Information processing system, information processing device, information processing method, and program

Abstract

To provide an information processing system, an information processing device, an information processing method, and a program that verify validity of an abnormality notification transmitted from an external device.SOLUTION: An information processing system includes a first device and a second device communicatively connected. The first device includes an abnormality detection unit that detects abnormality, and, when the abnormality is detected, notifies the second device of the abnormality. The second device acquires, when receiving notification of the abnormality from the first device, acquires information about the abnormality from the first device and / or another device of the information processing system, and on the basis of the acquired information, verifies validity of the abnormality notification.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing system, an information processing device, an information processing method, and a program. [Background technology]

[0002] In recent years, a system has been known in which a device having a communication function is connected to the Internet or a cloud, and communicates with a server and other devices to obtain various information, thereby receiving services. Examples of such devices having a communication function include fixed devices such as office equipment such as a copier or printer, and mobile objects such as a vehicle or a drone. In such a system, when a server that has received an abnormality notification determines that an abnormality has occurred in the device that sent the abnormality notification, the server performs post-processing specified in the system on the device. Post-processing is performed to make the system more robust, and for example, the device in question may be isolated from the network. In addition, for example, in a certificate-based system, post-processing may be performed by revoking the certificate of the device in which the abnormality has occurred. In this way, when post-processing is performed, other devices can continue to provide services using the system, but the device that sent the abnormality notification cannot continue to provide services. Since the device that sent the abnormality notification will suffer such disadvantages, the reliability of the abnormality notification message sent by the device is important. In addition, it is also important for the server that has received the abnormality notification to correctly determine whether or not information sent from the device in which the abnormality has occurred or the device that has been attacked can be trusted.

[0003] Patent Document 1 discloses a system in which a server collects and analyzes vehicle data to detect cyber attacks on an in-vehicle network. According to Patent Document 1, the server determines whether or not a vehicle is under cyber attack based on the collected vehicle data, and notifies the vehicle that is determined to be under cyber attack of the determination result. Patent Document 2 discloses a system in which, when a vehicle detects abnormal human behavior, the vehicle notifies the server of the information, and the server compiles the information (for example, by region) and notifies other vehicles of dangers such as theft. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-166452 A [Patent Document 2] JP 2009-289220 A [Non-patent literature]

[0005] [Non-Patent Document 1] ETSI TR 103 460 Summary of the Invention [Problem to be solved by the invention]

[0006] In Patent Document 1, the server detects an abnormality and notifies the vehicle, so the target of confirmation is limited, and the reliability of the data notified from the vehicle is not verified, so the accuracy of the abnormality determination may be reduced. In addition, Patent Document 1 does not assume a configuration in which the device itself notifies of an abnormality that has occurred in the device, and does not verify the validity of the notified abnormality. In Patent Document 2, the server collects abnormality notifications sent by the device and provides a service according to the collected results, but does not verify the validity of each notification. In addition, Non-Patent Document 1 does not have a mechanism for notifying an abnormality that has occurred in the vehicle. As such, there is no proposal for a mechanism for verifying the validity of the abnormality notification itself.

[0007] The present disclosure provides a technique for verifying the validity of an abnormality notification sent to a server or the like. [Means for solving the problem]

[0008] A system according to an embodiment of the present invention includes the following components: A system having a first device and a second device communicatively connected to each other, The first device is A detection means for detecting an abnormality; a notification means for notifying the second device of an abnormality when the detection means detects an abnormality, The second device is a receiving means for receiving a notification of the abnormality from the notifying means; an acquisition means for acquiring information relating to the abnormality from the first device and / or another device of the information processing system in response to the reception means receiving the notification of the abnormality; and a verifying means for verifying the validity of the notification of the abnormality based on the information acquired by the acquiring means. Effect of the Invention

[0009] According to the present invention, it is possible to verify the validity of an abnormality notification sent from an external device. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a system according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of the functional configuration of the system according to the first embodiment. [Diagram 3] 1A is a diagram showing an example of a message format, FIG. 1B is a diagram showing an example of the structure of an abnormality notification message, FIG. 1C is a diagram showing an example of an ID corresponding to various types of abnormality, FIG. 1D is a diagram showing an example of an ID corresponding to a code indicating the content of various abnormalities, and FIG. 1E is a diagram showing an example of an ID corresponding to various levels of abnormality. [Figure 4]4 is a flowchart showing an example of the operation of the system according to the first embodiment. [Diagram 5] FIG. 11 is a block diagram showing an example of the functional configuration of a system according to a second embodiment. [Figure 6] 10 is a flowchart showing an example of the operation of the system according to the second embodiment. [Figure 7] 10 is a flowchart showing another operation example of the system according to the second embodiment. [Figure 8] 10 is a flowchart showing the operation of a system according to a third embodiment. [Figure 9] 13 is a flowchart showing an example of operation of a verification process of the system according to the third embodiment. [Figure 10] 13 is a flowchart showing an example of the operation of the system according to the fourth embodiment. [Figure 11] 13 is a flowchart showing an example of the operation of the system according to the fifth embodiment. [Figure 12] 13 is a flowchart showing an example of the operation of the system according to the sixth embodiment. [Figure 13] FIG. 23 is a block diagram showing an example of the hardware configuration of an apparatus according to a seventh embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, the embodiments will be described in detail with reference to the attached drawings. Note that the following embodiments do not limit the invention according to the claims. Although the embodiments describe a number of features, not all of these features are essential to the invention, and the features may be combined in any manner. Furthermore, in the attached drawings, the same reference numbers are used for the same or similar configurations, and duplicated descriptions are omitted.

[0012] [First embodiment] FIG. 1 is a block diagram showing an example of the configuration of an information processing system (hereinafter, referred to as the system) according to the first embodiment. As shown in FIG. 1, the system according to this embodiment has a server 101, which is an information processing device functioning as an authentication authority, and a device A102 and a device B103 that can access the server 101. The server 101, the device A102, and the device B103 are all connected to a network 104 and can communicate with each other. The network 104 is a wired and / or wireless network such as a LAN or the Internet. The device A102 and the device B103 are examples of information processing devices that can access the server 101 via the network 104. Note that in FIG. 1, two information processing devices (device A102 and device B103) are shown as devices that can access the server 101 via the network 104, but the number of devices that can access the server 101 via the network 104 is not limited to this. Also, in FIG. 1, a network configuration is shown in which the device A102 and the device B103 directly perform data communication via the network 104, but the communication between the devices is not limited to this. For example, data communication between the devices may be performed via one or more relay devices provided between the devices.

