Information processing device and information processing method

Abstract

To provide an information processor that enables a rapid response / a countermeasure when a threat event related to a target system or a component is reported or observed.SOLUTION: An information processor includes: a confirmation element determination unit 102 that extracts, from among elements constituting a target system 300, putting an element related to a threat event as a starting point to use a level of trust from one element to another element between the elements and a direction of trust indicating a direction from one element to another element between the elements, an element that satisfies a preset condition of the level of trust from among the elements as an element for which confirmation work is to be performed to identify an influence range of the threat event, and determines them as confirmation elements; and a confirmation order determination unit 103 that determines, for the confirmation elements, on the basis of at least the level of trust between the elements and the direction of trust, an order where the confirmation work is performed.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an information processing apparatus and an information processing method suitable for application to systems such as industrial control systems.

Background Art

[0002] With the advent of DX (Digital Transformation), a variety of numerous elements (devices, OS (Operating System), software, subsystems, clouds, etc.) are intricately intertwined to form systems such as industrial control systems. When threat events (signs or traces of attacks, etc.) against the system are observed / reported, it is required to respond promptly.

[0003] Patent Document 1 describes ranking one or more security countermeasure technologies based on the degree of fulfillment of the system requirements indicated in the requirement information using the requirement information and impact information of the system. The impact information is information indicating the correspondence relationship between information indicating one or more security countermeasure technologies and information indicating the impact on the system when each of the one or more security countermeasure technologies included in the one or more security countermeasure technologies is introduced into the system.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Incidentally, due to the diversification and increasing complexity of the elements and relationships related to industrial control systems and other systems accompanying DX, it takes time (man-hours) to identify the scope of impact of a threat event, or the scope that is expected to be affected in the future. In systems where various elements are intricately intertwined, there is a need to respond quickly to observed / reported threat events and to operate the system securely.

[0006] This invention has been made in view of the above circumstances, and aims to provide a method that enables rapid response / countermeasures when a threat event related to a target system or component is reported or observed. [Means for solving the problem]

[0007] To solve the above problems, an information processing device according to one aspect of the present invention includes: a confirmation element determination unit that, starting from elements related to a threat event among the elements constituting a target system, extracts elements that satisfy a predetermined level of trust from among the elements, using the level of trust from one element to another and the direction of trust indicating the direction from one element to another, and determines them as confirmation elements for performing confirmation work to identify the scope of impact of a threat event; and a confirmation order determination unit that determines the order in which confirmation work will be performed for the confirmation elements, based at least on the level of trust and the direction of trust between each element. [Effects of the Invention]

[0008] According to at least one aspect of the present invention, the scope (elements) of the impact of a threat event can be efficiently narrowed down, thereby enabling a rapid response to the threat event. Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0009] [Figure 1] This is a block diagram showing an example of the functional configuration of a trusted system according to the first embodiment of the present invention. [Figure 2] This figure shows an example of the hardware configuration of a trusted system according to the first embodiment of the present invention. [Figure 3] This figure shows an example of an industrial control system. [Figure 4] This figure shows an example of the direction and level of confidence according to the first embodiment of the present invention. [Figure 5] This figure shows an example of a threat information table according to the first embodiment of the present invention. [Figure 6] This flowchart shows an example of the procedure for determining a verification element by the verification element determination unit according to the first embodiment of the present invention. [Figure 7] This flowchart shows an example of the procedure for determining the order of confirmation by the order of confirmation determination unit according to the first embodiment of the present invention. [Figure 8] This figure shows an example of a sequence of verification steps for identifying elements that affect a threat event in an industrial control system, according to the first embodiment of the present invention. [Figure 9] This is a block diagram showing an example of the functional configuration of a trusted system according to a second embodiment of the present invention. [Figure 10] This figure shows examples of the direction, level, and attributes of trust according to a second embodiment of the present invention. [Figure 11] Figure 10 shows an example of a vulnerability related to reliability. [Figure 12] Block diagram showing an example of the functional configuration of a trusted system according to a third embodiment of the present invention. [Figure 13] This figure shows an example of business information according to the third embodiment of the present invention. [Figure 14] This flowchart shows an example of the procedure for determining a verification element by the verification element determination unit according to the third embodiment of the present invention. [Figure 15] This flowchart shows an example of the procedure for determining the order of confirmation by the confirmation order determination unit according to the third embodiment of the present invention. [Figure 16] This figure shows an example of a sequence of verification steps for identifying elements that affect a threat event in an industrial control system, according to a third embodiment of the present invention.

Best Mode for Carrying Out the Invention

[0010] Hereinafter, an example of a mode for carrying out the present invention (hereinafter referred to as “embodiment”) will be described with reference to the accompanying drawings. In this specification and the accompanying drawings, the same reference numerals are assigned to the same components or components having substantially the same functions, and duplicate descriptions are omitted.

[0011] <First Embodiment> [Configuration of Trusted System] First, the configuration of the trusted system according to the first embodiment of the present invention will be described with reference to FIG. 1. FIG. 1 is a block diagram showing an example of the functional configuration of the trusted system according to the first embodiment. The trusted system 100 is a system that identifies the range affected by threat events related to the elements constituting a target system (for example, the industrial control system 300 in FIG. 3 described later). The trusted system 100 is an example of an information processing device. The trusted system 100 is connected to at least one target system, and information on threat events observed / reported in the target system is input to the trusted system 100.

