POLICY CONTROL DEVICE, ZERO TRUST SYSTEM, POLICY CONTROL METHOD, AND POLICY CONTROL PROGRAM

Abstract

Provided is a policy control device comprising: a module verification unit (10) that verifies observation data (73D); a reliability evaluation unit (20) that calculates, from a result of the verification by the module verification unit (10), a reliability score for each entity (81) based on the cost of damage caused by cyberattacks on a corporate resource (82) from the entity (81); and a strategy determination unit (30) that determines, on the basis of a cost incurred when a policy is applied to the entity (81) and a damage cost to be reduced through application of the policy, the entity (81) at a strategic location where the policy is to be applied so that the total cost of the both costs is low.

Description

[Technical field]

[0001] The present invention relates to a policy control device, a zero trust system, a policy control method, and a policy control program. [Background technology]

[0002] Large-scale systems such as telecom networks, large-scale enterprise networks, and IoT (Internet of Things) networks are becoming widespread. It is important for security operations to implement measures (policies) to address the risk of cyber attacks on large-scale systems from entities such as external terminals. When formulating policies, it is necessary to select appropriate policy content, such as cutting off communications with entities at high-risk policy locations, such as those located in unfriendly foreign countries.

[0003] Below are some techniques that can be useful when formulating strategies. The Zero Trust Architecture (ZTA) described in Non-Patent Documents 1 and 2 is an architecture that verifies access from each entity and executes measures against untrusted entities. This makes it possible to deal with cyber attacks from internal terminals by not trusting external terminals, but also internal terminals (zero trust) as verification targets. Non-Patent Document 3 describes i-ZTA (Intelligent ZTA), which is an extension of ZTA. i-ZTA extends ZTA for large-scale networks, and performs anomaly detection using a graph neural network and reinforcement learning to dynamically evaluate risk and reliability scores. As a result, entities with high risk or low reliability scores are automatically selected as policy locations with priority over other entities. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] K. John, "Build Security Into Your Network's DNA: The Zero Trust Network Architecture," Forrester Research Inc, pp.1-26, 2010. [Non-Patent Document 2] S.Rose, et al., “SP800-207: Zero Trust Architecture”, NIST, 2020 [Non-Patent Document 3] K. Ramezanpour and J. Jithin, “Intelligent Zero Trust Architecture for 5G / 6G Tactical Networks: Principles, Challenges, and the Role of Machine Learning.”, ArXiv abs / 2105.01478, 2021. Summary of the Invention [Problem to be solved by the invention]

[0005] Implementing measures is expected to reduce security risks, but at the same time, it has the side effect of increasing risks other than security risks, such as the risk of violating the Service Level Agreement (SLA) by blocking part of the service due to the implementation of the measures. For example, when an entity with high performance but low reliability score is eliminated by executing a policy, the performance of the entire system decreases as a side effect, and the SLA that guarantees a certain standard of TPS (Transaction Per Second) is no longer met.

[0006] The entities can be excluded by implementing the measures exemplified below. - False positive blocking - Blocking communication other than false positives - Temporarily evacuate devices with low reliability scores

[0007] The role of security operator is often only responsible for the task of reducing security risks. Therefore, the more security risks are reduced, the better the job is done, so they are proactive in implementing measures. On the other hand, company managers have the task of continuing to provide services to customers and earning revenue, so in addition to reducing security risks, they also need to achieve two other indicators: protecting customers by adhering to SLAs, and reducing the costs of implementing measures to increase profitability. Conventional technologies such as those described in Non-Patent Documents 1 to 3 are technologies aimed at security operators to reduce security risks, and lack the perspective of balancing with other risks. Therefore, a tool is required to formulate measures that reflect the overall risks when providing services to customers.

