DETECTION SYSTEM, DETECTION METHOD, AND DETECTION PROGRAM

Abstract

To protect a detection system, a detection method, and a detection program for detecting replay attacks regardless of communication protocols.SOLUTION: A detection system 1 comprises a control apparatus 10 and a monitoring apparatus 20 communicably connected to the control apparatus 10. An acquisition unit 10A of the control apparatus 10 acquires an observed value of a target by a sensor 30. A first noise output unit 10B outputs a first noise value that changes over time and is less than the resolution of the sensor 30. An integrating unit 10C outputs an integrated value that integrates the first noise value and the observed value. A transmitting unit 10D transmits the integrated value to the monitoring apparatus 20. A separation unit 20A of the monitoring apparatus 20 separates the integrated value received from the control apparatus 10 into the observed value and the first noise value. A second noise output unit 20B outputs a second noise value, which is the same value as the first noise value. A detection unit 20C detects whether the integrated value is a replay attack based on the spatial distance between the first noise value and the second noise value.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] FIELD An embodiment of the present invention relates to a detection system, a detection method, and a detection program. [Background technology]

[0002] A replay attack is known as a threat to information processing devices connected to a network.

[0003] As a technique for detecting threats to information processing devices, for example, a technique for adding a key to a communication layer by DPC (Dirty Paper Coding) has been disclosed (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2008-527920 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the conventional technology, the application is limited to a specific wireless communication protocol, and it is difficult to detect a replay attack in a wired communication or a communication using a communication protocol unique to a specific system. In other words, in the conventional technology, it is difficult to detect a replay attack regardless of the communication protocol.

[0006] An object of the present invention is to provide a detection system, a detection method, and a detection program capable of detecting a replay attack regardless of the communication protocol. [Means for solving the problem]

[0007] A detection system according to an embodiment includes a first information processing device and a second information processing device communicably connected to the first information processing device. The first information processing device includes an acquisition unit that acquires an observation value of a target by a sensor, a first noise output unit that outputs a first noise value that changes over time and is less than the resolution of the sensor, an integration unit that outputs an integrated value obtained by integrating the first noise value and the observation value, and a transmission unit that transmits the integrated value to the second information processing device. The second information processing device includes a separation unit that separates the integrated value received from the first information processing device into the observation value and the first noise value, a second noise output unit that outputs a second noise value that is the first noise value, and a detection unit that detects whether the integrated value is a replay attack based on a spatial distance between the first noise value and the second noise value. The first noise output unit has a first noise model unit that outputs a first noise output value that changes non-linearly over time and fluctuates non-periodically within a specific value range, and a first scaling unit that outputs the first noise value by reducing the first noise output value to less than the resolution of the sensor, and the second noise output unit has a second noise model unit that outputs a second noise output value that is the first noise output value, and a second scaling unit that outputs the second noise value by reducing the second noise output value to a reduction ratio of the first noise value. [Brief description of the drawings]

[0008] [Figure 1] Schematic diagram of the detection system. [Diagram 2] FIG. 2 is a diagram showing the functional configuration of the detection system. [Diagram 3] 1 is a flowchart showing the flow of information processing. [Figure 4] 1 is a flowchart showing the flow of information processing. [Diagram 5] FIG. 1 is a diagram showing the functional configuration of a detection system. [Figure 6] 1 is a flowchart showing the flow of information processing. [Figure 7] 1 is a flowchart showing the flow of information processing. [Figure 8] FIG. 2 is a diagram showing the functional configuration of the detection system. [Figure 9] 1 is a flowchart showing the flow of information processing. [Figure 10] 1 is a flowchart showing the flow of information processing. [Figure 11] FIG. 2 is a diagram showing the functional configuration of the detection system. [Figure 12] 1 is a flowchart showing the flow of information processing. [Figure 13] 1 is a flowchart showing the flow of information processing. [Figure 14] Hardware configuration diagram. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] The detection system, the detection method, and the detection program of the present embodiment will be described in detail below with reference to the accompanying drawings.

[0010] In the following description of each embodiment, parts denoted with the same reference numerals have substantially the same functions, and descriptions of overlapping parts will be omitted as appropriate.

[0011] (First embodiment) FIG. 1 is a schematic diagram of an example of a detection system 1 according to the present embodiment.

[0012] The detection system 1 is a system that detects a replay attack on the detection system 1.

[0013] The detection system 1 includes a control device 10 and a monitoring device 20. The control device 10 and the monitoring device 20 are connected to each other so as to be able to communicate with each other via a network or the like.

[0014] The control device 10 is an example of a first information processing device, and the monitoring device 20 is an example of a second information processing device.

[0015] The first information processing device and the second information processing device are information processing devices connected to each other so as to be able to communicate with each other via a network or the like. The first information processing device is an example of an information processing device that is a source of various data and signals. The second information processing device is an example of an information processing device that receives various data and signals from the first information processing device. Note that the communication protocol used for communication between the first information processing device and the second information processing device is not limited as long as it is an arbitrary communication protocol.

[0016] In this embodiment, an example will be described in which the first information processing device is a control device 10 and the second information processing device is a monitoring device 20. The control device 10 is an information processing device that controls a member on which the sensor 30 is mounted based on an observation value by the sensor 30. The monitoring device 20 is an information processing device that monitors the control device 10.

[0017] The sensor 30 is an observation device that observes an object.

[0018] The target is an object to be observed by the sensor 30. The target is, for example, the environment in which the sensor 30 is installed. The environment in which the sensor 30 is installed is, for example, the internal environment of the component in which the sensor 30 is installed, the external environment of the component in which the sensor 30 is installed, etc. The component in which the sensor 30 is installed is, for example, a vehicle, a driving device such as a manufacturing machine, a structure such as a building, etc.

[0019] The sensor 30 observes an object and outputs an observation value, which is the observation result of the object, to the control device 10. For example, the sensor 30 detects the temperature, humidity, air pressure, etc. of the environment in which the sensor 30 is installed. Also, for example, the sensor 30 detects information related to the drive of the member in which the sensor 30 is installed. The information related to the drive is, for example, speed, acceleration, etc. Also, for example, the sensor 30 detects various signals by receiving the signals output from an object such as a drive device. Then, the sensor 30 outputs these detection results to the control device 10 as an observation value, which is the observation result of the object.

[0020] FIG. 2 is a diagram illustrating an example of a functional configuration of the detection system 1 of the present embodiment.

[0021] The control device 10 includes an acquisition unit 10A, a first noise output unit 10B, an integration unit 10C, and a transmission unit 10D.

[0022] The acquisition unit 10A, the first noise output unit 10B, the integration unit 10C, and the transmission unit 10D are realized, for example, by one or more processors. For example, each of the above units may be realized by having a processor such as a CPU (Central Processing Unit) execute a program, that is, by software. Each of the above units may be realized by a processor such as a dedicated IC, that is, by hardware. Each of the above units may be realized by using both software and hardware. When multiple processors are used, each processor may realize one of the units, or may realize two or more of the units.

[0023] The acquisition unit 10A acquires an observation value of an object by the sensor 30. The sensor 30 and the control device 10 are connected so as to be able to exchange data or signals. The acquisition unit 10A outputs the observation value acquired from the sensor 30 to the integration unit 10C.

[0024] The first noise output section 10B outputs a first noise value.

[0025] The first noise value is noise that changes over time and has a value less than the resolution of the sensor 30. The first noise value may also be a value that changes over time and is less than the resolution of the sensor 30, and further less than a predetermined fixed point. The digit on which the decimal point represented by the fixed point is placed may be any digit on which the first noise value represented by the decimal point is less than the resolution of the sensor 30.

