Monitoring device, monitoring system, monitoring method and program

Abstract

To appropriately determine the status of equipment while suppressing information leakage and increased computational load. [Solution] The monitoring device includes: an acquisition unit that acquires first encrypted data, which is data encrypted using a first method in which first data relating to the monitored device is TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; an index value calculation unit that calculates a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; a conversion unit that converts the second encrypted index value into a first encrypted index value encrypted using the first method; and a determination unit that calculates an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

Description

Technical Field

[0001] The present disclosure relates to a monitoring device, a monitoring system, a monitoring method, and a program.

Background Art

[0002] In order to suppress information leakage about devices to be monitored, a technique of encrypting device data and performing device monitoring based on the encrypted data is known. For example, Patent Document 1 describes encrypting data of a user system and transmitting it to a non-decryptable cloud service, and in the non-decryptable cloud service, determining whether the encrypted data satisfies specifications and outputting the determination result. Also, Non-Patent Document 1 describes a technique of performing secret calculation using data encrypted by the TFHE (fully homomorphic encryption) method and outputting the determination result about the data in a state encrypted by the TFHE method. Further, Non-Patent Document 2 describes performing secret calculation for calculating an index value used to determine the presence or absence of an abnormality of a device using data encrypted by the CKKS (Cheon-Kim-Kim-Song) method, converting the result to the TFHE method, performing secret calculation for performing an abnormality determination on the data converted to the TFHE method, and outputting the determination result in a state encrypted by the TFHE method.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Non-Patent Document 1

[0004] Patent Document 1 can suppress data leakage from the device, but the judgment results are output in an unencrypted state, so there is a risk of the judgment results being leaked. Non-Patent Document 1 can suppress data leakage by using the TFHE method to output the judgment results in an encrypted state. However, the TFHE method's secure computation can determine whether the data itself is abnormal or not, but it cannot determine the state of the device that is not reflected in the device data itself. Furthermore, Non-Patent Document 2 can perform abnormality detection on index values ​​calculated from the device data, but the process of converting CKKS ciphertext to TFHE encryption is computationally intensive, so it is desirable to CKKS encrypt only the data related to the calculation of the index value. Therefore, there is room for improvement in order to appropriately determine the state of the device while appropriately suppressing information leakage and increased computational load.

[0005] This disclosure aims to solve the aforementioned problems and to provide a monitoring device, monitoring system, monitoring method, and program that can appropriately determine the status of equipment while appropriately suppressing information leakage and increased computational load. [Means for solving the problem]

[0006] The monitoring device relating to this disclosure includes: an acquisition unit that acquires first encrypted data, which is data encrypted using a first method in which first data relating to a monitored device is TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; an index value calculation unit that calculates a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; a conversion unit that converts the second encrypted index value into a first encrypted index value encrypted using the first method; and a determination unit that calculates an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

[0007] The monitoring system relating to this disclosure comprises the monitoring device and a management device that encrypts the first data to generate the first encrypted data, encrypts the second data to generate the second encrypted data, and transmits the first encrypted data and the second encrypted data to the monitoring device.

[0008] The monitoring method relating to this disclosure includes the steps of: acquiring first encrypted data, which is data encrypted using a first method in which first data relating to a device to be monitored is TFHE; and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; calculating a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; converting the second encrypted index value into a first encrypted index value encrypted using the first method; and calculating an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

[0009] The program relating to this disclosure causes a computer to perform the following steps: acquire first encrypted data, which is data encrypted using a first method in which first data relating to a monitored device is TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; calculate a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; convert the second encrypted index value into a first encrypted index value encrypted using the first method; and calculate an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value. [Effects of the Invention]

[0010] According to this disclosure, it is possible to appropriately determine the status of the equipment while appropriately suppressing information leakage and increased computational load. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 is a schematic block diagram of the monitoring system according to the embodiment. [Figure 2] Figure 2 is a schematic block diagram of the control device. [Figure 3] Figure 3 is a schematic block diagram of the monitoring device. [Figure 4] Figure 4 is a flowchart illustrating the process of obtaining the key. [Figure 5] Figure 5 is a flowchart illustrating the generation of an automaton. [Figure 6] Figure 6 is a schematic diagram illustrating the monitoring process. [Figure 7] Figure 7 is a flowchart illustrating the processing flow of the monitoring process according to the embodiment. [Figure 8] Figure 8 is a schematic diagram illustrating the monitoring process in the second embodiment. [Modes for carrying out the invention]

[0012] Hereinafter, referring to the accompanying drawings, preferred embodiments of the present disclosure will be described in detail. Note that the present disclosure is not limited by this embodiment, and when there are multiple embodiments, those configured by combining each embodiment are also included.

