Device management apparatus and device management system

Abstract

In a device management apparatus connected to a plurality of IoT devices via a network, logs involved in actions of the plurality of IoT devices are collected, an action that is set in advance as a suspicious action is detected based on the logs, in a case where the suspicious action is detected in the IoT device, it is determined whether the detected suspicious action is an action caused by a security countermeasure for the IoT device, in a case where it is determined that the suspicious action is an action caused by the security countermeasure, an alarm is not output to a manager of the IoT device in which the suspicious action is detected, in a case where it is determined that the suspicious action is not an action caused by the security countermeasure, an alarm is output to the manager of the IoT device. Thus, it is possible to implement a security operation job while suppressing false detection of a cyber attack on the IoT device.

Description

Technical Field

[0001] This invention relates to an equipment management device and an equipment management system. Background Technology

[0002] Previously, the so-called "Internet of Things" (IoT), which enables devices and things not connected to the internet to communicate and operate via networks, is rapidly becoming widespread. On the other hand, with the increasing prevalence of IoT, concerns about the potential damage caused by cyberattacks on IoT devices via the network are growing, making it crucial to build more secure security measures.

[0003] As prior art related to computer security countermeasures, for example, the technology described in Patent Document 1 is known. Patent Document 1 discloses an intrusion detection device for detecting unauthorized intrusion into a monitored program by a computer. The intrusion detection device includes: a storage unit that stores system calls and path information up to the system call when there is no unauthorized intrusion into the monitored program; an acquisition unit that acquires information representing the system call and path information up to the system call when the monitored program requests a system call through execution; a determination unit that determines whether the information representing the requested system call and the path information up to the system call are consistent with the stored system calls and path information corresponding to the system call; and an execution unit that executes the requested system call when the determination unit determines that they are consistent.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2006-106939 Summary of the Invention

[0007] The technical problem that the invention aims to solve

[0008] In IoT devices used for long-term business operations, security maintenance requires remote monitoring, security measures, and regular diagnostics. On the other hand, these security operations often involve simulating attacks or modifying settings on IoT devices, but these are difficult to distinguish from cyberattacks. Therefore, actions of IoT devices used for security operations can be falsely detected as cyberattacks, increasing the workload for administrators of IoT devices receiving cyberattack detection notifications.

[0009] The present invention was made in view of the above circumstances, and its object is to provide a device management apparatus and a device management system that can suppress false detections of network attacks on IoT devices while performing secure operation.

[0010] Technical solutions to solve technical problems

[0011] This application includes multiple solutions to the aforementioned technical problems. For example, it includes a device management apparatus that connects to and manages multiple IoT devices via a network. The device management apparatus includes: a log management unit that collects logs related to the actions of the multiple IoT devices via the network; a detection unit that detects, for each of the multiple IoT devices, actions pre-set as suspicious actions based on the logs; a determination unit that, when a suspicious action is detected in at least one of the multiple IoT devices, determines whether the detected suspicious action is caused by security measures for the IoT devices; and an alarm control unit that, if it is determined that the suspicious action is caused by the security measures, controls the device to not output an alarm to the user or manager of the IoT device that detected the suspicious action, and controls the device to output an alarm to the user or manager of the IoT device if it is determined that the suspicious action is not caused by the security measures.

[0012] Invention Effects

[0013] According to the present invention, secure operation can be carried out while suppressing false detections of network attacks on IoT devices. Attached Figure Description

[0014] Figure 1 This is a diagram schematically illustrating the overall structure of the equipment management system involved in Embodiment 1.

[0015] Figure 2 This diagram illustrates an example of the operation of the device management system. It shows the attack detection action and related actions extracted from the attack detection unit of the device management device.

[0016] Figure 3 This is a diagram illustrating a transfer example of a registration operation screen displayed by a management application that assists in the registration and management of security countermeasures permission information.

[0017] Figure 4 This is a diagram showing an example of a list of security measures that have registered security measure permission information.

[0018] Figure 5 This is a diagram illustrating the anomaly detection sequence for IoT devices.

[0019] Figure 6 This is a diagram illustrating an example of logs sent from an IoT device to a device management unit.

[0020] Figure 7 This is a diagram showing an example of the alarm screen displayed on the PC300 of a maintenance personnel who received an abnormal alarm.

[0021] Figure 8 This is a diagram showing an example of the alarm screen displayed on the PC300 of a maintenance personnel who received an abnormal alarm.