[0026] There may be cases where a plurality of sensors 30 are connected to the control device 10, and the acquisition unit 10A acquires observed values ​​from each of the plurality of sensors 30. In this case, the first noise value may be a value less than the resolution of the sensor 30 with the highest resolution among the plurality of sensors 30 connected to the control device 10. That is, in this embodiment, the resolution of the sensor 30 refers to the resolution of the sensor 30 with the highest resolution among one or more sensors 30 connected to the control device 10.

[0027] The first noise output section 10B sequentially generates first noise values ​​that satisfy the above condition, and outputs them to the integrating section 10C.

[0028] The first noise output section 10B is configured by a program or a circuit that executes an algorithm for sequentially generating and outputting first noise values ​​that satisfy the above conditions.

[0029] The program for executing an algorithm for sequentially generating and outputting the first noise values ​​may be created in advance and installed in the control device 10 in advance as the first noise output section 10B.

[0030] An example of the circuit that sequentially generates the first noise values ​​is a PUF (Physical Unclonable Function). An example of the PUF is an Arbiter PUF. The output of the Arbiter PUF is a binary number. Therefore, when an Arbiter PUF is used as the first noise output unit 10B, the first noise output unit 10BJ may convert the output of the Arbiter PUF into a decimal number and output it to the integrating unit 10C as the first noise value. Moreover, this conversion process from binary number to decimal number may be performed by the integrating unit 10C.

[0031] The first noise output unit 10B satisfies the above condition and outputs a first noise value that is a positive value. Therefore, when a program or circuit that executes an algorithm for sequentially generating and outputting noise generates a first noise value that is a negative value, the first noise output unit 10B may output a first noise value that is a positive value by outputting the absolute value of the generated first noise value that is a negative value. In detail, it is assumed that the algorithm for sequentially generating noise is composed of a state equation and an output equation. In this case, the first noise output unit 10B may output a first noise value that is a positive value by taking the absolute value of the output equation. Also, for example, it is assumed that the algorithm for sequentially generating noise is composed of one equation such as a linear regression model. In this case, the first noise output unit 10B may output a first noise value that is a positive value by taking the absolute value of the output value of the equation.

[0032] The integrating unit 10C integrates the observed value input from the acquiring unit 10A and the first noise value input from the first noise output unit 10B, and outputs the integrated value to the transmitting unit 10D.

[0033] For example, the integration unit 10C integrates the observed value input from the acquisition unit 10A and the first noise value input from the first noise output unit 10B by adding these values ​​together, and outputs the integrated value resulting from the addition to the transmission unit 10D.

[0034] Specifically, assume that at a certain timing, the acquisition unit 10A outputs an observed value of "25.43" to the integrating unit 10C, and the first noise output unit 10B outputs a first noise value of "0.00542" to the integrating unit 10C. In this case, the integrating unit 10C outputs "25.43542", which is the sum of these values, as an integrated value to the transmitting unit 10D.

[0035] The transmission unit 10D transmits the integrated value input from the integrating unit 10C to the monitoring device 20 via a network or the like. Therefore, the control device 10 sequentially transmits the integrated value obtained by adding the first noise value to the observation value to the monitoring device 20.

[0036] Next, the monitoring device 20 will be described.

[0037] The monitoring device 20 includes a separation section 20A, a second noise output section 20B, a detection section 20C, and a monitoring section 20D.

[0038] The separator 20A separates the integrated value received from the control device 10 into an observed value and a first noise value.

[0039] For example, the separator 20A separates the integrated value into the observation value and the first noise value by a floor function using the resolution of the sensor 30. Specifically, the separator 20A separates the integrated value into the observation value and the first noise value by using the following formulas (1) and (2).

[0040]

number

[0041] In formulas (1) and (2), t represents the number of steps, i.e., the elapsed time. s (t) represents the observation value output at step t. In equation (1), γ g represents the resolution of the sensor 30. In equations (1) and (2), w(t) represents the integrated value output at step t. The right side of equation (1) is a real number γ g -1 represents the floor function of w(t). In equation (2), y n1 (t) represents the first noise value output at step t.

[0042] The separation unit 20A is configured to detect the above γ g may be stored in advance and used to separate the integrated value. The separator 20A outputs the first noise value obtained by separating the integrated value to the detector 20C, and outputs the observed value to the monitor 20D.

[0043] The second noise output section 20B outputs the second noise value, which is the first noise value, to the detection section 20C.

[0044] The second noise value is the same value as the first noise value. More specifically, the second noise value is noise that changes over time and has a value less than the resolution of the sensor 30, similar to the first noise value.

[0045] The second noise output section 20B is adjusted in advance so as to output to the detection section 20C a second noise value that is the same as the first noise value included in the integrated value input from the control device 10 to the separation section 20A.

[0046] The second noise output section 20B sequentially generates second noise values ​​that satisfy the above condition, and outputs them to the detection section 20C.

[0047] The second noise output unit 20B is configured, for example, from the same program or circuit as the first noise output unit 10B. When an Arbiter PUF, which is a circuit that generates a first noise value, is used as the first noise output unit 10B, a mathematical model of the Arbiter PUF may be applied to the second noise output unit 20B. This is because a PUF has an ID (identification) unique to an IC chip, making it difficult to apply the same PUF to the control device 10 and the monitoring device 20. For this reason, a mathematical model of the Arbiter PUF installed as the first noise output unit 10B may be generated in advance by a known method using machine learning or the like, and may be installed in advance in the monitoring device 20 as the second noise output unit 20B.

[0048] The detection unit 20C detects whether the integrated value received from the control device 10 is a replay attack based on the spatial distance between the first noise value input from the separation unit 20A and the second noise value input from the second noise output unit 20B.

[0049] In detail, when the spatial distance between the first noise value and the second noise value is greater than a threshold value, the detection unit 20C detects the integrated value as a replay attack.

[0050] Specifically, for example, the detection unit 20C detects a replay attack by using the formulas (3) and (4).

[0051]

number

[0052] In equations (3) and (4), t represents the number of steps, i.e., the elapsed time. n1 (t) represents the first noise value output at step t. y n2 (t) represents the second noise value output at step t.

[0053] As described above, the second noise output unit 20B is adjusted in advance so as to output a second noise value that is the same as the first noise value included in the integrated value input to the separation unit 20A from the control device 10. Therefore, when the detection system 1 is not subjected to a replay attack, the first noise value input from the separation unit 20A to the detection unit 20C and the second noise value input from the second noise output unit 20B to the detection unit 20C will be the same value.

[0054] Therefore, in this embodiment, "0" is used as the threshold value used to determine whether or not a replay attack has occurred. Then, the detection unit 20C determines whether or not the absolute value of the difference, which is the spatial distance between the first noise value input from the separation unit 20A and the second noise value input from the second noise output unit 20B, expressed by the above formula (3), is greater than the threshold value "0" (see formula (4)). If the absolute value of the difference, which is the spatial distance, is greater than the threshold value "0", the detection unit 20C detects that the integrated value received from the control device 10 is a replay attack. On the other hand, if the absolute value of the difference, which is the spatial distance, is equal to or less than the threshold value "0", the detection unit 20C detects that the integrated value received from the control device 10 is not a replay attack. Then, the detection unit 20C outputs the detection result to the monitoring unit 20D.

[0055] As described above, the first noise output section 10B outputs a first noise value that changes over time and is less than the resolution of the sensor 30. The second noise output section 20B outputs the first noise value as a second noise value. As described above, these first noise value and second noise value are noises that change over time and are less than the resolution of the sensor 30.

[0056] In this embodiment, it is further preferable that these first noise value and second noise value are values ​​that diverge over time. That is, in this embodiment, it is preferable that the first noise output section 10B and the second noise output section 20B output the first noise value and the second noise value, respectively, that have a divergence that does not approach a finite value at the limit but becomes an infinite or oscillating value.