[0013] (Monitoring System) FIG. 1 is a schematic block diagram of the monitoring system according to this embodiment. The monitoring system 1 according to this embodiment is a system for monitoring whether there is an abnormality in the operation of the device 100 to be monitored. As shown in FIG. 1, the monitoring system 1 includes a management device 10 and a monitoring device 12. In the example of FIG. 1, there is one device 100 to be monitored, but the number of devices 100 may be plural, and the monitoring system 1 may monitor a plurality of devices 100. Also, in this embodiment, the monitoring device 12 is provided at a location (separate facility) away from the device 100 and the management device 10, and the management entity of the monitoring device 12 is different from the management entities of the device 100 and the management device 10. Also, both the device 100 and the management device 10 may be provided at separate locations (separate facilities), and the management entity of the device 100 and the management entity of the management device 10 may be different. However, the management entity of the device 100 and the management entity of the management device 10 may be the same.

[0014] (Device) The device 100 is a device to be monitored by the monitoring system 1. The device 100 may be composed of one device or a system composed of a plurality of devices. The device 100 may be a device for any application, for example, a device provided in a plant or the like, or a moving body or the like.

[0015] In this embodiment, the monitoring system 1 monitors the device 100 based on device data. The device data is data related to the device 100.

[0016] (Management Device) FIG. 2 is a schematic block diagram of the management device. The management device 10 is a device that acquires the device data of the device 100 and can also be said to be a device that manages the device 100. The management device 10 may be a device that also has the function of a control device for controlling the device 100 (that is, a device integrated with the control device), or may be a device different from the control device for controlling the device 100 (that is, a device separate from the control device). As shown in FIG. 2, the management device 10 is a computer and includes an input unit 20, an output unit 22, a communication unit 24, a storage unit 26, and a control unit 28. Note that the management device 10 may be configured as a single device, may be configured integrally with other devices, or may be configured as a system combining various devices such as an arithmetic device and a data server, and is not particularly limited.

[0017] The input unit 20 is a device that receives a user's operation and may be, for example, a mouse, a keyboard, a touch panel, or the like. The output unit 22 is a device that outputs information and may be, for example, a display that displays an image. The communication unit 24 is a module that communicates with external devices such as the device 100 and the monitoring device 12 and may include, for example, an antenna. The communication method by the communication unit 24 is wireless communication in the present embodiment, but the communication method may be arbitrary.

[0018] The storage unit 26 is a memory that stores various information such as the calculation content and programs of the control unit 28 and includes, for example, at least one of a main storage device such as a RAM (Random Access Memory) and a ROM (Read Only Memory), and an external storage device such as an HDD (Hard Disk Drive). The program for the control unit 28 stored in the storage unit 26 may be stored in a recording medium readable by the management device 10.

[0019] The control unit 28 is an arithmetic device and includes an arithmetic circuit such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The control unit 28 executes processing by reading a program (software) from the storage unit 26 and executing it.

[0020] The control unit 28 includes a key generation unit 30, a data acquisition unit 32, an encryption unit 34, a decryption unit 36, and an output control unit 38. The control unit 28 reads a program (software) from the storage unit 26 and executes it to realize the key generation unit 30, the data acquisition unit 32, the encryption unit 34, the decryption unit 36, and the output control unit 38, and then executes their processing. The control unit 28 may execute these processes using a single arithmetic circuit, or it may have multiple arithmetic circuits and execute the processing using those multiple arithmetic circuits. Furthermore, at least a portion of the processing of the key generation unit 30, the data acquisition unit 32, the encryption unit 34, the decryption unit 36, and the output control unit 38 may be realized by hardware circuits.

[0021] The processing performed by the control unit 28 will be described later.

[0022] (monitoring device) Figure 3 is a schematic block diagram of the monitoring device. The monitoring device 12 is a device that monitors equipment 100. As shown in Figure 3, the monitoring device 12 is a computer and has an input unit 40, an output unit 42, a communication unit 44, a storage unit 46, and a control unit 48. The monitoring device 12 may be configured as a standalone device, as an integral part of other devices, or as a system combining various devices such as a computing unit and a data server, and is not particularly limited.

[0023] The input unit 40 is a device that accepts user input and may be, for example, a mouse, keyboard, or touch panel. The output unit 42 is a device that outputs information and may be, for example, a display that shows images. The communication unit 44 is a module that communicates with external devices such as the management device 10 and may include, for example, an antenna. In this embodiment, the communication method used by the communication unit 44 is wireless communication, but the communication method may be arbitrary. In this embodiment, the monitoring device 12 does not communicate directly with the device 100 and is configured not to acquire device data from the device 100.

[0024] The memory unit 46 is a memory that stores various information such as the calculation contents and programs of the control unit 48, and includes at least one of the following: RAM, main memory such as ROM, and external storage device such as HDD. The program for the control unit 48 stored in the memory unit 46 may be stored on a recording medium that can be read by the monitoring device 12.

[0025] The control unit 48 is an arithmetic unit and includes arithmetic circuits such as a CPU or GPU. The control unit 48 executes processing by reading and executing a program (software) from the storage unit 46.