[0012] The target system information input unit 110 inputs information on the target system (hereinafter referred to as “target system information”) to the trusted system 100. The target system information (system configuration and elements) is stored in the target system information storage unit 104. The target system information input unit 110 can be configured using, for example, an input device of a communication terminal such as a PC or a communication device that communicates with an external device.

[0013] The target system information includes information on the elements (devices, operating systems, software, subsystems, clouds, etc.) that make up the target system and information on the system configuration. The system configuration information is information indicating the connection form of a plurality of elements. This connection form can be divided into a physical connection relationship (physical network) and a logical connection relationship (logical network). Generally speaking, the physical connection relationship is a connection relationship that reflects a network switch as an element, and the logical connection relationship is a connection relationship that omits the network switch as an element.

[0014] The trust information input unit 120 inputs information regarding trust between a plurality of elements of the target system (hereinafter referred to as "trust information") into the trusted system 100. The trust information includes information on the direction of trust (trust direction) and information on the level of trust (trust level). The trust information is stored in the target system information storage unit 104. The trust information input unit 120 can be configured using, for example, an input device of a communication terminal such as a PC or a communication device that communicates with an external device. The trust information (trust direction, trust level) will be described in detail later with reference to FIG. 4.

[0015] The trust direction is the direction when looking at other elements connected to one element that makes up the target system, starting from this one element. For example, when looking from device A to device B, the trust direction is "the direction from device A to device B".

[0016] The trust level is information representing the degree of trust in the target as seen from a certain device or the target system. The trust level is determined using information about the element itself or the management state of the element. In this embodiment, the trust level is evaluated qualitatively or / and quantitatively.

[0017] Trust levels can be determined by comprehensively considering one or more evaluation items such as "authenticity," "reliability," and "protection." For example, one method for setting a trust level is to assign points to the evaluation content of each evaluation item and set the trust level based on the total points (quantitative evaluation). Alternatively, one could select the highest and / or lowest scores from each evaluation item and set the trust level based on those highest and / or lowest scores. Furthermore, these evaluation items and their scores could be output to a display device, and a person could verify the score of each evaluation item and set the trust level. This can be considered a type of qualitative evaluation.

[0018] Authenticity is a property that indicates whether an element is genuine as described or claimed, and whether its authenticity can be assured or proven. In the case of data output by an element, authenticity refers to a state in which the creator or sender (or the element outputting the data) is truthful and without error, and where the content has not been erased, altered, or replaced due to system malfunction or malicious actions by someone since its creation or transmission.

[0019] Mechanisms to ensure authenticity include, for example, verification of the creator and sender using digital signatures, detection of tampering using hash values ​​and message authentication, and prevention of theft and tampering through encryption. Authenticity can also be verified using the serial number of products used in industrial control systems, IP addresses, or MAC addresses of devices with communication capabilities.

[0020] Reliability refers to the ability to perform its expected role stably under certain conditions (the likelihood of events that hinder its performance, such as failures or unintended abnormal behavior, occurring, and the likelihood of failure or damage). Reliability can be said to be information that indicates the status of countermeasures against system vulnerabilities.

[0021] One method for evaluating reliability is to use standards established by international organizations such as ISO (International Organization for Standardization). For example, products made by manufacturers certified with the ISO 27000 series, which is a management system for information security, can be considered to have a certain level of reliability.

[0022] Protection refers to the level of protection against threats such as disruption (destruction) of system operation, information theft, or tampering, or the strength of the measures and countermeasures taken to protect against these threats. For example, computers, software, data, and communication channels are technically protected using encryption software, security software, access control mechanisms, etc., to eliminate risks such as leakage of confidential information, eavesdropping on communications, data tampering or deletion, and attacks or intrusions on computers. Furthermore, system protection includes physical measures (dustproof, fireproof, waterproof, etc.) and theft prevention.

[0023] There are mainly three patterns to consider when determining the level of trust. (A) Make judgments using a unified standard within a certain scope (Examples of scope: absolute scope of an organization (company, factory, branch office, manufacturing department, etc.), scope involving gateway 30 in Figure 3) (B) Determined by comparison with the starting element (relative judgment) (C) Determined by requirements from the starting element (absolute judgment)

[0024] In relative assessment, the trust level is determined by taking into account the status of the counterparty element from the perspective of the originating element. For example, if the counterparty element has more robust security measures than the originating element, the trust level will be higher, and vice versa.

[0025] In absolute judgment, each starting element has an absolute criterion for setting the trust level, and the trust level is set based on whether the absolute criterion is met, regardless of the status of the counterpart element. For example, if the security measures of the counterpart element meet a certain criterion, the trust level is set to "2," and if the criterion is not met, the trust level is set to "1."

[0026] The following shows information that can help determine the trust level, along with an example of a trust level. Here, the information that can help determine the trust level mainly concerns the elements that make up the system themselves or the state of management of those elements. The higher the number in parentheses, the higher the trust level. (1) No countermeasures (2) System resource management (≒ Understanding the internal configuration information of the system, which includes software-related information (firmware, etc.)) (3) Periodic inspection (manual or automated inspection) (4) Automatic security patch application (meaning that countermeasures are automatically implemented, and patches are applied if necessary as a result of the inspection)

[0027] Trust direction and trust level can be determined manually or automatically. For example, experienced system administrators or system managers can manually input information such as development / manufacturing process data. Furthermore, if the logic is established, it is possible to automatically determine the trust direction and trust level. For instance, a system could be conceivable that automatically collects information using the following methods, makes judgments, and inputs the judgment results. In this case, the collected information would be classified into the three categories mentioned above, and the trust direction and trust level would be determined by evaluating the information classified into each category. Examples of information to be collected include external information, photographic information, and internal information. Regarding the method of collecting information, well-known and commonly used techniques can be employed.