[0057] For example, assume that the first noise value and the second noise value are values ​​that converge over time. That is, assume that the first noise output unit 10B and the second noise output unit 20B output the first noise value and the second noise value that have convergence, respectively. In this case, it may be difficult for the detection unit 20C to detect a replay attack using the above formulas (3) and (4). For example, assume that a replay attack is made using an integrated value recorded for a certain period after the first noise value and the second noise value output from each of the first noise output unit 10B and the second noise output unit 20B have converged. In this case, the first noise value included in the replay attack may match the value of the second noise value output from the second noise output unit 20B.

[0058] On the other hand, assume that the first noise value and the second noise value are values ​​having divergence. That is, assume that the first noise output unit 10B and the second noise output unit 20B output the first noise value and the second noise value having divergence, respectively. In this case, even if a replay attack is made using an integrated value recorded in any fixed period, the first noise value included in the replay attack and the second noise value output from the second noise output unit 20B will not match. For this reason, it is preferable that the first noise value and the second noise value output from each of the first noise output unit 10B and the second noise output unit 20B are values ​​having divergence. When the first noise value and the second noise value are values ​​having divergence, the detection unit 20C can detect the replay attack with high accuracy using the above formula (3) and formula (4).

[0059] The monitoring unit 20D executes a monitoring process using the observation values ​​input from the separation unit 20A and the detection results input from the detection unit 20C.

[0060] For example, when the detection result input from the detection unit 20C indicates the detection of a replay attack, the monitoring unit 20D executes a predetermined attack response process against the replay attack. The attack response process may be determined in advance. For example, the monitoring unit 20D may execute a known attack response process such as blocking from the network, identifying the infection route, recovery, restoration, etc.

[0061] On the other hand, when the detection result input from the detection unit 20C indicates that a replay attack has not been detected, the monitoring unit 20D may execute a predetermined monitoring process or the like using the observation value input from the separation unit 20A.

[0062] Next, an example of the flow of information processing executed by the control device 10 will be described.

[0063] FIG. 3 is a flowchart showing an example of the flow of information processing executed by the control device 10.

[0064] The first noise output unit 10B outputs the first noise value to the integrating unit 10C (step S100). The acquiring unit 10A acquires an observation value from the sensor 30, and outputs it to the integrating unit 10C (step S102).

[0065] The integrating unit 10C outputs an integrated value obtained by integrating the observation value input from the acquiring unit 10A and the first noise value input from the first noise output unit 10B to the transmitting unit 10D (step S104). The transmitting unit 10D transmits the integrated value input from the integrating unit 10C to the monitoring device 20 (step S106). Then, this routine ends.

[0066] Next, an example of the flow of information processing executed by the monitoring device 20 will be described.

[0067] FIG. 4 is a flowchart showing an example of the flow of information processing executed by the monitoring device 20.

[0068] The separator 20A receives the integrated value from the control device 10 (step S200). The separator 20A separates the integrated value received in step S200 into an observed value and a first noise value (step S202).

[0069] The second noise output unit 20B outputs the second noise value to the detection unit 20C (step S204). As described above, the second noise output unit 20B is adjusted in advance so as to output to the detection unit 20C a second noise value that is the same as the first noise value included in the integrated value received in step S200.

[0070] The detection unit 20C determines whether the absolute value of the spatial distance between the first noise value separated in step S202 and the second noise value input from the second noise output unit 20B in step S204 is greater than the threshold value "0" (step S206).

[0071] If the determination in step S206 is affirmative (step S206: Yes), the detection unit 20C outputs a detection result indicating the detection of a replay attack to the monitoring unit 20D (step S208). The monitoring unit 20D, which has received the detection result indicating the detection of a replay attack, executes a predetermined attack response process against the replay attack (step S210). Then, this routine ends.

[0072] On the other hand, if the determination in step S206 is negative (step S206: No), the process proceeds to step S212. In step S212, the detection unit 20C outputs a detection result indicating that a replay attack has not been detected to the monitoring unit 20D (step S212). The monitoring unit 20D, which has received the detection result indicating that a replay attack has not been detected, executes a predetermined monitoring process or the like using the observation value separated in step S202 (step S214). Then, this routine ends.

[0073] As described above, the detection system 1 of the present embodiment includes the control device 10 and the monitoring device 20 communicably connected to the control device 10. The control device 10 includes an acquisition unit 10A, a first noise output unit 10B, an integration unit 10C, and a transmission unit 10D. The acquisition unit 10A acquires an observation value of an object by the sensor 30. The first noise output unit 10B outputs a first noise value that changes over time and is less than the resolution of the sensor 30. The integration unit 10C outputs an integrated value obtained by integrating the first noise value and the observation value. The transmission unit 10D transmits the integrated value to the monitoring device 20. The monitoring device 20 includes a separation unit 20A, a second noise output unit 20B, and a detection unit 20C. The separation unit 20A separates the integrated value received from the control device 10 into an observation value and a first noise value. The second noise output unit 20B outputs a second noise value that is the first noise value. The detection unit 20C detects whether the integrated value represents a replay attack or not, based on the spatial distance between the first noise value and the second noise value.

[0074] As described above, in the detection system 1 of this embodiment, the control device 10 transmits an integrated value obtained by integrating the first noise value and the observed value to the monitoring device 20. The monitoring device 20 separates the integrated value received from the control device 10 into the observed value and the first noise value. Then, the monitoring device 20 detects whether the integrated value received from the control device 10 represents a replay attack or not, based on the spatial distance between the separated first noise value and the second noise value input from the second noise output unit 20B.

[0075] That is, in the detection system 1 of this embodiment, the first noise value added to the observation value by the control device 10 and the second noise value generated by the monitoring device 20 are used to detect whether the integrated value is a replay attack.

[0076] Therefore, in the detection system 1 of this embodiment, regardless of the communication protocol between the control device 10 and the monitoring device 20, it is possible to detect whether the integrated value received by the monitoring device 20 from the control device 10 is a replay attack.

[0077] Therefore, the detection system 1 of this embodiment can detect a replay attack regardless of the communication protocol.

[0078] In addition to the above-mentioned effects, the detection system 1 of this embodiment can improve the security of the detection system 1.

[0079] In addition, a conventional technique has been disclosed that uses DPC (Dirty Paper Coding) to detect replay attacks. It is known that the calculation of DPC is complicated, and the use of DPC can increase the processing load of the device.

[0080] On the other hand, the detection system 1 of the present embodiment does not use the DPC, but uses the first noise value and the second noise value to detect whether the integrated value is a replay attack.

[0081] Therefore, in addition to the above-mentioned effects, the detection system 1 of this embodiment can detect replay attacks with a low processing load.

[0082] Second embodiment In this embodiment, a mode in which the first noise value and the second noise value are generated by a method different from that of the first embodiment will be described.

[0083] FIG. 5 is a diagram showing an example of a functional configuration of a detection system 1B of the present embodiment.

[0084] The detection system 1B includes a control device 11 and a monitoring device 21. The control device 11 and the monitoring device 21 are communicatively connected via a network or the like. The control device 11 is communicatively connected to one or more sensors 30. The detection system 1B has the same configuration as the detection system 1 of the above embodiment, except that the detection system 1B includes the control device 11 instead of the control device 10 and the monitoring device 21 instead of the monitoring device 20.

[0085] The control device 11 includes an acquisition unit 10A, a first noise output unit 11B, an integration unit 10C, and a transmission unit 10D. The control device 11 includes a first noise output unit 11B instead of the first noise output unit 10B in the control device 10.

[0086] The first noise output section 11B outputs a first noise value, similar to the first noise output section 10B in the above embodiment.

[0087] Here, in the above embodiment, it has been described that the first noise value and the second noise value are values ​​that change over time and are less than the resolution of the sensor 30. Also, in the above embodiment, it has been described that it is preferable that the first noise value and the second noise value are values ​​that diverge over time, that is, values ​​that have divergence.

