Evaluation device, evaluation method, and program

Abstract

An evaluation device capable of evaluating the safety of a device to be evaluated with high accuracy is provided. [Solution] The evaluation device 10 is a device for evaluating an evaluation target device 20 which includes multiple physical components for executing processing according to multiple logical components, and is equipped with an input unit 11 which acquires equipment information regarding the evaluation target device 20, a path determination unit 12 which determines, based on the equipment information, a logical path consisting of an array of one or more logical components from outside the evaluation target device 20 to access an asset which is data or a function possessed by the evaluation target device 20, and a physical path consisting of an array of one or more physical components corresponding to the logical path, and a risk re-evaluation unit 13 which evaluates the risk value of the asset based on the level of attack probability against the determined physical path and logical path, and the level of impact when the asset is compromised.

Description

[Technical field]

[0001] The present disclosure relates to an evaluation device for evaluating an evaluation target device. [Background technology]

[0002] For example, Patent Document 1 discloses a security countermeasure support device. This security countermeasure support device quantitatively and appropriately judges whether or not security countermeasures can be implemented for an information processing device. Specifically, the security countermeasure support device compares specification information representing one or more specification items of the information processing device with item-vulnerability information representing one or more vulnerabilities for each of two or more specification items. Then, based on the comparison result, the security countermeasure support device judges whether or not there is a vulnerability for each of one or more specification items of the information processing device. Furthermore, for each of one or more specification items judged to have a vulnerability, the security countermeasure support device judges the urgency of fixing the vulnerability for the specification item, and outputs the judgment result. In other words, such a security countermeasure support device can also be said to be an evaluation device that evaluates the vulnerability of an information processing device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2022-100815 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the security countermeasure support device of Patent Document 1 has a problem in that it is not possible to evaluate the security of the information processing device, which is the device to be evaluated, with high accuracy.

[0005] Therefore, the present disclosure provides an evaluation device and the like that can evaluate the safety of a device to be evaluated with high accuracy. [Means for solving the problem]

[0006] An evaluation device according to one embodiment of the present disclosure is an evaluation device that evaluates an evaluation target device that includes a plurality of physical components for executing processing according to a plurality of logical components, and includes: an input unit that acquires equipment information regarding the evaluation target device; a path determination unit that determines, based on the equipment information, a logical path consisting of an arrangement of one or more logical components from outside the evaluation target device to access an asset, which is data or a function possessed by the evaluation target device, and a physical path consisting of an arrangement of one or more physical components corresponding to the logical path; and an evaluation unit that evaluates a risk value of the asset based on the determined physical path and the level of attack probability against the logical path, and the level of impact when the asset is compromised.

[0007] These comprehensive or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized by any combination of the system, the method, the integrated circuit, the computer program, and the recording medium. The recording medium may be a non-transitory recording medium. Effect of the Invention

[0008] The evaluation device according to the present disclosure can evaluate the safety of a device to be evaluated with high accuracy.

[0009] Further advantages and effects of one aspect of the present disclosure will become apparent from the specification and drawings. Such advantages and / or effects are provided by the configurations described in the embodiments and the specification and drawings, but all configurations are not necessarily required. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram for explaining a risk value evaluated by a threat analysis device. [Diagram 2]FIG. 2 is a block diagram showing an example of a configuration of the evaluation device according to the first embodiment. As shown in FIG. [Diagram 3] FIG. 3 is a diagram for explaining a processing operation of the path determination unit in the first embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a combined physical path and a combined logical path in the first embodiment. [Diagram 5] FIG. 5 is a flowchart illustrating an example of a processing operation of the evaluation device according to the first embodiment. [Figure 6] FIG. 6 is a block diagram showing an example of a configuration of an evaluation device according to the second embodiment. As shown in FIG. [Figure 7] FIG. 7 is a diagram illustrating the determination of the priority in the second embodiment. [Figure 8] FIG. 8 is a flowchart showing an example of a processing operation of the evaluation device according to the second embodiment. [Figure 9] FIG. 9 is a block diagram showing an example of a configuration of an evaluation device according to the third embodiment. As shown in FIG. [Figure 10] FIG. 10 is a diagram illustrating calculation of the priority score value in the third embodiment. [Figure 11] FIG. 11 is a flowchart showing an example of a processing operation of the evaluation device according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] An evaluation device according to a first aspect of the present disclosure is an evaluation device that evaluates an evaluation target device that includes a plurality of physical components for executing processing according to a plurality of logical components, and includes an input unit that acquires equipment information regarding the evaluation target device, a path determination unit that determines, based on the equipment information, a logical path consisting of an arrangement of one or more logical components from outside the evaluation target device to access an asset, which is data or a function possessed by the evaluation target device, and a physical path consisting of an arrangement of one or more physical components corresponding to the logical path, and an evaluation unit that evaluates a risk value of the asset based on the determined physical path and the level of attack probability against the logical path, and the level of impact when the asset is compromised.

[0012] This allows the risk value of an asset to be evaluated based on the physical path corresponding to the logical path, thereby improving the accuracy of the evaluation of the risk value and enabling the safety of the device to be evaluated with high accuracy. In other words, the risk value evaluated only based on the physical path can be reevaluated with high accuracy.

[0013] In addition, in the evaluation device according to a second aspect, the path determination unit may include a separation setting specification unit that specifies a separation state set for the plurality of logical components, and a path combination unit that determines the logical path based on the specified separation state and determines the physical path corresponding to the logical path, thereby combining the physical path and the logical path, and the evaluation unit may evaluate a risk value of the asset based on the combined physical path and logical path. Note that the second aspect may be subordinate to the first aspect.

[0014] As a result, a logical path is determined based on the separation state of a plurality of logical components, so that a more appropriate logical path can be determined and the risk value of an asset can be evaluated with even higher accuracy.

[0015] In addition, in the evaluation device according to a third aspect, the input unit may further acquire vulnerability assessment information indicating a vulnerability of at least one logical component among the plurality of logical components, the path determination unit may further re-determine the physical path and the logical path for each vulnerability of the at least one logical component indicated by the vulnerability assessment information based on the vulnerability, the evaluation unit may further re-evaluate the risk value of the asset based on the re-determined physical path and the logical path for each vulnerability of the at least one logical component, and the evaluation device may further include a priority determination unit that determines the priority of a measure against the vulnerability based on the re-evaluated risk value of the asset for each vulnerability of the at least one logical component. Note that the third aspect may be subordinate to the first or second aspect.

[0016] This allows the risk value of the asset to be reevaluated for each vulnerability based on the logical path corresponding to that vulnerability, and the priority of the countermeasures against that vulnerability is determined based on the reevaluated risk value. Therefore, it is possible to derive an appropriate priority for the vulnerability, and by taking measures according to that priority, the safety of the device to be evaluated can be improved.

[0017] In addition, in the evaluation device according to a fourth aspect, the evaluation target device has a plurality of assets including the asset, and for each of the plurality of assets, (a) the path determination unit re-determines the physical path and the logical path for the asset, (b) the evaluation unit re-evaluates a risk value of the asset based on the re-determined physical path and the logical path, and the priority determination unit may determine the priority for each vulnerability of the at least one logical configuration element based on the risk value re-evaluated for each of the plurality of assets. Note that the fourth aspect may be subordinate to the third aspect.

[0018] As a result, the priority of countermeasures against vulnerabilities is determined based on the risk values ​​reevaluated for each of the multiple assets, making it possible to derive appropriate priorities from the perspective of the multiple assets, and by taking measures according to those priorities, the safety of the equipment being evaluated can be effectively improved.

[0019] In addition, in the evaluation device according to a fifth aspect, the priority determination unit may determine the priority for each vulnerability of the at least one logical configuration element based on (a) a sum of risk values ​​reevaluated for each of the multiple assets, (b) a number of risk values ​​that indicate a predetermined maximum value among the risk values ​​reevaluated for each of the multiple assets, or (c) a sum of changes in the risk values ​​reevaluated for each of the multiple assets. Note that the fifth aspect may be dependent on the fourth aspect.

[0020] This makes it possible to derive an appropriate priority according to the purpose.