[0028] External information is information that the Trusted System 100 can obtain from outside via a network such as the Internet. For example, this includes information that can be obtained from the Cloud 301 (see Figure 3) or information that can be obtained through the LAN within the Industrial Control System 300 (see Figure 3). This information includes, for example, a spec sheet summarizing the performance, functions, specifications, and other details of the target, BOM information (Bill of Materials or Bill of Materials), and vulnerability information.

[0029] The captured information is derived from the external appearance of the equipment that makes up the system (such as network equipment and field equipment). This information includes not only images of the equipment's exterior captured by a camera, but also barcode readings. This information includes the equipment's serial number and external condition.

[0030] Internal information refers to information about the internal workings of devices that can be collected from the equipment that makes up the system. Examples of internal information from network devices and field equipment include the type and version of the operating system and security configuration information. Security configuration information can be obtained using the security software used by the system.

[0031] The threat event input unit 130 inputs information on threat events observed / reported for the target system to the trusted system 100. Threatening events against the target system can be detected using threat detection means such as firewalls, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), and security software applied to the target system. Alternatively, threat events against the target system can be detected by analyzing the behavior of each element within the target system and communication data using AI (Artificial Intelligence) as a threat detection means. Information on threat events detected by the threat detection means may be automatically input to the trusted system 100 by the threat event input unit 130, or it may be manually input through a management terminal or the like. The threat event input unit 130 is, for example, an input / output interface provided by a terminal device, or an input device (such as a keyboard) provided by a terminal device.

[0032] The trusted system 100 shown in Figure 1 comprises a base point determination unit 101, a verification element determination unit 102, a verification order determination unit 103, a target system information storage unit 104, and a threat information table 500.

[0033] The target system information storage unit 104 stores the target system information (system configuration, elements) input from the target system information input unit 110 and the trust information (trust direction, trust level) input from the trust information input unit 120. The target system information storage unit 104 also outputs the system configuration of the target system information to the base point determination unit 101. Furthermore, the target system information storage unit 104 outputs the system configuration and elements of the target system information, as well as the trust information, to the verification element determination unit 102.

[0034] The Threat Information Table 500 is a table (see Figure 5 below) that associates threat information with elements to be observed or elements suspected to be related to that threat information. The Threat Information Table 500 will be described in detail below with reference to Figure 5.

[0035] The base point determination unit 101 identifies elements related to the threat event within the target system based on the threat event information (also referred to as "threat information") input from the threat event input unit 130, the threat information table 500, and the target system information (system configuration) stored in the target system information storage unit 104. The identified elements are then determined as the base points for performing verification work to determine the scope of impact of the threat event. For example, if the threat event exploits a vulnerability in the OS implemented on a server, the server will be the base point because its abnormal behavior will affect the system. Depending on the threat event, there may be two or more base points. For example, if there are two elements in the target system that behave strangely, there will be two base points.

[0036] The verification element determination unit 102 uses the element determined as the base point (hereinafter referred to as the "base point element") as a base point and, based on the target system information (system configuration and elements) and trust information (trust direction, trust level) stored in the target system information storage unit 104, determines (selects) the elements for which verification work will be performed to identify the scope of influence. The verification element determination unit 102 extracts elements (hereinafter referred to as the "extracted elements") whose trust level, as seen from the base point element, is lower than a pre-set trust level. Next, the verification element determination unit 102 extracts elements whose trust level, as seen from the extracted elements, is lower than the set level and determines them as elements to be verified (hereinafter referred to as "verification elements"). Then, the verification element determination unit 102 outputs the determined one or more verification elements (group of verification elements) to the verification order determination unit 103.

[0037] The verification order determination unit 103 determines the order in which verification work will be performed (verification order) for one or more elements (group of verification elements) determined by the verification element determination unit 102. The verification order is the priority order for elements for which verification work will be performed to identify the scope of influence, and is determined, for example, based on the distance from the base element and the trust level. For elements with the same conditions, they may be arranged alphabetically as an example.

[0038] The verification element / sequence output unit 140 outputs the verification element and sequence information output from the verification sequence determination unit 103 to the outside. The verification element and sequence information is output to terminal devices 26-1 and 26-2 (Figure 2). In Figure 1, the verification element / sequence output unit 140 is located outside the trusted system 100, but the verification element / sequence output unit 140 may also be built into the trusted system 100.

[0039] [Trusted System Hardware Configuration] Next, the hardware configuration of the trusted system 100 will be explained with reference to Figure 2. Figure 2 shows an example of the hardware configuration of the trusted system 100. The trusted system 100 comprises an information processing unit 20 and a storage device 24. Here, an example is given in which the information processing unit 20 and the storage device 24 are installed separately, but the information processing unit 20 may also have a configuration in which the storage device 24 is built into it.

[0040] The information processing device 20 comprises a processing unit 21 connected to a bus, a memory 22, and an input / output interface (I / F) 23. The processing unit 21, memory 22, and input / output I / F 23 are hardware components used as a so-called computer.

[0041] The processing unit 21 executes a computer program stored in the memory 22 to realize each function according to this embodiment (base point determination unit 101, verification element determination unit 102, and verification order determination unit 103). While it is assumed that the processing unit 21 uses a CPU (Central Processing Unit), a processor such as an MPU (Micro-Processing Unit) may be used instead of a CPU.