[0088] However, when the first noise output section 10B and the second noise output section 20B each output a first noise value and a second noise value having divergence, respectively, by continuing to generate and output these values ​​for a long period of time, each of the output first noise value and second noise value may reach or exceed the resolution of the sensor 30.

[0089] Therefore, the first noise output section 11B of the present embodiment includes a first noise model section 11E and a first scaling section 11F.

[0090] The first noise model unit 11E outputs a first noise output value that changes non-linearly with time and fluctuates non-periodically within a specific value range.

[0091] The first noise output value is a value that does not have convergence, changes nonlinearly over time, and varies aperiodically within a specific range of values, i.e., the first noise output value is a value that does not have convergence and divergence, changes nonlinearly, and varies aperiodically within a specific range of values.

[0092] The first noise model unit 11E sequentially generates first noise output values ​​that satisfy the above conditions and outputs them to the first scaling unit 11F. The first noise model unit 11E is configured with a program or a circuit that executes an algorithm for sequentially generating and outputting first noise output values ​​that satisfy the above conditions.

[0093] The program for executing an algorithm for sequentially generating and outputting the first noise output values ​​may be created in advance and may be pre-installed in the control device 10 as the first noise model section 11E.

[0094] For example, a program using a non-periodic function may be used as a program for executing an algorithm for sequentially generating and outputting the first noise output values. A non-periodic function is a function that does not exhibit periodicity, such as a sine function or a cosine function. Non-periodicity refers to not converging to an equilibrium point, not having a periodic orbit, and the like.

[0095] For example, a program that executes an algorithm that sequentially generates and outputs the first noise output value may be a program that uses a chaotic map. A chaotic map is an algorithm that is sensitive to initial values ​​and non-periodic. Initial value sensitivity refers to the property that even in the same system, a very small error in the initial value causes the output difference to increase with the number of steps (i.e., the passage of time).

[0096] Examples of chaotic maps include the logistic map, the tent map, the Bernoulli map, and the Henon map.

[0097] The first noise model unit 11E outputs the generated first noise output value to the first scaling unit 11F.

[0098] The first scaling unit 11F reduces the first noise output value input from the first noise model unit 11E to a value less than the resolution of the sensor 30, and outputs the reduced first noise value.

[0099] As described above, the first noise model unit 11E outputs the first noise output value, which does not have convergence, changes nonlinearly over time, and is a value that fluctuates nonperiodically within a specific value range, to the first scaling unit 11F. Therefore, the first noise output value output from the first noise model unit 11E may become a value equal to or greater than the resolution of the sensor 30 over time.

[0100] Therefore, the first scaling unit 11F reduces the first noise output value input from the first noise model unit 11E to a value less than the resolution of the sensor 30. Then, the first scaling unit 11F outputs the first noise value, which is the reduced first noise output value, to the integrating unit 10C.

[0101] For example, it is assumed that the first noise model unit 11E is a program using the logistics map. The logistics map is expressed by the following formula (5).

[0102]

number

[0103] In equation (5), t represents the number of steps, i.e., the elapsed time. a is a parameter. x represents the first noise output value. When the logistic map is used, x varies non-periodically within the range of value "0" to value "1". x(t+1) represents step t+1, i.e., the first noise output value output by the first noise model unit 11E this time. x(t) represents step t, i.e., the first noise output value output by the first noise model unit 11E last time.

[0104] When the first noise model unit 11E is a program using a logistic map, the first noise output value output from the first noise model unit 11E changes nonlinearly with time and becomes a value that fluctuates nonperiodically within a specific value range from the value "0" to the value "1." However, the first noise output value output from the first noise model unit 11E may become a value equal to or greater than the resolution of the sensor 30 as time passes.

[0105] As described in the first embodiment, the first noise value input to the integration unit 10C needs to be less than the resolution of the sensor 30. Therefore, the first scaling unit 11F reduces (scales) the first noise output value output from the first noise model unit 11E to less than the resolution of the sensor 30. Specifically, the first scaling unit 11F calculates the first noise value by reducing the first noise output value to less than the resolution of the sensor 30 using the following formula (6).

[0106]

number

[0107] In formula (6), γ is a reduction ratio. The first scaling unit 11F stores γ in advance and uses it to reduce the first noise output value. x(t) has the same meaning as in formula (5) above. y(t) represents the first noise value output at step t.

[0108] The control device 11 includes an acquisition unit 10A, an integration unit 10C, and a transmission unit 10D, which are similar to those of the control device 10 of the above embodiment.

[0109] Next, the monitoring device 21 will be described.

[0110] The monitoring device 21 includes a separation unit 20A, a second noise output unit 21B, a detection unit 20C, and a monitoring unit 20D. The monitoring device 21 includes a second noise output unit 21B instead of the second noise output unit 20B in the monitoring device 20.

[0111] The second noise output section 21B has a second noise model section 21E and a second scaling section 21F.

[0112] The second noise model unit 21E outputs the second noise output value, which is the first noise output value, to the second scaling unit 21F. The second scaling unit 21F outputs the second noise value obtained by reducing the second noise output value at the reduction ratio of the first noise value to the detection unit 20C.

[0113] The second noise model unit 21E is pre-adjusted so as to output to the second scaling unit 21F a second noise output value that is the same as the first noise output value, which is the value of the first noise value input from the control device 11 to the separation unit 20A and included in the integrated value before scaling by the first scaling unit 11F.

[0114] The second noise model unit 21E sequentially generates second noise output values ​​that satisfy the above condition, and outputs them to the second scaling unit 21F.

[0115] The second noise model unit 21E is configured, for example, from the same program or circuit as the first noise model unit 11E. When an Arbiter PUF, which is a circuit that generates a first noise output value, is used as the first noise model unit 11E, a mathematical model of the Arbiter PUF may be applied to the second noise model unit 21E. For example, a mathematical model of the Arbiter PUF mounted as the first noise model unit 11E may be generated in advance by a known method using machine learning or the like, and may be mounted in the monitoring device 21 as the second noise model unit 21E.

[0116] When the first noise model unit 11E is a program using a logistic map, the second noise model unit 21E may be a program that generates a second noise output value using the same program. In this case, in the above formula (5), x(t+1) represents step t+1, i.e., the second noise output value output by the second noise model unit 21E this time, and x(t) represents step t+1, i.e., the second noise output value output by the second noise model unit 21E last time.

[0117] The second noise model section 21E outputs the generated second noise output value to the second scaling section 21F.

[0118] The second scaling unit 21F generates a second noise value by reducing the second noise output value input from the second noise model unit 21E at the same reduction ratio as the first scaling unit 11F, and outputs the second noise value to the detection unit 20C. The second scaling unit 21F may generate the second noise value using the above formula (6) in the same manner as the first scaling unit 11F. The second scaling unit 21F may store γ, which is the reduction ratio used in the first scaling unit 11F, in advance, and may generate the second noise value using the above formula (6). In this case, in the above formula (6), y(t) represents the second noise value output in step t.

[0119] The separation unit 20A, the detection unit 20C, and the monitoring unit 20D included in the monitoring device 21 are similar to those of the monitoring device 20 of the above embodiment.

[0120] Next, an example of the flow of information processing executed by the control device 11 will be described.

[0121] FIG. 6 is a flowchart showing an example of the flow of information processing executed by the control device 11.

[0122] The first noise model unit 11E outputs the first noise output value to the first scaling unit 11F (step S300). The first scaling unit 11F outputs the first noise value obtained by reducing the first noise output value input from the first noise model unit 11E to a value less than the resolution of the sensor 30 to the integration unit 10C (step 302).

[0123] The acquiring unit 10A acquires the observed value from the sensor 30 (step S304).

[0124] The integrating unit 10C outputs an integrated value obtained by integrating the observation value input from the acquiring unit 10A and the first noise value input from the first noise output unit 11B to the transmitting unit 10D (step S306). The transmitting unit 10D transmits the integrated value input from the integrating unit 10C to the monitoring device 21 (step S308). Then, this routine ends.