[0022] Figure 9 This is a diagram showing an example of the alarm screen displayed on the PC300 of a maintenance personnel who received an abnormal alarm.

[0023] Figure 10 This is a diagram showing an example of the alarm screen displayed on the PC300 of a maintenance personnel who received an abnormal alarm.

[0024] Figure 11 This is a diagram schematically illustrating the overall structure of the equipment management system involved in Embodiment 2. Detailed Implementation

[0025] The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0026] <Implementation Method 1>

[0027] Reference Figures 1-10 The following describes Embodiment 1 of the present invention.

[0028] Figure 1 This is a diagram schematically illustrating the overall structure of the equipment management system involved in this embodiment.

[0029] exist Figure 1 In this context, the device management system is used to manage multiple IoT devices connected via a network. Its schematic configuration includes: multiple IoT devices as management objects (IoT device 200 is shown here); a device management device 100 connected to the multiple IoT devices via a device management network 1; and an information terminal used by the user or manager of the IoT device 200, namely a maintenance personnel PC 300 connected to the device management device 100 via an information network 2.

[0030] The IoT device 200 includes: a communication unit 230 that connects the IoT device 200 to a device management network 1; a log management unit 220 that collects logs related to the actions of the IoT device 200; and a control unit 210 that controls the actions of the IoT device 200 and sends the action-related logs collected by the log management unit 220 from the communication unit 230 to the device management device 100 via the device management network 1.

[0031] IoT device 200 refers to devices and objects that operate in the so-called "Internet of Things" (IoT) by connecting to networks such as the Internet through communication functions. Examples include medical devices such as inspection / analysis devices, control / information devices mounted in automobiles, and field devices that constitute control systems in factories, etc.

[0032] In addition, in this embodiment, IoT device 200 is shown as representing multiple IoT devices (referred to as IoT device group as needed) that are managed. However, other IoT devices also have the same structure as IoT device 200 and are each connected to device management device 100 via device management network 1. They are managed by sending and receiving logs related to actions or execution permissions for security measures (described later) with device management device 100.

[0033] The maintenance personnel PC 300 is an information terminal used by the user or manager of the IoT device 200, including: a communication unit 320, which connects the maintenance personnel PC 300 to the information network 2; and an alarm notification unit 310, which notifies the user or manager of alarms and other information received from the device management device 100 via the information network 2.

[0034] The alarm notification unit 310 includes a display device such as a monitor, which displays various information related to the maintenance of the IoT device 200, in addition to alarm information.

[0035] The device management device 100 manages multiple IoT devices (IoT devices 200) connected via the device management network 1, including: a communication unit 110, which connects the device management device 100 to the device management network 1 and the information network 2; an authentication unit 120, which determines whether a user of the IoT device 200 is a legitimate user based on user authentication information registered in the user authentication table 121, and grants permission to use the device after confirming that the user is a legitimate user, i.e., performs so-called user authentication; a log management unit 130, which collects logs related to the actions of the IoT devices 200 via the device management network 1 and records them in the log collection management table 131; a device management unit 140, which retrieves the identification information of the IoT devices that are the management objects of the device management device 100 from the device management table 141; and an attack detection unit 150, which performs pre-set actions based on log detection as suspicious actions for each of the multiple IoT devices 200.

[0036] The attack detection unit 150 is a functional unit that performs attack detection. It detects suspicious actions of the IoT device 200 as attacks, etc. The attack detection unit 150 has a countermeasure permission information registration unit 151, a countermeasure permission determination unit 152, a security countermeasure permission list 153, and an alarm output control unit 154.

[0037] Based on the operation of the device management system administrator, the countermeasure license information registration unit 151 registers and manages the identification information of IoT devices 200 that will become targets of attack detection implementation in the security countermeasure license list 153, and registers and manages the security countermeasure license information, including the identification information of IoT devices 200 that will become targets of security countermeasure implementation and the content of the security countermeasure, in the security countermeasure license list 153.

[0038] When the countermeasure approval determination unit 152 detects a suspicious action in at least one of the plurality of IoT devices 200, it determines whether the detected suspicious action is caused by a security measure against the IoT device 200 based on security measure approval information pre-registered in the security measure approval list 153. If the detected suspicious action matches the information registered in the security measure approval list 153, it outputs an implementation permission for the security measure to the IoT device 200. Conversely, if the detected suspicious action does not match the information registered in the security measure approval list 153, it outputs a stop command for the security measure to the IoT device 200.