[0042] Memory 22 is composed of ROM and RAM, for example. The RAM temporarily stores computer programs read from ROM by the processing unit 21, as well as variables and parameters generated during calculations performed by the processing unit 21.

[0043] Non-volatile storage is used for the storage device 24. Examples of non-volatile storage include HDDs (Hard Disk Drives), SSDs (Solid State Drives), NVRAM (Non-Volatile Random Access Memory), flexible disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, and non-volatile memory cards. In addition to the OS and various parameters, programs for operating the computer of the information processing device 20 are recorded in this storage device 24.

[0044] The functions of the target system information storage unit 104 and the threat information table 500 of the trusted system 100 (Figure 1) are realized by the storage device 24.

[0045] The input / output interface 23 is comprised of a device that controls the input and output of data between the information processing device 20 and other devices. In this embodiment, other devices include the storage device 24 and terminal devices 26-1 and 26-2. The target system information input unit 110, the trust information input unit 120, the verification element / sequence output unit 140, and the business information input unit 1210 shown in Figure 12 (described later) may also be configured using the input / output interface 23.

[0046] Terminal device 26-1 communicates with information processing device 20 using a closed network such as a dedicated line. Terminal device 26-1 is used in an on-premise system. Engineers, administrators, etc., operate input devices such as keyboards connected to terminal device 26-1 to input target system information and trust information, and this information is transmitted to the information processing device 20 of the trusted system 100.

[0047] Terminal device 26-2 communicates with information processing device 20 via network 25. Similar to terminal device 26-1, engineers, administrators, etc., operate input devices such as keyboards connected to terminal device 26-2 to input target system information and trust information, and this information is transmitted to the information processing device 20 of the trusted system 100.

[0048] Network 25 is, for example, a wireless network such as Wi-Fi®, or a wired LAN (Local Area Network) that provides multiple topologies such as Ethernet®.

[0049] The Internet 27 is an example of a public network. The information processing device 20 of the trusted system 100 communicates with the cloud 301 and communication devices in the external factory 302, as shown in Figure 3 below, via the Internet 27. The public network may also be a wireless communication infrastructure (wireless network) provided by a network operator.

[0050] The terminal devices 26-1 and 26-2 also include a processing unit 21 (processor), memory 22, input / output I / F 23, and storage device 24 (non-volatile storage), and the processing unit 21 executes a computer program stored in memory 22 to realize the function of a terminal device. The terminal devices 26-1 and 26-2 also include a display device (not shown) that displays information such as the status of the target system, and an input device (not shown) that generates an input signal according to the input content from the system administrator or the like.

[0051] [Example of target system] Next, an example of the target system in this embodiment will be described with reference to Figure 3. Figure 3 shows an example of an industrial control system as a target system. The industrial control system 300 shown in Figure 3 comprises a gateway 30, a control device 31, a server 32, a subsystem 33, a robot 34, and a PC 35.

[0052] Gateway 30 is a device that controls communication between the computer network within the organization (in this case, within the industrial control system 300) and communication devices outside the organization.

[0053] The control device 31 is a device that outputs control signals to the robot 34, which is part of the industrial control system 300, in order to control the operation of the robot 34.

[0054] Server 32 is a device that collects and aggregates data generated by the control device 31 and subsystem 33. Server 32 also communicates with PC 35.

[0055] Subsystem 33 is a subsystem built within the industrial control system 300 to collectively control and manage the robot 33a and the controller 33b.

[0056] Robot 34 is a robot that performs tasks based on control signals input from control device 31, and performs tasks such as picking and assembling parts and products.

[0057] PC35 is a terminal device that processes and monitors data collected by server 32. PC35 has the same hardware configuration as terminal devices 26-1 and 26-2 shown in Figure 2. Specifically, PC35 can be composed of a processing unit 21 (processor), memory 22, input / output interface 23, storage device 24 (non-volatile storage), display device, and input device.

[0058] This PC35 has the OS36 and a PC application (labeled "app" in the diagram)37 installed. PC35 is connected to the controller 33b of subsystem 33 and can issue commands to controller 33b. In order to enable PC35 to monitor and control subsystem 33 in real time, it is desirable that OS36 be an OS suitable for real-time processing.

[0059] Cloud 301 manages and processes information from the industrial control system 300, and performs processing to optimize the operating status of the target system (industrial control system 300, etc.) using, for example, AI. As an example, Cloud 301 can be configured with a monitoring server equipped with AI connected to the Internet 27.

[0060] External factory 302 is a factory that manufactures products different from those produced by industrial control system 300. External factory 302 has its own computer network.

[0061] The trusted system 100 is communicatively connected to the industrial control system 300 via the gateway 30 and the network. The trusted system 100 also performs processing to identify the scope of impact of threat events related to the elements constituting the industrial control system 300, based on observed / reported threat events, target system information, and trust information.

[0062] In the embodiment described above, the trusted system 100 communicates with the gateway 30 of the industrial control system 300 via the network 25 or the internet 27, but this is not the only example. The trusted system 100 may also be configured to communicate with the gateway 30 of the industrial control system 300 via the cloud 301.

[0063] [Trust direction and trust level] Next, we will explain the trust direction and trust level included in the trust information, referring to Figure 4. Figure 4 shows an example of trust direction and trust level. As shown in Figure 4, the trust information 400 has a From field 410, a To field 420, and a Level field 430.