[0026] The control unit 48 includes an acquisition unit 50, a specification setting unit 52, an index value calculation unit 54, a conversion unit 56, a determination unit 58, and an output control unit 60. The control unit 48 reads a program (software) from the storage unit 46 and executes it to realize the acquisition unit 50, the specification setting unit 52, the index value calculation unit 54, the conversion unit 56, the determination unit 58, and the output control unit 60, and then performs their processing. The control unit 48 may perform these processing using one arithmetic circuit, or it may have multiple arithmetic circuits and perform the processing using those multiple arithmetic circuits. Furthermore, at least a part of the processing of the acquisition unit 50, the specification setting unit 52, the index value calculation unit 54, the conversion unit 56, the determination unit 58, and the output control unit 60 may be realized by hardware circuits.

[0027] The processing performed by the control unit 48 will be described later.

[0028] (Processing by the monitoring system) The following describes the processing of monitoring system 1.

[0029] The monitoring system 1 remotely monitors the device 100 by acquiring the device data in an encrypted state using the monitoring device 12 and outputting the status determination result of the device 100 in an encrypted state. More specifically, the management device 10 encrypts the first data from the device data using the first method to obtain the first encrypted data, and encrypts the second data from the device data using the second method to obtain the second encrypted data. The monitoring device 12 then calculates a second encrypted index value, which is an index value indicating the status of the device 100 encrypted using the second method, based on the second encrypted data, and converts the second encrypted index value back into the first encrypted index value encrypted using the first method. The monitoring device 12 then calculates the status determination result of the device 100 in an encrypted state, based on the first encrypted data for the first data and the first encrypted index value for the second data. An explanation of encryption methods such as the first and second methods will be provided later.

[0030] (Data 1) The first data may be any data included in the equipment data, but in this embodiment, it is information indicating the operating conditions of the equipment 100 (under what conditions it is operating). In this embodiment, the first data can also be described as a variable whose number of possible values ​​is limited to a predetermined number or less. In this embodiment, the first data is time-series data (data whose value may change over time). For example, the first data may be an index value indicating the state of the environment around the equipment 100 (such as weather, temperature, and atmospheric pressure), a flag indicating the operating conditions of the equipment 100, or information indicating the operating mode of the equipment 100.

[0031] (Second data) The second data is time-series data (data whose value can change over time) included in the equipment data. The second data may be any time-series data included in the equipment data, but in this embodiment it is different from the first data. More specifically, in this embodiment the second data is data indicating the operating state of equipment 100 (what state equipment 100 is in as a result of operation). In this embodiment, the second data can also be said to be a variable in which the number of possible values ​​is greater than that of the first data (greater than a predetermined number). For example, the second data may be measured values ​​of the operating state of equipment 100 (e.g., temperature, pressure, speed of equipment 100).

[0032] (Indicator value) Furthermore, the index value refers to a value that indicates the state of device 100, calculated from the second data. In other words, the index value is not the data itself contained in the device data, but rather a feature that indicates the state of device 100, calculated using the second data. The index value may be a feature calculated from one type of second data, or it may be a feature calculated from multiple types of second data.

[0033] (Pre-processing) In this embodiment, the monitoring system 1 performs the following preprocessing steps in order to monitor the equipment 100 using the monitoring device 12 (i.e., calculate the result of determining the state of the equipment 100): obtaining an encryption key and generating an automaton for calculating the result of determining the state of the equipment 100. In other words, the monitoring system 1 monitors the equipment 100 only after these preprocessing steps are completed. The preprocessing steps will be described in detail below.

[0034] (Obtaining the key) Figure 4 is a flowchart illustrating key acquisition. The key generation unit 30 of the management device 10 acquires the keys necessary for monitoring the device 100. Here, the key is data used to execute an algorithm that converts data into other data. As shown in Figure 4, in this embodiment, the key generation unit 30 acquires a first key, which is an encryption key for the first method; a second key, which is an encryption key for the second method, which is different from the first method; a calculation key for calculating an index value indicating the status of the device from the device data encrypted with the second method; and a conversion key for converting the data encrypted with the second method into data encrypted with the first method (step S10).

[0035] The first key is the encryption key for the first scheme. The first scheme is the TFHE (Fully Homomorphic Encryption) scheme. In other words, the first key is the data used to encrypt data using the first scheme (TFHE scheme) and to decrypt data encrypted using the first scheme (TFHE scheme). The key generation unit 30 may obtain the first key by any method, generate the first key by any method, or obtain the first key from another device.

[0036] The second key is the encryption key for the second method. In other words, the second key is the data used to encrypt data using the second method and to decrypt data encrypted using the second method. The second method is an encryption method different from the first method (TFHE method). More specifically, in this embodiment, the second method is an encryption method that can calculate an index value indicating the state of device 100 based on device data encrypted using that method (second method), while the data is encrypted using that method (second method). In other words, the second method is an encryption method that can calculate an encrypted index value from encrypted device data using secure computation. Furthermore, in this embodiment, the second method is an encryption method that can convert data encrypted using that method (second method) into data encrypted using the first method, or in other words, an encryption method that can directly convert data from the second method into data from the first method without decryption. An example of the second method is the CKKS (Cheon-Kim-Kim-Song) method. The key generation unit 30 may obtain the second key by any means, generate the second key by any means, or obtain the second key from another device.