[0039] If the countermeasure permission determination unit 152 determines that the suspicious action is caused by security countermeasures, the alarm output control unit 154 controls the output to not output an alarm to the user or manager (maintenance personnel PC300) of the IoT device 200 that detected the suspicious action. If the countermeasure permission determination unit 152 determines that the suspicious action is not caused by security countermeasures, the alarm output control unit 154 generates an alarm and outputs it to the user or manager (maintenance personnel PC300) of the IoT device 200.

[0040] Furthermore, the network that serves as device management network 1 or information network 2 can include, but is not limited to, the Internet. Device management network 1 can be any network capable of sending permissions for logging of IoT devices or executing security measures. Information network 2 can be any network capable of outputting / sending alarms when suspicious actions (abnormal actions) of IoT devices are detected; for example, it could be an intra-facility network used to manage devices within the facility. Moreover, device management network 1 and information network 2 do not need to be different networks; they can be configured to connect device management device 100, IoT device 200, and maintenance personnel PC 300 to the same network.

[0041] Figure 2 This diagram illustrates an example of the operation of the device management system. It shows the attack detection action and related actions extracted from the attack detection unit of the device management device.

[0042] exist Figure 2In this system, the administrator of the device management system manages the overall status of the registered IoT device group or registers / manages security countermeasures permit information according to the requirements of the device maintenance personnel. The IoT device maintenance personnel are those who perform security maintenance on the IoT device 200, and are distinct from the users and administrators of the IoT device 200. An attacker against the IoT device 200 is someone who attacks the IoT device 200 (performs actions not listed in the security countermeasures permit list).

[0043] During the operation of the equipment management system, during the process of the manager of the equipment management system registering / managing the entire group of IoT devices, including IoT device 200 (process (1)), the maintenance personnel of the IoT devices who are responsible for the security maintenance of the IoT devices (different from users and managers) apply to the manager of the equipment management system for registration of security countermeasures permission information before implementing security countermeasures, as a preparation for implementing security countermeasures on IoT device 200 (process (2-1)).

[0044] Based on the application from the maintenance personnel of the IoT devices, the device management system administrator registers the security countermeasures license information into the security countermeasures license list 153 via the countermeasures license information registration department 151 of the attack detection department 150 (procedure (2-2)). Alternatively, the application for registration of security countermeasures license information can be submitted by the IoT device maintenance personnel to the crisis management system administrator via email or application form through the maintenance personnel PC 300, or it can be submitted offline. Furthermore, the IoT device maintenance personnel can also directly register the security countermeasures license information, but registration by third parties other than the device management system administrator and the IoT device maintenance personnel is prohibited.

[0045] Figure 3 This is a diagram illustrating a transfer example of a registration operation screen displayed by a management application that assists in the registration and management of security countermeasures permission information.

[0046] like Figure 3 As shown, the registration operation screen displayed by the management application consists of various screens for registering and managing security countermeasures permission information, such as the top screen S2001, the new registration screen S2002, the overview screen S2003, the change screen S2004, the confirmation screen S2005, and the result screen S2006.

[0047] The top screen S2001 is the initial screen displayed as the registration operation screen, and it is the first screen displayed when the management application is launched. In the top screen S2001, when a new IoT device 200 is registered as a security measure object, the new registration screen S2002 is displayed by selecting the "New Registration" button. When a list of information of IoT devices 200 that have been registered as security measures objects is displayed, the list display screen S2003 is displayed by selecting the "List Display" button.

[0048] The new registration screen S2002 is used for registering the IoT device 200, which is the target of security measures. The new registration screen S2002 includes input fields for various items such as product name, manufacturer number, customer name, validity period, and license content, providing information about the newly registered IoT device 2000. When registering the IoT device 200, entering the required information and selecting the "Register" button displays the confirmation screen S2005. If the new registration is cancelled and the user returns to the top screen S2001, selecting the "Return to Top" button displays the top screen S2001.

[0049] The overview display screen S2003 displays information about the IoT devices 200 that have been registered as targets of security measures. The overview display screen S2003 shows information for each registered IoT device 200, including license ID, product name, manufacturing number, customer name, and other items. In the overview display screen S2003, when the information of an IoT device 200 is changed, the change screen S2004 is displayed by selecting the "Change" button while the information to be changed is selected (e.g., a checkbox is selected). When the information of an IoT device 200 is deleted (excluded from the list of targets of security measures), the confirmation screen S2005 is displayed by selecting the "Delete" button while the information to be deleted is selected (e.g., a checkbox is selected). Furthermore, in the overview display screen S2003, when registering a new IoT device 200 that is a target of security measures, the new registration screen S2002 is displayed by selecting the "new registration" button, and when returning to the top screen S2001, the top screen S2001 is displayed by selecting the "return to top" button.