[0064] The From field 410 stores information indicating the starting element in the trust direction. The To field 420 stores information indicating other elements (endpoint elements) that are connected to the starting element, relative to the starting element. The level field 430 stores information indicating the trust level between the elements identified by the information in the From field 410 and the To field 420 (in the trust direction).

[0065] In the example in Figure 4, the trust level is set to "0" for the direction from gateway 30 to cloud 301. Similarly, the trust level is "1" for the direction from gateway 30 to external factory 302. The trust level is "2" for the direction from gateway 30 to server 32. The trust level is "3" for the direction from control device 31 to robot 34. Even if the starting element is the same, the trust level will differ if the other element (ending element) changes.

[0066] [Threat Intelligence Table] Next, the threat intelligence table will be explained with reference to Figure 5. Figure 5 shows an example of threat information and observation / related elements included in the threat information table. As shown in Figure 5, the threat information table 500 has a threat information field 510 and an observation / related elements field 520. This threat information table 500 is created in advance by an engineer or administrator for each target system and stored in the storage device 24. Alternatively, the same information as the threat information table 500 may be stored in the storage device 24 in the form of a database instead of a table.

[0067] The threat information field 510 stores information indicating anticipated threat events (hereinafter referred to as "threat information"). The Observation / Relevance Element Field 520 stores information indicating elements that should be observed or elements suspected to be related to the above threat information.

[0068] For example, in the example in Figure 5, "server" is registered as an observed / related element for the threat information "operation outside of normal operations." Similarly, the observed / related element for the threat information "signs of suspicious login" is "gateway." Also, the observed / related element for the threat information "attack case exploiting vulnerabilities in a related industry" is "control device." In the case of a system that includes robots 34 and subsystems 33 as elements, such as the industrial control system 300, the related industry would be, for example, the industrial robot industry.

[0069] The base point determination unit 101 selects an element related to a threat event from among the elements constituting the target system and determines it as a base point, based on the relationship between threat events and elements as defined in the threat information table 500. That is, the base point determination unit 101 searches the threat information table 500 for observed and related elements based on the system configuration of the target system and the threat information (observed / detected threat events) input from the threat event input unit 130. Then, based on the searched observed and related elements and the system configuration, it determines an element to be used as a base point for the verification work to identify the scope of impact of the threat event (for example, the server 32 in Figure 8, which will be described later), and notifies the verification element determination unit 102 of that element as a base point element.

[0070] [Confirmation element determination process] Next, the verification element determination process by the verification element determination unit 102 according to this embodiment will be described with reference to Figure 6. Figure 6 is a flowchart showing an example of the procedure for determining the verification element by the verification element determination unit 102.

[0071] First, the verification element determination unit 102 sets an upper limit on the trust level to be targeted for verification work based on the threat information (S601). It is desirable that the upper limit of the trust level in this verification work be determined based on the severity of the threat information. For example, in the case of a threat that would make business continuity difficult, the upper limit of the trust level is raised and the verification work is performed.

[0072] Next, the verification element determination unit 102 extracts elements whose trust level, as viewed from the base point element determined by the base point determination unit 101 (for example, the server 32 in Figure 8), is lower than the set upper limit (S602). If the upper limit trust level is "3", the verification element determination unit 102 extracts elements with trust levels from "0" to "2". In the example in Figure 8, the control device 31, subsystem 33, and PC 35 are the elements that are extracted.

[0073] Next, the verification element determination unit 102 extracts elements whose trust level, as viewed from the extracted elements, is lower than the set upper limit (S603). In this way, the verification element determination unit 102 uses the elements that satisfy the trust level conditions extracted from the elements as a starting point to extract elements that satisfy the trust level conditions. In other words, the verification element determination unit 102 uses the elements extracted in step S602 as the starting point in the trust direction to extract elements with trust levels lower than the upper limit. Then, the verification element determination unit 102 checks whether it is possible to extract elements that satisfy the above conditions, using all the elements extracted in step S602 as a starting point.

[0074] Next, the verification element determination unit 102 determines whether it has confirmed whether elements satisfying the above conditions can be extracted based on all elements extracted in steps S602 and 603 (S604). If it has not confirmed whether elements satisfying the above conditions can be extracted based on all extracted elements (NO determination in S604), the verification element determination unit 102 returns to step S603 to confirm whether elements satisfying the above conditions can be extracted. That is, the verification element determination unit 102 continues the element extraction process in step S603 that satisfies the above conditions until there are no more elements with a trust level lower than the upper limit.

[0075] In step S604, if it is confirmed whether an element satisfying the above conditions can be extracted based on all the extracted elements (YES determination in S604), the confirmation element determination unit 102 generates data with the elements extracted in steps S602 and S603 as confirmation elements and stores it in memory 22 (S605). After the processing in step S605 is completed, the confirmation element determination process is terminated.

[0076] [Confirmation Order Determination Process] Next, the confirmation order determination process by the confirmation order determination unit 103 according to this embodiment will be described with reference to Figure 7. Figure 7 is a flowchart showing an example of the procedure for determining the order of confirmation by the confirmation order determination unit 103.

[0077] First, the verification sequence determination unit 103 reads the verification element data generated by the verification element determination unit 102 in step S605 of Figure 6 (S701).

[0078] Next, the verification order determination unit 103 rearranges the verification elements based on the distance from the base element to the verification element and the trust level (S702). One example of the rearrangement rule is to first place verification elements with lower trust levels higher, and secondly, to place verification elements that are closer in distance higher.