[0037] The calculation key is a key (data) for calculating an index value indicating the state of device 100 from device data encrypted using the second method, while the index value remains encrypted using the second method. In other words, the calculation key is a key for performing the process of calculating an index value encrypted using the second method from device data encrypted using the second method, using secure computation. In this embodiment, the calculation key is a key for performing relinearization processing to reduce the dimensionality of the ciphertext, but is not limited to that. The calculation key may be obtained by any method. For example, the key generation unit 30 may set the processing content for calculating the index value from the device data using secure computation based on the type of index value to be calculated and the type of device data used to calculate that index value, and generate data that can execute that processing content as the calculation key.

[0038] As described above, the conversion key is a key (data) for converting data encrypted using the second method back into data encrypted using the first method. In this embodiment, the conversion key is a key for performing bootstrapping, but is not limited to that. The conversion key may be obtained by any method. For example, the key generation unit 30 may generate the conversion key based on the first key and the second key.

[0039] The output control unit 38 of the management device 10 transmits the calculated key and conversion key acquired by the key generation unit 30 to the monitoring device 12 (step S12). The acquisition unit 50 of the monitoring device 12 acquires the calculated key and conversion key from the management device 10 and stores them in the storage unit 46. The monitoring device 12 does not acquire information on the first key and the second key, and does not store the information on the first key and the second key in the storage unit 46. As a result, the monitoring device 12 cannot decrypt the data encrypted using the first or second method, and information leakage of data related to the device 100 can be suppressed.

[0040] (Automata generation) The specification setting unit 52 of the monitoring device 12 generates an automaton for calculating the status determination result of the equipment 100 in an encrypted state. The method for generating the automaton will be described below.

[0041] Figure 5 is a flowchart illustrating the generation of an automaton. The specification setting unit 52 acquires information about the specifications (step S14). Here, the specifications refer to the specifications that the index value of the device 100 must satisfy. For example, in this embodiment, the specification setting unit 52 acquires the value indicated by the first data of the device 100 (here, the operating condition) and the numerical range that the index value must satisfy when the first data is that value, as information about the specifications. More specifically, the specification setting unit 52 acquires the value indicated by the first data of the device 100 (here, the operating condition) and the numerical range that the index value must satisfy at times after the first data was acquired, when the first data is that value, as information about the specifications. That is, for example, if the first data is a flag indicating either true or false, the information about the specifications can be said to be information that shows temporal logic, such as "when the first data (flag) at time t1 is true, the index value at the next time t2 after time t1 is always greater than or equal to a predetermined threshold." Information about the specifications may be set in any way, for example, by the user or automatically by the management device 10. The specification setting unit 52 may acquire information about the specifications in any way, for example, by inputting it into the input unit 40 by the user or by receiving it from the management device 10.

[0042] The specification setting unit 52 sets a linear temporal logic formula that represents the specifications based on the information about the specifications (step S16). For example, if the information about the specifications is that "when the first data (flag) at time t1 is true, then the index value at the next time t2 is always greater than or equal to a predetermined threshold," then the linear temporal logic formula can be expressed as G(p0->N(p1)). Here, p0 refers to the proposition that the first data is true, and p1 refers to the proposition that the index value at the next time is greater than or equal to a threshold. By inputting the first data and the index value into such a linear temporal logic formula that represents the specifications, it is possible to calculate as a solution whether or not the index value satisfies the specifications, in other words, the result of determining the state of the device 100.

[0043] The specification setting unit 52 converts the linear temporal logic formula representing the specifications into an automaton (step S18). That is, the specification setting unit 52 generates an automaton capable of executing the linear temporal logic formula representing the specifications (i.e., an automaton capable of calculating the determination result of the state of the device 100) based on the linear temporal logic formula representing the specifications. Here, the automaton is preferably a deterministic finite automaton. By inputting the first data and index values ​​into such an automaton, it is possible to obtain as a solution whether or not the index values ​​satisfy the specifications, in other words, the determination result of the state of the device 100.

[0044] The specification setting unit 52 constructs an automaton (secret computation circuit) from the generated automaton that can handle data encrypted using the first method. In other words, when the automaton generated by the specification setting unit 52 receives first data encrypted using the first method and an index value (a combined ciphertext described later) as input, it outputs the result of determining the state of the device 100 (information on whether the index value meets the specifications) in an encrypted state using the first method.

[0045] Furthermore, in the above explanation, the specification setting unit 52 generated linear temporal logic formulas and automata itself based on information regarding the specifications, but it is not limited to generating linear temporal logic formulas and automata itself. For example, the specification setting unit 52 may acquire linear temporal logic formulas generated by other devices such as the management device 10 and generate automata from the acquired linear temporal logic formulas, or it may acquire automata generated by other devices such as the management device 10.

