step S713). The software reliability management device 10 acquires reliability improvement measure (applied measure) information for priority k (step S714) and transmits the reliability improvement measure (applied measure) information for priority k to the installer 20 (step S715). Here, the reliability improvement measure information for priority k may be written in an extension field of an electronic certificate such as X.509, and the electronic certificate may be transmitted to the installer 20. Alternatively, the reliability improvement measure information for priority k may be written in a file such as text, and the file may be transmitted to the installer 20, or the file may be transmitted to the installer 20 as stream data. Alternatively, the reliability improvement measure information for priority k may be transmitted to the installer 20 using an encryption protocol such as IPSec, TLS, or SSH, or may be transmitted to the installer 20 with tamper detection information such as a hash value, a message digest, a message authentication code, or a digital signature added thereto, or may be transmitted by combining encryption and tamper detection information.

[0030] Next, the installer 20 receives information about reliability improvement measures (applied measures) with priority k from the software reliability management device 10 (step S716). Next, the installer 20 performs operation verification of the applied measures based on the various information received in step S712 and the applied measure information received in step S716 (step S717). In this embodiment, the operation verification unit 202 of the installer 20 verifies whether a business scenario generated using various information as input values ​​or a business scenario set by a user can be achieved after the applied measures.

[0031] Next, the installer 20 transmits the operation verification result to the software reliability management device 10 (step S718). Here, the operation verification result may be written in a file and the file, such as text, may be transmitted to the software reliability management device 10, or may be transmitted as stream data to the installer 20. The operation verification result may be transmitted to the software reliability management device 10 using a cryptographic protocol such as IPSec, TLS, or SSH, or may be transmitted to the software reliability management device 10 with tamper detection information, such as a hash value, a message digest, a message authentication code, or a digital signature, added, or may be transmitted to the software reliability management device 10 in combination with encryption and tamper detection information.

[0032] Next, the software reliability management device 10 receives the verification result from the installer 20 (step S719). Next, it determines whether there is a problem with the verification result (step S720). The software reliability management device 10 can make this determination using various information. In this embodiment, if there is an impact on business continuity, it is determined that there is a problem with the verification result. Note that cases where there is an impact on business continuity include when the business scenario cannot be achieved, when real-time performance falls below an acceptable range, or when an error occurs. If it is determined that there is a problem with the verification result in step S720, it determines whether the priority k matches m, which is the number of reliability improvement measures (step S721). If it is determined that there is no match, the priority k is incremented by one (step S722), and the process returns to step S714. On the other hand, if there is a match, a warning is issued to the user (step S723).

[0033] Next, the installer 20 determines whether there is a problem in the verification result (step S724). If there is a problem as a result of the determination, the process returns to step S716. On the other hand, if there is no problem as a result of the determination, the installer 20 sends an application instruction to the field device 30. i (step S725).

[0034] Next, the field device 30 iBased on the application instruction from the installer 20, the application program applies the application policy (step S726), and transmits an application completion notice to the installer 20 (step S727).

[0035] Next, the installer 20 notifies the field device 30 of the completion of application. i The installer 20 receives the application completion notification from the installer 20 (step S728) and transfers the application completion notification to the software reliability management device 10 (step S729). If the determination result of step S720 is no problem, the software reliability management device 10 receives the application completion notification of the applied measure (step S730). The application completion notification may be written in a file, and a file such as text may be sent to the software reliability management device 10, or it may be sent as stream data to the installer 20. The application completion notification may be sent to the software reliability management device 10 using a cryptographic protocol such as IPSec, TLS, or SSH, or may be sent to the software reliability management device 10 with tamper detection information such as a hash value, a message digest, a message authentication code, or a digital signature added thereto, or may be sent by combining encryption and tamper detection information.

[0036] Next, the software reliability management device 10 determines whether verification of all items n for the software X has been completed (step S731). If it is determined that verification has not been completed, n is incremented by one (step S732) and the process returns to processing step S705. On the other hand, if it is determined that verification has been completed, it determines whether verification has been completed for all of the software X (step S733). If it is determined that verification has not been completed, X is incremented by one (step S734) and the process returns to processing step S702. On the other hand, if it is determined that verification has been completed, the process ends (step S735).

[0037] Next, a second embodiment will be described. Details similar to those already described will be omitted. Fig. 6 is a diagram showing an example of the overall system configuration in the second embodiment. In Fig. 6, in addition to the configuration example in the first embodiment, the software reliability management device 10 includes an electronic certificate storage unit 115 and an electronic certificate issuing unit 116. All or part of the environmental information, configuration information, external information, reliability, and reliability threshold are entered in the extension field of the electronic certificate by the electronic certificate issuing unit 116 and stored in the electronic certificate storage unit 115. Alternatively, the electronic certificate issuing unit 116 may cooperate with an external CA and issue an electronic certificate signing request to the external CA. Furthermore, the electronic certificate may be issued to the field device 30 as needed. i may be distributed to.

[0038] Next, an example of a displayed screen will be described. Fig. 7 is a diagram showing an example of a screen in the first or second embodiment. Fig. 7 shows an example of a software management screen 90 operated by a user of this system. The software management screen 90 includes a field device selection area 91, a software selection area 92, a variety of information input area 93, a reliability calculation execution button 94, a reliability display area 95, an application execution button 96, and an application result area 97.

