Access control device, access control method, and program

Abstract

Provided is an access control device that, even if a fluctuating risk arises during operation of an instrument, contributes to recognizing, as a numerical value, the feasibility of continued use of the instrument. This access control device includes: a risk target list registration unit for registering, in a risk target list, a dynamically fluctuating risk that has arisen during operation of an instrument that makes an access to a system; an evidence trail information management unit that, from an evidence trail management server for managing evidence trail information of a supply chain by using a block chain, collects and manages evidence trail information concerning the instrument related to the risk that has arisen; a score calculation unit that calculates a score of the instrument on the basis of the evidence trail information concerning the instrument and the risk registered in the risk target list; a determination unit that determines a control method of an access to the system by the instrument, on the basis of the score of the instrument and a policy defining a relationship between the score and an access control method; and a control unit that controls an access by the instrument to the system in accordance with the access control method.

Description

[Technical field]

[0001] The present invention relates to an access control device, an access control method, and a program. [Background technology]

[0002] The reliability of devices used in a system dynamically changes depending on international situations (war, cyberterrorism, suspected espionage, etc.) and corporate risks (takeovers, bankruptcies, data tampering, etc.) even when the devices are in operation. From the perspective of security in system operation, access from devices connected to the system should be dynamically restricted accordingly if the reliability of the devices dynamically drops. However, there is currently no method of tracing the supply chain to obtain correct information and dynamically applying that information to access control.

[0003] Patent Document 1 relates to an information processing device that evaluates a supplier's information security level.

[0004] Patent Document 2 relates to a method for analyzing risks in a supply chain of partner companies.

[0005] Patent Document 3 relates to a management system that improves the efficiency of operational management of a computer system.

[0006] Patent Document 4 relates to a quality control support method for managing defect information of products etc. that occurs in a supply chain without tampering and for identifying the extent of the effect of the defect.

[0007] Patent Document 5 relates to a technique for discovering and managing the security of applications. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] International Publication No. 2020 / 194587 [Patent Document 2] Special Publication No. 2021-511555 [Patent Document 3] Patent Publication No. 2021-077220 [Patent Document 4] Patent Publication No. 2021-002129 [Patent Document 5] Special Publication No. 2019-510304 Summary of the Invention [Problem to be solved by the invention]

[0009] The following analysis is provided by the present invention.

[0010] In cases like the above, simple scoring may not be able to deal with the anticipated threats. For example, it is unclear whether parts or equipment have been tampered with during production or distribution, and if tampering has occurred, the parts or equipment will be unreliable. Also, even if an application installed on a device currently works without problems, and a problem is later detected, it may be difficult to determine the extent of the problem or on which device it is running. In other words, when there are multiple supply chains, and various information from production to distribution, operation, and maintenance overlaps in a complex manner involving the items and people involved, the reliability also becomes ambiguous. Therefore, a method is needed to increase and determine the reliability of equipment in such ambiguous situations.

[0011] In the conventional rule-based method, if there is a problem with a part of the device or a vulnerability in an application, the device will be stopped or access will be prohibited. However, since there are multiple parts and applications from multiple manufacturers in the device, it is difficult to determine whether there is a problem in general due to the level of vulnerability and the impact of each. For example, if there is only one part (the part itself has no problem) from a manufacturer with a low reliability, the device can be used continuously, but if a similar problem occurs in many parts, the device must be stopped. Similarly, it can be difficult to determine whether an application can be used (OK / NG) even if there is a minor problem that is not a bug. As such, there are multiple factors such as the reliability of the manufacturer, how many parts and applications from that manufacturer are used, and the impact on users who use them, so a comprehensive judgment cannot be made with the conventional rule-based method.

[0012] For example, let's say that a country uses parts manufactured by multiple companies in country A because of their quality and price. Even if a political decision is made that there is a risk of information leakage due to suspicions of espionage in country A, it may be difficult to investigate whether a system uses equipment incorporating parts manufactured in country A.

[0013] For example, suppose you use Company C's software because of its performance and popularity, but then discover that data on products sold by Company C has been tampered with. Company C is currently investigating the matter, and if it is not clear whether the data tampering has affected the software being used, it may be difficult to determine whether the software has been affected (whether it is affected but not the functions being used, or whether it is necessary to stop using it, etc.) until there is an announcement from Company C.

[0014] Furthermore, for example, since the person in charge of inspecting equipment is not fixed, suppose that inspections are carried out by inexperienced person D and veteran person E. There are no problems with the inspection results, but for example, there is a risk of careless mistakes due to the experience of person D, and care must be taken, but there are cases where it is difficult to judge the experience level.