[0046] (Monitoring process) Next, the monitoring process of device 100 will be explained. Figure 6 is a schematic diagram illustrating the monitoring process.

[0047] (Acquisition of device data) As shown in Figure 6, the management device 10 acquires equipment data from the equipment 100 using the data acquisition unit 32. The data acquisition unit 32 acquires equipment data from the equipment 100, for example. The data acquisition unit 32 acquires equipment data sequentially at predetermined time intervals.

[0048] In this embodiment, the data acquisition unit 32 acquires the first data and the second data as device data. The data acquisition unit 32 acquires the device data including the first data and the second data, and then divides the acquired device data into the first data and the second data. In other words, the data acquisition unit 32 extracts the first data and the second data from the acquired device data. However, the process of dividing the acquired device data into the first data and the second data is not mandatory, and the data acquisition unit 32 may acquire the first data and the second data individually in a state where they are mutually identified.

[0049] The data acquisition unit 32 may acquire one type of first data, or it may acquire multiple types of first data. Similarly, the data acquisition unit 32 may acquire one type of second data, but in this embodiment, it is preferable to acquire multiple types of second data. This allows index values ​​(feature quantities) to be calculated from multiple types of second data, and the state of the device 100 can be determined using index values ​​that take into account multiple types of second data.

[0050] (Generation of the first encrypted data) The management device 10 uses the encryption unit 34 to encrypt the first data using a first method, generating first encrypted data in which the first data has been encrypted using the first method. The encryption unit 34 encrypts the first data using a first key to generate first encrypted data. The encryption unit 34 encrypts the first data each time the first data is acquired, sequentially generating first encrypted data. Furthermore, if multiple types of first data are acquired, the encryption unit 34 may generate first encrypted data for each type of first data, or it may encrypt data that integrates multiple types of first data to create a single first encrypted data.

[0051] (Generation of the second encrypted data) The management device 10 uses the encryption unit 34 to encrypt the second data using the second method, generating second encrypted data in which the second data has been encrypted using the second method. The encryption unit 34 encrypts the second data using the second key to generate second encrypted data. The encryption unit 34 encrypts the second data each time the second data is acquired, sequentially generating second encrypted data. Furthermore, if multiple types of second data are acquired, the encryption unit 34 may generate second encrypted data for each type of second data, or it may encrypt data that integrates multiple types of second data to create a single second encrypted data.

[0052] (Sending encrypted data) The management device 10 transmits the first encrypted data and the second encrypted data generated by the encryption unit 34 to the monitoring device 12 via the output control unit 38. The output control unit 38 transmits the first encrypted data and the second encrypted data to the monitoring device 12 each time the first encrypted data and the second encrypted data are generated.

[0053] (Acquisition of encrypted data) The monitoring device 12 acquires the first encrypted data and the second encrypted data transmitted from the management device 10 using the acquisition unit 50.

[0054] (Calculation of the second cryptographic index value) The monitoring device 12 calculates a second encrypted index value based on the second encrypted data using an index value calculation unit 54. The second encrypted index value is an index value indicating the state of the device 100, encrypted using the second method. In this embodiment, the index value calculation unit 54 calculates the second encrypted index value using a calculation key obtained in the preprocessing. That is, the index value calculation unit 54 converts the second encrypted data into a second encrypted index value using the calculation key. It can be said that the index value calculation unit 54 calculates the index value in an encrypted state from the encrypted second encrypted data without decrypting the second encrypted data.

[0055] (Conversion to the first cryptographic index value) The monitoring device 12 uses a conversion unit 56 to convert the second encrypted index value, encrypted using the second method, into a first encrypted index value, encrypted using the first method. In other words, the first encrypted index value can be said to be an index value indicating the state of the device 100, encrypted using the first method. In this embodiment, the conversion unit 56 converts the second encrypted index value into the first encrypted index value using a conversion key obtained in preprocessing. The index value calculation unit 54 calculates the index value encrypted using the first method (first encrypted index value) from the index value encrypted using the second method (second encrypted index value) without decrypting the second encrypted index value.

[0056] (Calculation of encryption detection result) The monitoring device 12 calculates an encryption determination result based on the first encrypted data (first data encrypted using the first method) and the first encrypted index value (index value encrypted using the first method) using the determination unit 58. The encryption determination result refers to the determination result of the state of the device 100 encrypted using the first method. The index value calculation unit 54 calculates the determination result of the state encrypted using the first method (encryption determination result) from the first data and index value (first encrypted data and first encrypted index value) of the state encrypted using the first method without decrypting the first encrypted data and the first encrypted index value. In this embodiment, the determination unit 58 calculates an encryption determination result that is encrypted using the first method, indicating whether the index value shown in the first encrypted index value satisfies the specifications that must be met in the first data (operating conditions) shown in the first encrypted data.