[0079] Distance is the number of links (communication channels) between one element and another element. When one element and another element are directly connected by a communication channel without the intervention of a third element, the number of links is the smallest unit, "1". In the example in Figure 8, the number of links between server 32 and control device 1 is "1", and the number of links between server 32 and robot 34 is "2". Therefore, the distance from server 32 to control device 31 is shorter than the distance from server 32 to robot 34.

[0080] Next, the confirmation order determination unit 103 generates data containing information about the confirmation elements and their order and stores it in the memory 22 (S703). After the processing in step S703 is completed, the confirmation order determination process is terminated.

[0081] The verification order determination unit 103 then sends data containing information on the verification elements and their order to the verification element / order output unit 140. The verification element / order output unit 140 outputs the data containing information on the verification elements and their order to terminal devices 26-1, 26-2, etc. By verifying the verification elements displayed on terminal devices 26-1, 26-2, etc., in the specified order, administrators can quickly consider or implement responses and countermeasures to observed / reported threat events, thereby enabling the secure operation of the target system.

[0082] Thus, in this embodiment, the verification order determination unit 103 is configured to determine the order in which verification work on verification elements is performed based on the distance on the communication path from the base element to the verification element and the level of confidence.

[0083] [Order of verification steps] Next, we will explain the sequence of steps for identifying the elements (scope of impact) that affect a threat event, referring to Figure 8. Figure 8 shows an example of the sequence of verification steps to identify the elements (scope of impact) affecting a threat event in the industrial control system 300. In this example, the base element is the server 32, and elements with a trust level of less than 3, shown by the solid line, are included in the verification process, while elements with a trust level of 3 or higher, shown by the dashed line, are excluded from the verification process.

[0084] In Figure 8, the order in which verification tasks are performed is determined for elements (control device 31, subsystem 33, PC 35) that are one link away from the base element (server 32), in order from lowest to highest trust level (trust levels 0, 1, 2). That is, the administrator performs verification tasks (1) to (3) regarding responses / countermeasures to threat events in the order of subsystem 33, control device 31, and PC 35. Finally, the administrator performs verification task (4) for the element (PC application 37) that is two links away from the base element (server 32).

[0085] Here, subsystem 33, control device 31, and PC 35 correspond to the elements extracted in step S602 of Figure 6. Also, PC application 37 corresponds to the elements extracted in step S603.

[0086] As described above, the trusted system 100 (information processing device 20, storage device 24) according to the first embodiment comprises at least a verification element determination unit (verification element determination unit 102) and a verification order determination unit (verification order determination unit 103). The verification element determination unit selects elements from among the elements constituting the target system that are related to a threat event (for example, a server 32), and uses the level of trust (trust level) between each element and the direction of trust (trust direction) indicating the direction from one element to the other between each element to determine which elements satisfy the pre-set trust level conditions, and selects them as verification elements to perform verification work to identify the scope of impact of the threat event. The verification order determination unit determines the order in which the verification work will be performed for the above verification elements, based at least on the level of trust and the direction of trust between each element.

[0087] According to the first embodiment described above, by setting trust directions and trust levels between elements, it becomes possible to identify the scope of impact of a threat event for each element individually. Therefore, in this embodiment, the scope of impact of a threat event (the elements to be checked) can be efficiently narrowed down, making it possible to respond to / counter threat events quickly.

[0088] Conventionally, the scope of impact of a threat event was identified in a broader area (network range) using simple information such as logical networks. As a result, all connected areas were included in the scope of the verification work, and it took time to identify the scope of impact of a threat event. In contrast, this embodiment allows for the identification of the scope of impact of a threat event more quickly.

[0089] <Second Embodiment> The second embodiment is an example in which, in the trusted system 100 (information processing device 20) according to the first embodiment, attributes of evaluation items are assigned to the trust information, and the priority of the verification work when identifying the scope of impact is changed by associating the attributes with threat events.

[0090] [Trusted System Configuration] Figure 9 is a block diagram showing an example of the functional configuration of the trusted system according to the second embodiment. The trusted system 100A of this embodiment differs from the trusted system 100 of the first embodiment (Figure 1) in that it includes a trust information update unit 901. The second embodiment will be described below, focusing on the differences from the first embodiment.

[0091] The trust information update unit 901 is positioned between the target system information storage unit 104 and the base point determination unit 101 and the verification element determination unit 102. Based on the threat information input from the threat event input unit 130, the trust information stored in the target system information storage unit 104, to which the attributes of evaluation items have been assigned, is updated by the trust information update unit 901.

[0092] The trust information update unit 901 then outputs the system configuration of the target system information stored in the target system information storage unit 104, along with the updated trust information, to the base point determination unit 101. The trust information update unit 901 also outputs the system configuration and elements of the target system information stored in the target system information storage unit 104, along with the updated trust information, to the verification element determination unit 102. The base point determination unit 101 may directly obtain the system configuration from the target system information storage unit 104. Similarly, the verification element determination unit 102 may directly obtain the system configuration and elements from the target system information storage unit 104.

[0093] [Trust direction, trust level, attributes] Next, the trust direction, trust level, and attributes included in the trust information will be explained with reference to Figures 10 and 11. Figure 10 shows examples of trust direction, trust level, and attributes. As shown in Figure 10, the trust information 1000 has a From field 410, a To field 420, and a Level field 1010.

[0094] Level field 1010 contains attributes (one of the following items: authenticity, reliability, or protection) that evaluate the trust between elements (trust direction). The trust level values ​​are the same as the values ​​shown in level field 430 in Figure 4.