[0015] The present invention aims to provide an access control device, an access control method, and a program that contribute to grasping, in numerical form, whether or not a device can be continued to be used even if a risk of change occurs during operation of the device. [Means for solving the problem]

[0016] According to a first aspect of the present invention, an access control device can be provided that includes a risk target list registration unit that registers dynamically changing risks that occur during the operation of equipment accessing a system in a risk target list, a trail information management unit that collects and manages trail information on the equipment related to the risk that has occurred from a trail management server that manages supply chain trail information using blockchain, a score calculation unit that calculates a score for the equipment based on the trail information on the equipment and the risk registered in the risk target list, a policy that defines the relationship between the score and an access control method, a determination unit that determines a control method for the access to the system by the equipment from the score of the equipment, and a control unit that controls the access to the system by the equipment in accordance with the access control method.

[0017] According to a second aspect of the present invention, there can be provided an access control method executed by a computer having a processor and a storage device, the method including the steps of registering in a risk target list dynamically changing risks that occur during operation of equipment accessing a system; collecting and managing audit trail information on the equipment related to the risk that has occurred from an audit trail management server that manages supply chain audit trail information using blockchain; calculating a score for the equipment based on the audit trail information on the equipment and the risks registered in the risk target list; determining a control method for the access to the system by the equipment from a policy that defines the relationship between the score and an access control method and the score of the equipment; and controlling the access to the system by the equipment in accordance with the access control method.

[0018] According to a third aspect of the present invention, there is provided a program that causes a computer to execute the following operations: registering a dynamically changing risk that occurs during the operation of a device that accesses a system in a risk target list; collecting and managing trace information on the device related to the risk that occurs from a trace management server that manages trace information of a supply chain using a blockchain; calculating a score for the device based on the trace information on the device and the risk registered in the risk target list; determining a control method for the access to the system by the device from a policy that defines a relationship between the score and an access control method and the score of the device; and controlling the access to the system by the device according to the access control method. The program can be recorded in a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. Effect of the Invention

[0019] According to the present invention, it is possible to provide an access control device, an access control method, and a program that contribute to grasping whether or not a device can be continued to be used in numerical form even if a risk of change occurs during the operation of the device. [Brief description of the drawings]

[0020] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of an access control device according to an embodiment of the present invention. [Diagram 2] 1 is a diagram illustrating an example of a configuration of an access control device according to a first exemplary embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram showing an example of an overview of storing and managing supply chain trace information using a blockchain in a trace management server of a first embodiment of the present invention. [Figure 4]2 is a diagram illustrating an example of supply chain trace information stored in the trace management server of the first embodiment of the present invention. FIG. [Diagram 5] 4 is a flowchart showing an example of an outline of an operation of the access control device according to the first exemplary embodiment of the present invention. [Figure 6] FIG. 11 is a diagram illustrating an example of a configuration of an access control device according to a second exemplary embodiment of the present invention. [Figure 7] 10 is a flowchart showing an example of an outline of the operation of the access control device according to the second exemplary embodiment of the present invention. [Figure 8] FIG. 2 is a diagram showing a configuration of a computer that constitutes the access control device of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] First, an overview of one embodiment of the present invention will be described with reference to the drawings. Note that the reference numerals in the drawings attached to this overview are attached to each element for convenience as an example to aid in understanding, and are not intended to limit the present invention to the illustrated form. Furthermore, the connection lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional lines. The unidirectional arrows are intended to diagrammatically indicate the flow of the main signal (data), and do not exclude bidirectionality.

[0022] 1 is a diagram showing an example of the configuration of an access control device (policy engine) 300 according to one embodiment of the present invention. The access control device 300 according to one embodiment of the present invention includes a risk target list registration unit 310, a trail information management unit 330, a score calculation unit 340, a determination unit 360, a control unit 370, a risk target list 320, and a policy 350. The score calculation unit 340 includes a score storage unit 345 that stores the calculated score. The score storage unit 345 may be provided outside the score calculation unit 340 or outside the access control device 300, as long as it can be referenced from the score calculation unit 340.

[0023] The risk target list registration unit 310 registers the dynamically changing risk 10 that occurs during the operation of the device 200 that accesses the system 100 in the risk target list 320. The risk target list 320 may be included in the access control device 300, or may be placed in an external server of the access control device 300 that can be referenced by the access control device 300. The trail information management unit 330 collects and manages trail information on the device 200 related to the occurred risk 10 from the trail management server 400 that manages the trail information of the supply chain using a blockchain. The score calculation unit 340 calculates a score (credit score) of the device 200 based on the trail information on the device and the risk 10 registered in the risk target list 320, and stores the score in the score storage unit 345. As an example, the score is a score value recorded for the supply chain information. The determination unit 360 determines a method of controlling access by the device 200 to the system 100, based on the policy 350 that defines the relationship between the score and the access control method, and the score of the device 200 stored in the score storage unit 345. The control unit 370 controls access by the device 200 to the system 100 in accordance with the determined access control method.