[0057] The determination unit 58 may calculate the determination result (encryption determination result) of the state encrypted by the first method in any way based on the first encrypted data and the first encrypted index value, but an example of the calculation method in this embodiment will be described below. In this embodiment, the determination unit 58 combines the first encrypted data and the first encrypted index value to generate a combined ciphertext. The combined ciphertext refers to data (string) that includes the first encrypted data and the first encrypted index value, and can be said to be data that includes the first data and index value in the state encrypted by the first method. The determination unit 58 then inputs the combined ciphertext into the automaton obtained in the preprocessing, and obtains the data output from the automaton as the determination result (encryption determination result) of the state encrypted by the first method. Since the automaton executes temporal logic formulas as described above, the determination unit 58 calculates data as the encryption determination result that indicates whether the index value satisfies the temporal logic formula (for example, whether the index value satisfies the numerical range that it should satisfy at a time after the first data was obtained).

[0058] Each time the first encrypted data and the second encrypted data are acquired, the monitoring device 12 performs the process described above and sequentially calculates the encryption determination result.

[0059] (Sending the encryption detection result) The monitoring device 12 transmits the encryption determination result to the management device 10 via the output control unit 60. The output control unit 60 transmits the encryption determination result to the management device 10 each time an encryption determination result is calculated.

[0060] (Decryption of encryption detection results) The management device 10 decrypts the encryption determination result obtained from the monitoring device 12 using the decryption unit 36 ​​to obtain the decrypted determination result. The decryption unit 36 ​​decrypts the encryption determination result using the first key to obtain the determination result. The decryption unit 36 ​​decrypts the encryption determination result each time an encryption determination result is obtained to obtain the determination result. As a result, the management device 10 can output the decrypted determination result, allowing the management device 10 to check the determination result of the status of the device 100 and manage the device 100 appropriately.

[0061] (Processing flow) The monitoring process flow described above will now be explained. Figure 7 is a flowchart illustrating the processing flow of the monitoring process according to this embodiment. As shown in Figure 7, the management device 10 acquires device data of device 100 (step S20) and generates first encrypted data and second encrypted data (step S22). The management device 10 encrypts the first data from the device data using the first method to generate first encrypted data, and encrypts the second data from the device data using the second method to generate second encrypted data. The management device 10 transmits the first encrypted data and the second encrypted data to the monitoring device 12.

[0062] The monitoring device 12 obtains the first encrypted data and the second encrypted data from the management device 10 (step S24). The monitoring device 12 calculates the second encrypted index value, which is an index value encrypted using the second method, from the second encrypted data (step S26), and converts the second encrypted index value to the first encrypted index value, which is an index value encrypted using the first method (step S28). Then, the monitoring device 12 combines the first encrypted data and the first encrypted index value to generate a combined ciphertext (step S30), inputs the combined ciphertext into an automaton, and calculates the encryption determination result (the determination result of the device 100 encrypted using the first method) (step S32). The monitoring device 12 transmits the encryption determination result to the management device 10.

[0063] The management device 10 decrypts the encryption determination result obtained from the monitoring device 12 and obtains the determination result of the decrypted device 100 (step S34).

[0064] (effect) In this embodiment, the first data not used to calculate the index value is encrypted using the first method, which is a TFHE method, and the second data used to calculate the index value is encrypted using the second method, which is capable of secure computation. Then, the second encrypted index value (index value encrypted using the second method) is calculated from the second data (second encrypted data) encrypted using the second method by secure computation, and this is converted to the first encrypted index value encrypted using the first method. Then, using both the first encrypted index value (index value encrypted using the first method) and the first encrypted data (first data encrypted with the first data), the judgment result of the device 100 is calculated in an encrypted state using the first method. According to this embodiment, since the judgment result of the device 100 is calculated in an encrypted state, the leakage of the judgment result can be suppressed. Furthermore, by calculating a second encrypted index value from the second encrypted data encrypted using the second method using secure computation and converting it to a first encrypted index value using the first method, the state of the device, which is not expressed in the device data (second data) itself, can be determined using the second encrypted index value. Therefore, according to this embodiment, the state of device 100 can be appropriately determined. Moreover, since the conversion process from second encrypted data to first encrypted data is computationally intensive, the overall computational load can be suppressed by encrypting only the data used to calculate the index value using the second method, calculating the index value using secure computation and converting it to first encrypted data, while encrypting the data not used to calculate the index value using the first method and combining it with the first encrypted data obtained by conversion. Therefore, according to this embodiment, the state of device 100 can be appropriately determined while suppressing information leakage and the increase in computational load.

[0065] (Second Embodiment) Next, a second embodiment will be described. The second embodiment differs from the first embodiment in that multiple automata are set up and the determination results from each automaton are obtained. In the second embodiment, parts that are common to the first embodiment will not be explained.