[0008] Therefore, a main object of the present invention is to formulate a method for reducing security risks and risks involved in providing services in a well-balanced manner. [Means for solving the problem]

[0009] In order to solve the above problems, the policy control device of the present invention has the following features. The present invention includes a module verification unit that verifies observation data resulting from observing an entity that accesses an asset; A reliability evaluation unit that calculates a reliability score for each of the entities based on a damage cost caused by a cyber attack from the entity to the asset from a verification result of the module verification unit; The system is characterized by having a policy decision unit that decides the entity at which the policy is to be applied based on the cost incurred when the policy is applied to the entity and the damage cost reduced by applying the policy, so that the total cost of both costs is reduced. Effect of the Invention

[0010] According to the present invention, it is possible to formulate a measure capable of reducing security risks and risks involved in providing services in a well-balanced manner. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a configuration diagram of a zero trust system according to an embodiment of the present invention. [Diagram 2] This is a configuration diagram when the zero trust system of Figure 1 according to this embodiment is applied to a 5G network. [Diagram 3] FIG. 2 is an explanatory diagram of a policy control device according to the present embodiment. [Figure 4] FIG. 2 is a hardware configuration diagram of a policy control device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0013] FIG. 1 is a configuration diagram of a zero trust system 80. The zero trust system 80 is configured by connecting an entity 81, a corporate resource 82, a policy control unit 83, and a policy execution unit 84 via a network. The enterprise resource 82 corresponds to a resource in Non-Patent Document 2 and is also called an asset. The enterprise resource 82 is an object to be protected, such as an in-house device that stores confidential information. The entity 81 corresponds to an entity in Non-Patent Document 2. The entity 81 is a terminal attempting to access the enterprise resource 82, or a network to which a set of terminals attempting to access the enterprise resource 82 belongs, and is an object to be inspected by the policy control device. The policy control device may not only inspect the entity 81 on a device basis, but also inspect the entity 81 on a network basis, such as the target network 73 in Fig. 2. If a contaminated network is found in the inspection, the policy control device may apply a measure to disconnect (disconnect and disable communication) the network from the carrier network.

[0014] For ease of understanding, the present specification will be described assuming that each device is classified as either an entity 81 or an enterprise resource 82. However, the same device may be both an entity 81 and an enterprise resource 82. For example, device A storing secret information A1 and device B storing secret information B1 belong to the enterprise resource 82 when their own secret information is accessed from outside. On the other hand, when device A obtains secret information B1 from device B, device A becomes entity 81. Thus, in a zero trust system 80, the only truly trustworthy device is the policy control device that performs the verification, and all other devices, whether internal or external, correspond to entities 81 that are subject to inspection without trust (zero trust).

[0015] The policy control unit 83 corresponds to a PDP (policy decision point) in Non-Patent Document 2. The policy control unit 83 has an access permission unit 83A and a policy setting unit 83B. The access permission unit 83A authenticates whether to permit or deny access to each entity 81 accessed via the policy enforcement unit 84, by referring to an in-house database (not shown) or the like. The policy setting unit 83B sets the authentication result of the access permission unit 83A in the policy enforcement unit 84 as a policy (measure).

[0016] The policy enforcement unit 84 corresponds to a PEP (policy enforcement point) in Non-Patent Document 2. The policy enforcement unit 84 permits or denies access to the entity 81 according to the policy. An entity 81 that passes the authentication can access the enterprise resource 82. An entity 81 that fails the authentication cannot access the enterprise resource 82.

[0017] FIG. 2 is a configuration diagram of the zero trust system 80 of FIG. 1 applied to a 5G network. The target network 73 includes an enterprise resource 82. The enterprise resource 82 in FIG. 1 is embodied as a carrier network group including the following devices in FIG. ·NEF82A:Network Exposure Function. ·PCF82B:Policy Control function. ·AMF82C: Access and Mobility management Function. · UPF 82D: User Plane Function. This UPF 82D is connected to a DN (Data Network) 82E.

[0018] The entity 81 in Fig. 1 is embodied as a User Entity (UE) such as an in-vehicle terminal 81A, a smartphone 81B, or a tablet terminal 81C in Fig. 2. The target network 73 itself may also be one entity 81.