[0024] The policy 350 can predefine how the score and access are controlled. For example, the policy 350 can If the score is 80 or less, instruct the system 100 to remove the write permission to a specific database (DB) related to the device 200; If the score is 50 or less, restrict the device 200 to access only the specific system (server) 100 (restrict IP address). If the score is below 25, then prevent the device 200 from connecting to the system 100 (enforce the certificate) and require manual re-enrollment; The above policy 350 is an example, and other definitions are possible. In addition, the definition of the policy 350 can be changed while the device 200 is in operation in order to review the validity of the score value and the behavior.

[0025] The management of equipment using the equipment score (trust score) according to an embodiment of the present invention has the following advantages. For example, the following items are available as judgment items for basic parts and software: Device serial number (identifier) -Serial numbers (identifiers) of the parts used Name of software used If the parts and software inside the equipment are managed using the above, when there is a possibility of a risk arising from the manufacturer or distributor of the parts or software occurring or when such a risk occurs, it is not possible to determine the risk even if it affects the stable supply of parts or the quality of the software, etc.

[0026] In response to this, in addition to the above criteria, · Parts and software sales · Manufacturing country information (economic situation, security situation, etc.) Parts and software sales and manufacturing company information (business status, quality, etc.) Parts and software distribution information (transportation method, transportation date and time) By using equipment scores (credit scores) calculated from fluid information (risk) that changes daily, such as the business situation and quality of the sales and manufacturing companies, the situation of the country where it is produced, and distribution information (risk), it is possible to reduce security risks. For example, if the security situation is good and the company is good, it can be determined that the stable supply and quality of parts, software, etc. are guaranteed, and furthermore, if they are transported on a fixed route and at a fixed time, it can be determined that storage management is in place, so parts, software, etc. can be used.

[0027] According to one embodiment of the present invention, even if a fluctuating risk 10 occurs during the operation of equipment 200, an access control device 300 can be provided that can numerically grasp whether or not equipment 200 can be continued to be used by using a score (credit score) of equipment 200 calculated from a composite element of supply chain audit information managed by audit trail management server 400 using blockchain, and further can control access by equipment 200 to system 100.

[0028] [First embodiment] Next, a first embodiment of the present invention will be described with reference to the drawings. Fig. 2 is a diagram showing an example of the configuration of an access control device (policy engine) 300, a system 100, and a device 200 according to the first embodiment of the present invention. In Fig. 2, components with the same reference numerals as those in Fig. 1 are assumed to be the same components, and their description will be omitted.

[0029] An example of the configuration of the access control device 300 according to the first embodiment of the present invention will be described with reference to FIG. 2. The access control device 300 according to the first embodiment of the present invention includes a risk target list registration unit 310, a trail information management unit 330, a score calculation unit 340, a determination unit 360, a control unit 370, a device information management unit 380, a risk target list 320, and a policy 350. The score calculation unit 340 includes a score storage unit 345 that stores the calculated score. As an example, the score is a score value that is described for information on the supply chain, and in the initial state, an initial value such as 100 is given. The score storage unit 345 may be provided outside the score calculation unit 340 or outside the access control device 300, as long as it can be referenced from the score calculation unit 340.

[0030] The device information management unit 380 includes a device information storage unit 385. The device information storage unit 385 may be provided outside the device information management unit 380 or outside the access control device 300, as long as the device information management unit 380 can refer to the device information storage unit 385.

[0031] 2 shows an example of a case where a device 200 uses a part made in country A. Referring to FIG. 2, the device 200 includes, for example, an agent 210 and an application 220.

[0032] The agent 210, whose control program is secured in a secure area, collects various information of the device 200, such as the product model number, product serial number, MAC address, IP address, and software information (e.g., OS, applications, etc.), and transmits it to the access control device 300. Also, in response to an instruction from the access control device 300, the agent 210 can autonomously perform access control for output from the device 200 and input to the device 200. Also, the agent 210 can control access from the device 200 to the system 100 in accordance with an instruction from the system 100.

[0033] The above-mentioned device information management unit 380 receives various information such as product model number, product serial number, MAC address, IP address, software information (e.g., OS, application, etc.) from the agent 210 of the device 200, and stores it in the device information storage unit 385 as device information.

[0034] The system 100 includes, for example, a gateway 110 and a data resource 120. The gateway 110 controls access to the data resource 120 from the device 200 in response to an instruction from an access control device 300.

[0035] Next, the trail management server 400 that cooperates with the access control device 300 of the first embodiment of the present invention will be described. The trail management server 400 manages part information of the devices 200 in each supply chain, such as the date and time of manufacture, the name of the manufacturer, and the names of the parts to be incorporated into the devices when the devices 200 are produced, as well as software information, personnel in charge, and the like, and also manages similar information in operation and maintenance. It also manages the results of verification by the information verification server 500, making it possible to share information between each supply chain.