[0050] The Change Screen S2004 is used to change the information of an IoT device 200 that has been registered as a target of security measures. It includes input fields for items such as product name, manufacturer number, customer name, validity period, and license content, to display the information of the IoT device 200 being changed. Additionally, the input fields can display the registered information of the IoT device 200 being changed, and this information can be modified. In Change Screen S2004, when making information changes, entering the items and selecting the "Change" button displays the Confirmation Screen S2005. If the information change is cancelled and the user returns to the Overview Screen S2003, selecting either the "Overview" button or the "Back to Top" button displays the Overview Screen S2003.

[0051] Confirmation screen S2005 is used to confirm whether a new registration / change can be made based on the content entered / changed in the new registration screen S2002 or the change screen S2004, or whether information selected for deletion in the overview display screen S2003 can be deleted. In confirmation screen S2005, when performing a new registration, change, or deletion, the "Confirm" button is selected to execute the new registration, change, or deletion, and result screen S2006 is displayed. Furthermore, when canceling a new registration, change, or deletion and returning to the previous screen, the "Return" button is selected to display the previously displayed screen (new registration screen S2002, overview display screen S2003, or change screen S2004).

[0052] The result screen S2006 displays the following: The registration, modification, or deletion of information of the IoT device 200 as a security countermeasure has been completed. On the result screen S2006, the top screen S2001 is displayed by selecting the "Return to Top" button.

[0053] Figure 4 This is a diagram showing an example of a list of security measures that have registered security measure permission information.

[0054] like Figure 4As shown, the security countermeasure license list, used to identify each IoT device 200 as the target of security countermeasure implementation and the content of the implemented security countermeasures (actions caused by the implementation of security countermeasures), consists of the following items: License ID F3001, Product Name F3002, Manufacturing Number F3003, Customer Name F3004, IP Address F3005, OSF 3006, Validity Period F3007, License Content F3008, and Last Update Date and Time F3009. For example, for the IoT device 200 registered with License ID F3001 as "aaaa", the product name F3002 of the target device is identified as "Device A", and the manufacturing number F3003 is "PR12345". In addition, the customer name F3004 of the owner (customer) of IoT device 200 is determined to be "X Hospital", the IP address F3005 is "10.3.1.10", and the OS (object software) F3006 is "OS1". The validity period of the information with license IDF3001 as "aaaa" is F3007, that is, the period during which the implementation of security countermeasures for the IoT device 200 is licensed is "2023 / 7 / 1 0:00-2023 / 7 / 14 23:59". The content of the operation or action permitted to be implemented as the security countermeasure, i.e., the licensed content F3008, is "Network; eth1; 10.2.2.10; portScan", "Network; eth1; 10.2.2.10; filesize>1G", and "Network; eth1; 10.2.2.10; DoS". In addition, the last update date and time of this information, F3009, is "2023 / 6 / 23 11:30".

[0055] By pre-registering the objects or implementation content of security countermeasures as security countermeasure license information in a security countermeasure license list as described above, and using this security countermeasure license information, it becomes possible to distinguish between security countermeasures and cyberattacks for operations (IoT device actions) targeting IoT devices that are difficult to determine from logs alone. Furthermore, by setting the validity period of the security countermeasure information during registration, preventing the execution of security countermeasures during other periods, actions caused by cyberattacks (e.g., unauthorized operations by attackers on IoT devices) can be identified / prevented as suspicious actions, further enhancing security. For example, in operations requiring two-step verification, such as security setting changes like disabling antivirus software, even if an attacker bypasses the two-step verification, the execution of unauthorized operations (including unauthorized security countermeasures) can be prevented. Moreover, as a response to future monitoring and inspection, a license ID and a timestamp of the creation / update date and time are assigned so that previously registered security countermeasure license information can be verified as historical data.

[0056] return Figure 2 The device management device 100 collects logs (step (3-2)) from the IoT device 200 regarding operations (step (3-1)) performed by maintenance personnel on the IoT device 200 or operations (step (3-1')) related to the implementation of security countermeasures. The countermeasures approval unit 152 then compares these logs with the security countermeasures approval information list. Similarly, for example, in the event of an unauthorized operation (cyberattack) by an attacker targeting the IoT device, the device management device 100 collects logs (step (3-2'')) from the IoT device 200 and compares them with the information in the security countermeasures approval list. In other words, the device management device 100 collects logs regardless of whether the operation is performed by maintenance personnel or by an attacker targeting the IoT device.