[0021] In addition, in the evaluation device according to a sixth aspect, the input unit may further acquire vulnerability assessment information indicating, as a score value, a vulnerability of at least one logical component among the plurality of logical components, the evaluation target device has a plurality of assets including the asset, the path determination unit determines the logical path for each of the plurality of assets, and the evaluation device may further include a score calculation unit that calculates, for each vulnerability of the at least one logical component indicated by the vulnerability assessment information, a priority of a measure against the vulnerability as a priority score value based on the score value of the vulnerability and a usage status of the logical component corresponding to the vulnerability by the plurality of assets. Note that the sixth aspect may be subordinate to any one of the first to fifth aspects.

[0022] This makes it possible to derive the priority as a priority score value without using the risk value of the asset, thereby increasing the degree of freedom in deriving the priority.

[0023] In addition, in the evaluation device according to a seventh aspect, the evaluation device may further include a usage status identification unit that identifies a usage status of the logical configuration element corresponding to the vulnerability by the multiple assets as the number of assets that use the logical configuration element, and the score calculation unit may calculate the priority score value by multiplying the score value by the number of assets. Note that the seventh aspect may be dependent on the sixth aspect.

[0024] As a result, the more assets that use a logical component corresponding to a vulnerability, the higher the priority (i.e., the priority score value) that is derived for that vulnerability, making it possible to derive an appropriate priority.

[0025] In addition, an evaluation device according to an eighth aspect is an evaluation device that evaluates an evaluation target that executes processing according to a plurality of logical components, and includes an input unit that acquires configuration information regarding the evaluation target, a path determination unit that determines a logical path consisting of an arrangement of one or more logical components from outside the evaluation target to access an asset, which is data or a function possessed by the evaluation target, based on the configuration information, and an evaluation unit that evaluates a risk value of the asset based on a level of attack probability against the determined logical path and a level of impact when the asset is violated.

[0026] This makes it possible to derive a risk value based on the logical path even when the physical path is unknown. The derived risk value may then be combined with the physical path to reassess the risk. This is expected to have the effect of shortening the risk reassessment period when derivation is expanded to other physical configurations.

[0027] Hereinafter, the embodiment will be specifically described with reference to the drawings.

[0028] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component arrangement and connection forms, steps, and order of steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in an independent claim showing a top concept are described as optional components.

[0029] In addition, each drawing is a schematic diagram and is not necessarily a precise illustration. In addition, in each drawing, the same components are denoted by the same reference numerals.

[0030] (Embodiment 1) The evaluation device in this embodiment reevaluates the risk value of the asset held by the equipment to be evaluated. That is, the evaluation device in this embodiment reevaluates the risk value of the asset evaluated by the threat analysis device in the development stage of the equipment to be evaluated. Note that the process of evaluating the risk value can also be said to be a process of deriving a risk value, and the process of reevaluating the risk value can also be said to be a process of re-deriving a risk value. Below, the evaluation of the risk value by the threat analysis device will be described, followed by the evaluation device in this embodiment.

[0031] FIG. 1 is a diagram for explaining a risk value evaluated by a threat analysis device.

[0032] As shown in FIG. 1(a), the threat analysis device evaluates the risk value of each of assets A, B, and C owned by the evaluation target device 20. The assets A, B, and C are data or functions to be protected in the evaluation target device 20. The evaluation target device 20 is configured as an ECU (Electronic Control Unit) mounted on a vehicle, and communicates wirelessly or wired with external devices such as a smartphone 91 and a Diag 92. The smartphone 91 is a smartphone, and the Diag 92 is a device for diagnosing defects and malfunctions of the vehicle, that is, a diagnosis. The evaluation target device 20 includes a BT interface 21, a USB interface 22, a CAN interface 23, a Main microcomputer 24, and a CAN microcomputer 25, which are physical components. The BT interface 21 is also written as BT I / F and is an interface for Bluetooth (registered trademark). The USB interface 22 is also written as USB I / F and is an interface for USB (Universal Serial Bus). The CAN interface 23 is also written as CAN I / F, and is an interface for CAN (Controller Area Network). The main microcomputer 24 is a microcomputer that controls the evaluation target device 20. The main microcomputer 24 has the above-mentioned assets A, B, and C. The CAN microcomputer 25 is a microcomputer that performs control related to the CAN of the evaluation target device 20. Note that the physical components are hardware components.

[0033] Here, there are physical paths between the Main microcomputer 24 and each of the BT interface 21, the USB interface 22, and the CAN microcomputer 25. There is also a physical path between the BT interface 21 and the smartphone 91. There is also a physical path between the CAN microcomputer 25 and the CAN interface 23, and there is also a physical path between the CAN interface 23 and the Diag 92. Note that the physical paths are physical connection paths.

[0034] Also, the physical components may be assigned a level of attackability. For example, the BT interface 21 is assigned a level of attackability of Medium, and the USB interface 22 is assigned a level of attackability of Very Low.

[0035] In addition, for each asset, a level of impact that an attack on the asset will have on the evaluation target device 20 is set. For example, the impact level of asset A is set to Moderate, the impact level of asset B is set to Severe, and the impact level of asset C is set to Major.

[0036] The threat analysis device determines an attack path to each of assets A, B, and C. In other words, the threat analysis device determines a physical path consisting of an arrangement of one or more physical components from an external device to each of assets A, B, and C. Hereinafter, such a physical path is also referred to as a physical path to the asset.

[0037] For example, when the smartphone 91 attacks assets A, B, and C, the smartphone 91 may access the main microcomputer 24 via the BT interface 21, which is assigned an attack possibility level of "Medium". Alternatively, the smartphone 91 may access the main microcomputer 24 via the USB interface 22, which is assigned an attack possibility level of "Very Low". In this case, the threat analysis device determines an attack path via a physical component that is assigned the highest attack possibility level. In the above example, the highest attack possibility level is Medium. Therefore, the attack path determined by the threat analysis device indicates a physical path from the smartphone 91 to the main microcomputer 24 via the BT interface 21.

[0038] The threat analysis device evaluates the risk value of the asset by referring to the risk matrix table shown in Figure 1(b) and deriving a risk value for the asset using the level of attack probability "Medium" and the level of impact on the asset.

[0039] As shown in (b) of Figure 1, the risk matrix table shows the risk value corresponding to each combination of the attack probability level and the impact level. The attack probability levels are classified as Very Low, Low, Medium, and High. These levels are arranged in ascending order. The impact levels are classified as Severe, Major, Moderate, and Negligible. These levels are arranged in ascending order.

[0040] In the above example, the impact level of asset A is Moderate, the impact level of asset B is Severe, and the impact level of asset C is Major. The attack probability level for the attack paths to these assets is Medium. That is, the highest attack probability level on the attack path, i.e., the physical path to the assets, is Medium. Therefore, the risk re-evaluation unit 13 derives "2" as the risk value of asset A, "4" as the risk value of asset B, and "3" as the risk value of asset C by referring to the risk matrix table. In this way, the risk values ​​of assets A, B, and C are evaluated. The impact level, attack probability level, and risk matrix table are defined by, for example, ISO (International Organization for Standardization) 21434.

[0041] The evaluation device 10 in this embodiment re-evaluates the risk value thus evaluated.

[0042] FIG. 2 is a block diagram showing an example of the configuration of the evaluation device according to the present embodiment.

[0043] The evaluation device 10 in this embodiment is a device that evaluates the safety of an evaluation target device 20 that includes a plurality of physical components for executing processing according to a plurality of logical components, and reevaluates the risk value of an asset evaluated by the threat analysis device as described above. Such an evaluation device 10 includes an input unit 11, a path determination unit 12, a risk reevaluation unit 13, and an output unit 14.

[0044] The input unit 11 acquires logical configuration information D1 and threat analysis information D2, which are device information related to the evaluation target device 20. The logical configuration information D1 indicates the logical configuration of the evaluation target device 20. The logical configuration can also be said to be a software configuration. The logical configuration information D1 may also indicate a software bill of materials, i.e., a software bill of materials (SBOM). The threat analysis information D2 indicates, for example, the risk value of each asset evaluated by the threat analysis device, the level of impact of each asset, and one or more attack paths. The attack path may indicate the physical path leading to the asset and the level of attack probability on the physical path.

[0045] The path determination unit 12 determines a physical path and a logical path. That is, based on the device information, the path determination unit 12 determines a logical path consisting of an array of one or more logical components from outside the evaluation target device 20 to an asset, which is data or a function possessed by the evaluation target device 20, and a physical path consisting of an array of one or more physical components corresponding to the logical path. The logical components are, for example, software. The logical path is also called a logical path leading to the asset, and the physical path is a physical path leading to the above-mentioned asset. Such a path determination unit 12 includes a separation setting specification unit 12a and a path connection unit 12b. The separation setting specification unit 12a specifies a separation state set in the logical configuration of the evaluation target device 20, that is, a separation state set in a plurality of logical components. The path connection unit 12b determines a logical path based on the specified separation state, and determines a physical path corresponding to the logical path, thereby connecting the physical path and the logical path.