[0036] FIG. 3 is a diagram showing an example of an overview of storing and managing the trace information of each supply chain 1000 in the trace management server 400 that cooperates with the access control device 300 of the first embodiment of the present invention using a blockchain. Referring to FIG. 3, the trace management server 400 adds various traceability information (1100) to each trace information group such as parts information 1010, production information 1020, logistics information 1030, operation information 1040, maintenance information 1050, and disposal information 1060 of the device 200 input from each supply chain 1000, and stores and manages the trace information using a blockchain. In the case of a blockchain, for example, the traceability information is a hash value or the like related to a previously stored block, and the hash value or the like related to the previously stored block may be added to a newly stored block and stored in the trace management server. In addition, the parts information 1010 may further include parts production information 1011 and parts logistics information 1012. Each piece of audit trail information may be stored manually in the audit trail management server 400, or may be automatically collected by the system and stored. The audit trail management server 400 also stores and manages the verification results of the information verification server 500, making it possible to share information between each supply chain 1000.

[0037] Fig. 4 is a diagram showing an example of trail information 2000 of a supply chain 1000 stored in a trail management server 400 that cooperates with the access control device 300 of the first embodiment of the present invention. Referring to Fig. 4, each column indicates trail information such as parts information 1010, production information 1020, logistics information 1030, operation information 1040, maintenance information 1050, and disposal information 1060 input from each supply chain 1000, and the rows of main trail information 2001 indicate an example of specific storage contents for each piece of trail information.

[0038] For example, part information 1010 includes various information about the part, i.e., part information such as part model number, part serial number, manufacturer name, manufacturing date and time, etc., and logistics information such as shipping date and time, logistics company name, etc.

[0039] In the first embodiment of the present invention, it is assumed that the part information 1010 in the supply chain trace information of the device 200 stored in the trace management server 400 lists the name of a manufacturer in country A as the manufacturer name.

[0040] Next, an information verification server 500 that cooperates with the access control device 300 of the first embodiment of the present invention will be described. The information verification server 500 verifies information stored in the trail management server 400 and information in the TPM (Trusted Platform Module) of the device 200, and responds with the verification result, i.e., whether or not the information has been tampered with, to the access control device 300. The information verification server 500 may be, for example, an external resource service rather than an in-house developed server, such as a database server of an external third party organization (integrity information database / application vulnerability information database, etc.).

[0041] Regarding the information verification server 500's determination of whether or not the information has been tampered with, for example, when information (including hash values) stored using the blockchain in the evidence management server 400 is registered in the information verification server 500, and then the information (including hash values) from the evidence management server 400 is sent again to the information verification server 500, it becomes possible to determine whether or not the information has been tampered with.

[0042] Next, the operation of the access control device 300 of the first embodiment of the present invention to prohibit the use of equipment 200 that uses parts made in country A when country A itself becomes a risk target will be described with reference to the drawings.

[0043] FIG. 5 is a flowchart showing an example of an outline of the operation of the access control device 300 according to the first embodiment of the present invention.

[0044] The flowchart of FIG. 5 begins at step S501.

[0045] The following describes a case where a suspicion of espionage arises in country A during operation of device 200, and country A itself becomes a target of risk. Since country A itself becomes a target of risk, risk 10 is notified to the access control device 300 (step S502).

[0046] The risk target list registration unit 310 registers country A in the risk target list 320 (step S503). As an example, a reduction in the score for country A, for example 50 points, may be registered in the risk target list 320.

[0047] The evidence information management unit 330 receives information about Country A, such as the deducted points in the score for Country A, registered in the risk target list 320 from the risk target list registration unit 310, and identifies the equipment 200 according to the equipment information (e.g., product model number, product serial number, MAC address, IP address, software information (e.g., OS, application, etc.)) stored in the equipment information storage unit 385, and accesses the evidence management server 400 to search for information related to Country A regarding the equipment 200, such as parts information 1010 and production information 1020 (step S504).

[0048] The trace information management unit 330 detects that the part information 1010 in the supply chain trace information of the equipment 200 stored on the trace management server 400 lists the name of a manufacturer from country A as the manufacturer name, and detects this as trace information indicating that the equipment 200 uses parts made in country A (step S505).

[0049] The trace information management unit 330 sends the trace information indicating that the detected parts made in country A were used to the information verification server 500, and the information verification server 500 verifies whether the trace information has been tampered with and returns the verification result to the trace information management unit 330 (step S506).

[0050] The score calculation unit 340 receives verified audit trail information for the equipment 200 from the audit trail information management unit 330, and receives information about country A, such as the deductible points in the score for country A, registered in the risk target list 320 from the risk target list registration unit 310, and calculates the score of the equipment 200.