[0066] Figure 8 is a schematic diagram illustrating the monitoring process in the second embodiment. In the second embodiment, the determination unit 58 sets multiple specifications and calculates an encryption determination result for each specification, indicating whether the index value shown in the first encryption index value satisfies the specification. Specifically, in the second embodiment, the management device 10 sets multiple specifications in the preprocessing and generates an automaton for each specification. The specification setting unit 52 acquires information on multiple types of specifications in which at least one of the first data type, the index value type, and the numerical range that the index value should satisfy is different, and generates an automaton for each of those specifications.

[0067] As shown in Figure 8, the monitoring device 12, similar to the first embodiment, acquires the first encrypted data and the second encrypted data, generates a first encrypted index value from the second encrypted data, and combines the first encrypted data and the first encrypted index value to generate a combined ciphertext. The determination unit 58 of the monitoring device 12 then inputs the combined ciphertext to each of the multiple automata and obtains the encryption determination result output from each automaton. The monitoring device 12 then transmits each encryption determination result to the management device 10. The management device 10 decrypts each encryption determination result to obtain the respective determination result (i.e., the determination result from each automaton).

[0068] When the monitoring device 12 transmits each encryption determination result to the management device 10, it may transmit each encryption determination result individually to the management device 10, and the management device 10 may perform decryption processing for each encryption determination result. Alternatively, the management device 10 may integrate each encryption determination result to generate an integrated encryption determination result and transmit it to the management device 10. In this case, the management device 10 decrypts the integrated encryption determination result to obtain each determination result. In this case, it is preferable that the management device 10 and the monitoring device 12 store information about the rules for integrating each encryption determination result in the integrated encryption determination result (for example, the order in which they are combined).

[0069] Each automaton is constructed on the premise that the type of first data and the type of index value are common, but the numerical range that the index value must satisfy is different. The monitoring device 12 may input a common combined ciphertext (i.e., the first encrypted data and the first encrypted index value) into each of the multiple automatons to obtain the encryption determination result. In other words, in this case, multiple automatons determine the same index value using different criteria (specifications) to obtain the encryption determination result. This makes it possible to determine not only a two-stage determination result of whether the specifications are met or not, but also a more multi-stage determination result (i.e., degree of abnormality).

[0070] Furthermore, the monitoring device 12 may input different combined ciphertexts (i.e., first encrypted data and first encrypted index value) into each automaton to obtain an encryption determination result. In this case, each automaton is constructed on the premise that at least one of the types of first data and index value is different. In this case, it is preferable that the automaton is associated with the first data and second data (first encrypted data and second encrypted data) of the specifications used to generate the automaton, and that the monitoring device 12 stores this association. The monitoring device 12 inputs the combined ciphertext (i.e., first encrypted data and first encrypted index value) into the automaton of the specifications associated with the first encrypted data and second encrypted data used to generate the combined ciphertext, and calculates an encryption determination result. This makes it possible to determine various states of the device 100.

[0071] (effect) The monitoring device 12 according to the first aspect of this disclosure includes: an acquisition unit 50 that acquires first encrypted data, which is data encrypted using the TFHE method for first data relating to the monitored device 100, and second encrypted data, which is time-series second data relating to the device 100 encrypted using a second method different from the first method; an index value calculation unit 54 that calculates a second encrypted index value, which is an index value indicating the state of the device 100 encrypted using the second method, based on the second encrypted data; a conversion unit 56 that converts the second encrypted index value into a first encrypted index value encrypted using the first method; and a determination unit 58 that calculates an encrypted determination result, which is the determination result of the state of the device 100 encrypted using the first method, based on the first encrypted data and the first encrypted index value. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0072] The monitoring device 12 according to the second aspect of this disclosure is the monitoring device 12 according to the first aspect, wherein the first data is information indicating the operating conditions of the device 100, and the second data is information indicating the operating state of the device 100. According to this disclosure, the first data indicating the operating conditions of the device 100, which is not used to calculate the index value, is acquired in an encrypted state using the first method, and the second data indicating the operating state of the device 100, which is used to calculate the index value, is acquired in an encrypted state using the second method, thereby suppressing an increase in computational load and enabling appropriate determination of the state of the device 100 by the index value.

[0073] The monitoring device 12 according to the third aspect of this disclosure is the monitoring device 12 according to the first or second aspect, wherein the index value calculation unit 54 calculates a second encrypted index value based on multiple types of second encrypted data. This makes it possible to determine the state of the device 100 by taking into account multiple types of second data.

[0074] The monitoring device 12 according to the fourth aspect of this disclosure is a monitoring device 12 according to any of the first to third aspects, wherein the determination unit 58 calculates an encrypted determination result, encrypted in the first method, whether the index value shown in the first encrypted index value satisfies the specifications that the first data (operating conditions) shown in the first encrypted data should satisfy. According to this disclosure, by determining whether the index value satisfies the specifications that the first data should satisfy in its current state, the state of the device 100 can be appropriately determined according to the first data such as operating conditions.