[0046] The risk re-evaluation unit 13 evaluates the risk value of the asset based on the physical path and logical path combined by the path combination unit 12b. That is, the risk re-evaluation unit 13 evaluates the risk value of the asset based on the level of the possibility of attack on the physical path and logical path determined by the path combination unit 12b and the level of the impact when the asset is violated. In this embodiment, since the risk value of the asset is evaluated first by the threat analysis device, the risk re-evaluation unit 13 re-evaluates the risk value of the asset evaluated by the threat analysis device. Note that if the risk value of the asset has not been evaluated first by the threat analysis device, that is, if the risk value of the asset is not indicated in the threat analysis information D2, the risk re-evaluation unit 13 may evaluate the risk value instead of re-evaluating it. Such a risk re-evaluation unit 13 may be called an evaluation unit.

[0047] The output unit 14 generates information indicating the risk value of the asset evaluated or reevaluated by the risk reevaluation unit 13 as asset risk information D3 and outputs it to the outside of the evaluation device 10.

[0048] FIG. 3 is a diagram for explaining the processing operation of the path determination unit 12 in this embodiment.

[0049] The main microcomputer 24 has a plurality of logical components. For example, as shown in Fig. 3, the main microcomputer 24 has a virtualization platform 31, a BT driver 32, a USB driver 33, an I2C driver 34, a first OS 35, a second OS 36, a container 37, a first function 38, a second function 39, and a third function 40 as a plurality of logical components.

[0050] The virtualization platform 31 is a hypervisor (also called HV) mounted on the ECU. The BT driver 32 is a driver for controlling or operating the BT interface 21. The USB driver 33 is a driver for controlling or operating the USB interface 22. The I2C driver 34 is a driver for controlling or operating an I2C (Inter-Integrated Circuit) communication interface. The first OS 35 and the second OS 36 are operation systems. The container 37 is, for example, a container used in Docker. The first function 38 has an asset A, the second function 39 has an asset B, and the third function 40 has an asset C.

[0051] Also, there are logical paths between the virtualization platform 31 and each of the BT driver 32, the USB driver 33, and the I2C driver 34. There is also a logical path between the BT driver 32 and the first OS 35, and there is also a logical path between the first OS 35 and the first function 38. There are also logical paths between the second OS 36 and each of the USB driver 33, the I2C driver 34, the container 37, the second function 39, and the third function 40. There is also a logical path between the container 37 and the third function 40.

[0052] Here, a memory separation mechanism is set in the virtualization platform 31 and the container 37. The memory separation mechanism is also simply called a separation mechanism. The separation mechanism by the virtualization platform 31 separates the BT driver 32, the first OS 35, and the first function 38 from the USB driver 33, the I2C driver 34, the second OS 36, the container 37, the second function 39, and the third function 40, and the logical paths between them are blocked. That is, the logical path between the BT driver 32 and the second OS 36 is blocked. Therefore, the logical path is considered not to exist. Also, the separation mechanism by the container 37 blocks the logical path between the second OS 36 and the third function 40. Therefore, the logical path is considered not to exist. By such a separation mechanism of logical components, a separation state is set for the multiple logical components included in the evaluation target device 20.

[0053] The logical configuration information D1 acquired by the input unit 11 indicates, as described above, a plurality of logical components included in the main microcontroller 24, the logical paths between those logical components, and a separation mechanism set in one or more of the plurality of logical components.

[0054] The threat analysis information D2 acquired by the input unit 11 indicates, for each of assets A, B, and C owned by the evaluation target device 20, the level of impact set for that asset and one or more attack paths to that asset.

[0055] If multiple attack paths are indicated in the threat analysis information D2 for each of assets A, B, and C, the path determination unit 12 extracts one or more attack paths from the multiple attack paths based on the logical configuration information D1, and determines the one or more attack paths as attack paths to be evaluated. That is, for each of assets A, B, and C, the path determination unit 12 determines a physical path to the asset based on the logical configuration information D1. For example, the path determination unit 12 determines a physical path from the smartphone 91 to asset A of the main microcomputer 24 via the BT interface 21. Specifically, it is as follows.

[0056] The separation setting specification unit 12a specifies the above-mentioned separation state set in the multiple logical components included in the main microcomputer 24 based on the separation mechanism indicated in the logical configuration information D1. The path combination unit 12b determines a logical path to access each asset from outside the main microcomputer 24 based on the separation state. That is, the path combination unit 12b determines a logical path from the virtualization platform 31 to each of the assets A, B, and C. For example, the path combination unit 12b determines a path from the virtualization platform 31 to the first function 38 via the BT driver 32 and the first OS 35 as a logical path to the asset A. Furthermore, the path combination unit 12b considers that no logical path exists between the BT driver 32 and the second OS 36 based on the above-mentioned separation state. As a result, the path combination unit 12b determines a path from the virtualization platform 31 to the second function 39 via the USB driver 33 or the I2C driver 34, and the second OS 36 as a logical path to the asset B. Similarly, based on the above-mentioned separation state, the path combination unit 12b determines that there is no logical path between the second OS 36 and the third function 40. As a result, the path combination unit 12b determines a path from the virtualization platform 31 to the third function 40 via the USB driver 33 or the I2C driver 34, the second OS 36, and the container 37 as a logical path to the asset C.

[0057] Furthermore, the path combination unit 12b determines a physical path for each of the assets A, B, and C in accordance with the determined logical path, thereby combining the physical path and the logical path.

[0058] FIG. 4 is a diagram illustrating an example of a combined physical path and a combined logical path.

[0059] For example, the path combination unit 12b extracts an attack path corresponding to a logical path to the asset A from a plurality of attack paths to the asset A shown in the threat analysis information D2. The logical path to the asset A is a path from the virtualization platform 31 to the first function 38 via the BT driver 32 and the first OS 35, as described above. Therefore, the path combination unit 12b extracts an attack path indicating a physical path from the smartphone 91 to the asset A of the main microcomputer 24 via the BT interface 21 as an attack path corresponding to the logical path to the asset A from a plurality of attack paths to the asset A shown in the threat analysis information D2. This determines a physical path corresponding to the logical path to the asset A. That is, as shown in (a) of FIG. 4, the physical path "smartphone 91, BT interface 21, main microcomputer 24" + logical path "virtualization platform 31, BT driver 32, first OS 35, first function 38" is determined as the path to the asset A. In this way, the physical path and logical path to the asset A are combined.

[0060] Also, for example, the path combination unit 12b extracts an attack path corresponding to a logical path to the asset B from a plurality of attack paths to the asset B shown in the threat analysis information D2. As described above, the logical path to the asset B is a path from the virtualization platform 31 to the second function 39 via the USB driver 33 or the I2C driver 34 and the second OS 36. Therefore, the path combination unit 12b determines an attack path indicating a physical path from the external device 90 to the asset B of the main microcomputer 24 via the USB interface 22 as an attack path corresponding to the logical path to the asset B from a plurality of attack paths to the asset B shown in the threat analysis information D2. Thereby, a physical path corresponding to the logical path to the asset B is determined. As a result, the attack path determined by the threat analysis device, that is, the physical path from the smartphone 91 to the main microcomputer 24 via the BT interface 21 is not determined as a physical path to be evaluated by the evaluation device 10. That is, the physical path "external device 90, USB interface 22, main microcomputer 24" + logical path "virtualization platform 31, USB driver 33, second OS 36, second function 39" is determined as the path to asset B. In this way, the physical path and logical path to asset B are combined.

[0061] Similarly, the path combination unit 12b extracts an attack path corresponding to a logical path to the asset C from a plurality of attack paths to the asset C shown in the threat analysis information D2. As described above, the logical path to the asset C is a path from the virtualization platform 31 to the third function 40 via the USB driver 33 or the I2C driver 34, the second OS 36, and the container 37. Therefore, the path combination unit 12b determines an attack path indicating a physical path from the external device 90 to the asset C of the main microcomputer 24 via the USB interface 22 as an attack path corresponding to the logical path to the asset C from a plurality of attack paths to the asset C shown in the threat analysis information D2. As a result, a physical path corresponding to the logical path to the asset C is determined. As a result, the attack path determined by the threat analysis device, that is, the physical path from the smartphone 91 to the main microcomputer 24 via the BT interface 21 is not determined as a physical path to be evaluated by the evaluation device 10. That is, the physical path "external device 90, USB interface 22, main microcomputer 24" + logical path "virtualization platform 31, USB driver 33, second OS 36, container 37, third function 40" is determined as the path to asset C. In this way, the physical path and logical path to asset C are combined.