[0051] Here, score storage unit 345 of score calculation unit 340 stores the score calculated by score calculation unit 340, and as an example, the score is a score value recorded for supply chain information, and in the initial state, an initial value such as 100 is assigned. Note that the initial value of the score may be set to 0, and decrement points in the score for country A may be set as increment points, so that the score increases as the risk increases.

[0052] For example, the score calculation unit 340 calculates the score of the device 200 by lowering the score from an initial value when there is a risk in the device 200. Note that, as described later, if the risk is eliminated, for example, the score may be set to the initial value or the score may be increased by a predetermined value.

[0053] If the score calculation unit 340 determines that the trace information has been tampered with based on the verification results for the equipment 200 received from the trace information management unit 330, for example, if the manufacturing date and time of the part information 1010 has been tampered with (Y in step S507), the score calculation unit 340 lowers the score of the equipment 200 and stores the new score in the score storage unit 345 (step S508).

[0054] On the other hand, if the score calculation unit 340 determines that the trace information has not been tampered with based on the verification results for the device 200 received from the trace information management unit 330 (N in step S507), it lowers the score of the device 200 based on the retrieved trace information and stores the new score in the score storage unit 345 (step S509).

[0055] As an example, if the “manufacturer name” (including country) or the like is a risk, or if the device 200 is subject to a risk in the security policy of the company that uses the device 200, the score calculation unit 340 lowers the score and stores the new score in the score storage unit 345.

[0056] Incidentally, the security policy of the company using device 200 may or may not be affected depending on the company using device 200, and it is necessary to incorporate the independent judgment of the company using device 200. For example, it is possible to set a security policy of the company using device 200 such that if the functions of the parts present in device 200 are used, there is a high risk, and if the functions are not used, there is no impact.

[0057] As another example, in the case where the risk is 10, there is no problem with the manufacturer of the parts made in country A, but country A itself becomes a risk target and the use of all supplies (materials, products, etc.) is prohibited, the score calculation unit 340 can, for example, reduce the score for country A in the risk target list 320 from the initial value of 100 by, for example, 50 points, set the score to 50, and store this in the score storage unit 345.

[0058] Next, the determination unit 360 receives the score of the device 200 (e.g., the above-mentioned score of 50) stored in the score storage unit 345 from the score calculation unit 340, and determines the method of controlling access to the system 100 of the device 200 based on the policy 350 that defines the relationship between the score and the method of controlling access (step S510).

[0059] As an example, the policy 350 can be set so that, as described above, if the score is 50 or less, access to the device 200 is restricted (IP address is restricted) only to a specific system (server) 100. In accordance with this setting, as a method of controlling access to the system 100 by the device 200, it is determined that access from the device 200 to the system 100 is prohibited. Note that, if the initial value of the score is set to 0 and the decrement points of the score for country A are set as increment points so that the score increases as the risk increases, the policy 350 is also set to correspond to this.

[0060] Next, the control unit 370 identifies the device 200 according to the device information (e.g., product model number, product serial number, MAC address, IP address, software information (e.g., OS, application, etc.)) stored in the device information storage unit 385, and instructs the agent 210 of the device 200 to prohibit (block) access to the system 100, or instructs the gateway 110 of the system 100 to prohibit access from the device 200 (step S511), according to the determined access control method. For example, the use of the device 200 itself (access to the system 100) may be prohibited, or access rights (access to the data resource 120, function operation restrictions, etc.) may be set for the gateway 110 of the system 100 and the agent 210 of the device 200. If the risk is eliminated, for example, the score may be set to an initial value, or the score may be increased by a predetermined value.

[0061] In this way, if a risk 10 occurs during operation of the device 200, access to the system 100 from the device 200 can be controlled.

[0062] Next, as long as the risk continues, it is monitored whether the risk is eliminated (N in step S512). For example, when risk 10 is eliminated (Y in step S512), such as when the suspicion of espionage from country A is eliminated, the access control device 300 is notified of the elimination of risk 10, and the risk target list registration unit 310 deletes the registration of risk 10 from the risk target list 320, and the risk target list registration unit 310 may notify the score calculation unit 340 that the risk has been eliminated (step S513).

[0063] When the score calculation unit 340 receives a notification indicating that the risk has disappeared, it sets the score to an initial value or increases the score by a predetermined value and stores the score in the score storage unit 345 (step S514).

[0064] When the score is set to an initial value or increased by a predetermined value, the judgment unit 360 judges whether to lift the access prohibition based on the score and the policy 350, and the control unit 370 lifts the prohibition on the access of the device 200 to the system 100 (step S515).

[0065] The flow chart of FIG. 5 ends at step S516.

[0066] Next, when a risk occurs or when the risk changes dynamically, the operations of steps S501 to S516 are repeated. In this manner, it is possible to perform operation management of the device 200 that accesses the system 100 by utilizing supply chain trail management in response to dynamically changing risks that occur during the operation of the device 200.