[0019] The policy control device is one or more housings having a module verification unit 10, a reliability evaluation unit 20, a policy decision unit 30, and a scheduler unit 40. In Fig. 2, the four processing units are distributed in separate housings (four housings), but the four processing units may be accommodated in one housing. The policy control unit 83 in FIG. 1 is embodied in FIG. 2 as the reliability evaluation unit 20 and the scheduler unit 40 in the core network 71. 2, the policy execution unit 84 in Fig. 1 is embodied as a module verification unit 10 and a policy decision unit 30 in the access network 72. Furthermore, the policy execution unit 84 in Fig. 1 may include a gNB (next generation NodeB) 84A, which is a base station of the communication standard 5G in Fig. 2.

[0020] The module verification unit 10 has an observation data DB 12 that stores the results of observing the entity 81 (observation data 73D in FIG. 3), and a verification module 11 that verifies the entity 81 on a module-by-module basis based on the data stored in the observation data DB 12. The verification module 11 executes one or more of the verifications exemplified below. - Verify the communication performed by the modules. -Verify the system calls used by the module. -Verify tampering with the memory area that the module rewrites.

[0021] The reliability evaluation unit 20 includes a reliability calculation unit 21 and a network DB 22 . The reliability calculation unit 21 calculates a reliability score for each entity 81 by applying a quantitative risk management method to the verification results of the module verification unit 10. This reliability score is an index based on the cost of damage caused by a cyber attack from the entity 81 to the enterprise resources 82. Note that the cyber attack is, for example, an unauthorized access from the entity 81 or a denial of service attack such as a DoS (Denial of Services). The network DB 22 stores inventory information of the target network 73 and asset information of the enterprise resources 82 .

[0022] The policy decision unit 30 has a policy control unit 31 as the policy control unit 83 in FIG. The policy control unit 31 determines a policy based on the cost incurred when the policy is applied to the entity 81 (hereinafter referred to as the "application cost") and the damage cost to be reduced by applying the policy, so that the total cost of both costs is reduced. In other words, the policy control unit 31 determines a policy by evaluating the security risk (reliability score) calculated by the reliability evaluation unit 20 and the risk when providing a service (such as the risk of not complying with the SLA) using a unified index.

[0023] The policy determined by the policy control unit 31 is at least one of a "policy content" indicating what policy to execute and a "policy location" indicating which entity 81 to execute the policy on. When there are multiple pairs of policy content and policy location, the policy control unit 31 determines an optimal combination from among the pairs. "Optimal" here refers to the perspective of being able to reduce not only security risks (reliability scores) but also risks when providing services in a balanced manner, as will be described later in FIG. 3.

[0024] The policy control unit 31 applies the determined policy to the target network 73 (the policy enforcement unit 84 in FIG. 1). The policy determination unit 30 applies the policy to access from the entity 81 to the enterprise resource 82 by setting the determined policy in the policy execution unit 84. Alternatively, the policy determination unit 30 may present the determined policy to the operator on a display screen to allow the operator to understand the policy.

[0025] The scheduler unit 40 has an operation unit 41 that operates each processing unit (the module verification unit 10, the reliability evaluation unit 20, and the policy decision unit 30) of the policy control device. In the operation phase, the operation unit 41 schedules processing by each processing unit of the policy control device according to the security risk indicated by the reliability score for each entity 81. The operation unit 41 may periodically execute the scheduling based on this operation phase, or may execute it one-off at an irregular timing.