[0013] Specific examples of device A102 and device B103 include fixed devices such as office equipment that connect to the Internet or cloud and provide services by connecting to other devices and servers. For example, a copier connects to the Internet or cloud to provide a printing service. When data is exchanged frequently between devices and between devices and servers, the importance of information such as abnormal occurrences sent by the devices increases, and it is also important to ensure the credibility of the information.

[0014] Another specific example of the device A102 and the device B103 is a moving object. A vehicle, which is a typical example of a moving object, is equipped with a communication function and transmits and receives information using V2X communication such as vehicle-to-vehicle (V2V) communication for communicating with other vehicles and road-to-vehicle (V2I) communication for communicating with roadside devices such as traffic lights. V2V stands for Vehicle To Vehicle, and V2I stands for Vehicle To Infrastructure. Activities are being promoted to realize support for driver recognition, judgment, and operation by connecting vehicles to the Internet and cloud and acquiring various information such as road information. In addition, with the spread of autonomous driving, etc., it is possible to control driving based on information from a sensor of the vehicle itself, such as a driving position and a moving speed measured by a sensor mounted on the vehicle, and information received from the outside by V2X communication. Here, when an abnormality occurs in the vehicle itself, it is important to transmit an abnormality notification and control the vehicle based on the abnormality notification in the vehicle that received it in order to prevent a traffic accident. Therefore, the reliability of the abnormality notification is also important.

[0015] In recent years, there has been an increasing trend to utilize drones, which are small unmanned mobile objects, and such mobile objects can also be applied as device A102 and device B103. For example, when drones are used for parcel delivery in the future, it is expected that the drones will fly in an autonomous driving mode at an altitude of about 150 m above the ground. On the other hand, if an abnormality occurs in a drone, it is expected that the drone will be unable to fly autonomously or that the drone will collide with another drone. In such a situation, the drone or the parcel may fall to the ground, causing damage to pedestrians on the ground. Therefore, it is important for the drone to notify other drones, vehicles on the ground, pedestrians, etc. of the abnormality that has occurred. As described above, in a mobile object such as a vehicle or a drone, one of the important issues is to ensure the legitimacy of the abnormality to be notified.

[0016] Fig. 2 is a block diagram showing an example of the functional configuration of the server 101, device A102, and device B103. In Fig. 2, the functional configuration of device B103 is omitted because it is similar to that of device A102. In addition, in each of the following embodiments, device A102 and device B103 are described as having the same functional configuration, but they may be devices having different functional configurations. The operation of each functional unit of such an information processing system will be described below with reference to the flowchart in Fig. 4.

[0017] In the device A102, the anomaly detection unit 201 periodically or irregularly monitors whether an anomaly has occurred in the device A102. The anomaly detection unit 201 includes a first anomaly detection unit 206 and a second anomaly detection unit 207. The first anomaly detection unit 206 detects that an "anomaly from the viewpoint of security" has occurred in the device A102. For example, the first anomaly detection unit 206 determines that an anomaly has occurred when it detects an attack from the outside on the device A102 or when it detects that a message received from the outside is suspected to have been tampered with. For example, the first anomaly detection unit 206 detects an anomaly (in terms of security) in a message received from the outside or in data stored in the device A102. For example, the first anomaly detection unit 206 detects, as an anomaly (in terms of security), a tampering of a message detected by a MAC, which is an authentication code, or a malware intrusion detected by an anti-malware function using machine learning. Here, MAC stands for Message Authentication Code. The second abnormality detection unit 207 monitors the operation of each function of the device A102 and detects an "abnormality from the viewpoint of safety." For example, the second abnormality detection unit 207 has a mechanism for making the power supply circuit of the device A102 redundant and comparing the output voltages, and detects an unexpected loss of power as an abnormality (from the viewpoint of safety).

[0018] In step S401, if at least one of first anomaly detection unit 206 and second anomaly detection unit 207 detects an anomaly (YES in step S401), the process proceeds to step S402. On the other hand, if neither first anomaly detection unit 206 nor second anomaly detection unit 207 detects an anomaly (NO in step S401), the process waits in step S401. In step S402, generation unit 202 of device A102 generates an anomaly notification message as a notification indicating that an anomaly has occurred.

[0019] The device A102 (the generating unit 202) can generate various kinds of messages, but in this embodiment, all messages will be described as having the format exemplified in FIG. 3(a). In FIG. 3(a), an area 301 is an area for storing a header, and an area 302 is an area for storing data indicating the contents to be notified. An area 303 is an area for storing a set of a certificate and a corresponding serial number, and an area 304 is an area for storing signature data of the certificate. The generating unit 202 of the device A102 generates an abnormality notification message according to the format shown in FIG. 3(a). FIG. 3(b) shows an example of the format of an abnormality notification message 310 generated by the generating unit 202. A header is stored in the area 301 of the abnormality notification message 310. The header includes information for identifying the sender of the abnormality notification message 310 (the device A102 in this embodiment), information for identifying the destination (the server 101 in this embodiment) required in terms of a protocol for connecting to the network 104 and communicating, and the like. In addition, area 302 of abnormality notification message 310 has area 305 for storing information indicating the type, area 306 for storing an error code indicating the nature of the abnormality, area 307 for storing a level indicating the seriousness of the abnormality, and area 308 for storing attribute information.

[0020] In the area 305, an identifier (ID) corresponding to the type of anomaly detected by the anomaly detection unit 201 is stored. FIG. 3(c) shows an example of a table in which IDs corresponding to the types of anomalies are registered. For example, when the second anomaly detection unit 207 detects an anomaly, the generation unit 202 stores ID=1 corresponding to the type "Safety" in the table 320 in the area 305. When the first anomaly detection unit 206 detects an anomaly, the generation unit 202 stores ID=2 corresponding to the type "Security" in the table 320 in the area 305. The table 320 in FIG. 3(c) is stored in a memory device accessible by the device A102. When the number of types of anomalies to be detected increases, the type of anomaly and the corresponding ID may be additionally registered in the table 320.

[0021] In the area 306, IDs corresponding to codes (ErrorCodes) representing the contents of the abnormality (classification of the cause of the abnormality) detected by the abnormality detection unit 201 are stored. The contents of the abnormality include, for example, an abnormality detected by the second abnormality detection unit 207 such as a hardware failure or hardware not responding, and an abnormality detected by the first abnormality detection unit 206 such as a message being tampered with or attacked. An example of a table in which IDs corresponding to codes representing the contents of various abnormalities are registered is shown in FIG. 3(d). It is assumed that the table 321 in FIG. 3(d) is stored in a memory device accessible by the device A102. In addition, when the number of types of abnormalities to be detected increases, the code representing the contents of the abnormality and the corresponding ID may be additionally registered in the table 321.