[0057] The result of comparing the collected logs with the security countermeasures license list is that if any security countermeasures license information in the security countermeasures license list matches the log (complies / consistent), the operation targeting the IoT device that is the source of the log is determined to be an operation related to a licensed security countermeasure, and an execution license for the security countermeasure is sent to the IoT device, enabling the execution of the security countermeasure (steps (3-3), (3-3')). Furthermore, if the result of comparing the collected logs with the security countermeasures license list is that if none of the logs match any security countermeasures license information in the security countermeasures license list (does not match / is inconsistent), the operation targeting the IoT device that is the source of the log is determined to be an unlicensed security countermeasure (including operations outside the validity period) or an operation related to a network attack (suspicious action), and the execution of the security countermeasure on the IoT device is prevented by sending an instruction to implement non-licensing (step (3-3'')), and an abnormal alarm is generated in the alarm output control unit 154 and sent to the maintenance personnel PC 300 (step (3-4)).

[0058] This section explains the anomaly detection process for IoT devices in the device management system.

[0059] Figure 5 This is a diagram illustrating the anomaly detection sequence for IoT devices.

[0060] like Figure 5 As shown, when the operation of the device is detected in the control unit 210 of the IoT device 200 (action P5001), a log is generated in the log management unit 220 (action P5002), and sent from the log management unit 220 to the device management device 100 via the communication unit 230 (actions P5003, P5004).

[0061] Figure 6 This is a diagram illustrating an example of logs sent from an IoT device to a device management unit.

[0062] Logs sent from IoT device 200 to device management device 100 include, for example: Figure 6 Various logs, such as access log D6001, event log D6002 (security log), and error log D6003, are shown and sent in association with identification information such as the product name or product number of the IoT device 200.

[0063] In addition, such as Figure 5As shown, the device management unit 100 collects logs received from the IoT device 200 via the communication unit 110 in the log management unit 130 (action P5005) and performs log analysis (action P5006). During log analysis, identification information (product name, product number, etc.) associated with the logs is used to retrieve object product information for the device management unit 140 (action P5007), and product information (customer name, IP address, OS, etc.) is obtained (action P5008). Furthermore, based on the obtained product information, the attack detection unit 150 performs a security countermeasures license list search (action P5009). If corresponding security countermeasures license information exists, it is obtained; otherwise, no corresponding information is obtained (action P5010).

[0064] If the Log Management Unit 130 has the corresponding security countermeasure license information in the security countermeasure license list, it sends the license content (product information, validity period, license content, etc.) contained in the security countermeasure license information to the IoT Device 200 via the Communication Unit 110 (Actions P5011, P5012). When the Log Management Unit of the IoT Device 200 receives the license content via the Communication Unit 230 (Action P5013), it sends the security countermeasure implementation license to the Control Unit 210 based on the content (Action P5014).

[0065] In addition, if the corresponding security measure license information is not found in the security measure license list (i.e., if no corresponding information is obtained), the log management unit 130 generates an abnormal alarm and sends it to the maintenance personnel PC300 via the communications unit (action P5015).

[0066] Figures 7-10 This is a diagram showing an example of the alarm screen displayed on the PC300 of a maintenance personnel who received an abnormal alarm.

[0067] For example, Figure 7 An example of an alarm screen D7001 is shown when a security diagnostic from the Internet detects an anomaly. In this screen, along with the time of occurrence, the identification information of the IoT device, the abnormal content (here, a message indicating that a large number of accesses from a specific IP address have been detected), and a message urging the administrator of the device management system to make an emergency contact, are also displayed.

[0068] Figure 8 An example of an alarm screen D7002 is shown when an abnormality is detected in the registry for security enhancement. The screen displays the time of occurrence, the identification information of the IoT device, the abnormal content (here, a message indicating that a specific account's access to the registry has been detected and blocked), and a message urging the administrator of the device management system to contact them urgently.

[0069] Figure 9 An example of an alarm screen D7003 is shown when the temporary invalidation of the whitelist used for software updates is detected as an anomaly. In addition to the time of occurrence, the identification information of the IoT device, and the abnormal content (here, a message indicating that a specific account has issued a stop command to the whitelist is detected), a message urging the administrator of the device management system to be contacted urgently is also displayed.