[0095] Figure 11 shows an example of when the observed / reported threat information in Trust Information 1000 in Figure 10 is related to trustworthiness. In Figure 11, Trust Information 1100 is shown, in which the trust levels for each element of Trust Information 1000 have been updated according to the attributes.

[0096] For example, if threat information for the target system is related to reliability, the trust level value between elements with the reliability attribute is increased. In trust information 1100, the trust level value between elements with the reliability attribute, indicated by hatching, is increased by "1". Elements connected to elements without the reliability attribute have weak reliability, so those elements connected to elements with low trust levels are checked first.

[0097] As described above, in the trusted system 100A according to the second embodiment, one or more evaluation items (for example, reliability in Figure 11) are assigned to the trust information (level of trust and direction of trust), and the system includes an update unit (trust information update unit 901) that updates the level of trust based on the relationship between the threat event and the evaluation items assigned to the level of trust and direction of trust.

[0098] According to the second embodiment described above, based on the attributes assigned to the trust information, verification work can be prioritized for elements that require a more rapid response / countermeasure against observed / reported threat information.

[0099] <Third Embodiment> The third embodiment is an example in which the trusted system 100 (information processing device 20) according to the first embodiment determines the priority of verification work based on business information, taking into account the degree of business impact. The greater the business impact, the greater the severity when a threat event causes a failure in the target system. In other words, the third embodiment can also be said to be an example in which the priority of verification work is determined in advance based on the severity of the failure.

[0100] [Trusted System Configuration] Figure 12 is a block diagram showing an example of the functional configuration of a trusted system according to the third embodiment. The trusted system 100B of this embodiment differs from the trusted system 100 of the first embodiment (Figure 1) in that business information is input from the business information input unit 1210. The third embodiment will be described below, focusing on the differences from the first embodiment.

[0101] The business information input unit 1210 inputs business-related information (hereinafter referred to as "business information"), such as business operations and business continuity plans, into the verification element determination unit 1201 and the verification sequence determination unit 1202 of the trusted system 100B. A business continuity plan is a plan that outlines, for example, how to protect the business and how to cooperate with external parties (factories, etc.) in the event of a disaster such as an earthquake.

[0102] The verification element determination unit 1201 uses the base element as a starting point and, based on the target system information (system configuration and elements), trust information (trust direction, trust level), and business information, determines (selects) the elements for which verification work will be performed to identify the scope of impact.

[0103] The verification order determination unit 1202 takes into account the business information and determines the order in which the verification work will be performed on one or more elements (group of verification elements) determined by the verification element determination unit 102 (verification order).

[0104] [Business Information] Next, we will explain the business information table with reference to Figure 13. Figure 13 shows an example of business content and important elements included in the business information table. As shown in Figure 13, the business information table 1300 has a business content field 1310 and an important elements field 1320. This business information table 1300 may be created in advance by an administrator or the like using the target system for each anticipated business and stored in the storage device 24, or it may be manually entered by an administrator or the like when inputting into the trusted system 100B. Alternatively, the same information as the business information table 1300 may be stored in the storage device 24 in the form of a database instead of a table.

[0105] The Business Content field 1310 stores information (hereinafter referred to as "Business Content") that indicates the content of business operations and business continuity plans performed by the target system and elements connected to that target system. The critical element field 1320 stores information indicating the elements that are important or necessary for carrying out the above-mentioned operations and business continuity plans.

[0106] For example, in the example shown in Figure 13, the important elements registered for the task "production activities using robot 34" are "robot 34 and control device 31". Similarly, the important elements for the task "stable operation of subsystem 33" are "server 32 and subsystem 33". Furthermore, the important elements for the task "information sharing with external factory 302" are "gateway 30 and external factory 302".

[0107] Note that the information in the business content field 1310 and the information in the important element field 1320, and their combinations, are examples only and are not limited to these examples. For example, the administrator inputs a combination of business content and one important element as business information from the business information input unit 1210 to the trusted system 100B (input / output I / F 23 in Figure 2).

[0108] [Confirmation element determination process] Next, the verification element determination process by the verification element determination unit 1201 according to this embodiment will be described with reference to Figure 14. Figure 14 is a flowchart showing an example of the procedure for determining the verification element by the verification element determination unit 1201. In Figure 14, steps S1401 and S1402 are included instead of step S602 in Figure 6. Below, Figure 14 will be explained, focusing on the differences from Figure 6.

[0109] After processing in step S601, the verification element determination unit 1201 extracts elements that correspond to important elements related to the business content from the system configuration of the target system, regardless of the upper limit of the trust level (S1401).

[0110] Next, the verification element determination unit 1201 extracts elements from the important elements extracted in step S1401 whose trust level, as viewed from the base element, is lower than the set upper limit (S1402). After that, it executes the processes in steps S603 to S605, and after the process in step S605 is completed, it terminates the verification element determination process.

[0111] [Confirmation Order Determination Process] Next, the confirmation order determination process by the confirmation order determination unit 1202 according to this embodiment will be described with reference to Figure 15. Figure 15 is a flowchart showing an example of the procedure for determining the order of verification by the verification order determination unit 1202. In Figure 15, step S1501 is added immediately after step S701 in Figure 7. Below, Figure 15 will be explained, focusing on the differences from Figure 7.

[0112] First, the verification sequence determination unit 1202 reads the verification element data generated by the verification element determination unit 1201 in step S605 of Figure 14 (S701).