[0022] In the area 307, an ID corresponding to a level indicating how serious the abnormality detected by the abnormality detection unit 201 is is stored. For example, when the abnormality detection unit 201 detects a serious abnormality that causes an abnormality in operation, the generation unit 202 stores an ID=1 corresponding to a level of "serious malfunction" in the area 307. Also, for example, when the abnormality detection unit 201 detects an abnormality that does not affect operation, the generation unit 202 stores an ID=3 corresponding to a level of "minor malfunction" in the area 307. An example of a table in which IDs corresponding to various abnormality levels are registered is shown in FIG. 3(e). It is assumed that the table 322 in FIG. 3(e) is stored in a memory device accessible by the device A102. In addition, when the number of types of abnormalities to be detected increases, the abnormality level and the corresponding ID may be additionally registered in the table 322.

[0023] Further, in the area 308, more detailed information (attribute information) on the abnormality that cannot be expressed by the information stored in the areas 305 to 307 alone is stored. In addition, in the area 303 of the abnormality notification message 310, the "certificate and serial number of the device A102" that the device A102 acquires from a certificate authority (the server 101 in this embodiment) and that is managed by the management unit 211 is stored. The certificate is information that indicates the legitimacy of the sender. In addition, in the area 304 of the abnormality notification message 310, signature data for proving that the abnormality notification message 310 has not been tampered with is stored. For example, the generation unit 202 of the device A102 generates signature data by signing a hash value calculated for the entire abnormality notification message 310 using the "certificate of the device A102" managed by the management unit 211, and stores the signature data in the area 304.

[0024] 4, in step S403, notification unit 203 of device A102 transmits (notifies) the abnormality notification message generated by generation unit 202 in the above-mentioned step S402 to server 101 via network 104. Note that the abnormality notification message may be transmitted to server 101, or may be transmitted to a plurality of servers including server 101 using a mechanism such as multicast or broadcast, and the transmission method is not limited.

[0025] Next, a description will be given of the operation of server 101 receiving the abnormality notification message from device A 102. In step S441, notification receiving unit 204 of server 101 receives the abnormality notification message transmitted from device A 102. In step S442, judgment unit 213 judges whether or not the abnormality notification message received by notification receiving unit 204 needs to be verified by a verification function.

[0026] The determination unit 213 determines whether or not the system requires post-processing, which is predefined for the notified abnormality. The determination unit 213 of this embodiment has an importance determination unit 214 and a verification unit 215. The importance determination unit 214 determines the degree of influence on surrounding devices from the type and level of the abnormality, and determines the severity of the abnormality. The verification unit 215 performs re-verification to determine whether or not an abnormality actually occurs based on the continuity and frequency of occurrence of the abnormality. First, in step S442, the importance determination unit 214 analyzes the abnormality notification message received in step S441, and determines whether or not "immediate execution of post-processing" is required based on the management criteria of the server 101, and whether or not "verification" by the verification unit 215 is required. Here, an example of the determination by the importance determination unit 214 is shown. For example, it is assumed that a criterion is set such that a safety abnormality that causes a traffic accident is important in the system, but a security abnormality does not immediately cause a traffic accident. When ID=1 (Type=Safety) is stored in area 305 of the abnormality notification message and ID=1 (Level=Major fault) is stored in area 307, importance determination unit 214 determines that "immediate execution of post-processing" is required. When ID=2 (Type=Security) is stored in area 305 of the abnormality notification message, importance determination unit 214 determines that "verification" of the abnormality notification message is required. When ID=3 (Type=Semantics) is stored in area 305 of the abnormality notification message, importance determination unit 214 determines that neither "post-processing" nor "verification" is required.

[0027] If it is determined in step S442 that "immediate execution of post-processing" is necessary, the process proceeds to step S445. On the other hand, if it is determined in step S442 that "verification" is necessary, the process proceeds to step S406. Furthermore, if it is determined in step S442 that neither "post-processing" nor "verification" is necessary, the process ends.

[0028] In step S443, the verification unit 215 performs verification using a verification process defined in advance in the system. For example, the verification unit 215 verifies the abnormality using an abnormality notification further received from the device A102 using the notification receiving unit 204. Alternatively, the verification unit 215 communicates with the device A102 using the communication unit 209, or with another device other than the device A102, to obtain additional information, and verifies the abnormality using the obtained information. In this way, additional information for verifying the validity of the notified abnormality can be obtained from the device that notified the abnormality and / or from another device other than the device that notified the abnormality. As a result of the above verification, if the verification unit 215 determines that the device A102, which is the sender of the abnormality notification message received in step S441, is in an abnormal state (YES in step S444), the process proceeds to step S445. On the other hand, if the verification unit 215 determines that the device A102 that is the sender of the abnormality notification message received in step S441 is not in an abnormal state (NO in step S444), this process ends.

[0029] In step S445, the post-processing unit 205 performs post-processing defined in advance in the system. For example, if the system is constructed from a network between devices, the post-processing unit 205 isolates the device that sent the abnormality notification message from the network. In this case, by isolating the device from the network, the system can continue to operate with only normal devices.

[0030] As described above, according to the first embodiment, the server verifies the abnormality notification from the device, so that it is possible to improve the accuracy of determining whether the device is in an abnormal state.

[0031] [Second embodiment] In the second and subsequent embodiments, differences from the first embodiment will be mainly described. Therefore, unless otherwise specified in the following description, the embodiments are assumed to be similar to the first embodiment.

[0032] FIG. 5 is a block diagram showing an example of the functional configuration of an information processing system according to the second embodiment. The system according to the second embodiment is a certificate-based system. In FIG. 5, the functional configurations of device A102 and device B103 are similar to those of the first embodiment (FIG. 2), and are not shown. In the second embodiment, a system in which a certificate is revoked as post-processing performed by post-processing unit 205 of server 101 is exemplified. As shown in FIG. 5, post-processing unit 205 of server 101 has a revocation unit 216, a first management unit 208, and a second management unit 212.

[0033] The operation of the system according to the second embodiment will be described with reference to the flowchart in Fig. 6. In the flowchart shown in Fig. 6, step S601, steps S641 to S642, and steps S661 to S667 are added to the processing shown in the first embodiment (Fig. 4). Fig. 7 is a flowchart showing an asynchronous example as a processing example different from that in Fig. 6.