[0062] Based on the threat analysis information D2, the risk re-evaluation unit 13 identifies the highest level of the attack probability levels assigned to one or more physical components on the physical path determined for each of assets A, B, and C. Then, with reference to the risk matrix table shown in (b) of Fig. 2, the risk re-evaluation unit 13 derives a risk value for the asset using the attack probability level identified as the highest level and the impact level of the asset. This reevaluates the risk value.

[0063] For example, the risk re-evaluation unit 13 identifies the attack possibility level "Medium" of the BT interface 21 as the highest level for the physical path leading to asset A. Then, the risk re-evaluation unit 13 derives the risk value associated with the combination of the attack possibility level "Medium" and the impact level "Moderate" of asset A in the risk matrix table shown in FIG. 2(b) as the risk value "2" of asset A. This causes the risk value of asset A to be reevaluated. In other words, as shown in FIG. 3, the risk value "2" of asset A evaluated by the threat analysis device is also reevaluated as "2" by the evaluation device 10.

[0064] Furthermore, the risk re-evaluation unit 13 identifies the level of the attack possibility of the USB interface 22 for the physical path leading to asset B as "Very Low" as the highest level. Then, the risk re-evaluation unit 13 derives the risk value associated with the combination of the attack possibility level "Very Low" and the impact level of asset B "Severe" in the risk matrix table shown in Fig. 2(b) as a risk value of asset B of "2". This causes the risk value of asset B to be re-evaluated. That is, as shown in Fig. 3, the risk value of asset B of "4" evaluated by the threat analysis device is re-evaluated as "2" by the evaluation device 10.

[0065] Furthermore, the risk re-evaluation unit 13 specifies the level of the attack possibility of the USB interface 22 for the physical path leading to asset C as "Very Low" as the highest level. Then, the risk re-evaluation unit 13 derives the risk value associated with the combination of the level of the attack possibility "Very Low" and the level of the impact of asset C "Major" in the risk matrix table shown in Fig. 2(b) as a risk value of "1" for asset C. This causes the risk value of asset C to be re-evaluated. That is, as shown in Fig. 3, the risk value of asset C of "3" evaluated by the threat analysis device is re-evaluated as "1" by the evaluation device 10.

[0066] FIG. 5 is a flowchart showing an example of the processing operation of the evaluation device 10.

[0067] First, the input unit 11 of the evaluation device 10 acquires the logical configuration information D1 and the threat analysis information D2 as device information (step S11). Next, the separation setting specification unit 12a specifies the separation states set for the multiple logical components included in the evaluation target device 20 based on the logical configuration information D1 (step S12).

[0068] Next, the path combining unit 12b combines the logical path and the physical path corresponding to the logical path for each asset based on the separation state (step S13). The risk reevaluation unit 13 reevaluates the risk value of the asset using the combined logical path and physical path for each asset (step S14). Then, the output unit 14 generates and outputs asset risk information D3 indicating the reevaluated risk value for each asset (step S15). Note that the asset risk information D3 may indicate not only the reevaluated risk value for each asset, but also the risk value before reevaluation. The risk value before reevaluation is the risk value indicated by the threat analysis information D2.

[0069] As described above, in this embodiment, the risk value of an asset is evaluated based on the physical path corresponding to the logical path, so that the accuracy of the evaluation of the risk value can be improved, and the safety of the evaluation target device 20 can be evaluated with high accuracy. In other words, the risk value evaluated only based on the physical path can be reevaluated with high accuracy. In addition, since the logical path is determined based on the separation state of a plurality of logical components, a more appropriate logical path can be determined, and the risk value of the asset can be evaluated with even higher accuracy.

[0070] In the above example, the evaluation target device 20 is an ECU, but it is not limited to an ECU and may be other devices. The evaluation target device 20 may be a vehicle or a system equipped with an ECU. In this case, the above-mentioned Main microcomputer 24 may be an ECU or a server. This makes it possible to reevaluate the risk value based on the isolation mechanism and logical path of the ECU.

[0071] Furthermore, the separation state set for multiple logical components may not only be a state in which the multiple logical components are separated into two or more element groups, but may also be a multi-stage separation state in which the element groups are further separated. For example, multiple logical components are separated into two or more element groups by the virtualization platform 31, and multiple logical components included in one of the element groups are separated into two or more sub-element groups by a container.

[0072] In addition, when a vulnerability that is difficult to counter occurs in software such as open source software (OSS), the risk value may be reduced by switching the logical path to an alternative logical path.

[0073] (Embodiment 2) FIG. 6 is a block diagram showing an example of the configuration of an evaluation device according to the present embodiment.

[0074] The evaluation device 10a in this embodiment includes each of the components included in the evaluation device 10 in the first embodiment, and further includes a priority determination unit 15. The input unit 11 in this embodiment acquires not only the logical configuration information D1 and the threat analysis information D2, but also vulnerability assessment information D4. The vulnerability assessment information D4 indicates the vulnerability of at least one logical component among the multiple logical components included in the evaluation target device 20.

[0075] The evaluation device 10a in this embodiment first re-evaluates the risk value of the asset by performing a processing operation similar to that of the evaluation device 10 in the first embodiment, for example, at a stage where the evaluation target device 20 is shipped and operated. Through this re-evaluation, the risk value evaluated by the threat analysis device is re-evaluated by the evaluation device 10a. Then, when the vulnerability assessment information D4 is acquired by the input unit 11, the evaluation device 10a in this embodiment re-evaluates the risk value of the asset. Through this re-re-evaluation, the risk value evaluated in the development stage is re-evaluated by the evaluation device 10a based on the vulnerability assessment information D4. In other words, if the risk value of the asset is evaluated by the threat analysis device in the development stage, the evaluation and re-evaluation by the evaluation device 10a correspond to re-evaluation and re-re-evaluation, respectively.

[0076] Specifically, when vulnerability assessment information D4 is acquired by input unit 11, path determination unit 12 in this embodiment re-determines the physical path and logical path to the asset based on the vulnerability of at least one logical configuration element indicated by the vulnerability assessment information D4. Then, risk re-evaluation unit 13 re-evaluates the risk value of the asset based on the re-determined physical path and logical path for each vulnerability of the at least one logical configuration element.

[0077] The priority determination unit 15 determines the priority of measures against vulnerabilities for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, based on the risk value of the reassessed asset, i.e., the risk value of the re-reassessed asset. That is, the priority determination unit 15 determines the priority for the vulnerability. The output unit 14 generates vulnerability priority information D5 regarding the priority determined for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, and outputs the vulnerability priority information D5 to the outside of the evaluation device 10a.

[0078] When the evaluation target device 20 has multiple assets, the risk reevaluation unit 13 reevaluates the risk value of each of the multiple assets. Then, the priority determination unit 15 determines the priority of measures against vulnerabilities based on the risk value reevaluated for each of the multiple assets. That is, for each of the multiple assets, the path determination unit 12 re-determines the physical path and logical path for the asset, and the risk reevaluation unit 13 re-evaluates the risk value of the asset based on the re-determined physical path and logical path. Note that the physical path and logical path are the physical path and logical path leading to the asset. Then, the priority determination unit 15 determines the priority of each vulnerability of at least one logical component based on the risk value reevaluated for each of the multiple assets.

[0079] FIG. 7 is a diagram for explaining the determination of the priority.

[0080] For example, as shown in FIG. 7A, the vulnerability assessment information D4 indicates vulnerability D of the first OS 35, which is a logical component. Specifically, the vulnerability D is indicated as the severity of the vulnerability, and more specifically, as a CVSS (Common Vulnerability Scoring System) value (i.e., a CVSS score value). The vulnerability assessment information D4 may indicate a CVSS score value for each CVE identification number of CVE (Common Vulnerabilities and Exposures). The separation setting identification unit 12a of the path determination unit 12 identifies a separation state when vulnerability D is indicated for the first OS 35. In this case, the separation setting identification unit 12a identifies the same separation state as the separation state when vulnerability D is not indicated for the first OS 35. In other words, the separation setting identification unit 12a identifies the same separation state as when the risk value was evaluated. As a result, the path determination unit 12 determines the same logical path and physical path as when the risk value was evaluated for each of the assets A, B, and C. Therefore, the risk reevaluation unit 13 derives the same risk value as at the time of evaluation for each of assets A, B, and C. In this way, the risk values ​​of assets A, B, and C are reevaluated.