[0067] As described above, the access control device 300 of the first embodiment of the present invention can provide an access control device 300 that contributes to grasping whether or not the device 200 can be continued to be used in a numerical value even if a risk of fluctuation occurs during operation of the device 200.

[0068] [Second embodiment] Next, an access control device according to a second embodiment of the present invention will be described with reference to the drawings. Fig. 6 is a diagram showing an example of the configuration of an access control device 300 according to the second embodiment of the present invention. In Fig. 6, components with the same reference numerals as those in Fig. 2 are assumed to be the same components, and descriptions thereof will be omitted.

[0069] The operation of the access control device 300 of the second embodiment of the present invention in restricting the use of the application 220 developed by company B when fraud by company B, such as data tampering or falsification of business accounts, is discovered during the operation of the device 200 equipped with the application 220 developed by company B will be described with reference to the drawings.

[0070] Note that, with reference to Figure 4, in the second embodiment of the present invention, it is assumed that the production information 1020 of the supply chain audit information of the equipment 200 stored in the audit management server 400 lists Company B as the developer name of the software information.

[0071] FIG. 7 is a flowchart showing an example of an outline of the operation of the access control device 300 according to the second embodiment of the present invention.

[0072] The flowchart of FIG. 7 begins at step S701.

[0073] The following describes a case where company B becomes a risk target because fraud such as data tampering or falsification of business accounts is discovered during operation of device 200. Since company B becomes a risk target, risk 10 is notified to the access control device 300 (step S702).

[0074] The risk target list registration unit 310 registers company B in the risk target list 320 (step S703). As an example, a reduction in the score for company B, for example, 20 points, may be registered in the risk target list 320.

[0075] The evidence information management unit 330 receives information about company B, such as the deducted points in the score for company B, registered in the risk target list 320 from the risk target list registration unit 310, and identifies device 200 according to the device information stored in the device information storage unit 385 (e.g., product model number, product serial number, MAC address, IP address, software information (e.g., OS, application, etc.), etc.), and accesses the evidence management server 400 to search for information related to device 200 and related to company B, such as products developed in-house or products sold (step S704).

[0076] The trace information management unit 330 detects that the production information 1020 of the supply chain trace information of the equipment 200 stored on the trace management server 400 lists company B as the name of the developer of the software information, and therefore detects this as trace information indicating that the equipment 200 is using company B's application 220 (step S705).

[0077] The trail information management unit 330 sends the trail information indicating that the detected application 220 of company B is being used to the information verification server 500, and the information verification server 500 verifies whether the trail information has been tampered with and returns the verification result to the trail information management unit 330 (step S706).

[0078] The score calculation unit 340 receives verified audit trail information for the equipment 200 from the audit trail information management unit 330, and receives information about company B, such as the deductible points in the score for company B, registered in the risk target list 320 from the risk target list registration unit 310, and calculates the score of the equipment 200.

[0079] Here, score storage unit 345 of score calculation unit 340 stores the score calculated by score calculation unit 340, and as an example, the score is a score value recorded for supply chain information, and in the initial state, an initial value such as 100 is given. Note that the initial value of the score may be set to 0, and decrement points in the score for company B may be set as increment points, so that the score increases as the risk increases.

[0080] For example, the score calculation unit 340 calculates the score of the device 200 by lowering the score from an initial value when there is a risk in the device 200. Note that, as described later, if the risk is eliminated, for example, the score may be set to the initial value or the score may be increased by a predetermined value.

[0081] If the score calculation unit 340 determines, based on the verification results for the equipment 200 received from the trace information management unit 330, that the trace information has been tampered with, for example, if the software information in the production information 1020 has been tampered with (Y in step S707), the score calculation unit 340 lowers the score of the equipment 200 and stores the new score in the score storage unit 345 (step S708).

[0082] On the other hand, if the score calculation unit 340 determines that the trace information has not been tampered with based on the verification results for the device 200 received from the trace information management unit 330 (N in step S707), it lowers the score of the device based on the retrieved trace information and stores the new score in the score storage unit 345 (step S709).

[0083] As an example, if “software information” (including the development company and country) is a risk, or if the software information is a risk in the security policy of the company using the device 200, the score calculation unit 340 lowers the score and stores the new score in the score storage unit 345.

[0084] Incidentally, the security policy of the company using device 200 may or may not be affected depending on the company using device 200, and it is necessary to incorporate the unique judgment of the company using device 200. For example, the security policy of the company using device 200 can be set such that if the function of application 220 present in the device is used, there is a high risk, and if the function is not used, there is no impact.

[0085] As another example, in the current case where the risk is 10, there is no problem with Company B's application, but if the reliability of Company B drops, it will become a risk target, and the score calculation unit 340 can, for example, reduce the score for Company B in the risk target list 320 from the initial value of 100 by, for example, 20 points, set the score to 80, and store this in the score storage unit 345.