[0034] The processing of steps S441 to S444 by the server 101 is the same as that of the first embodiment (FIG. 4). When it is determined in step S442 or step S444 that post-processing is necessary for the abnormality notification message received by the notification receiving unit 204, the processing proceeds to step S641, and the post-processing is started. The processing of step S641 corresponds to the post-processing at the time of abnormality (step S445) in the first embodiment. In step S641, the revocation unit 216 revokes the certificate of the device A102 by using the abnormality notification message received by the notification receiving unit 204. The first management unit 208 manages a CRL (Certificate Revocation List) in which the serial number of the revoked certificate and the date and time of the revocation (revocation date) are registered. The CRL is an example of management information including the revocation status of the certificate. The revocation unit 216 revokes the certificate of the device A102 by updating the CRL managed by the first management unit 208 by registering the serial number of the certificate and the current date and time included in the abnormality notification message received by the notification receiving unit 204. The first management unit 208 also manages revoked certificates and responds to inquiries regarding revocation (step S642).

[0035] The second management unit 212 in the server 101 issues certificates and serial numbers, manages issued certificates and serial numbers, verifies certificates, etc. For example, when the second management unit 212 receives a request for issuing a certificate from an external device such as the device A102 or the device B103, the second management unit 212 issues a certificate for the external device and transmits the issued certificate and the serial number of the certificate to the external device. This allows the external device to hold its own certificate and serial number. In this embodiment, the server 101 has the second management unit 212, but this is not limited thereto, and an external device accessible to the server 101 may have the second management unit 212.

[0036] Here, after the certificate of the device A102 is revoked, it is assumed that the user performs an operation to send a message to the device B103 using various applications 290 of the device A102. When this operation is accepted in the device A102, the processing unit 210 generates a message having the format shown in FIG. 3(a). In detail, the processing unit 210 stores the header of the message in the area 301, and stores the contents of the message in the area 302. In addition, the processing unit 210 stores the "certificate and serial number of the device A102" managed by the management unit 211 in the area 303. Furthermore, the processing unit 210 generates signature data of the message as described above, and stores the generated signature data in the area 304. In step S601, the communication unit 209 of the device A102 transmits the message generated by the processing unit 210 to the device B103 via the network 104.

[0037] In step S661, communication unit 209 of device B103 receives the message. In step S662, communication unit 209 of device B103 makes an inquiry about the CRL to server 101. In step S642, first management unit 208 of server 101 transmits (notifies) the latest CRL it manages to device B103 in response to the inquiry. In step S663, communication unit 209 of device B103 receives the latest CRL transmitted from server 101 (first management unit 208), and processing unit 210 of device B103 updates the CRL managed by management unit 211 to the received latest CRL.

[0038] In step S664, processing unit 210 of device B103 verifies whether or not the serial number of the certificate of device A102 stored in area 303 of the message received in step S607 is registered in the latest CRL managed by management unit 211. Through this verification, processing unit 210 of device B103 judges whether or not the certificate of device A102 has been revoked. That is, if the serial number of the certificate of device A102 is registered in the latest CRL managed by management unit 211, it is determined that the certificate of device A102 has been revoked. On the other hand, if the serial number of the certificate of device A102 is not registered in the latest CRL managed by management unit 211, it is determined that the certificate of device A102 has not been revoked.

[0039] Here, it is assumed that the serial number of the certificate of device A102 is registered in the latest CRL managed by management unit 211. In this case, processing unit 210 of device B103 determines that the certificate of device A102 has been revoked (YES in S665). Therefore, the process proceeds to step S666, and processing unit 210 of device B103 discards the message received in step S661. Note that discarding the message in step S666 is not essential, and it is sufficient that no processing is performed according to the message received in step S661. On the other hand, if it is determined that the serial number of the certificate of device A102 is not registered in the latest CRL managed by management unit 211 and that the certificate of device A102 has not been revoked (NO in step S665), the process proceeds to step S667. In step S667, processing unit 210 of device B103 executes processing according to the message received in step S661.

[0040] In the process according to the flowchart of FIG. 6, the device B103 updates the CRL it manages in response to receiving a message from the device A102. However, the timing at which the device B103 updates the CRL is not limited to such a specific timing. For example, as shown in the flowchart of FIG. 7, the device B103 may update the CRL it manages periodically or at any timing, regardless of whether it receives a message from the device A102. That is, the processes of steps S662 to S663 may be performed periodically or at any timing. Also, every time the server 101 updates the CRL, it may transmit (notify) the updated CRL to each device (in this example, the device A102 and the device B103) via the network 104. In FIG. 7, step S701 represents the processes of steps S665 to S667 in FIG. 6 in one step, and is a process of discarding the received message or executing the corresponding process depending on whether the certificate of the device A has expired.

[0041] In the second embodiment, the device B103 inquires of the server 101 about the CRL, and judges whether or not the certificate of the device A102 has been revoked by using the CRL acquired from the server 101 in response to the inquiry. However, this mechanism is merely an example of a mechanism by which the server 101 revokes the certificate of the device A102 and the device B103 can detect the revocation of the certificate, and is not limited to this mechanism. For example, the server 101 may transmit to another device that the certificate of the device A102 has been revoked by using another method such as OCSP (Online Certificate Status Protocol).

[0042] Furthermore, in the second embodiment, messages transmitted from device A102 and device B103 are transmitted to server 101 via the same network 104 regardless of whether the message is an abnormality notification message or another message. However, abnormality notification messages transmitted from device A102 and device B103 may be transmitted to server 101 via a network different from that for other types of messages (for example, a dedicated network that is a notification path for abnormality notifications). For example, communication between notification unit 203 and notification receiving unit 204 and communication between communication units 209 of each device may be performed via different networks. This can be applied to embodiments other than the second embodiment.

[0043] The types of abnormalities to be detected are not limited to security abnormalities and safety abnormalities, but may include various abnormalities. In addition, there are various abnormalities, such as abnormalities occurring within the device and abnormalities acting on the device from the outside, and the abnormalities are not limited to specific abnormalities as long as they are detectable by the device.

[0044] In the second embodiment, the server 101 revokes the certificate of the device A102 in response to detection of an abnormality by the device A102, and the device B103 discards a message from the device A102 in response to detection of the revocation of the certificate of the device A102. However, the second embodiment is not limited to this. For example, it is clear that the present invention can be applied to a case in which the server 101 revokes the certificate of the device B103 in response to detection of an abnormality by the device B103, and discards a message from the device B103 in response to detection of the revocation of the certificate of the device B103 by the device A102. In either case, there may be multiple devices functioning as the device A102 or the device B103.

[0045] As described above, according to the second embodiment, the abnormality notification of a device in which an abnormality has occurred can be verified and the accuracy of determining the abnormal state can be improved, so that unnecessary revocation of a certificate can be suppressed. Therefore, the certificate of a device in which an abnormality has occurred can be revoked at an appropriate timing. Furthermore, since an abnormality notification message is only sent to the server, it is possible to notify a device that requires it (device B103 in this embodiment) while reducing the amount of communication. Furthermore, it is possible to check from a remote location whether or not a device is abnormal.