[0125] Next, an example of the flow of information processing executed by the monitoring device 21 will be described.

[0126] FIG. 7 is a flowchart showing an example of the flow of information processing executed by the monitoring device 21.

[0127] The separator 20A receives the integrated value from the control device 10 (step S400). The separator 20A separates the integrated value received in step S400 into an observed value and a first noise value (step S402).

[0128] The second noise model unit 21E outputs the second noise output value to the second scaling unit 21F (step S404). The second scaling unit 21F outputs the second noise value obtained by reducing the second noise output value input from the second noise model unit 21E at the same reduction ratio as the first noise value to the detection unit 20C (step S406).

[0129] The detection unit 20C determines whether the absolute value of the spatial distance between the first noise value separated in step S402 and the second noise value input from the second noise output unit 21B in step S406 is greater than the threshold value "0" (step S408).

[0130] If the determination in step S408 is affirmative (step S408: Yes), the detection unit 20C outputs a detection result indicating the detection of a replay attack to the monitoring unit 20D (step S410). The monitoring unit 20D, which has received the detection result indicating the detection of a replay attack, executes a predetermined attack response process against the replay attack (step S412). Then, this routine ends.

[0131] On the other hand, if the determination in step S408 is negative (step S408: No), the process proceeds to step S414. In step S414, the detection unit 20C outputs a detection result indicating that a replay attack has not been detected to the monitoring unit 20D (step S414). The monitoring unit 20D, which has received the detection result indicating that a replay attack has not been detected, executes a predetermined monitoring process or the like using the observation value separated in step S402 (step S416). Then, this routine ends.

[0132] As described above, in the detection system 1B of this embodiment, the first noise output unit 11B of the control device 11 has the first noise model unit 11E and the first scaling unit 11F. Also, the second noise output unit 21B of the monitoring device 21 has the second noise model unit 21E and the second scaling unit 21F.

[0133] The first noise model unit 11E outputs a first noise output value that changes non-linearly over time and fluctuates non-periodically within a specific value range. The first scaling unit 11F outputs a first noise value obtained by reducing the first noise output value to less than the resolution of the sensor 30. The second noise model unit 21E outputs a second noise output value that is the first noise output value. The second scaling unit 21F outputs a second noise value obtained by reducing the second noise output value at a reduction ratio of the first noise value.

[0134] The first noise output value and the second noise output value output from the first noise model section 11E and the second noise model section 21E, respectively, are values ​​that change non-linearly with time and fluctuate non-periodically within a specific value range.

[0135] Here, it is assumed that values ​​having periodicity are used as the first noise output value and the second noise output value output from the first noise model unit 11E and the second noise model unit 21E, respectively. It is also assumed that the control device 11 and the monitoring device 21 are configured not to include the first scaling unit 11F and the second scaling unit 21F, respectively.

[0136] In this case, an algorithm used to generate noise having periodicity may be estimated by utilizing machine learning or the like from the time series data of the integrated values ​​sequentially transmitted from the control device 11 to the monitoring device 21.

[0137] On the other hand, in the detection system 1B of this embodiment, the first noise model unit 11E and the second noise model unit 21E each output a first noise output value and a second noise output value, respectively, which are values ​​that change non-linearly over time and fluctuate non-periodically within a specific value range.

[0138] Therefore, in the detection system 1B of this embodiment, it is possible to prevent the algorithm used to generate the first noise output value included in the integrated value transmitted from the control device 11 to the monitoring device 21 from being inferred. Therefore, in addition to the effects of the above-mentioned embodiments, the detection system 1B of this embodiment can detect a replay attack with high accuracy.

[0139] The first noise output value and the second noise output value output from the first noise model section 11E and the second noise model section 21E, respectively, may become values ​​equal to or greater than the resolution of the sensor 30 over time.

[0140] On the other hand, in the detection system 1B of this embodiment, the first scaling unit 11F reduces the first noise output value output from the first noise model unit 11E to a value less than the resolution of the sensor 30 and outputs it as a first noise value. Also, the second scaling unit 21F outputs a second noise value obtained by reducing the second noise output value output from the second noise model unit 21E at a reduction ratio to the first noise value.

[0141] Therefore, the first noise value and the second noise value outputted to the integrating unit 10C and the detecting unit 20C, respectively, can be prevented from becoming values ​​equal to or greater than the resolution of the sensor 30.

[0142] Therefore, the detection unit 20C of the monitoring device 21 can easily detect whether the integrated value is a replay attack by determining whether the spatial distance between the first noise value input from the separation unit 20A and the second noise value input from the second noise output unit 21B is greater than a threshold value.

[0143] Therefore, in addition to the effects of the above-mentioned embodiments, the detection system 1B of this embodiment can detect a replay attack with high accuracy. Also, the detection system 1B of this embodiment can easily detect a replay attack even when the first noise output value and the second noise output value generated by the first noise model unit 11E and the second noise model unit 21E are equal to or greater than the resolution of the sensor 30.

[0144] (Third embodiment) In this embodiment, a configuration will be described in which the control device and the monitoring device each include a plurality of noise output units.

[0145] FIG. 8 is a diagram showing an example of a functional configuration of a detection system 1C of the present embodiment.

[0146] The detection system 1C includes a control device 13 and a monitoring device 23. The control device 13 and the monitoring device 23 are communicatively connected via a network or the like. The control device 13 is communicatively connected to one or more sensors 30. The detection system 1C has the same configuration as the detection system 1 of the above embodiment, except that the detection system 1C includes the control device 13 instead of the control device 10 and the monitoring device 23 instead of the monitoring device 20.

[0147] The control device 13 includes an acquisition unit 10A, a first output unit 13E, an integration unit 10C, and a transmission unit 10D. The control device 13 includes a first output unit 13E instead of the first noise output unit 10B in the control device 10.

[0148] The first output section 13E outputs a first noise value, similar to the first noise output section 10B of the above embodiment.

[0149] The first output section 13E of the present embodiment has a plurality of first noise output sections 13B and a first selection section 13F.

[0150] 8 shows an embodiment in which the first output section 13E includes m first noise output sections 13B, ie, first noise output section 13B1 to first noise output section 13Bm, where m is an integer of 2 or more.

[0151] The multiple first noise output units 13B output different first noise values. That is, the multiple first noise output units 13B have at least a part of different algorithms for outputting the first noise values. The multiple first noise output units 13B include, for example, the first noise output unit 10B and the first noise output unit 11B in the above embodiment.

[0152] Identification information (hereinafter, referred to as ID) for uniquely identifying each of the multiple first noise output sections 13B included in the first output section 13E is added in advance to each of them.

[0153] The first selection unit 13F selects one of the multiple first noise output units 13B in accordance with predetermined selection rules, and outputs the first noise value output from the selected first noise output unit 13B to the integrating unit 10C.

[0154] The first selection unit 13F selects one of the IDs of the multiple first noise output units 13B, thereby selecting the first noise output unit 13B identified by the selected ID. The first selection unit 13F selects the ID of one first noise output unit 13B using an algorithm that can uniquely determine an ID, rather than a random number.

[0155] In detail, for example, the first selection section 13F selects the ID of one of the first noise output sections 13B by using the following formula (7).

[0156]

number

[0157] In formula (7), x selector (t+1) represents step t+1, that is, the ID of the first noise output unit 13B selected by the first selection unit 13F this time. In the formula (7), x selector (t) represents the ID of the first noise output unit 13B selected by the first selection unit 13F last time, i.e., at step t. n is an integer representing the number of first noise output units 13B. For example, the ID is set to a value from 0 to n-1. In this case, the maximum value of m is a value that coincides with n-1. b is a parameter and is a non-negative number. mod represents the MOD function.

[0158] The first selection section 13F uses the above formula (7) to select the ID of one of the first noise output sections 13B.