[0070] Figure 10 The example shown is an alarm screen D7004 that displays when the data output used for product investigation is detected as abnormal. In addition to the time of occurrence, the identification information of the IoT device, the abnormal content (here, a message indicating that a file appending from a USB of a specific account has been detected and blocked), it also displays a message urging the administrator of the device management system to make an emergency contact.

[0071] The effects of this embodiment constructed in the above manner will be explained.

[0072] In IoT devices used for long-term business operations, security maintenance requires remote monitoring, security measures, and regular diagnostics. On the other hand, these security operations often involve simulating attacks or modifying settings on IoT devices, but these are difficult to distinguish from cyberattacks. Therefore, actions of IoT devices used for security operations can be falsely detected as cyberattacks, increasing the workload for administrators of IoT devices receiving cyberattack detection notifications.

[0073] In this embodiment, the device management apparatus for managing multiple IoT devices by connecting to multiple IoT devices via a network is configured to include: a log management unit that collects logs related to the actions of the multiple IoT devices via the network; a detection unit that detects pre-set actions as suspicious actions for each of the multiple IoT devices based on the logs; a determination unit that, when a suspicious action is detected in at least one of the multiple IoT devices, determines whether the detected suspicious action is caused by security measures against the IoT devices; and an alarm control unit that, if it is determined that the suspicious action is caused by security measures, controls the operation to not output an alarm to the user or manager of the IoT device that detected the suspicious action, and controls the operation to output an alarm to the user or manager of the IoT device if it is determined that the suspicious action is not caused by security measures. Therefore, it is possible to perform secure operation while suppressing false detections of network attacks on IoT devices.

[0074] <Implementation Method 2>

[0075] Reference Figure 11 To illustrate Embodiment 2 of the present invention.

[0076] This embodiment illustrates the process of log collection and countermeasure permission determination in various IoT devices. In this embodiment, structures and other elements identical to those in Embodiment 1 are labeled with the same reference numerals, and descriptions are omitted where appropriate.

[0077] Figure 11 This is a diagram schematically illustrating the overall structure of the equipment management system involved in this embodiment.

[0078] exist Figure 11 In this embodiment, the device management system is schematically configured to include: multiple IoT devices as management objects (IoT device 200A is shown here as a representative example); a device management device 100A connected to the multiple IoT devices via a device management network 1; and a maintenance personnel PC 300 connected to the device management device 100A via an information network 2.

[0079] The IoT device 200A includes: a communication unit 230 that connects the IoT device 200A to the device management network 1; a log management unit 220A that collects logs related to the actions of the IoT device 200A and records them in a log collection management table 131A; and a control unit 210 that controls the actions of the IoT device 200A. In addition, the IoT device 200A also includes a countermeasure permission determination unit 152A, a security countermeasure permission list 153A classified by product, and an alarm output control unit 154A, which are functional units for attack detection. The attack detection is used to detect suspicious actions of the IoT device 200A as attacks, etc.

[0080] When a suspicious action is detected in the IoT device 200A, the countermeasure approval determination unit 152A determines whether the detected suspicious action is caused by a security measure against the IoT device 200A, based on the security measure approval information for each product pre-registered in the product-categorized security measure approval list 153A. If the detected suspicious action matches the information registered in the product-categorized security measure approval list 153A, the unit outputs an implementation approval for the security measure to the control unit 210. Conversely, if the detected suspicious action does not match the information registered in the product-categorized security measure approval list 153A, the unit outputs a stop command for the security measure to the control unit 210.

[0081] If the countermeasure permission determination unit 152A determines that the suspicious action is caused by security countermeasures, the alarm output control unit 154A controls the output to not output an alarm to the user or manager (maintenance personnel PC300) of the IoT device 200A that detected the suspicious action. If the alarm is determined to be not caused by security countermeasures, an alarm is generated and output to the user or manager (maintenance personnel PC300) of the IoT device 200A via the device management device 100A through the communication unit 230.

[0082] The maintenance personnel PC 300 is an information terminal used by the user or manager of the IoT device 200A, including: a communication unit 320, which connects the maintenance personnel PC 300 to the information network 2; and an alarm notification unit 310, which notifies the user or manager of alarms and other information received from the IoT device 200A via the information network 2 and the device management device 100.

[0083] The alarm notification unit 310 includes a display device such as a monitor, which displays various information related to the maintenance of the IoT device 200A, in addition to alarm information.