[0046] [Third embodiment] The operation of the system according to this embodiment will be described with reference to the flowchart in Fig. 8. In Fig. 8, a more specific example of the verification process of step S443 shown in the first embodiment (Fig. 4) is shown by steps S801 to S802 and steps S841 to S842. Also, Fig. 9 is a flowchart specifically showing the process of step S801 (check for abnormal connection) and the process of step S842 (verification process) shown in Fig. 8. It is assumed that the device A102 and the server 101 have defined and shared a protocol for abnormality notification in the event of an abnormality in advance. The protocol will be described with reference to a flowchart.

[0047] The abnormality detection unit 201 of the device A102 in the third embodiment periodically checks the continuation of the abnormality even after the abnormality notification message is transmitted to the server 101 in step S403 (hereinafter, referred to as abnormality continuation confirmation), and sequentially transmits the confirmation result to the server. That is, in step S801, the abnormality detection unit 201 of the device A102 performs a continuation confirmation of the abnormality notified in step S403, and transmits the confirmation result to the server 101. Note that the notification of the continuation confirmation result is transmitted periodically at a fixed interval, but is not limited to this. For example, the transmission interval of the confirmation result may be gradually increased as time passes since the abnormality was first detected, or may be irregular.

[0048] Details of the abnormality continuation confirmation in step S801 will be described with reference to FIG. 9. In step S901, the abnormality detection unit 201 of the device A102 performs abnormality detection again to confirm whether the abnormality notified to the server 101 continues or not. If it is determined that the abnormality continues by this abnormality detection (YES in S901), the process proceeds to step S902. In step S902, the generation unit 202 of the device A102 generates an abnormality continuation notification message, and in step S903, the notification unit 203 of the device A102 transmits the abnormality continuation notification message to the server 101. On the other hand, if it is determined that the abnormality has been resolved (NO in step S901), the process proceeds to step S904. In step S904, the generation unit 202 of the device A102 generates an abnormality resolution notification message, and in step S905, the notification unit 203 of the device A102 transmits this abnormality resolution notification message to the server 101.

[0049] In step S802, if the abnormality has been resolved or if the device A102 has performed a predetermined number of abnormality continuation checks (YES in step S802), the device A102 ends the abnormality continuation check process (step S801). If the condition is not met (NO in step S802), the abnormality continuation check (step S801) is repeated. Note that in the judgment in step S802, the passage of a specified time (the passage of a specified time from the start of the abnormality continuation check) may be used as a condition instead of or in combination with the specified number of times.

[0050] On the other hand, if the server 101 determines in step S442 that verification is necessary, the notification receiving unit 204 continues to receive a notification message (abnormality continuation notification message or abnormality resolution notification message) from the device A102 in step S841. In step S842, the verification unit 215 of the server 101 verifies the abnormal state of the device A102 using a verification criterion that has been defined in advance. The verification criterion is, for example, any one of the duration, the number of notifications, and the frequency of the abnormality notification or abnormality continuation notification, or a combination of two or more of them.

[0051] The verification process in step S842 will be described with reference to the flowchart in FIG. 9. In step S910, the verification unit 215 of the server 101 judges whether the abnormality notification message received in step S841 is an abnormality continuation notification message or an abnormality resolution notification message. If the verification unit 215 judges that the abnormality notification message is an abnormality continuation notification message (NO in step S910), the process proceeds to step S911. In step S911, the verification unit 215 judges whether the elapsed time from the start of reception of the abnormality continuation notification message is within a specified time, and whether the cumulative number, which is the number of receptions of the abnormality continuation notification message, is within a specified number. If the verification unit 215 judges that the elapsed time is within the specified time and that the cumulative number is within the specified number (YES in step S911), the process returns to step S910. On the other hand, if the verification unit 215 judges that the elapsed time has exceeded the specified time or that the cumulative number has exceeded the specified number, the process proceeds to step S913. In step S913, the verification unit 215 sets an abnormality flag. As a result, in step S444, it is determined that an abnormality has occurred as a result of the verification process. On the other hand, if verification unit 215 determines that an abnormality resolution notification message has been received (YES in step S910), the process proceeds to step S912. In step S912, verification unit 215 sets a normal flag. As a result, in step S444, it is determined that no abnormality has occurred as a result of the verification process.

[0052] In the above, both of the predefined verification criteria are used: "When the abnormality continuation notification message is repeatedly received for more than a specified time, it is determined that an abnormality has occurred" and "When the abnormality continuation notification message is repeatedly received for more than a specified number of times, it is determined that an abnormality has occurred". However, the present invention is not limited to this, and either the specified time or the specified number of times may be used, or other criteria may be used. For example, the above example is an example in which verification is performed using the continuity of the occurrence of an abnormality, but verification can also be performed using the frequency of occurrence of an abnormality. For example, the verification unit 215 may measure the number of times the abnormality continuation notification message is received within a specified time, that is, the frequency, and may determine that an abnormality has occurred when the frequency exceeds a threshold value. When such a frequency is used, for example, even in a case in which the occurrence and resolution of an abnormality are repeated, the occurrence of an abnormality can be correctly verified. In addition, the abnormality continuation notification message may be a specific notification message indicating that the abnormality is continuing, or may be a message having the same content as the abnormality notification message generated in step S402. When the abnormality notification message is used as the abnormality continuation notification message, the server 101 may analyze the received abnormality notification message to determine the continuation of the abnormality.

[0053] As described above, according to the third embodiment, it is possible to verify the abnormality notification of a device in which an abnormality has occurred and to improve the accuracy of judging the abnormal state. In other words, it is possible to accurately judge the validity of the notified abnormality. In addition, although an example in which the third embodiment is applied to the first embodiment has been shown above, it is clear that the third embodiment may also be applied to the second embodiment.

[0054] [Fourth embodiment] The operation of the system according to the fourth embodiment will be described with reference to the flowchart in Fig. 10. The flowchart in Fig. 10 shows another example of the verification process of step S443 shown in the first embodiment (Fig. 4) by steps S1001 and S1041. Note that the process shown in Fig. 10 is the process shown in the third embodiment (Fig. 8) with the addition of steps S1001 and S1041.