[0026] Furthermore, the operation unit 41 may receive the reliability score evaluated by the reliability evaluation unit 20 and increase or decrease the verification load when the verification module 11 verifies the entity 81. For example, the operation unit 41 assigns fewer types of verification functions to an entity 81 having a higher reliability score in order to reduce the load of verifying the observation data 73D. As a result, finite system resources (verification capacity) are concentrated and allocated in large quantities to entities 81 with low reliability scores, making it possible to perform appropriate verification with low latency even in a system with a large number of entities 81. Alternatively, the operation unit 41 may perform verification processing for a specific entity 81 that requires low latency later than the other entities 81. The operation unit 41 may assign a provisional verification result (communication permission or communication blocking) to the specific entity 81 for the period of time that has elapsed until the verification processing for the specific entity 81 is performed.

[0027] FIG. 3 is an explanatory diagram of the policy control device. First, each variable used in the explanation of FIG. 3 will be explained. The entity 81 is indicated by a variable e. The first entity 81 is e[1], and the m-th entity 81 is e[m]. The risk manifestation probability 21B is indicated by the probability P(e[m]=malicious | I) that the risk of e[m] manifests. The manifestation of a risk means, for example, that an entity 81 actually attacks corporate resources 82 with a cyber-attack. The network setting 21F in the network DB 22 is information on the target network 73, and is referred to in order to identify the impact on the surroundings when the risk of e[m] becomes apparent.

[0028] The assets of the enterprise resources 82 are represented by the variable a. The first asset is represented by a[1], and the nth asset is represented by a[n]. The value of the asset a[n] is represented by v(a[n]). The intrusion probability 21D is represented by the probability p(a[i]) that the asset a[i] is intruded into. The resource information 21G in the network DB 22 is represented by a set of asset values ​​V={v(a[1]), v(a[2]), . . . v(a[n])}.

[0029] Each component in FIG. 3 will be described below. The observation data DB 12 registers observation data 73D obtained by observing an entity 81 (e[m]) in the target network 73. Therefore, each entity 81 has a log output function, and the module verification unit 10 (observation data DB 12) has a log collection function for collecting logs from the log output function. The verification module 11 receives the observation data 73D, performs verification, and outputs the verification result to the reliability calculation unit 21 as an event I={i[1], i[2], . . . i[k]}.

[0030] The reliability calculation unit 21 includes a risk manifestation evaluation unit 21A, an influence extent evaluation unit 21C, and a reliability calculation unit 21E. The risk manifestation evaluation unit 21A calculates a risk manifestation probability 21B (P(e[m])) from the event I output by the verification module 11 using algorithms such as machine learning and mathematical statistical processing. The impact range evaluation unit 21C evaluates the intrusion probability 21D(p(a[i])) based on the event I output by the verification module 11, the risk manifestation probability 21B, and the network setting 21F. Then, the impact range evaluation unit 21C calculates the impact cost Im(e[m]) of the manifested risk on the surroundings from the intrusion probability 21D and the asset value v(a[i]). The reliability calculation unit 21E calculates a reliability score 21H based on the intrusion probability 21D and the resource information 21G. The reliability score 21H is a scale for uniformly measuring risks such as security risk and SLA violation risk. In the following, the cost expectation value Ex(e[m])=P(e[m]×Im(e[m]) is used as an example of the reliability score 21H, but it is not limited to the cost expectation value and any unified scale may be used.

[0031] In addition, the policy control device can also improve the accuracy of the reliability score 21H by calculating the impact on the surroundings when the risk of e[m] becomes apparent. Therefore, the impact range evaluation unit 21C first lists all assets A={a[1], a[2], ...a[n]} that can be reached from e[m] when the risk of e[m] becomes apparent, and the value set V of the assets={v(a[1]),v(a[2]), ...v(a[n])}. Based on the listed assets, the impact range evaluation unit 21C calculates the impact cost Im(e[m]) of the risk of e[m] on the surroundings as shown in (Formula 1). Here, the intrusion probability 21D(p(a[i])) is the sum of the products of the impact cost and the probability of intrusion (the sum of the expected cost values ​​of all assets).