[0081] In this case, since the change amount of each of the risk values ​​of asset A, asset B, and asset C is 0, the priority determination unit 15 calculates the risk value change amount of "0" as the sum of these changes, as shown in (b) of Fig. 7. As a result, the priority determination unit 15 determines that the priority of vulnerability D is "low".

[0082] 7A, the vulnerability assessment information D4 indicates vulnerability E of the virtualization platform 31, which is a logical component. The separation setting identification unit 12a of the path determination unit 12 identifies an isolation state in the case where vulnerability E is indicated for the virtualization platform 31. In this case, the separation setting identification unit 12a identifies an isolation state different from an isolation state in the case where vulnerability E is not indicated for the virtualization platform 31. In other words, the separation setting identification unit 12a determines that there is no isolation mechanism for the virtualization platform 31, and only the isolation mechanism for the container 37 exists. As a result, the separation setting identification unit 12a identifies an isolation state in which a logical path exists between the BT driver 32 and the second OS 36, and a logical path is blocked between the second OS 36 and the third function 40. In other words, the separation setting determination unit 12a determines a separation state in which the BT driver 32, the first OS 35, and the first function 38 are not separated from the USB driver 33, the I2C driver 34, the second OS 36, the container 37, the second function 39, and the third function 40, and the second OS 36 is separated from the third function 40.

[0083] As a result, the path determination unit 12 determines the same logical path and physical path for the asset A as those at the time of the risk value evaluation, but determines different logical paths and physical paths for each of the assets B and C from those at the time of the risk value evaluation. That is, the path determination unit 12 determines, as a path to the asset B, a logical path that passes through the BT driver 32, which has a higher level of attack possibility than the USB driver 33 and the I2C driver 34, and a physical path corresponding to the logical path. Specifically, as a path to the asset B, a physical path "smartphone 91, BT interface 21, main microcomputer 24" + logical path "virtualization platform 31, BT driver 32, second OS 36, second function 39" is determined. Similarly, the path determination unit 12 determines, as a path to the asset C, a logical path that passes through the BT driver 32, which has a higher level of attack possibility than the USB driver 33 and the I2C driver 34, and a physical path corresponding to the logical path. Specifically, the path to asset C is determined to be the physical path "smartphone 91, BT interface 21, main microcomputer 24" + logical path "virtualization platform 31, BT driver 32, second OS 36, container 37, third function 40."

[0084] Therefore, the risk re-evaluation unit 13 derives a risk value of "2" for asset A, which is the same as the risk value at the time of evaluation. On the other hand, the risk re-evaluation unit 13 derives a risk value of "4" for asset B, which is different from the risk value of "2" at the time of evaluation, and also derives a risk value of "3" for asset C, which is different from the risk value of "1" at the time of evaluation. As a result, the risk values ​​of assets A, B, and C are reevaluated.

[0085] In this case, the change in the risk value of asset A is "0", the change in the risk value of asset B is "+2", and the change in the risk value of asset C is "+2". Therefore, the priority determination unit 15 calculates the risk value change amount of "+4" as the sum of these changes, as shown in (b) of Figure 7. As a result, the priority determination unit 15 determines that the priority of vulnerability D is "high".

[0086] As shown in (a) and (b) of Figures 7, when the vulnerability assessment information D4 indicates a vulnerability F in the USB driver 33, the same processing as when the vulnerability assessment information D4 indicates a vulnerability D in the first OS 35 is performed.

[0087] In the above example, if the vulnerability assessment information D4 indicates a vulnerability of a logical component, the separation setting identification unit 12a determines that there is no separation mechanism set in the logical component. However, if the CVSS score value of the vulnerability is equal to or greater than a threshold, the separation setting identification unit 12a may determine that there is no separation mechanism set in the logical component corresponding to the vulnerability. Furthermore, if the change in the risk value of the vulnerability is less than a first threshold, the priority determination unit 15 may determine the priority of the vulnerability as "low." If the change in the risk value of the vulnerability is equal to or greater than the first threshold and less than a second threshold, the priority determination unit 15 may determine the priority of the vulnerability as "medium," and if the change in the risk value of the vulnerability is equal to or greater than the second threshold, the priority determination unit 15 may determine the priority of the vulnerability as "high."

[0088] In the above example, the priority determination unit 15 calculates the risk value change amount, but may calculate other parameters. For example, the parameter may be the sum of the reevaluated risk values ​​of each of the multiple assets, or the number of risk values ​​indicating the predetermined maximum value "5" among the reevaluated risk values ​​of each of the multiple assets. That is, the priority determination unit 15 determines the priority of each vulnerability of at least one logical configuration element indicated in the vulnerability assessment information D4 based on (a) the sum of the risk values ​​reevaluated for each of the multiple assets, (b) the number of risk values ​​indicating the predetermined maximum value "5" among the risk values ​​reevaluated for each of the multiple assets, or (c) the sum of the change amounts of the risk values ​​reevaluated for each of the multiple assets. The sum of the change amounts of the risk values ​​is the above-mentioned risk value change amount.

[0089] FIG. 8 is a flowchart showing an example of the processing operation of the evaluation device 10a.

[0090] First, the evaluation device 10a executes a process of evaluating a risk value (Step S10). That is, the evaluation device 10a executes the processes of steps S11 to S14 or steps S11 to S15 in the flowchart shown in FIG.

[0091] Next, the input unit 11 of the evaluation device 10a acquires the vulnerability assessment information D4 (step S21). Next, the separation setting identification unit 12a identifies, for each of the vulnerabilities indicated in the vulnerability assessment information D4, the separation state set in the multiple logical configuration elements included in the evaluation target device 20 based on the vulnerability and the logical configuration information D1 (step S22).

[0092] Next, the path combining unit 12b combines, for each asset, a logical path leading to the asset and a physical path corresponding to the logical path based on the separation state corresponding to each vulnerability (step S23). The risk reevaluation unit 13 reevaluates, for each asset, a risk value of the asset using the combined logical path and physical path for each vulnerability (step S24). Next, the priority determination unit 15 determines the priority of each vulnerability based on the reevaluated risk values ​​of the assets (step S25). At this time, the priority determination unit 15 may calculate parameters such as the above-mentioned risk value change amount, and determine the priority based on the parameters.

[0093] Then, the output unit 14 generates and outputs vulnerability priority information D5 indicating the priority for each of the multiple vulnerabilities (step S26). The output unit 14 may include a parameter such as a risk value change amount in the vulnerability priority information D5, or may include the parameter in place of the priority in the vulnerability priority information D5. The output unit 14 may further output asset risk information D3 indicating the result of the processing of step S10, or may output asset risk information D3 indicating the risk values ​​of the multiple assets reevaluated by the processing of step S24.

[0094] In the above example, the input unit 11 acquires the vulnerability assessment information D4 after the logical configuration information D1 and the threat analysis information D2, but the input unit 11 may acquire the vulnerability assessment information D4 at the same timing as the logical configuration information D1 and the threat analysis information D2. In other words, the input unit 11 may acquire the logical configuration information D1, the threat analysis information D2, and the vulnerability assessment information D4 in any order.

[0095] In the above example, the risk value evaluation process is performed in step S10, but this evaluation process does not have to be performed. For example, if the priority determination unit 15 calculates the sum of the reevaluated risk values ​​or the number of the maximum risk values ​​as the above-mentioned parameters, rather than the risk value change amount, the risk value evaluation process does not have to be performed. In this case, in step S10, the input unit 11 acquires the logical configuration information D1 and the threat analysis information D2.

[0096] In this manner, in this embodiment, for each vulnerability, the risk value of the asset is reevaluated based on the logical path corresponding to the vulnerability, and the priority of the countermeasure against the vulnerability is determined based on the reevaluated risk value. Therefore, an appropriate priority for the vulnerability can be derived, and the safety of the evaluation target device 20 can be improved by taking a countermeasure according to the priority. In addition, since the priority of the countermeasure against the vulnerability is determined based on the risk value reevaluated for each of the multiple assets, an appropriate priority can be derived from the viewpoint of the multiple assets, and the safety of the evaluation target device 20 can be effectively improved by taking a countermeasure according to the priority. In addition, since the priority for the vulnerability is determined based on the sum of the risk values ​​reevaluated for each of the multiple assets, the number of the maximum risk values, or the sum of the change amounts of the risk values, an appropriate priority according to the purpose can be derived.