[0055] In step S1041, the verification unit 215 of the server 101 transmits a request for reconfirmation of the abnormal state to the device A102 via the communication unit 209. In step S1001, when the abnormality detection unit 201 of the device A102 receives the reconfirmation request transmitted from the server 101 via the communication unit 209, the abnormality detection unit 201 of the device A102 executes the abnormality continuation confirmation (steps S801 to S802) described in the third embodiment, using the reconfirmation request as a trigger. Note that, although the reconfirmation request transmitted from the server 101 is one in FIG. 10, this is not limited to this. The issuance of the reconfirmation request may be specified between the server 101 and the device A102, and for example, one abnormality continuation confirmation may be performed every time a confirmation request is transmitted. In this case, for example, the server 101 may transmit the reconfirmation request periodically at a certain interval, or may gradually increase the interval at which the reconfirmation request is transmitted as time elapses since the abnormality was first detected. In step S801, the abnormality detection unit 201 of the device A102 transmits the confirmation result of the abnormal state to the server 101. Note that the information transmitted from the device A102 may include not only the abnormal state but also detailed information related to the abnormality.

[0056] As described above, according to the fourth embodiment, it is possible to verify the abnormality notification of the device in which an abnormality has occurred and improve the accuracy of judging the abnormal state. Also, the fourth embodiment has been described as being applied to the first embodiment, but is not limited to this. It is clear that the fourth embodiment may be applied to the second embodiment.

[0057] [Fifth embodiment] In the above embodiment, an example has been shown in which a notification of an abnormality is received only from a device that has caused the abnormality (e.g., device A102). However, the present disclosure is not limited to this, and a notification of an abnormality can be received from a device (e.g., device B103) other than the device that has caused the abnormality (e.g., device A102). The fifth embodiment describes such an information processing system.

[0058] An operation example of the system according to the fifth embodiment will be described with reference to the flowchart of FIG. 11. In the flowchart shown in FIG. 11, the same step numbers are assigned to processes similar to those shown in the first embodiment (FIG. 4). In the fifth embodiment, the device B103 is assumed to be present within a range in which the device A102 can detect an abnormality. The range in which the abnormality can be detected may be, for example, a range in which the device B103 is present in the vicinity in terms of distance, or, if the abnormality can be detected by communication, may be distant in terms of distance as long as the communication is possible. In addition, in the example of V2X (Vehicle to X), the range in which the abnormality can be detected may be a surrounding vehicle, or may be a device in the vicinity of the vehicle such as a roadside unit. In addition, although the device B103 is illustrated as one in this embodiment, there may be one or more, and there is no restriction on the number of devices.

[0059] In step S1161, the abnormality detection unit 201 of the device B103, which exists within a range where the abnormality of the device A102 can be detected, detects the abnormality of the device A102. Specific configurations for the abnormality detection unit 201 of the device B103 to detect the abnormality of the device A102 include, for example, a configuration in which the abnormality of the device A102 is detected using a camera or the like, and a configuration in which the abnormality is detected by making an inquiry to the device A102 using communication via the communication unit 209. In addition, for example, a configuration in which the abnormality of the device A102 is detected by detecting the abnormality of a message from the device A102 received via the communication unit 209 may be used, and the method of detecting the abnormality by the abnormality detection unit 201 is not limited to these examples. When the abnormality detection unit 201 detects the abnormality of the device A102 (YES in step S1161), the process proceeds to step S1162. In step S1162, the generation unit 202 of the device B 103 generates an abnormality notification message for the device A 102 detected in step S1161. In step S1163, the notification unit 203 of the device B 103 transmits the generated abnormality notification message to the server 101.

[0060] In step S1141, the server 101 receives an abnormality notification message from the device B103. In step S441, the notification receiving unit 204 of the server 101 receives an abnormality notification message transmitted from the device A102. In step S442, the judgment unit 213 judges whether or not the abnormality notification message received by the notification receiving unit 204 needs to be verified by the verification function. If it is judged in step S442 that "verification" is needed, the process proceeds to step S443. In step S443, the verification unit 215 of the server 101 uses the abnormality notification message received from the device B103 in step S1141 to verify the abnormality notified from the device A102. For example, the verification unit 215 compares the abnormality notification message received from the device A102 with the abnormality notification message regarding the device A102 received from the device B103, and sets an abnormality flag if the abnormality contents match. Alternatively, the verification unit 215 sets an abnormality flag when it receives an abnormality notification message related to the device A102 from, for example, a plurality of devices B103 or a predetermined number or more of devices B103. Here, in Fig. 11, step S1141 is illustrated as a process prior to step S441, but step S1141 only needs to be executed prior to step S443, and the order of the processes is not limited to the order illustrated. Also, the server 101 stores the abnormality notification received in step S1141 in a database or the like so that it can be used for verification in step S443.

[0061] As described above, according to the fifth embodiment, the abnormality notification of a device in which an abnormality has occurred can be verified from a third party's perspective, and the accuracy of determining the abnormal state can be improved. Furthermore, even if the abnormality detection unit 201, the generation unit 202, and the notification unit 203 of the device A102 fail and the device A102 sends an abnormality notification even though the device A102 is normal, the server 101 can correctly determine the state of the device A102. Note that the fifth embodiment has been described as being applied to the first embodiment, but is not limited to this. For example, it is clear that the fifth embodiment can be applied to the second embodiment.

[0062] [Sixth embodiment] The operation of the system according to the sixth embodiment will be described with reference to the flowchart of FIG. 12. In the flowchart shown in FIG. 12, the same process as that shown in the first embodiment (FIG. 4) is assigned the same step number. As in the fifth embodiment, the device B103 is assumed to be present within a range in which it can detect an abnormality in the device A102, and the number of the devices B103 may be at least one. In the fifth embodiment, the device B103 present within a range in which it can detect an abnormality in the device A102 detects an abnormality in the device A and notifies the server 101 of the abnormality. In the sixth embodiment, the server 101 requests the device B103 present within a range in which it can detect an abnormality in the device A102 to detect an abnormality in the device A102. The device B103 that receives the request detects an abnormality in the device A and notifies the server 101.

[0063] In step S1241, the verification unit 215 of the server 101 transmits an abnormality confirmation inquiry to a device (also called a peripheral device) within a range where the abnormality of the device A102 can be detected in order to confirm the validity of the abnormality notification from the device A102. Here, the server 101 specifies the device B103 as one of the peripheral devices, and the verification unit 215 transmits the abnormality confirmation inquiry to the device B103. Note that, in this example, a configuration is used in which an inquiry is made to a device specified as a peripheral device, but this is not limited to this. For example, an abnormality confirmation inquiry of the device A102 may be broadcast, and a confirmation result may be received from a device capable of confirming the abnormality of the device A102. In step S1261, the device B103, which is a peripheral device of the device A102, receives the abnormality confirmation inquiry from the server 101 via the communication unit 209. In step S1262, the device B103 uses the abnormality detection unit 201 to investigate the abnormality content of the device A102 specified by the server 101. For example, if it is necessary to check the appearance, if the device B103 is a vehicle, the state of the device A102 is checked using an on-board camera. For example, if the device B103 is a roadside unit (such as a communication device, sensor, or display installed at the side of the road (roadside)), the state of the device A102 is checked using a camera of the roadside unit. The device B103 may also communicate with the device A102 using the communication unit 209 to check for abnormalities. In this way, the device B103 conducts an investigation depending on the confirmed abnormality, but the checking method is not limited. It should be noted that whether the device B103 is a peripheral device of the device A102 or not can be specified based on, for example, the relationship between the current position of the device A102 and the position of the device B103.