[0113] Next, the confirmation order determination unit 1202 determines the order of the confirmation work, prioritizing elements that are important elements related to the business content (S1501). After that, it executes the processes in steps S702 to S703, and after the process in step S703 is completed, it terminates the confirmation order determination process.

[0114] [Order of verification steps] Next, we will explain the sequence of steps for identifying the elements (scope of impact) that affect a threat event, referring to Figure 16. Figure 16 shows an example of the sequence of verification steps to identify elements (camera range) that affect a threat event in the industrial control system 300. In this example, the base element is server 32, the elements with a trust level of less than 3 are the targets of the verification step, and the business information is "production activities using robot 34".

[0115] In Figure 16, the administrator performs verification (1) regarding responses / countermeasures for threat events, etc., starting with the control device 31 connected to the robot 34, which is one link away from the base element (server 32). Next, the administrator performs verification (2) of the robot 34 connected to the control device 31. Then, among the remaining elements (subsystem 33, PC 35) that are one link away from the server 32, verification (3) to (4) are performed in order of lowest trust level (level 0, 2), i.e., subsystem 33, then PC 35. Finally, verification (5) is performed on the element (PC application 37) that is two links away from the base element (server 32).

[0116] As described above, in the trusted system 100B according to the third embodiment, the verification element determination unit (verification element determination unit 1201) further determines elements related to the specified business content (important elements) as verification elements, regardless of the reliability level conditions, and the verification order determination unit (verification order determination unit 1202) determines the elements related to the above business content among all verification elements in the highest priority order.

[0117] According to the third embodiment described above, the importance of each element is set based on the business operations and business continuity plans (business content), and the elements to be verified and the order of verification are determined using this importance level and trust information. As a result, in this embodiment, it becomes possible to take measures to protect the specified business content more directly.

[0118] It should be noted that the present invention is not limited to the embodiments described above, and various other applications and modifications are possible as long as they do not depart from the gist of the invention as described in the claims. For example, the embodiments described above are detailed and specific in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those comprising all the components described. Furthermore, it is possible to replace parts of the configuration of one embodiment with components of another embodiment. It is also possible to add components of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, replace, or delete other components for parts of the configuration of each embodiment.

[0119] For example, the functions of the trusted systems 100, 100A, and 100B in the above-described embodiment may be incorporated into a major element of the target system (e.g., server 32). Alternatively, one or more elements or each element of the target system may possess the functions of the trusted systems 100, 100A, and 100B.

[0120] Furthermore, some or all of the above configurations, functions, and processing units may be implemented in hardware, for example, by designing them as integrated circuits. Broadly defined processor devices such as FPGAs (Field Programmable Gate Arrays) and ASICs (Application Specific Integrated Circuits) may be used as hardware. [Explanation of Symbols]

[0121] 20…Information processing unit, 21…Processing unit, 22…Memory, 23…Input / output interface, 24…Storage device, 100,100A,100B…Trusted system, 101…Base point determination unit, 102…Confirmation element determination unit, 103…Confirmation sequence determination unit, 104…Target system information storage unit, 110…Target system information input unit, 120…Trust information input unit, 130…Threat event input unit, 140…Confirmation element / sequence output unit, 300…Industrial control system, 400…Trust information, 500…Threat information table, 901…Trust information update unit, 1201…Confirmation element determination unit, 1202…Confirmation sequence determination unit, 1210…Business information input unit

Claims

1. A verification element determination unit selects elements from among the elements constituting the target system that are related to a threat event, using the level of trust from one element to another and the direction of trust indicating the direction from one element to the other, to extract elements that satisfy the pre-set conditions for the level of trust, and designates them as verification elements to be used for verification work to identify the scope of impact of the threat event. The system includes a verification sequence determination unit that determines the order in which the verification work is performed based on at least the level of trust between each element and the direction of trust for the verification elements. Information processing device.

2. The verification sequence determination unit determines the order in which to perform the verification work on the verification elements based on the distance along the communication path from the base point element to the verification element and the level of confidence. The information processing apparatus according to claim 1.

3. The verification element determination unit extracts elements that satisfy the confidence level conditions, starting from the elements that satisfy the confidence level conditions extracted from the elements. The information processing apparatus according to claim 2.

4. The system includes a base point determination unit that, based on the relationship between the threat event and the element, selects an element related to the threat event from among the elements constituting the target system and determines it as a base point. The information processing apparatus according to claim 1.

5. One or more evaluation item attributes are assigned to the aforementioned level of confidence and direction of confidence. The system includes an update unit that updates the level of confidence based on the relationship between the threat event and the level of confidence and the evaluation items assigned to the direction of confidence. The information processing apparatus according to claim 1.

6. The aforementioned verification element determination unit further determines the elements related to the specified business content as verification elements, regardless of the conditions for the level of reliability. The verification order determination unit determines, in order of highest priority, the elements related to the business content among all the verification elements. The information processing apparatus according to claim 1.

7. An information processing method using an information processing device, A process in which, starting from elements related to a threat event among the elements constituting the target system, and using the level of trust from one element to another and the direction of trust indicating the direction from one element to the other among the elements, elements that satisfy the pre-set conditions for the level of trust are extracted from the elements and designated as elements for verification work to identify the scope of impact of the threat event, and these are determined to be verification elements. The process includes determining the order in which to perform the verification work based on at least the level of confidence between each element and the direction of that confidence, with respect to the verification elements. Information processing methods.

Images