[0039] The field device selection area 91 is a user interface for selecting the field device to be managed by the processing flow described above. As an example, the field device 30 i A possible format would be to display a list of the items and allow the user to select the target.

[0040] The software selection area 92 is a user interface for selecting the target software to be managed by the processing flow described above. As an example, the software selection area 92 is a user interface for selecting the target software to be managed by the field device 30 selected in the field device selection area 91. i A possible format would be to display a list of software from which the target can be selected.

[0041] The various information input area 93 is an area for displaying or inputting various information about the software selected in the software selection area 92. The various information is described in Fig. 4. By allowing the user to input various information, the user can flexibly register information about the software configuration.

[0042] The reliability calculation execution button 94 is a button for triggering the execution of reliability calculation based on the various information determined in the various information input area 93 .

[0043] The reliability display area 95 displays the results of the reliability calculation. As an example, it is possible to display the information about the reliability shown in Fig. 5 in a visible form on the screen.

[0044] The apply execution button 96 is a button for triggering the execution of the application process. The application result 97 is an area for displaying the result of the application process.

[0045] By protecting business continuity, for example, the application of software can prevent on-site equipment from shutting down, thereby preventing business interruptions. Therefore, the system described above can contribute economically.

[0046] The present invention is not limited to the first and second embodiments, and various modifications are possible within the scope of the gist thereof.

[0047] For example, the management object of the present invention is not limited to software, but can also be applied to hardware.

[0048] Furthermore, in the first and second embodiments, the software reliability management device 10 and the installer 20 are different devices, but the software reliability management device 10 may have the functions of the installer 20 . [Explanation of symbols]

[0049] 10 Software Reliability Management Device 20 Installer 30 Field equipment 40 Network 101 Reliability calculation unit 102 Reliability threshold calculation unit 103 Parameter calculation unit 104 Reliability Improvement Measures Determination Department 105 Screen Output Section 106 Operation input section 107 Communications Department 108 Environmental Information Storage Unit 109 Configuration information storage section 110 External information storage unit 111 Reliability storage unit 112 Reliability threshold storage unit 113 Reliability Improvement Measures Storage Unit 114 Managed Software Repository 201 Communications Department 202 Operation Verification Department 203 Verification result judgment unit 301 Communications Department

Claims

1. a processor and a storage device, The storage device Stores the software to be managed, The processor: For the software stored in the storage device, calculate the reliability of one or more items based on information on the terminal environment in which the software operates, configuration information of the software, and external information related to the software in accordance with the ISMS evaluation criteria, or calculate by interpreting the CVSS evaluation parameters; comparing the reliability with a reliability threshold value corresponding to one or more items of the reliability for each item; Based on the result of the comparison, it is determined that reliability improvement measures are necessary for the item of the software. A software reliability management device characterized by:

2. 2. The software reliability management device according to claim 1, The processor: Calculate a reliability threshold for one or more items based on information about the terminal environment in which the software operates, configuration information about the software, and external information related to the software, in accordance with the ISMS evaluation criteria, or by converting the CVSS evaluation parameters into the reliability threshold. A software reliability management device characterized by:

3. 2. The software reliability management device according to claim 1, The processor: When reliability improvement measures are necessary for the item of the software, calculate the reliability after application of one or more reliability improvement measures corresponding to the item and the application cost based on information on the terminal environment in which the software operates, configuration information of the software, and external information related to the software, determining a priority of one or more reliability improvement measures corresponding to the item based on the post-application reliability and the application cost; A software reliability management device characterized by:

4. 2. The software reliability management device according to claim 1, The processor: sending information to be used for executing the verification to an installer that verifies the reliability improvement measures based on information on the terminal environment in which the software operates, configuration information of the software, and external information related to the software; A software reliability management device characterized by:

5. A software reliability management device according to claim 3, The processor: sending information to be used for executing the verification to an installer that verifies the reliability improvement measures of the determined priority based on information on the terminal environment in which the software operates, configuration information of the software, and external information related to the software; A software reliability management device characterized by:

6. 2. The software reliability management device according to claim 1, The processor: Verifying reliability improvement measures based on information on the terminal environment in which the software operates, configuration information of the software, and external information related to the software. A software reliability management device characterized by:

7. The software reliability management device according to claim 4, The processor: determining whether there is a problem with the verification result received from the installer; A software reliability management device characterized by:

8. A software reliability management device according to claim 5, The processor: determining whether there is a problem with the verification result received from the installer; A software reliability management device characterized by:

9. 2. The software reliability management device according to claim 1, The processor: The information on the terminal environment in which the software runs, the reliability, and the reliability threshold are all or partly included in the digital certificate. A software reliability management device characterized by:

10. The software reliability management device according to claim 6, an output device; The processor: displaying the verification results of the reliability improvement measures on the output device; A software reliability management device characterized by:

11. The software reliability management device according to claim 7, an output device; The processor: displaying the verification results of the reliability improvement measures on the output device; A software reliability management device characterized by:

12. A software reliability management method performed using a processor and a storage device, comprising: The processor calculates the reliability of one or more items for the software to be managed stored in the storage device based on information on the terminal environment in which the software operates, configuration information of the software, and external information related to the software, in accordance with ISMS evaluation criteria or by converting the evaluation parameters of CVSS into the reliability of one or more items; the processor comparing, for each item, the confidence level to a confidence level threshold corresponding to one or more items of confidence level; determining, based on the results of the comparison, that the item of software requires reliability improvement measures; A software reliability management method comprising:

Images