[0064] In step S1263, the abnormality detection unit 201 of the device B103 judges whether or not an abnormality in the device A102 has been detected as a result of the abnormality investigation as described above. If it is judged that an abnormality has been detected (YES in step S1263), in step S1264, the abnormality detection unit 201 of the device B103 sets an abnormality flag. If it is judged that an abnormality has not been detected (NO in step S1263), in step S1265, the abnormality detection unit 201 of the device B103 sets a normality flag. In step S1266, the generation unit 202 of the device B103 generates an abnormality confirmation notification message depending on whether the abnormality flag or the normality flag has been set. In step S1267, the device B103 transmits the abnormality confirmation notification message to the server 101 via the notification unit 203. In step S1242, the server 101 receives an abnormality confirmation notification message indicating the abnormality confirmation result from the device B 103, and the verification unit 215 uses this in the verification process to determine the validity of the abnormality notification from the device A 102.

[0065] As a method of verification, for example, when the confirmation result from the device B103 indicates an abnormality, it is determined that the abnormality notified to the device A102 has occurred. In addition, the verification method described in the fifth embodiment may be used. For example, when the verification unit 215 receives an abnormality confirmation notification message indicating an abnormality occurrence regarding the device A102 from a plurality of devices B103 or from a predetermined number or more of devices B103, it determines that an abnormality has occurred in the device A102. Alternatively, the verification unit 215 compares the abnormality notification message received from the device A102 with the abnormality confirmation notification message regarding the device A102 received from the device B103, and if the abnormality contents match, it determines that an abnormality has occurred in the device A102. However, in this case, it is necessary for the device B103 to determine the abnormality contents of the device A102 and include the determined abnormality contents in the abnormality confirmation notification message.

[0066] [Seventh embodiment] 2 and 5 may be implemented by hardware or software (computer program). In the latter case, a computer device (information processing device) capable of executing the computer program is applicable to the server 101, device A102, and device B103. An example of the hardware configuration of a computer device applicable to the server 101, device A102, and device B103 will be described with reference to the block diagram of FIG.

[0067] The CPU 1301 executes various processes using computer programs and data stored in the RAM 1302 and the ROM 1303. As a result, the CPU 1301 controls the operation of the entire computer device, and executes or controls each of the processes described above as being performed by the server 101, device A 102, and device B 103 to which the computer device is applied.

[0068] The RAM 1302 has an area for storing computer programs and data loaded from the ROM 1303 or the external storage device 1306, and an area for storing data received from the outside via the I / F 1307. The RAM 1302 further has a work area used when the CPU 1301 executes various processes. In this way, the RAM 1302 can provide various areas as appropriate. The ROM 1303 stores setting data for the computer device, computer programs and data related to the startup of the computer device, computer programs and data related to the basic operation of the computer device, and the like.

[0069] The operation unit 1304 is a user interface such as a keyboard, a mouse, a touch panel, etc., and can be operated by a user to input various instructions to the CPU 1301. For example, the user can operate the above-mentioned various applications 290 using the operation unit 1304. The display unit 1305 is a display device having a liquid crystal screen or a touch panel screen, and can display the processing results by the CPU 1301 as images, characters, etc. The display unit 1305 may be a projection device such as a projector that projects images and characters.

[0070] The external storage device 1306 is a large-capacity information storage device such as a hard disk drive device. The external storage device 1306 stores computer programs and data for causing the CPU 1301 to execute or control the various processes described above as being performed by the OS, the server 101, the device A102, and the device B103. The data stored in the external storage device 1306 includes the data (certificates, serial numbers, CRLs, etc.) described above as being managed by each of the server 101, the device A102, and the device B103. The computer programs and data stored in the external storage device 1306 are loaded into the RAM 1302 as appropriate under the control of the CPU 1301, and become targets for processing by the CPU 1301.

[0071] The I / F 1307 is a communication interface for performing data communication with an external device via the network 104. When multiple networks are prepared according to communication purposes, the I / F 1307 may have an I / F for connecting to each network.

[0072] The CPU 1301, RAM 1302, ROM 1303, operation unit 1304, display unit 1305, external storage device 1306, and I / F 1307 are all connected to a system bus 1308. Note that a computer device having the hardware configuration example of Fig. 13 may be applied to each of the server 101, device A102, and device B103, or a computer device having a different hardware configuration may be applied to each of the server 101, device A102, and device B103.

[0073] In addition, the numerical values, processing timing, processing order, processing subject, data (information) configuration / acquisition method / sending destination / sending source / storage location, etc. used in each of the above embodiments are given as examples for the purpose of concrete explanation, and are not intended to be limited to such examples. In addition, some or all of the above-described embodiments may be used in appropriate combination. In addition, some or all of the above-described embodiments may be used selectively.

[0074] (Other embodiments) The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions.