[0086] Next, the determination unit 360 receives the score of the device 200 (e.g., the above score of 80) stored in the score storage unit 345 from the score calculation unit 340, and determines the method of controlling access to the system 100 by the device 200 based on the policy 350 that defines the relationship between the score and the method of controlling access (step S710).

[0087] As an example, the policy 350 can be set so that, as described above, if the score is 80 or less, the system 100 is instructed to remove the authority to write to a specific database (DB) related to the device 200. In accordance with this setting, the method of controlling the device 200's access to the system 100 is determined to be the prohibition of writing from the application 220 of the device 200 to the system 100. Note that if the initial value of the score is set to 0 and the decrement points of the score for company B are set as increment points so that the score increases as the risk increases, the policy 350 is also set to correspond to this.

[0088] Next, the control unit 370 identifies the device 200 according to the device information (e.g., product model number, product serial number, MAC address, IP address, software information (e.g., OS, application, etc.)) stored in the device information storage unit 385, and instructs the gateway 110 of the system 100 to prohibit writing (changing) to the data resource 120 from the application 220 of the device 200 according to the determined access control method (step S711). However, it is also possible to leave the data resource 120 of the system 100 accessible. As will be described later, when company B's fraud is resolved, writing (changing) to the data resource will also be possible by restoring the score.

[0089] In this way, if a risk 10 occurs during operation of the device 200, access to the system 100 from the device 200 can be controlled.

[0090] Next, as long as the risk continues, it is monitored whether the risk is eliminated (N in step S712). For example, when risk 10 is eliminated (Y in step S712), such as when the fraud of company B is resolved, the access control device 300 is notified of the elimination of risk 10, the risk target list registration unit 310 deletes the registration of risk 10 from the risk target list 320, and the risk target list registration unit 310 may notify the score calculation unit 340 that the risk has been eliminated (step S713).

[0091] When the score calculation unit 340 receives a notification indicating that the risk has disappeared, it sets the score to an initial value or increases the score by a predetermined value and stores the score in the score storage unit 345 (step S714).

[0092] When the score is set to the initial value or increased by a predetermined value, the determination unit 360 determines based on the score and the policy 350 whether to lift the prohibition on writing to the data resource 120, and the control unit 370 lifts the prohibition on writing to the data resource 120 by the device 200 in the system 100 (step S715).

[0093] The flow chart of FIG. 7 ends at step S716.

[0094] Next, when a risk occurs or when the risk changes dynamically, the operations of steps S701 to S716 are repeated. In this manner, it is possible to perform operation management of the device 200 that accesses the system 100 by utilizing supply chain trail management in response to dynamically changing risks that occur during the operation of the device 200.

[0095] As described above, the access control device 300 of the second embodiment of the present invention can provide an access control device 300 that contributes to grasping whether or not the device 200 can be continued to be used in a numerical value even if a risk of fluctuation occurs during operation of the device 200.

[0096] Although each embodiment of the present invention has been described above, the present invention is not limited to the above-mentioned embodiments, and further modifications, substitutions, and adjustments can be made without departing from the basic technical idea of ​​the present invention. For example, the system configuration, the configuration of each element, and the expression form of messages shown in each drawing are examples to help understand the present invention, and the present invention is not limited to the configurations shown in these drawings. In the following description, "A and / or B" is used to mean at least either A or B.

[0097] Moreover, the procedures shown in the first and second embodiments can be realized by a program that causes a computer (9000 in FIG. 8) functioning as the access control device 300 to realize the functions of the access control device 300. Such a computer is exemplified by a configuration including a CPU (Central Processing Unit) 9010, a communication interface 9020, a memory 9030, and an auxiliary storage device 9040 in FIG. 8. That is, the access control program is executed by the CPU 9010 in FIG. 8, and an update process of each calculation parameter held in the auxiliary storage device 9040 or the like is performed.

[0098] The memory 9030 is a RAM (Random Access Memory), a ROM (Read Only Memory), or the like.

[0099] In other words, each part (processing means, functions) of the access control device shown in the first and second embodiments described above can be realized by a computer program that causes the processor of the computer to execute each of the above-mentioned processes using its hardware.