[0032]

number

[0033] Next, the reliability calculation unit 21E calculates the final damage cost expectation value Ex(e[m]) according to (Formula 2). Ex(e[m])=P(e[m]=malicious | I)×Im(e[m]) …(Formula 2) The process in which the reliability calculation unit 21 outputs the reliability score 21H has been described above with reference to FIG.

[0034] The policy determination unit 30 determines an optimal policy based on the reliability score 21H. The process of the policy determination unit 30 will be described below. First, we will explain each variable used to explain the policy. A policy is indicated by the variable m. The first entity 81 is m[1], and the l-th entity 81 is m[l]. In other words, we define a policy set M = {m[1], m[2], ...m[l]}.

[0035] Each policy is defined as m[i] = {e(m[i]), d(m[i]), c(m[i]), i(m[i])}. ·e(m[i]) denotes the entity 81 at which the policy m[i] is applied. d(m[i]) denotes the content of the policy m[i]. Examples of the content of the policy include filtering communications, shutting down the entity 81, and stopping attacks. c(m[i]) represents the application cost when the measure m[i] is applied. This application cost includes the cost of executing the measure and the cost of affecting the SLA by executing the measure. i(m[i]) is the measure effect, which is the expected value of the damage cost that indicates the security risk mitigated by implementing m[i]. This measure effect i(m[i]) is related to the impact cost Im(e[m]) calculated by (Equation 1). Then, the set of measures M(e[m]) to be taken for e[m] is expressed as (Equation 3).

[0036]

number

[0037] The measure decision unit 30 evaluates both the measure effect and the applied cost obtained by executing each measure m[i] using (Formula 3), and decides the measure so that the overall cost is as low as possible. In other words, when the measure content d(m[i]) is executed, the damage cost is reduced even if the risk is actualized, so the cost expectation value Ex(e[m]) can be reduced by the measure effect i(m[i]). On the other hand, the execution of the measure content d(m[i]) increases the cost by the applied cost c(m[i]). The policy decision unit 30 uses (Equation 3) to offset the reduction in damage cost and the increase in applied cost, thereby selecting whether or not to execute each policy m[i] so that the overall cost is lower when the policy is executed or not executed. This enables total risk management, including security and SLAs, to be achieved.

[0038] FIG. 4 is a hardware configuration diagram of the policy control device. The policy control device is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (also called an application or its abbreviation, an app) loaded into the RAM 902. This program can be distributed via a communication line, or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

[0039] Furthermore, the policy control device may have a container board 920 having a H / W (Hardware) accelerator 921 and a TPM (Trusted Platform Module) 922. Each component of the container board 920 may be implemented in the CPU901. It is desirable to apply the functions of the H / W accelerator 921 and the container runtime of the container base 920 to each processing unit of the policy control device (the module verification unit 10, the reliability evaluation unit 20, the policy decision unit 30, and the scheduler unit 40). This enables each processing unit to be accelerated and scaled out, and makes it possible to support a system equipped with a large-scale entity 81. It is desirable to apply the TPM 922 to each processing unit of the policy control device (the module verification unit 10, the reliability evaluation unit 20, the policy decision unit 30, and the scheduler unit 40). This makes it possible to prevent tampering with the reliability score 21H and the policy m[i].

[0040] [effect] The policy control device of the present invention includes a module verification unit 10 that verifies observation data 73D obtained by observing an entity 81 that accesses an enterprise resource 82; A reliability evaluation unit 20 that calculates a reliability score for each entity 81 based on the damage cost of a cyber attack from the entity 81 to a corporate resource 82 from the verification result of the module verification unit 10; The system is characterized by having a policy decision unit 30 that decides the entity 81 to which the policy should be applied, based on the application cost incurred when the policy is applied to the entity 81 and the damage cost to be reduced by applying the policy, so that the total cost of both costs is reduced.

[0041] In this way, the policy control device evaluates the security risk of allowing an entity 81 with a low reliability score to remain and the service risk, such as falling short of the SLA when the policy is applied to the entity 81, using the same criterion of cost. This makes it possible to formulate a measure that can reduce the security risk and the risk when providing a service in a well-balanced manner.