[0075] The invention of this specification includes the following information processing system, information processing device, information processing method, and computer program. (Item 1) An information processing system having a first device and a second device communicatively connected to each other, The first device is A detection means for detecting an abnormality; a notification means for notifying the second device of an abnormality when the detection means detects an abnormality, The second device is a receiving means for receiving a notification of the abnormality from the notifying means; an acquisition means for acquiring information relating to the abnormality from the first device and / or another device of the information processing system in response to the reception means receiving the notification of the abnormality; a verifying unit that verifies the validity of the notification of the abnormality based on the information acquired by the acquiring unit. (Item 2) the notification means, after notifying the abnormality, notifies the second device of a result of the detection of the abnormality by the detection means; 2. The information processing system according to item 1, wherein the verification means verifies the notification of the abnormality received by the receiving means based on the notification of the result. (Item 3) The verification means requests the first device to confirm an abnormality, 3. The information processing system according to item 2, wherein the notification means notifies the second device of the result in response to the request. (Item 4) 4. The information processing system according to item 2 or 3, wherein the notification of the result by the notification means is repeated periodically at regular intervals. (Item 5) 4. The information processing system according to item 2 or 3, wherein the notification of the result by the notification means is repeated with gradually increasing intervals over time. (Item 6) The information processing system according to any one of items 2 to 5, wherein the verification means verifies the notification of the abnormality based on whether or not the notification of the result indicating that the abnormality has been detected has been received repeatedly more than a specified number of times, whether or not it has been received repeatedly more than a specified time, or whether or not it has been received with a frequency exceeding a threshold. (Item 7) the information processing system further includes at least one third device that detects an abnormality in the first device and notifies the second device of the result; The information processing system according to any one of items 1 to 6, characterized in that the verification means verifies the validity of the notification of the abnormality received from the first device based on the notification of the result from the third device. (Item 8) the verification means requests the third device to confirm an abnormality in the first device; 8. The information processing system according to item 7, wherein the third device transmits to the second device the results of confirming the abnormality of the first device in response to the confirmation request from the second device. (Item 9) The information processing system according to item 8, characterized in that the verification means performs the verification based on the abnormality content indicated in the result notification received from the third device and the abnormality content indicated in the abnormality notification received from the first device. (Item 10) The information processing system according to any one of items 1 to 9, characterized in that the second device further comprises a post-processing means for performing post-processing corresponding to the abnormality based on a result of the verification by the verification means. (Item 11) 11. The information processing system according to item 10, wherein the post-processing includes a process of revoking a certificate used by the first device in the information processing system. (Item 12) The information processing system described in item 11, characterized in that the second device further comprises a transmitting means for transmitting management information including the revocation status of the certificate of the first device to another device in the information processing system in response to a request from the other device. (Item 13) a determination unit that determines the content of the abnormality based on information included in the notification of the abnormality received by the receiving unit, 13. The information processing system according to any one of items 1 to 12, wherein the verification means determines whether or not to execute the verification based on a result of the determination by the determination means. (Item 14) The verification means performs the verification when the abnormality is determined to be of a first type, Item 14. The information processing system according to item 13, characterized in that if the abnormality is determined to be a second type different from the first type, post-processing corresponding to the abnormality is executed without performing the verification. (Item 15) A receiving means for receiving a notification of an abnormality of a first device detected by the first device, which is an external device; an acquisition means for acquiring information relating to the abnormality from the first device and / or an external device other than the first device in response to the reception means receiving the notification of the abnormality; a verifying unit that verifies the validity of the notification of the abnormality based on the information acquired by the acquiring unit. (Item 16) a receiving step of receiving a notification of an abnormality of a first device, the abnormality being detected by the first device which is an external device; an acquisition step of acquiring information relating to the abnormality from the first device and / or an external device other than the first device in response to receiving the notification of the abnormality in the receiving step; a verification step of verifying the validity of the notification of the abnormality based on the information acquired in the acquisition step. (Item 17) A computer program for causing a computer to function as each of the means of the information processing device described in item 15.

[0076] The invention is not limited to the above-described embodiments, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0077] 101: Server, 102: Device A, 103: Device B, 201: Anomaly detection unit, 202: Generation unit, 203: Notification unit, 204: Notification reception unit, 205: Post-processing unit, 213: Determination unit, 214: Importance determination unit, 215: Verification unit,

Claims

1. An information processing system having a first device and a second device communicatively connected to each other, The first device is A detection means for detecting an abnormality; a notification means for notifying the second device of an abnormality when the detection means detects an abnormality, The second device is a receiving means for receiving a notification of the abnormality from the notifying means; an acquisition means for acquiring information relating to the abnormality from the first device and / or another device of the information processing system in response to the reception means receiving the notification of the abnormality; a verifying unit that verifies the validity of the notification of the abnormality based on the information acquired by the acquiring unit.

2. the notification means, after notifying the abnormality, notifies the second device of a result of the detection of the abnormality by the detection means; 2. The information processing system according to claim 1, wherein said verifying means verifies said notification of said abnormality received by said receiving means based on said notification of said result.

3. The verification means requests the first device to confirm an abnormality, 3. The information processing system according to claim 2, wherein the notification means notifies the second device of the result in response to the request.

4. 3. The information processing system according to claim 2, wherein the notification of the result by the notification means is repeated periodically at a fixed interval.

5. 3. The information processing system according to claim 2, wherein the notification of the result by the notification means is repeated with the intervals gradually increasing as time passes.

6. 3. The information processing system according to claim 2, wherein the verification means verifies the notification of the abnormality based on whether the notification of the result indicating that the abnormality has been detected has been received repeatedly more than a specified number of times, whether the notification has been received repeatedly more than a specified time, or whether the notification has been received with a frequency exceeding a threshold value.

7. the information processing system further includes at least one third device that detects an abnormality in the first device and notifies the second device of the result; 2. The information processing system according to claim 1, wherein the verification means verifies the validity of the notification of the abnormality received from the first device based on the notification of the result from the third device.

8. the verification means requests the third device to confirm an abnormality in the first device; 8. The information processing system according to claim 7, wherein the third device transmits a result of confirming an abnormality in the first device to the second device in response to the request for confirmation from the second device.

9. 9. The information processing system according to claim 8, characterized in that the verification means performs the verification based on the abnormality content indicated in the result notification received from the third device and the abnormality content indicated in the abnormality notification received from the first device.

10. 2. The information processing system according to claim 1, wherein the second device further comprises a post-processing unit that executes a post-processing process corresponding to the abnormality based on a result of the verification by the verifying unit.

11. 11. The information processing system according to claim 10, wherein the post-processing includes a process of revoking a certificate used by the first device in the information processing system.

12. 12. The information processing system according to claim 11, characterized in that the second device further comprises a transmission means for transmitting management information including a revocation status of the certificate of the first device to another device of the information processing system in response to a request from the other device.

13. a determination unit that determines the content of the abnormality based on information included in the notification of the abnormality received by the receiving unit, 2. The information processing system according to claim 1, wherein said verifying means determines whether or not to execute said verification based on a result of the determination by said determining means.

14. The verification means performs the verification when the abnormality is determined to be of a first type, 14. The information processing system according to claim 13, wherein if the abnormality is determined to be a second type different from the first type, post-processing corresponding to the abnormality is executed without performing the verification.

15. A receiving means for receiving a notification of an abnormality of the first device detected by a first device which is an external device; an acquisition means for acquiring information relating to the abnormality from the first device and / or an external device other than the first device in response to the reception means receiving the notification of the abnormality; a verifying unit that verifies the validity of the notification of the abnormality based on the information acquired by the acquiring unit.

16. a receiving step of receiving a notification of an abnormality of the first device detected by a first device which is an external device; an acquisition step of acquiring information related to the abnormality from the first device and / or an external device other than the first device in response to receiving the notification of the abnormality in the receiving step; a verification step of verifying the validity of the notification of the abnormality based on the information acquired in the acquisition step.

17. A computer program for causing a computer to function as each of the means of the information processing device according to claim 15.

Images