[0159] In addition, the first selection unit 13F may select the ID of one of the multiple first noise output units 13B by selecting an ID that is shifted by one number from the previously selected ID for each step.

[0160] The first selection unit 13F selects one first noise output unit 13B identified by the selected ID. Then, the first selection unit 13F outputs the first noise value output from the selected first noise output unit 13B to the integrating unit 10C.

[0161] The control device 12 includes an acquisition unit 10A, an integration unit 10C, and a transmission unit 10D, which are similar to the control device 10 of the above embodiment.

[0162] The monitoring device 23 includes a separation unit 20A, a second output unit 23E, a detection unit 20C, and a monitoring unit 20D. The monitoring device 23 includes the second output unit 23E instead of the second noise output unit 20B in the monitoring device 20.

[0163] The second output section 23E includes a plurality of second noise output sections 23B which are the plurality of first noise output sections 13B. That is, the second output section 23E includes a plurality of second noise output sections 23B which are the same as the plurality of first noise output sections 13B provided in the first output section 13E.

[0164] That is, the second output section 23E includes m second noise output sections 23B, namely, second noise output section 23B1 to second noise output section 23Bm. These second noise output sections 23B1 to 23Bm are the same as the first noise output section 13B1 to second noise output section 23Bm of the first output section 13E, respectively.

[0165] Then, the plurality of second noise output sections 23B1 to 23Bm respectively output, as second noise values, the same first noise values ​​as the corresponding second noise output sections 23B1 to 23Bm.

[0166] Therefore, the second noise output units 23B output second noise values ​​different from one another. That is, the second noise output units 23B have at least a part of an algorithm different from one another for outputting the second noise values. The second noise output units 23B include, for example, the second noise output unit 20B and the second noise output unit 21B in the above embodiment.

[0167] Similarly to the first noise output units 13B, each of the second noise output units 23B included in the second output unit 23E is assigned an ID for uniquely identifying each of them in advance. Each of the second noise output units 23B is assigned the same ID as the ID assigned to the corresponding first noise output units 13B.

[0168] The second selection unit 23F selects one of the multiple second noise output units 23B according to the same selection rule as that used by the first selection unit 13F. That is, the second selection unit 23F is pre-adjusted so as to select, from the multiple first noise output units 13B included in the first output unit 13E, the second noise output unit 23B1 corresponding to the first noise output unit 13B that outputs the first noise value included in the integrated value input from the control device 13 to the separation unit 20A.

[0169] Then, the second selection unit 23F outputs the second noise value output from the selected first noise output unit 13B to the detection unit 20C. For this reason, the second output unit 23E is pre-adjusted so as to output a second noise value having the same value as the first noise value included in the integrated value input from the control device 13 to the separation unit 20A to the detection unit 20C.

[0170] The separation unit 20A, the detection unit 20C, and the monitoring unit 20D included in the monitoring device 23 are similar to those of the monitoring device 20 of the above embodiment.

[0171] Next, an example of the flow of information processing executed by the control device 13 will be described.

[0172] FIG. 9 is a flowchart showing an example of the flow of information processing executed by the control device 13.

[0173] Each of the first noise output units 13B included in the first output unit 13E outputs a first noise value to the first selection unit 13F (step S500). The first selection unit 13F selects one of the first noise output units 13B according to a predetermined selection rule (step S502). The first selection unit 13F outputs the first noise value input from the selected one first noise output unit 13B to the integration unit 10C (step S504).

[0174] The acquiring unit 10A acquires the observed value from the sensor 30 (step S506).

[0175] The integrating unit 10C outputs an integrated value obtained by integrating the observation value input from the acquiring unit 10A and the first noise value input from the first selecting unit 13F to the transmitting unit 10D (step S508). The transmitting unit 10D transmits the integrated value input from the integrating unit 10C to the monitoring device 21 (step S510). Then, this routine ends.

[0176] Next, an example of the flow of information processing executed by the monitoring device 23 will be described.

[0177] FIG. 10 is a flowchart showing an example of the flow of information processing executed by the monitoring device 23.

[0178] The separator 20A receives the integrated value from the control device 13 (step S600). The separator 20A separates the integrated value received in step S600 into an observed value and a first noise value (step S602).

[0179] Each of the multiple second noise output units 23B included in the second output unit 23E outputs the second noise value to the second selection unit 23F (step S604). The second selection unit 23F selects one of the multiple second noise output units 23B according to a predetermined selection rule (step S606). The second selection unit 23F selects the same second noise output unit 23B as the first noise output unit 13B selected by the first selection unit 13F. The second selection unit 23F outputs the second noise value input from the selected one second noise output unit 23B to the detection unit 20C (step S608).

[0180] The detection unit 20C determines whether the absolute value of the spatial distance between the first noise value separated in step S602 and the second noise value input from the second selection unit 23F in step S608 is greater than the threshold value "0" (step S610).

[0181] If the determination in step S610 is affirmative (step S610: Yes), the detection unit 20C outputs a detection result indicating the detection of a replay attack to the monitoring unit 20D (step S612). The monitoring unit 20D, which has received the detection result indicating the detection of a replay attack, executes a predetermined attack response process against the replay attack (step S614). Then, this routine ends.

[0182] On the other hand, if the determination in step S610 is negative (step S610: No), the process proceeds to step S616. In step S616, the detection unit 20C outputs a detection result indicating that a replay attack has not been detected to the monitoring unit 20D (step S616). The monitoring unit 20D, which has received the detection result indicating that a replay attack has not been detected, executes a predetermined monitoring process or the like using the observation value separated in step S612 (step S618). Then, this routine ends.

[0183] As described above, in the detection system 1C of the present embodiment, the first output unit 13E of the control device 13 has a plurality of first noise output units 13B that output different first noise values ​​from each other, and a first selection unit 13F. The first selection unit 13F selects one of the plurality of first noise output units 13B in accordance with a predetermined selection rule, and outputs the first noise value output from the selected first noise output unit 13B to the integrating unit 10C.

[0184] Further, the second output unit 23E of the monitoring device 23 includes a plurality of second noise output units 23B which are the plurality of first noise output units 13B, and a second selection unit 23F. The second selection unit 23F selects the first noise output unit 13B selected by the first selection unit 13F as the selected second noise output unit 23B from among the plurality of second noise output units 23B based on a selection rule, and outputs the second noise value output from the selected second noise output unit 23B to the detection unit 20C.

[0185] In this manner, the detection system 1C of this embodiment uses a plurality of noise output units (first noise output unit 13B, second noise output unit 23B) in each of the control device 13 and the monitoring device 23. Then, in the detection system 1C of this embodiment, the integrated value is transmitted and a replay attack is detected using the noise values ​​(first noise value, second noise value) output from different noise output units for each step.

[0186] Here, the algorithm used for generating noise may be estimated by using machine learning or the like from the time series data of the integrated values ​​sequentially transmitted from the control device 13 to the monitoring device 23.

[0187] On the other hand, in the detection system 1C of this embodiment, the control device 13 and the monitoring device 23 are each configured to have multiple noise output units, and the integrated value is transmitted and replay attacks are detected using noise values ​​output from different noise output units for each step.

[0188] Therefore, the detection system 1C of this embodiment can prevent the algorithm used to generate the first noise value included in the integrated value transmitted from the control device 13 to the monitoring device 23 from being inferred. Therefore, in addition to the effects of the above-mentioned embodiments, the detection system 1C of this embodiment can detect a replay attack with high accuracy.

[0189] (Fourth embodiment) In this embodiment, a form in which a random number is added to the first noise value output from the first noise output section will be described.

[0190] FIG. 11 is a diagram showing an example of a functional configuration of a detection system 1D of the present embodiment.