[0097] The evaluation device 10a in the present embodiment can also be said to be the following device. That is, the evaluation device 10a is a device for evaluating the evaluation target device 20 including a plurality of physical components for executing processing according to a plurality of logical components, and includes an input unit 11, a path determination unit 12, a risk re-evaluation unit 13, and a priority determination unit 15. The input unit 11 acquires device information on the evaluation target device 20 and vulnerability assessment information D4 indicating the vulnerability of at least one of the plurality of logical components. The path determination unit 12 determines, for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, a logical path consisting of an array of one or more logical components and a physical path consisting of an array of one or more physical components corresponding to the logical path from outside the evaluation target device 20 to access an asset that is data or a function possessed by the evaluation target device 20, based on the vulnerability and the above device information. The risk re-evaluation unit 13 evaluates the risk value of the asset for each vulnerability of the at least one logical component based on the determined level of attack possibility for the physical path and logical path and the level of impact when the asset is violated. The priority determination unit 15 determines the priority of measures against the vulnerability for each vulnerability of the at least one logical component based on the evaluated risk value of the asset.

[0098] In this way, for each vulnerability, the risk value of the asset is evaluated based on the logical path corresponding to the vulnerability, and the priority of the countermeasure against the vulnerability is determined based on the evaluated risk value. Therefore, it is possible to derive an appropriate priority for the vulnerability, and by taking the countermeasure according to the priority, the safety of the evaluation target device 20 can be improved.

[0099] (Embodiment 3) FIG. 9 is a block diagram showing an example of the configuration of an evaluation device according to the present embodiment.

[0100] The evaluation device 10b in this embodiment includes an input unit 11, a path determination unit 12, and an output unit 14, similar to the evaluation device 10 in the first embodiment, and further includes a use situation identification unit 16 and a score calculation unit 17.

[0101] Furthermore, the input unit 11 in this embodiment acquires not only the logical configuration information D1 and the threat analysis information D2, but also the vulnerability assessment information D4, as in the second embodiment. The vulnerability assessment information D4 indicates, as a score value, the vulnerability of at least one logical component among a plurality of logical components included in the evaluation target device. The score value is a CVSS score value.

[0102] The route determination unit 12 determines a logical route for each of a plurality of assets, as in the first and second embodiments.

[0103] The usage status identifying unit 16 identifies, for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, the CVSS score value of the vulnerability and the usage status of the logical component corresponding to the vulnerability by multiple assets. When identifying the usage status of the logical component, the usage status identifying unit 16 identifies the usage status by using the logical paths of each of the multiple assets determined by the path determining unit 12.

[0104] The score calculation unit 17 calculates, for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, a priority of a countermeasure against the vulnerability as a priority score value based on the CVSS score value of the vulnerability and the usage status of the logical component corresponding to the vulnerability by multiple assets.

[0105] The output unit 14 generates vulnerability priority information D5 relating to the priority score value calculated for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, and outputs the vulnerability priority information D5 to the outside of the assessment device 10b.

[0106] FIG. 10 is a diagram for explaining calculation of the priority score value.

[0107] 10(a), the vulnerability assessment information D4 indicates a vulnerability D in the first OS 35, a vulnerability E in the virtualization infrastructure 31, and a vulnerability F in the USB driver 33. Specifically, the vulnerabilities D, E, and F are indicated as CVSS score values. For example, the CVSS score value of vulnerability D is "8.0", the CVSS score value of vulnerability E is "4.0", and the CVSS score value of vulnerability F is "5.0".

[0108] The route determination unit 12 determines logical routes for the assets A, B, and C, as in the first or second embodiment.

[0109] The usage status identifying unit 16 identifies the usage status of the logical components corresponding to the vulnerability D, E, and F by the assets A, B, and C for each of the vulnerabilities D, E, and F indicated by the vulnerability assessment information D4. Specifically, the usage status identifying unit 16 identifies the usage status of the first OS35 corresponding to the vulnerability D by the assets A, B, and C. For example, the first OS35 is only on the logical path leading to the asset A, and the first OS35 is not on the logical paths leading to the assets B and C. Therefore, the usage status identifying unit 16 identifies a situation in which the first OS35 is used only by the asset A, and the first OS35 is not used by the assets B and C, as the usage status of the first OS35 corresponding to the vulnerability D. In other words, the usage status identifying unit 16 identifies the number of assets using the first OS35, "1", as the usage status of the first OS35 corresponding to the vulnerability D. In other words, the usage status identifying unit 16 identifies the asset usage frequency "1" of the first OS35 as the usage status.

[0110] Similarly, the usage status identifying unit 16 identifies the usage status of the virtualization infrastructure 31 by the assets A, B, and C, which corresponds to the vulnerability E. Specifically, the virtualization infrastructure 31 is on a logical path leading to each of the assets A, B, and C. Therefore, the usage status identifying unit 16 identifies the status in which the virtualization infrastructure 31 is used by the assets A, B, and C as the usage status of the virtualization infrastructure 31 which corresponds to the vulnerability E. In other words, the usage status identifying unit 16 identifies the number of assets using the virtualization infrastructure 31, "3," as the usage status of the virtualization infrastructure 31 which corresponds to the vulnerability E. In other words, the usage status identifying unit 16 identifies the asset usage frequency of the virtualization infrastructure 31, "3," as the usage status.

[0111] Similarly, the usage status identifying unit 16 identifies the usage status of the USB driver 33 corresponding to vulnerability F by the assets A, B, and C. Specifically, the USB driver 33 is present on the logical path leading to each of the assets B and C, and the USB driver 33 is not present on the logical path leading to the asset A. Therefore, the usage status identifying unit 16 identifies a situation in which the USB driver 33 is used by the assets B and C, and the USB driver 33 is not used by the asset A, as the usage status of the USB driver 33 corresponding to vulnerability F. In other words, the usage status identifying unit 16 identifies the number of assets using the USB driver 33, "2," as the usage status of the USB driver 33 corresponding to vulnerability F. In other words, the usage status identifying unit 16 identifies the asset usage frequency of the USB driver 33, "2," as the usage status.

[0112] In this way, the usage status identifying unit 16 identifies the usage status of a logical component corresponding to a vulnerability caused by multiple assets as the number of assets that use the logical component, that is, the asset usage frequency. Specifically, the processing by the usage status identifying unit 16 identifies the asset usage frequency for each of vulnerability D, vulnerability E, and vulnerability F, as shown in (b2) of Fig. 10.

[0113] The score calculation unit 17 multiplies the CVSS score value of each of the vulnerabilities D, E, and F shown in (b1) of FIG. 10 by the asset use frequency of each of the vulnerabilities shown in (b2) of FIG. 10. As a result, the score calculation unit 17 calculates the priority score value of each of the vulnerabilities D, E, and F as shown in (b3) of FIG. 10. In this manner, the score calculation unit 17 calculates the priority score value by multiplying the CVSS score value by the asset use frequency. The score calculation unit 17 may also determine a priority level for the priority score value of each of the vulnerabilities. The priority level is expressed, for example, by "low", "medium", or "high". For example, if the priority score value of a vulnerability is less than a third threshold, the score calculation unit 17 may determine the priority level of the vulnerability as "low". Then, the score calculation unit 17 may determine a priority level for a vulnerability as "medium" if the priority score value of the vulnerability is equal to or greater than the third threshold and less than the fourth threshold, and may determine a priority level for the vulnerability as "high" if the priority score value of the vulnerability is equal to or greater than the fourth threshold. In other words, the priority score value indicates a detailed priority, and the priority level indicates a rough priority.

[0114] FIG. 11 is a flowchart showing an example of the processing operation of the evaluation device 10b.