[0042] In the present invention, the policy control device further includes a scheduler unit 40. The scheduler unit 40 is characterized in that the higher the reliability score of an entity 81, the lower the load of the module verification unit 10 in verifying the observation data 73D observed from that entity 81.

[0043] This reduces the total verification load by focusing on verifying only a very small number of entities 81 that pose a high security risk. Therefore, even in a large-scale system in which the number of target entities 81 is several hundred million, the verification load on the policy control device is reduced, and the strict delay requirements imposed on the policy control device can be observed.

[0044] The present invention is characterized in that the scheduler unit 40 performs verification processing of a specified entity 81 later than other entities 81, and assigns a provisional verification result to the specified entity 81 for the period elapsed until the verification processing of the specified entity 81 is performed.

[0045] This allows the verification process for entity 81 to be temporarily skipped, but instead assigned a provisional verification result, thereby making it possible to comply with strict delay requirements imposed on the policy control device.

[0046] The present invention is characterized in that the processing of the module verification unit 10 , the processing of the reliability evaluation unit 20 , and the processing of the policy determination unit 30 are executed by the TPM 922 .

[0047] This makes it possible to prevent tampering with the contents of calculations performed by each processing unit of the policy control device. [Explanation of symbols]

[0048] 10 Module Verification Department 11 Verification Module 12 Observation Data DB 20 Reliability Evaluation Department 21 Reliability Calculation Section 21A Risk Manifestation Assessment Department 21B Risk manifestation probability 21C Impact Scope Assessment Division 21D Intrusion Probability 21E Reliability Calculation Section 21F Network Settings 21G Resource Information 21H Reliability Score 22 Network Database 30 Policy Decision-Making Department 31 Strategy Control Unit 40 Scheduler 41 Operations Department 71 Core Network 72 Access Network 73 Target Network 73D Observation Data 80 Zero Trust System 81 Entities 82 Corporate Resources (Assets) 83 Policy Control Section 83A Access permission section 83B Policy setting section 84 Policy Enforcement Department

Claims

1. a module verification unit that verifies observed data resulting from observing an entity that accesses the asset; a reliability evaluation unit that calculates a reliability score for each of the entities based on a damage cost caused by a cyber attack from the entity to the asset from a verification result of the module verification unit; and a policy decision unit that decides the entity of the policy location to which the policy is applied based on the cost incurred when the policy is applied to the entity and the damage cost to be reduced by the application of the policy, so that the total cost of both costs is reduced. Policy control device.

2. The policy control device further includes a scheduler unit, The scheduler unit reduces a load of the module verification unit for verifying the observation data observed from an entity having a higher reliability score. The policy control device according to claim 1 .

3. The scheduler unit performs a verification process for a specific entity after the verification process for the other entities, and assigns a provisional verification result to the specific entity for a period of time until the verification process for the specific entity is performed. The policy control device according to claim 2.

4. The processing of the module verification unit, the processing of the reliability evaluation unit, and the processing of the policy determination unit are executed by a TPM (Trusted Platform Module). The policy control device according to claim 1 .

5. The policy control device according to any one of claims 1 to 4, the entity, and the asset are connected via a network, The policy determined by the policy determination unit is applied to access from the entity to the asset. Zero trust system.

6. The policy control device includes a module verification unit, a reliability evaluation unit, and a policy determination unit. The module verification unit verifies observation data resulting from observing an entity accessing an asset; The reliability evaluation unit calculates a reliability score for each of the entities based on a damage cost caused by a cyber attack from the entity to the asset from the verification result of the module verification unit, The policy decision unit decides the entity of the policy location to which the policy is applied based on the cost incurred when the policy is applied to the entity and the damage cost to be reduced by applying the policy, so that the total cost of both costs is reduced. Policy control method.

7. A policy control program for causing a computer to function as the policy control device according to any one of claims 1 to 4.

Images