[0084] The device management device 100A is used to manage multiple IoT devices (IoT devices 200A) connected via the device management network 1, and includes: a communication unit 110, which connects the device management device 100A to the device management network 1 and the information network 2; an authentication unit 120, which determines whether a user of the IoT device 200 is a legitimate user based on the user authentication information registered in the user authentication table 121, and grants permission to use the device after confirming that the user is a legitimate user, i.e., performs user authentication; a device management unit 140, which retrieves the identification information of the IoT devices that are managed by the device management device 100A from the device management table 141; and an attack detection unit 150A, which performs some functions such as managing the security countermeasure permission information used for attack detection in the IoT device 200.

[0085] The attack detection unit 150A includes a countermeasure license information registration unit 151 and a security countermeasure license list 153. Based on the operations of the device management system administrator, the countermeasure license information registration unit 151 registers and manages the identification information of IoT devices 200 that will be targets of attack detection in the security countermeasure license list 153, and also registers and manages security countermeasure license information, including the identification information of the IoT devices 200 that will be targets of security countermeasures and the content of the security countermeasures, in the security countermeasure license list 153. Furthermore, the countermeasure license information registration unit 151 distributes the security countermeasure license information of each IoT device 200 that will be managed to each IoT device 200 and registers it in the product-categorized security countermeasure license list 153A. That is, each IoT device 200 only has security countermeasure license information relevant to itself. Additionally, the security countermeasure license information registered in the security countermeasure license list 153, or the security countermeasure license list 153 (DB), is preferably encrypted. Furthermore, in order to prevent tampering or copying when sending security measure authorization information from device management device 100A to IoT device 200, it is preferable to use a communication method that can assign a "digital signature" and a "random number (one-time random number)" to the security measure authorization information when sending it.

[0086] In the operation of the device management system configured as described above, during the registration / management of the entire IoT device group, including IoT device 200, by the device management system administrator, the IoT device maintenance personnel (different from users and administrators) who perform security maintenance on the IoT devices apply to the device management system administrator for registration of security countermeasures permission information before implementing security countermeasures. This serves as preparation for implementing security countermeasures on the IoT device 200. Based on the application from the IoT device maintenance personnel, the device management system administrator registers the security countermeasures permission information in the security countermeasures permission list 153 via the countermeasures permission information registration unit 151 of the attack detection unit 150A. Furthermore, the countermeasures permission information registration unit 151 distributes information on the security countermeasures implemented by each IoT device 200A (security countermeasures permission information).

[0087] The IoT device 200A collects logs of operations performed by maintenance personnel on the IoT device 200A, or operations related to the implementation of security countermeasures. These logs are then compared in the countermeasure approval unit 152A with the product-specific security countermeasure approval information registered in the product-specific security countermeasure approval list 153A. Similarly, logs are collected for, for example, unauthorized operations (cyberattacks) by attackers targeting the IoT device 200A, and compared with the security countermeasure approval information in the product-specific security countermeasure approval list 153A. In short, log collection of the IoT device 200A is continuous, regardless of whether the operations are performed by maintenance personnel or by attackers targeting the IoT device.

[0088] If the collected logs are compared with the security countermeasures license information in the product-categorized security countermeasures license list 153A, and the result shows a match (compliant / consistent) between the security countermeasures license information and the logs, then the operation originating from the log for the IoT device is determined to be related to a licensed security countermeasure. An execution license for the security countermeasure is then sent to the control unit 210, enabling the execution of the security countermeasure. Conversely, if the collected logs are compared with the security countermeasures license information, and the result shows a mismatch (inconsistent / incompatible) between the security countermeasures license information and the logs, then the operation originating from the log for the IoT device 200A is determined to be an unlicensed security countermeasure (including operations outside the validity period) or an operation related to a network attack (suspicious action). An instruction to disallow the implementation of the security countermeasure is sent to the control unit 210 to prevent the execution of the security countermeasure on the IoT device 200. An abnormal alarm is generated in the alarm output control unit 154 and sent to the maintenance personnel PC 300 via the device management device 100A.

[0089] The other structures are the same as in Implementation Method 1.

[0090] In this embodiment configured as described above, the same effects as in embodiment 1 can also be obtained.

[0091] Furthermore, by configuring the device management device 100A to perform registration with the security countermeasures license list 153, or to perform additional authentication during registration, the device management device 100A is centrally defended, thereby more reliably preventing attackers from performing illegal registration operations and securely storing the security countermeasures license list 153.