[0075] The monitoring device 12 according to the fifth aspect of this disclosure is the monitoring device 12 according to the fourth aspect, wherein the determination unit 58 calculates an encryption determination result by inputting a combined ciphertext including the first encrypted data and the first encrypted index value into an executable linear temporal logic formula that shows the specifications. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0076] The monitoring device 12 according to the sixth aspect of this disclosure is the monitoring device 12 according to the fourth or fifth aspect, wherein the determination unit 58 sets multiple specifications and calculates an encryption determination result for each specification, indicating whether the index value shown in the first encryption index value satisfies the specification. According to this disclosure, the status of the device 100 can be appropriately determined while suppressing information leakage.

[0077] The seventh aspect of this disclosure relates to a monitoring system comprising a monitoring device 12 according to any of the first to sixth aspects, and a management device 10 that encrypts first data to generate first encrypted data, encrypts second data to generate second encrypted data, and transmits the first encrypted data and the second encrypted data to the monitoring device 12. According to this disclosure, the status of the equipment 100 can be appropriately determined while suppressing information leakage.

[0078] The monitoring method according to the eighth aspect of this disclosure includes the steps of: acquiring first encrypted data, which is data encrypted using a first method in which first data relating to the monitored device 100 is TFHE method, and second encrypted data, which is time-series second data relating to the device 100 encrypted using a second method different from the first method; calculating a second encrypted index value, which is an index value indicating the state of the device 100 encrypted using the second method, based on the second encrypted data; converting the second encrypted index value to a first encrypted index value encrypted using the first method; and calculating an encrypted determination result, which is the determination result of the state of the device 100 encrypted using the first method, based on the first encrypted data and the first encrypted index value. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0079] The program according to the ninth aspect of this disclosure causes a computer to perform the following steps: acquire first encrypted data, which is data encrypted using a first method in which first data relating to the monitored device 100 is TFHE; and second encrypted data, which is time-series second data relating to the device 100 encrypted using a second method different from the first method; calculate a second encrypted index value, which is an index value indicating the state of the device 100 encrypted using the second method, based on the second encrypted data; convert the second encrypted index value to a first encrypted index value encrypted using the first method; and calculate an encrypted determination result, which is the determination result of the state of the device 100 encrypted using the first method, based on the first encrypted data and the first encrypted index value. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0080] Although embodiments of the present disclosure have been described above, the embodiments are not limited to those described herein. Furthermore, the aforementioned components include those that can be easily conceived by those skilled in the art, those that are substantially the same, and those that fall within the so-called equivalent range. Moreover, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the embodiments described above. [Explanation of Symbols]

[0081] 1. Monitoring System 10 Management device 12 Monitoring equipment 50 Acquisition Department 52 Specification Setting Section 54. Indicator Value Calculation Section 56 Conversion section 58 Judgment section 100 equipment

Claims

1. An acquisition unit acquires first encrypted data, which is data encrypted using a first method, where the first data relating to the monitored device is the TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method. An index value calculation unit calculates a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; A conversion unit that converts the second cryptographic index value into the first cryptographic index value encrypted using the first method, A determination unit calculates an encryption determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value. including, monitoring equipment.

2. The first data is information indicating the operating conditions of the device, and the second data is information indicating the operating state of the device. The monitoring device according to claim 1.

3. The index value calculation unit calculates the second encrypted index value based on multiple types of the second encrypted data. The monitoring device according to claim 1.

4. The determination unit calculates the determination result as the encryption determination result, in an encrypted state, whether the index value shown in the first encryption index value satisfies the specifications that the first data shown in the first encryption data should satisfy, in the state encrypted by the first method. The monitoring device according to claim 1.

5. The determination unit calculates the encryption determination result by inputting the combined ciphertext, which includes the first encrypted data and the first encrypted index value, into an automaton capable of executing a linear temporal logic formula that represents the specifications. The monitoring device according to claim 4.

6. The determination unit sets a plurality of specifications and calculates an encryption determination result for each specification, indicating whether the index value shown in the first encryption index value satisfies the specification. The monitoring device according to claim 4.

7. The monitoring device according to any one of claims 1 to 6, A management device that encrypts the first data to generate the first encrypted data, encrypts the second data to generate the second encrypted data, and transmits the first encrypted data and the second encrypted data to the monitoring device, Having, Monitoring system.

8. The steps include obtaining first encrypted data, which is data encrypted using a first method, where first data relating to the monitored device is the TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method. A step of calculating a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; The steps include converting the second cryptographic index value into the first cryptographic index value encrypted using the first method, A step of calculating an encryption determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value, including, Monitoring method.

9. The steps include obtaining first encrypted data, which is data encrypted using a first method, where first data relating to the monitored device is the TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method. A step of calculating a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; The steps include converting the second cryptographic index value into the first cryptographic index value encrypted using the first method, A step of calculating an encryption determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value, Make the computer execute it. program.

Images