[0115] First, the input unit 11 of the evaluation device 10b acquires the logical configuration information D1, the threat analysis information D2, and the vulnerability assessment information D4 (step S11a). Next, the evaluation device 10b executes the processes of steps S12 and S13 as in the first embodiment. Then, the usage situation identification unit 16 identifies the asset usage frequency for each vulnerability indicated in the vulnerability assessment information D4 as the usage situation (step S31). Next, the score calculation unit 17 calculates a priority score value by multiplying the CVSS score value of the vulnerability and the asset usage frequency of the vulnerability for each vulnerability indicated in the vulnerability assessment information D4. Furthermore, the score calculation unit 17 determines a priority level for the calculated priority score value (step S32). The output unit 14 generates vulnerability priority information D5 indicating the priority score value and the priority level calculated or determined by the score calculation unit 17 for each vulnerability, and outputs the vulnerability priority information D5 to the outside of the evaluation device 10b (step S33). The output unit 14 may include only one of the priority score value and the priority level in the vulnerability priority information D5. The evaluation device 10b may evaluate or re-evaluate the risk value of the asset, similarly to the first and second embodiments. That is, the evaluation device 10b may include a risk re-evaluation unit 13.

[0116] In this manner, in this embodiment, the priority can be derived as a priority score value without using the risk value of the asset, and the degree of freedom in deriving the priority can be increased. Also, the more assets that use the logical component corresponding to the vulnerability, the higher the priority is derived for that vulnerability, and therefore, appropriate priority derivation can be realized.

[0117] The evaluation device 10b in the present embodiment can also be said to be the following device. That is, the evaluation device 10b is a device for evaluating an evaluation target device 20 including a plurality of physical components for executing processing according to a plurality of logical components, and includes an input unit 11, a path determination unit 12, and a score calculation unit 17. The evaluation target device 20 has a plurality of assets, each of which is data or function. The input unit 11 acquires device information on the evaluation target device 20 and vulnerability assessment information D4 indicating, as a score value, the vulnerability of at least one logical component among the plurality of logical components. The path determination unit 12 determines, for each of the vulnerabilities of at least one logical component indicated by the vulnerability assessment information D4, a logical path consisting of an arrangement of one or more logical components from outside the evaluation target device 20 to accessing the asset, for each asset, based on the vulnerability and the device information. The score calculation unit 17 calculates, for each vulnerability of at least one logical component indicated by the vulnerability assessment information D4, a priority of a countermeasure against the vulnerability as a priority score value based on the score value of the vulnerability and the usage status of the logical component corresponding to the vulnerability by the above-mentioned multiple assets.

[0118] This makes it possible to derive the priority as a priority score value without using the risk value of the asset, thereby increasing the degree of freedom in deriving the priority.

[0119] (Embodiment 4) In the first embodiment, the physical path and logical path are combined to perform risk re-evaluation, but when the risk evaluation target function uses a virtualization platform 31 such as Hypervisior or Docker, the physical configuration may be unknown or not determined at the time of risk evaluation. In such a case, the risk value may be individually evaluated in advance using only the logical path. The procedure in this case is described below.

[0120] The evaluation device 10 of this embodiment will be described with reference to FIG.

[0121] The evaluation device 10 in this embodiment is a device for evaluating the safety of an evaluation target device 20 that executes processing according to a plurality of logical components, and evaluates the risk value of an asset evaluated by the threat analysis device as described above. Such an evaluation device 10 includes an input unit 11, a path determination unit 12, a risk re-evaluation unit 13, and an output unit 14.

[0122] The input unit 11 acquires logical configuration information D1 and threat analysis information D2 related to the evaluation target device 20. The logical configuration information D1 indicates the logical configuration of the evaluation target device 20. The logical configuration can also be said to be a software configuration, and hierarchically defines dependencies between software. The logical configuration information D1 may also indicate a software bill of materials, i.e., a software bill of materials (SBOM). The threat analysis information D2 indicates, for example, the risk value of each asset evaluated by the threat analysis device, the level of impact of each asset, one or more attack paths, and the like.

[0123] The path determination unit 12 determines the logical path only by using the logical path. In other words, the path determination unit 12 determines a logical path consisting of an arrangement of one or more logical components from outside the evaluation target device 20 to access an asset, which is data or a function, that the evaluation target device 20 has, based on the device information.

[0124] The logical component is, for example, software. The logical path is also called a logical path leading to an asset. The path determination unit 12 includes a separation setting specification unit 12a and a path connection unit 12b. The separation setting specification unit 12a specifies a separation state set in the logical configuration of the evaluation target device 20, i.e., a separation state set in a plurality of logical components. The path connection unit 12b determines a logical path based on the specified separation state.

[0125] The risk re-evaluation unit 13 evaluates the risk value of the asset based on the separation state between the logical path combined by the path combination unit 12b and the outside. That is, the risk re-evaluation unit 13 evaluates the risk value of the asset based on the level of the possibility of attack on the logical path determined by the path combination unit 12b and the level of the impact when the asset is violated. In this embodiment, since the risk value of the asset is evaluated first by the threat analysis device, the risk re-evaluation unit 13 re-evaluates the risk value of the asset evaluated by the threat analysis device. Note that if the risk value of the asset has not been evaluated first by the threat analysis device, that is, if the risk value of the asset is not indicated in the threat analysis information D2, the risk re-evaluation unit 13 may evaluate the risk value instead of re-evaluating it. Such a risk re-evaluation unit 13 may be called an evaluation unit.

[0126] The output unit 14 generates information indicating the risk value of the asset evaluated or reevaluated by the risk reevaluation unit 13 as asset risk information D3 and outputs it to the outside of the evaluation device 10. Note that, if the actual physical configuration to be allocated to the virtualization infrastructure is determined after the above-mentioned risk reassessment is performed, risk reassessment may be performed again using the method described in the first embodiment.

[0127] This makes it possible to derive a risk value based on the logical path even when the physical path is unknown. The derived risk value may then be combined with the physical path to reassess the risk. This is expected to have the effect of shortening the risk reassessment period when derivation is expanded to other physical configurations.

[0128] The evaluation device and evaluation method according to one or more aspects of the present disclosure have been described based on the respective embodiments, but the present disclosure is not limited to those embodiments. As long as it does not deviate from the spirit of the present disclosure, various modifications conceived by a person skilled in the art may also be included in the present disclosure. In addition, the present disclosure may also include a form constructed by combining components in multiple different embodiments.

[0129] For example, in the third embodiment, the score calculation unit 17 may calculate the priority score not only based on the CVSS score and the asset usage frequency, but also based on the user, type, characteristics, and the like of the evaluation target device 20. The characteristics may be, for example, characteristics indicating whether or not a logical configuration element can be updated.

[0130] Furthermore, the accuracy of the priority determined for a vulnerability may be improved by determining a detailed logical path according to the granularity of the vulnerability or CVE indicated in the vulnerability assessment information D4 in the second and third embodiments. For example, a logical path is composed of an array of one or more logical components, and each of the one or more logical components may be software, a module included in the software, or a function. The detailed logical path may be a path including the module or function.

[0131] In the first to fourth embodiments, the path combination unit 12b may determine a logical path using test result data such as coverage data acquired when the device 20 to be evaluated is verified.

[0132] In each of the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU (Central Processing Unit) or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software for realizing the evaluation device of each of the above embodiments is a computer program that causes a computer to execute each step of the flowcharts shown in Figures 5, 8, and 11.

[0133] The following cases are also included in this disclosure:

[0134] (1) The at least one device is specifically a computer system consisting of a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is stored in the RAM or hard disk unit. The at least one device achieves its functions by the microprocessor operating in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands for a computer to achieve a specified function.

[0135] (2) Some or all of the components constituting at least one of the above devices may be composed of one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on one chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0136] (3) A part or all of the components constituting at least one of the above devices may be composed of an IC card or a standalone module that is detachable from the device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunction LSI. The IC card or module achieves its functions by the microprocessor operating according to a computer program. This IC card or module may be tamper-resistant.

[0137] (4) The present disclosure may be embodied as any of the methods described above, a computer program for implementing these methods on a computer, or a digital signal comprising a computer program.

[0138] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD (Compact Disc)-ROM, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Also, the present disclosure may be a digital signal recorded on such a recording medium.