[0092] <Postscript>

[0093] This invention is not limited to the embodiments described above, and includes various modifications or combinations without departing from its spirit. Furthermore, this invention is not limited to having all the structures described in the above embodiments, but also includes structures after deleting a portion of their structure. Additionally, the aforementioned structures and functions can be implemented, for example, using integrated circuit design, in part or in whole. Furthermore, the aforementioned structures and functions can also be implemented in software by a processor interpreting and executing programs that implement their respective functions.

[0094] Label Explanation

[0095] 1. Device Management Network

[0096] 2. Information Network

[0097] 100, 100A Equipment Management Device

[0098] 110 Ministry of Communications

[0099] 120 Certification Department

[0100] 121 User Authentication Form

[0101] 130 Log Management Department

[0102] 131, 131A Collection Log Management Table

[0103] 140 Equipment Management Department

[0104] 141 Equipment Management Table

[0105] 150, 150A Attack Detection Department

[0106] 151 Countermeasures Permit Information Registration Department

[0107] 152, 152A Countermeasures Permit Determination Department

[0108] 153 Security Countermeasures Permit List

[0109] 153A List of Safety Countermeasures Licenses by Product Category

[0110] 154, 154A Alarm Output Control Unit

[0111] 200, 200A IoT devices

[0112] 210 Control Department

[0113] 220, 220A Log Management Department

[0114] 230 Ministry of Communications

[0115] 300 maintenance personnel PC

[0116] 310 Alarm Notification Department

[0117] 320 Ministry of Communications

[0118] D6001 Access Log

[0119] D6002 Event Log

[0120] D6003 Error Log

[0121] Alarm screens for D7001, D7002, D7003, and D7004

[0122] F3001 License ID

[0123] Product Name: F3002

[0124] F3003 Manufacturing Number

[0125] F3004 Customer Name

[0126] F3005 IP address

[0127] F3006 OS

[0128] F3007 Validity Period

[0129] F3008 License Contents

[0130] F3009 Last Updated Date and Time

[0131] S2001 Top View

[0132] S2002 New Registration Screen

[0133] S2003 Overview Display Screen

[0134] S2004 Screen Change

[0135] S2005 Confirmation Screen

[0136] S2006 Result Screen.

Claims

1. A device management apparatus, which connects to multiple IoT devices via a network and manages the multiple IoT devices, characterized in that, include: A log management unit that collects logs related to the actions of multiple IoT devices via the network; The detection unit, for each of the plurality of said IoT devices, detects pre-defined actions as suspicious actions based on the logs; The determination unit, when detecting the suspicious action in at least one of the plurality of IoT devices, determines whether the detected suspicious action is caused by security countermeasures against the IoT devices. as well as An alarm control unit controls the device to not output an alarm to the user or manager of the IoT device that detected the suspicious action if it determines that the suspicious action is caused by the security countermeasures, and controls the device to output the alarm to the user or manager of the IoT device if it determines that the suspicious action is not caused by the security countermeasures.

2. The equipment management device as described in claim 1, characterized in that, It also includes a license information registration department, which registers at least the information related to actions caused by the security measures concerning the IoT device in the security measure license list. The determination unit determines, based on the security countermeasures permission list, whether the suspicious action against the IoT device is caused by the security countermeasures.

3. A device management system, comprising a device management apparatus connected to multiple IoT devices via a network for managing the multiple IoT devices, characterized in that, include: The Log Management Department collects logs related to the actions of multiple IoT devices. The detection unit detects pre-defined actions as suspicious actions for multiple IoT devices based on the logs. The determination unit, upon detecting the suspicious action, determines whether the suspicious action is caused by security countermeasures against the IoT device. as well as An alarm control unit controls the device to not output an alarm to the user or manager of the IoT device that detected the suspicious action if it determines that the suspicious action is caused by the security countermeasures, and controls the device to output the alarm to the user or manager of the IoT device if it determines that the suspicious action is not caused by the security countermeasures.

4. The equipment management system as described in claim 3, characterized in that, The device management unit has a license information registration department, which registers at least the information related to actions caused by the security measures for the IoT device in the security measure license list. Furthermore, each of the aforementioned IoT devices has the aforementioned determination unit and alarm control unit. The determination unit determines, based on the security countermeasures permission list of the device management device, whether the suspicious action against the IoT device is caused by the security countermeasures.

Images