[0100] Finally, preferred embodiments of the present invention will be summarized. [First form] (See the access control device according to the first aspect above) [Second Form] In the access control device described in the first embodiment, it is desirable that when the audit trail information regarding the device is determined to have not been tampered with by an information verification server that performs information verification, the score calculation unit calculates the score of the device by updating the score of the device so that the difference from the initial value becomes larger when the audit trail information regarding the device is subject to the risk registered in the risk target list. [Third Form] In the access control device described in the first embodiment, it is desirable that when it is determined that the authentication information regarding the device has been tampered with by an information verification server that performs information verification, the score calculation unit calculates the score of the device by updating the score of the device so that the difference from the initial value becomes larger. [Fourth Form] In the access control device according to the second or third aspect, the score calculation unit sets the score to the initial value when the risk is eliminated, It is preferable that the control unit releases control over access by the device to the system. [Fifth Form] The access control device according to any one of the first to fourth aspects further includes a device information management unit that receives and manages device information from the device, It is desirable that the control unit and the trace information management unit identify the device in accordance with the device information. [Sixth Form] In the access control device according to any one of the first to fifth aspects, it is preferable that the policy prescribes a method of controlling access by the device to the system with respect to the score. [7th form] In the access control device according to any one of the first to sixth aspects, the system includes a gateway and a data resource, It is preferable that the control unit instructs the gateway to permit control of access to data resources by the device in accordance with the access control method. [8th form] In the access control device according to any one of the first to seventh aspects, the device includes an application and an agent that controls the application; It is preferable that the control unit instructs the agent to permit control of access to the system in accordance with the access control method. [9th form] (See the second aspect of access control above.) [10th form] (See the third perspective program above) The ninth and tenth embodiments can be expanded into the second to eighth embodiments in the same manner as the first embodiment.

[0101] The disclosures of the above patent documents are incorporated herein by reference. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the disclosure of the present invention, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or subrange included in the range should be interpreted as being specifically described even if not otherwise specified. [Explanation of symbols]

[0102] 10 Risks 100 Systems 110 Gateway 120 Data Resources 200 equipment 210 Agent 220 Applications 300 Access control device 310 Risk Target List Registration Section 320 Risk Object List 330 Trail Information Management Department 340 Score Calculation Unit 345 Score Storage 350 Policy 360 Judgment Department 370 Control Unit 380 Device information management department 385 Device Information Storage Unit 400 Trail Management Server 500 Information verification server 1000 Supply Chain 2000 Trail Information 9000 Computers 9010 CPU 9020 Communication Interface 9030 Memory 9040 Auxiliary storage device

Claims

1. a risk target list registration unit that registers dynamically changing risks to a country or risks to an enterprise that occur during the operation of a device that accesses the system in a risk target list; A trace information management unit that collects and manages trace information on the device related to the risk that has occurred from a trace management server that manages trace information of a supply chain using a blockchain; a score calculation unit that calculates a score for the device based on the trail information related to the device and the risks registered in the risk target list; a policy that defines a relationship between a score and an access control method, and a determination unit that determines a method of controlling the access by the device to the system based on the score of the device; an access control device including a control unit that controls the access to the system by the device in accordance with the access control method;

2. The access control device of claim 1, wherein when the trail information regarding the device is determined to have not been tampered with by an information verification server that performs information verification, the score calculation unit calculates the score of the device by updating the score of the device so that the difference from the initial value becomes larger when the trail information regarding the device is subject to the risk registered in the risk target list.

3. The access control device according to claim 1, wherein when the trail information regarding the device is determined to have been tampered with by an information verification server that performs information verification, the score calculation unit calculates the score of the device by updating the score of the device so that the difference from the initial value is larger.

4. The score calculation unit sets the score to the initial value when the risk is eliminated, The access control device according to claim 2 , wherein the control unit releases control of the access to the system by the device.

5. Further comprising a device information management unit that receives and manages device information from the device; The access control device according to claim 1 , wherein the control unit and the trail information management unit identify the device according to the device information.

6. The access control device according to claim 1 , wherein the policy specifies a method of controlling access to the system by the device with respect to the score.

7. The system includes a gateway and a data resource; The access control device according to claim 1 , wherein the control unit instructs the gateway to control the access to the data resource by the device in accordance with the access control method.

8. The device includes an application and an agent that controls the application; The access control device according to claim 1 , wherein the control unit instructs the agent to control the access to the system in accordance with the access control method.

9. Executed by a computer having a processor and a storage device, registering dynamically changing national or enterprise-related risks that arise during the operation of devices that access the system in a risk list; A step of collecting and managing traceability information on the device related to the risk that has occurred from a traceability management server that manages traceability information of a supply chain using a blockchain; Calculating a score for the device based on the audit trail information for the device and the risks registered in the risk target list; determining a method of controlling the access by the device to the system based on a policy that defines a relationship between a score and an access control method and the score of the device; and controlling the access by the device to the system in accordance with the access control method.

10. On the computer, A process of registering dynamically changing national or enterprise risks that occur during the operation of devices that access the system into a risk target list; A process of collecting and managing traceability information on the device related to the risk that has occurred from a traceability management server that manages traceability information of the supply chain using a blockchain; A process of calculating a score for the device based on the audit trail information related to the device and the risks registered in the risk target list; A process of determining a method of controlling access by a device to the system based on a policy that defines a relationship between a score and a method of controlling access and the score of the device; and a process of controlling the access to the system by the device in accordance with the access control method.

Images