[0139] The present disclosure may also involve transmitting a computer program or a digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0140] Furthermore, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system. [Industrial Applicability]

[0141] The evaluation device of the present disclosure can be applied to a device or system for evaluating an ECU or the like that is installed in a vehicle or the like. [Explanation of symbols]

[0142] 10, 10a, 10b Evaluation device 11 Input section 12 Route determination section 12a Separation setting specific part 12b Path junction 13 Risk Reassessment Department (Evaluation Department) 14 Output section 15 Priority judgment section 16 Usage Identification Section 17 Score Calculation Section 20. Equipment to be evaluated 21 BT interface 22 USB interface 23 CAN interface 24 Main microcomputer 25 CAN microcontroller 31 Virtualization Platform 32 BT Driver 33 USB Driver 34 I2C Driver 35 1st OS 36 2nd OS 37 Container 38 First Function 39 Second Function 40 Third Function 90 External equipment 91 Smartphone 92 Diag D1 Logical configuration information D2 Threat Analysis Information D3 Asset risk information D4 Vulnerability Assessment Information D5 Vulnerability priority information

Claims

1. An evaluation apparatus for evaluating an evaluation target device including a plurality of physical components for executing processes corresponding to a plurality of logical components, an input unit for acquiring device information regarding the evaluation target device; a path determination unit that determines, based on the device information, a logical path consisting of an array of one or more logical components from outside the evaluation target device to an access to an asset, which is data or a function of the evaluation target device, and a physical path consisting of an array of one or more physical components corresponding to the logical path; an evaluation unit that evaluates a risk value of the asset based on a determined level of attack possibility for the physical path and the logical path and a level of impact when the asset is violated; Equipped with The input unit further includes: acquiring vulnerability assessment information indicating a vulnerability of at least one of the plurality of logical components; The route determination unit further re-determining the physical path and the logical path based on each vulnerability of at least one logical component indicated by the vulnerability assessment information; The evaluation unit further reassessing a risk value of the asset based on the re-determined physical path and the re-determined logical path for each vulnerability of the at least one logical component; The evaluation device further comprises: a priority determination unit that determines a priority of a measure against each vulnerability of the at least one logical configuration element based on the reevaluated risk value of the asset; Evaluation equipment.

2. The route determination unit is a separation setting specification unit that specifies a separation state set for the plurality of logical components; a path combining unit that combines the physical path and the logical path by determining the logical path based on the identified separation state and determining the physical path corresponding to the logical path, The evaluation unit evaluates a risk value of the asset based on the combined physical path and logical path. The evaluation device according to claim 1 .

3. the evaluation target device has a plurality of assets including the asset, For each of the plurality of assets, (a) the path determination unit re-determines the physical path and the logical path for the asset; (b) the evaluation unit re-evaluates a risk value of the asset based on the re-determined physical path and the re-logical path; The priority determination unit determining, for each vulnerability of the at least one logic component, the priority for the vulnerability based on the re-evaluated risk value for each of the plurality of assets; The evaluation device according to claim 2 .

4. The priority determination unit determining the priority for each vulnerability of the at least one logical component based on (a) a sum of risk values ​​reevaluated for each of the plurality of assets, (b) a number of risk values ​​that indicates a predetermined maximum value among the risk values ​​reevaluated for each of the plurality of assets, or (c) a sum of changes in the risk values ​​reevaluated for each of the plurality of assets; The evaluation device according to claim 3 .

5. The input unit includes: obtaining the vulnerability assessment information indicating a vulnerability of the at least one logical configuration element as a score value; the evaluation target device has a plurality of assets including the asset, The route determination unit determines the logical route for each of the plurality of assets; The evaluation device further comprises: a score calculation unit that calculates, for each vulnerability of the at least one logical configuration element indicated by the vulnerability assessment information, a priority of a measure against the vulnerability as a priority score value based on the score value of the vulnerability and a usage status of the logical configuration element corresponding to the vulnerability by the plurality of assets; The evaluation device according to claim 1 .

6. The evaluation device further comprises: a usage status identification unit that identifies a usage status of a logical component corresponding to the vulnerability by the plurality of assets as a number of assets that use the logical component; The score calculation unit is calculating the priority score value by multiplying the score value by the number of assets; The evaluation device according to claim 5 .

7. An evaluation device for evaluating an evaluation target that executes processing according to a plurality of logical components, an input unit for acquiring configuration information regarding the evaluation target; a route determination unit that determines a logical route consisting of an arrangement of one or more logical components from outside the evaluation target to accessing an asset that is data or a function of the evaluation target based on the configuration information; an evaluation unit that evaluates a risk value of the asset based on the determined level of attack possibility for the logical path and the level of impact when the asset is violated; Equipped with The input unit further includes: acquiring vulnerability assessment information indicating, as a score value, a vulnerability of at least one of the plurality of logical components; The evaluation target has a plurality of assets including the asset, The route determination unit determines the logical route for each of the plurality of assets; The evaluation device further comprises: a score calculation unit that calculates, for each vulnerability of the at least one logical configuration element indicated by the vulnerability assessment information, a priority of a measure against the vulnerability as a priority score value based on the score value of the vulnerability and a usage status of the logical configuration element corresponding to the vulnerability by the plurality of assets; Evaluation equipment.

8. 1. An evaluation method in which a computer evaluates an evaluation target device including a plurality of physical components for executing processes corresponding to a plurality of logical components, comprising: Acquire device information regarding the evaluation target device; Based on the device information, a logical path consisting of an array of one or more logical components from outside the evaluation target device to an asset, which is data or a function of the evaluation target device, is determined, and a physical path consisting of an array of one or more physical components corresponding to the logical path is determined; assessing a risk value of the asset based on the determined level of attack probability for the physical path and the logical path and the level of impact when the asset is compromised; acquiring vulnerability assessment information indicating a vulnerability of at least one of the plurality of logical components; re-determining the physical path and the logical path based on each vulnerability of at least one logical component indicated by the vulnerability assessment information; reassessing a risk value of the asset based on the re-determined physical path and the re-determined logical path for each vulnerability of the at least one logical component; determining a priority of a countermeasure against each vulnerability of the at least one logical component based on the re-evaluated risk value of the asset; Evaluation method.

9. 1. An evaluation method in which a computer evaluates an evaluation target that executes processing according to a plurality of logical components, comprising: Obtaining configuration information regarding the evaluation target; Based on the configuration information, data or determines a logical path consisting of an arrangement of one or more logical components leading to accessing an asset which is a function; evaluating a risk value of the asset based on the determined level of attack probability for the logical path and the level of impact when the asset is compromised; acquiring vulnerability assessment information indicating, as a score value, a vulnerability of at least one of the plurality of logical components; In the determination of the logical path, When the evaluation target has a plurality of assets including the asset, determining the logical path of each of the plurality of assets; calculating, for each vulnerability of the at least one logical component indicated by the vulnerability assessment information, a priority of a measure against the vulnerability as a priority score value based on the score value of the vulnerability and a usage status of the logical component corresponding to the vulnerability by the plurality of assets; Evaluation method.

10. A program for evaluating an evaluation target device including a plurality of physical components for executing processes corresponding to a plurality of logical components, Acquire device information regarding the evaluation target device; Based on the device information, a logical path consisting of an array of one or more logical components from outside the evaluation target device to an asset, which is data or a function of the evaluation target device, is determined, and a physical path consisting of an array of one or more physical components corresponding to the logical path is determined; assessing a risk value of the asset based on the determined level of attack probability for the physical path and the logical path and the level of impact when the asset is compromised; acquiring vulnerability assessment information indicating a vulnerability of at least one of the plurality of logical components; re-determining the physical path and the logical path based on each vulnerability of at least one logical component indicated by the vulnerability assessment information; reassessing a risk value of the asset based on the re-determined physical path and the re-determined logical path for each vulnerability of the at least one logical component; determining a priority of a countermeasure against each vulnerability of the at least one logical component based on the re-evaluated risk value of the asset; A program that causes a computer to do something.

11. A program for evaluating an evaluation target that executes processing according to a plurality of logical components, Obtaining configuration information regarding the evaluation target; Based on the configuration information, a logical path consisting of an arrangement of one or more logical components from outside the evaluation target to access an asset, which is data or a function, possessed by the evaluation target is determined; evaluating a risk value of the asset based on the determined level of attack probability for the logical path and the level of impact when the asset is compromised; acquiring vulnerability assessment information indicating, as a score value, a vulnerability of at least one of the plurality of logical components; In the determination of the logical path, When the evaluation target has a plurality of assets including the asset, determining the logical path of each of the plurality of assets; calculating, for each vulnerability of the at least one logical component indicated by the vulnerability assessment information, a priority of a measure against the vulnerability as a priority score value based on the score value of the vulnerability and a usage status of the logical component corresponding to the vulnerability by the plurality of assets; A program that causes a computer to do something.

Images