[0191] The detection system 1D includes a control device 15 and a monitoring device 25. The control device 15 and the monitoring device 25 are communicatively connected via a network or the like. The control device 15 is communicatively connected to one or more sensors 30. The detection system 1D has the same configuration as the detection system 1 of the above embodiment, except that the detection system 1D includes the control device 15 instead of the control device 10 and the monitoring device 25 instead of the monitoring device 20.

[0192] The control device 15 includes an acquisition unit 10A, a first noise output unit 10B, an integration unit 10C, a transmission unit 10D, and a random number generation unit 15E. The control device 13 includes the same components as the control device 10, and further includes a random number generation unit 15E.

[0193] The random number generating section 15E adds a random number to the first noise value output from the first noise output section 10B, and outputs the result to the integrating section 10C.

[0194] The random number generation unit 15E generates an arbitrary value between a predetermined lower limit value and an upper limit value as a random number for each step. Then, the random number generation unit 15E adds the generated random number to the first noise value input from the first noise output unit 10B, and outputs the result to the integration unit 10C.

[0195] The acquisition unit 10A, the integration unit 10C, and the transmission unit 10D included in the control device 12 are similar to the control device 10 of the above embodiment. The integration unit 10C and the transmission unit 10D generate an integrated value and transmit it to the monitoring device 25 in the same manner as in the above embodiment, except that the first noise value to which a random number is added by the random number generation unit 15E is used as the first noise value. That is, in this embodiment, the integrated value of the observation value and the first noise value to which a random number is added is transmitted from the control device 15 to the monitoring device 25.

[0196] The monitoring device 25 includes a separator 20A, a second noise output unit 20B, a detector 25C, and a monitoring unit 20D. The monitoring device 25 includes a detector 25C instead of the detector 20C in the monitoring device 20.

[0197] If the spatial distance between the first noise value with a random number added thereto input from the separation unit 20A and the second noise value input from the second noise output unit 20B is greater than a threshold value corresponding to the random number, the detection unit 25C detects the integrated value received from the control device 15 as a replay attack.

[0198] That is, in this embodiment, the detection unit 25C uses a value according to the random number added by the random number generation unit 15E as a threshold value used for detecting a replay attack. In detail, the detection unit 25C uses the maximum value of the absolute value of the lower limit value and the absolute value of the upper limit value of the random number added by the random number generation unit 15E as the threshold value.

[0199] Specifically, the detection unit 25C uses a threshold value expressed by the following formula (8) to detect a replay attack: Then, when formula (9) is satisfied, the detection unit 25C detects the integrated value as a replay attack.

[0200]

number

[0201] In formula (8) and formula (9), γ upper represents the upper limit of the random number added by the random number generation unit 15E. lower represents the lower limit of the random number added by the random number generation unit 15E. thred represents the threshold used to detect replay attacks. n1 (t) represents the first noise value to which a random number is added, output from the separator 20A to the detector 25C. y n2 (t) represents the second noise value output from the second noise output section 20B to the detection section 25C. max is the MAX function.

[0202] As shown in the above formulas (8) and (9), in this embodiment, the maximum value among the absolute values ​​of the lower limit and upper limit of the random numbers added by the random number generation unit 15E is used as the threshold value used to determine the presence or absence of a replay attack. However, the range of the random numbers generated by the random number generation unit 15E is adjusted in advance so that this threshold value is smaller than the minimum absolute value of the possible values ​​of the first noise value and the second noise value.

[0203] Then, the detection unit 25C judges whether the absolute value of the difference, which is the spatial distance between the first noise value to which a random number is added and input from the separation unit 20A, and the second noise value input from the second noise output unit 20B, is greater than the threshold value. If the absolute value of the difference, which is the spatial distance, is greater than the threshold value, the detection unit 25C detects that the integrated value received from the control device 15 is a replay attack. On the other hand, if the absolute value of the difference, which is the spatial distance, is equal to or less than the threshold value, the detection unit 25C detects that the integrated value received from the control device 15 is not a replay attack. Then, the detection unit 25C outputs the detection result to the monitoring unit 20D.

[0204] Next, an example of the flow of information processing executed by the control device 15 will be described.

[0205] FIG. 12 is a flowchart showing an example of the flow of information processing executed by the control device 15.

[0206] The first noise output unit 10B outputs the first noise value to the random number generation unit 15E (step S700). The random number generation unit 15E adds a random number to the first noise value input from the first noise output unit 10B, and outputs the result to the integration unit 10C (step S702).

[0207] The acquiring unit 10A acquires the observed value from the sensor 30 (step S704).

[0208] The integrating unit 10C outputs an integrated value obtained by integrating the observed value input from the acquiring unit 10A and the first noise value to which the random number input from the random number generating unit 15E has been added to, to the transmitting unit 10D (step S706). The transmitting unit 10D transmits the integrated value input from the integrating unit 10C to the monitoring device 25 (step S708). Then, this routine ends.

[0209] Next, an example of the flow of information processing executed by the monitoring device 25 will be described.

[0210] FIG. 13 is a flowchart showing an example of the flow of information processing executed by the monitoring device 25.

[0211] The separator 20A receives the integrated value from the control device 10 (step S800). The separator 20A separates the integrated value received in step S800 into an observed value and a first noise value to which a random number has been added (step S802).

[0212] The second noise output unit 20B outputs the second noise value to the detection unit 25C (step S804).

[0213] The detection unit 25C judges whether the absolute value of the spatial distance between the first noise value to which the random number is added, which is separated in step S802, and the second noise value input from the second noise output unit 20B in step S804, is greater than a threshold value (step S806). In step S806, the maximum value of the absolute value of the lower limit value and the absolute value of the upper limit value of the random number added by the random number generation unit 15E is used as the threshold value.

[0214] If the determination in step S806 is affirmative (step S806: Yes), the detection unit 25C outputs a detection result indicating the detection of a replay attack to the monitoring unit 20D (step S808). The monitoring unit 20D, which has received the detection result indicating the detection of a replay attack, executes a predetermined attack response process against the replay attack (step S810). Then, this routine ends.

[0215] On the other hand, if the determination in step S806 is negative (step S806: No), the process proceeds to step S812. In step S812, the detection unit 25C outputs a detection result indicating that a replay attack has not been detected to the monitoring unit 20D (step S812). The monitoring unit 20D, which has received the detection result indicating that a replay attack has not been detected, executes a predetermined monitoring process or the like using the observation value separated in step S802 (step S814). Then, this routine ends.

[0216] As described above, in the detection system 1D of this embodiment, the random number generation unit 15E adds a random number to the first noise value output from the first noise output unit 10B, and outputs the result to the integrating unit 10C. Then, the integrating unit 10C and the transmitting unit 10D transmit to the monitoring device 25 an integrated value of the first noise value to which the random number has been added and the observed value.

[0217] Here, the algorithm used for generating noise may be estimated by utilizing machine learning or the like from the time series data of the integrated values ​​sequentially transmitted from the control device 15 to the monitoring device 25.

[0218] On the other hand, the detection system 1D of the present embodiment transmits to the monitoring device 25 the first noise value to which the random number has been added and the integrated value of the first noise value.

[0219] Therefore, in the detection system 1D of this embodiment, it is possible to prevent the algorithm used to generate the first noise value included in the integrated value transmitted from the control device 15 to the monitoring device 25 from being inferred. Therefore, in addition to the effects of the above-mentioned embodiments, the detection system 1D of this embodiment can detect a replay attack with high accuracy.

[0220] Furthermore, in comparison with the detection system 1C of the third embodiment, the detection system 1D of this embodiment generates noise values ​​(first noise value, second noise value) in one first noise output unit 10B and one second noise output unit 20B in each of the control device 15 and the monitoring device 25. Therefore, the detection system 1D of this embodiment is able to reduce the calculation load and detect a replay attack with high accuracy.

[0221] Next, an example of the hardware configuration of the control device 10, the control device 11, the control device 15, the monitoring device 20, the monitoring device 21, and the monitoring device 25 of the above embodiment will be described.

[0222] FIG. 14 is a diagram showing an example of a hardware configuration of the control device 10, the control device 11, the control device 15, the monitoring device 20, the monitoring device 21, and the monitoring device 25 of the above embodiment.

[0223] The control device 10, control device 11, control device 15, monitoring device 20, monitoring device 21, and monitoring device 25 in the above embodiments each include a control device such as a CPU (Central Processing Unit) 90B, a storage device such as a ROM (Read Only Memory) 90C, a RAM (Random Access Memory) 90D, and a HDD (Hard Disk Drive) 90E, an I / F section 90A which interfaces with various devices, and a bus 90F which connects each section, and is a hardware configuration that utilizes a normal computer.

[0224] In the control device 10, control device 11, control device 15, monitoring device 20, monitoring device 21, and monitoring device 25 of the above embodiments, the CPU 90B reads a program from ROM 90C onto RAM 90D and executes it, thereby realizing each of the above parts on the computer.

[0225] The programs for executing the above-mentioned processes executed by the control device 10, the control device 11, the control device 15, the monitoring device 20, the monitoring device 21, and the monitoring device 25 in the above-mentioned embodiments may be stored in the HDD 90E. Also, the programs for executing the above-mentioned processes executed by the control device 10, the control device 11, the control device 15, the monitoring device 20, the monitoring device 21, and the monitoring device 25 in the above-mentioned embodiments may be provided by being pre-installed in the ROM 90C.

[0226] The programs for executing the above processes executed by the control devices 10, 11, 15, monitoring devices 20, 21, and 25 of the above embodiments may be stored in a computer-readable storage medium such as a CD-ROM, CD-R, memory card, DVD (Digital Versatile Disc), or flexible disk (FD) in an installable or executable format file and provided as a computer program product. The programs for executing the above processes executed by the control devices 10, 11, 15, monitoring devices 20, 21, and 25 of the above embodiments may be stored on a computer connected to a network such as the Internet and provided by downloading the programs via the network. The programs for executing the above processes executed by the control devices 10, 11, 15, monitoring devices 20, 21, and 25 of the above embodiments may be provided or distributed via a network such as the Internet.

[0227] Although the embodiment of the present invention has been described above, the embodiment is presented as an example and is not intended to limit the scope of the invention. This new embodiment can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the gist of the invention. This embodiment and its modifications are included in the scope and gist of the invention, and are included in the scope of the invention and its equivalents described in the claims.

[0228] For example, in the above embodiment, the first information processing device is the control device 10, the control device 11, the control device 13, or the control device 15. Also, in the above embodiment, the second information processing device is the monitoring device 20, the monitoring device 21, the monitoring device 23, or the monitoring device 25.

[0229] However, the first information processing device and the second information processing device may be information processing devices communicably connected via a network or the like, and are not limited to a control device and a monitoring device. For example, the first information processing device may function as a client in a client-server system, and the second information processing device may function as a server. [Explanation of symbols]

[0230] 1, 1B, 1C, 1D Detection System 10, 11, 13, 15 Control device 20, 21, 23, 25 Monitoring equipment 10A Acquisition Department 10B, 11B, 13B First noise output section 10C Integration Department 10D Transmitter 11E Noise Model No. 1 11F 1st Scaling Section 13E First output section 15E Random number generator 20A separation part 20B, 21B, 23B Second noise output section 21E Noise Model No. 2 21F 2nd Scaling Section 23E 2nd output section 20C, 25C detector

Claims

1. A detection system including a first information processing device and a second information processing device communicatively connected to the first information processing device, The first information processing device is an acquisition unit for acquiring an observation value of an object by a sensor; a first noise output unit that outputs a first noise value that changes over time and is less than the resolution of the sensor; an integration unit that outputs an integrated value obtained by integrating the first noise value and the observed value; a transmission unit that transmits the integrated value to the second information processing device; Equipped with The second information processing device is a separation unit that separates the integrated value received from the first information processing device into the observed value and the first noise value; a second noise output unit that outputs a second noise value that is the first noise value; a detection unit that detects whether the integrated value is a replay attack based on a spatial distance between the first noise value and the second noise value; Equipped with The first noise output unit is a first noise model unit that outputs a first noise output value that changes non-linearly with time and fluctuates non-periodically within a specific value range; a first scaling unit configured to output the first noise value obtained by reducing the first noise output value to a value less than the resolution of the sensor; having The second noise output unit is a second noise model unit that outputs a second noise output value that is the first noise output value; a second scaling unit configured to scale the second noise output value at a scale-down ratio of the first noise value and output the second noise value; having Detection system.

2. The detection unit is If the spatial distance is greater than a threshold, the integrated value is detected as a replay attack. The detection system of claim 1 .

3. The first information processing device is A plurality of the first noise output units that output the first noise values ​​different from each other; a first selection unit that selects one of the plurality of first noise output units in accordance with a predetermined selection rule, and outputs the first noise value output from the selected first noise output unit to the integration unit; a first output having The second information processing device is A plurality of the second noise output units, which are a plurality of the first noise output units; a second selection unit that selects the first noise output unit selected by the first selection unit based on the selection rule as the selected second noise output unit from among the plurality of second noise output units, and outputs the second noise value output from the selected second noise output unit to the detection unit; a second output having The detection system according to claim 1 or 2.

4. The first information processing device is a random number generation unit that adds a random number to the first noise value output from the first noise output unit and outputs the result to the integration unit; Further comprising: The detection unit of the second information processing device When a spatial distance between the first noise value to which a random number is added and the second noise value is greater than a threshold value corresponding to the random number, the integrated value is detected as a replay attack. The detection system according to any one of claims 1 to 3.

5. A detection program executed in a detection system including a first information processing device and a second information processing device communicatively connected to the first information processing device, An acquisition step of acquiring an observation value of an object by a sensor; a first noise output step of outputting a first noise value that changes over time and is less than the resolution of the sensor; an integration step of outputting an integrated value obtained by integrating the first noise value and the observed value; a transmitting step of transmitting the integrated value to the second information processing device; a separation step of separating the integrated value received from the first information processing device into the observed value and the first noise value; a second noise output step of outputting a second noise value which is the first noise value; a detection step of detecting whether the integrated value is a replay attack based on a spatial distance between the first noise value and the second noise value; Including, The first noise output step includes: a first noise model step of outputting a first noise output value that varies non-linearly over time and non-periodically within a particular range of values; a first scaling step of scaling down the first noise output value to a value less than the resolution of the sensor and outputting the first noise value; Including, The second noise output step includes: a second noise model step of outputting a second noise output value which is the first noise output value; a second scaling step of outputting the second noise value obtained by scaling the second noise output value at a scaling ratio of the first noise value; Including, Detection program.

6. A detection method executed in a detection system including a first information processing device and a second information processing device communicatively connected to the first information processing device, An acquisition step of acquiring an observation value of an object by a sensor; a first noise output step of outputting a first noise value that changes over time and is less than the resolution of the sensor; an integration step of outputting an integrated value obtained by integrating the first noise value and the observed value; a transmitting step of transmitting the integrated value to the second information processing device; a separation step of separating the integrated value received from the first information processing device into the observed value and the first noise value; a second noise output step of outputting a second noise value which is the first noise value; a detection step of detecting whether the integrated value is a replay attack based on a spatial distance between the first noise value and the second noise value; Including, The first noise output step includes: a first noise model step of outputting a first noise output value that varies non-linearly over time and non-periodically within a particular range of values; a first scaling step of scaling down the first noise output value to a value less than the resolution of the sensor and outputting the first noise value; Including, The second noise output step includes: a second noise model step of outputting a second noise output value which is the first noise output value; a second scaling step of outputting the second noise value obtained by scaling the second noise output value at a scaling ratio of the first noise value; Including, Detection method.

Images