Information and communication system, information and communication method, and program

Abstract

This information communication system comprises a communication instrument and a verification device that verifies the authenticity of the communication instrument, the information communication system also comprising: a verification means for verifying the authenticity of each of a plurality of apparatuses managed by the communication instrument; and a notification means that, when an abnormality regarding the authenticity of one of the plurality of apparatuses is detected, issues a report on the abnormality of the apparatus to the verification device.

Description

[Technical field]

[0001] The present disclosure relates to an information communication system, an information communication method, and a recording medium. [Background technology]

[0002] Cyber ​​attacks against devices (edge ​​computers) installed at various business sites are becoming a reality. For example, when a system vendor delivers a system it has built to a customer, a malicious third party may tamper with the device, causing the system to malfunction. Tampering may occur during the transportation of the device or storage in a warehouse, or by illegal intrusion after the system has been built.

[0003] In response to this, it is known to verify the authenticity of a device before starting the system in order to prevent the system from performing abnormal operations. For example, Patent Document 1 discloses a technology in a communication system including a device and a smart meter, in which the device issues an authentication request to the smart meter and data of the device is read after authentication processing. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2016-039564 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, the invention described in Patent Document 1 executes authentication processing for each device separately. Therefore, for example, when the system to be verified is configured hierarchically and multiple devices located at the lowest layer are arranged in a branched manner, it is not possible to identify which device is managing the device under which the abnormality occurs.

[0006] An example of an objective of the present disclosure is to provide an information and communication system that is capable of identifying which device is managing a device in which an abnormality has been detected, even if the system to be verified has a hierarchical configuration. [Means for solving the problem]

[0007] An information and communication system in one aspect of the present disclosure is an information and communication system including a communication device and a verification device that verifies the authenticity of the communication device, and further including a verification means that verifies the authenticity of each of a plurality of devices managed by the communication device, and a notification means that, when an anomaly in the authenticity of any of the plurality of devices is detected, notifies the verification device of an abnormality in the device.

[0008] An information communication method in one aspect of the present disclosure verifies the authenticity of each of multiple devices managed by a communication device, and if an abnormality in the authenticity of any of the multiple devices is detected, notifies a verification device located above the communication device of an abnormality report for the device.

[0009] In one aspect of the present disclosure, a recording medium stores a program that causes a computer to verify the authenticity of each of multiple devices managed by a communication device, and if an abnormality in the authenticity of any of the multiple devices is detected, notify a verification device that is superior to the communication device of an abnormality report for the device. Effect of the Invention

[0010] One example of the effect of the present disclosure is that it is possible to provide an information and communication system that is capable of identifying which device is managing a device in which an abnormality has been detected, even if the system to be verified has a hierarchical configuration. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing a configuration of an information communication system in the first embodiment. [Diagram 2] FIG. 2 is a diagram showing a hardware configuration in which the device and the communication device in the first embodiment are realized by a computer device and its peripheral devices. [Diagram 3] FIG. 3 is a flowchart showing the operation of the information communication system in the first embodiment. [Figure 4] FIG. 4 is a diagram showing a configuration of an information communication system according to the second embodiment. [Diagram 5] FIG. 5 is an example of an output of a verification result by the output unit in the second embodiment. [Figure 6] FIG. 6 shows an example of a verification result output by the output unit in the second embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the information communication system in the second embodiment. [Figure 8] FIG. 8 is a diagram showing a configuration of an information communication system in the third embodiment. [Figure 9] FIG. 9 is an example of an output of a verification result by the output unit in the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Next, an embodiment will be described in detail with reference to the drawings.

[0013] [First embodiment] FIG. 1 is a diagram showing a configuration of an information communication system 10 in the first embodiment. Referring to FIG. 1, the information communication system 10 has a plurality of devices 100 (100a, 100b), a communication device 200, a higher-level verification device 300, and a top-level verification device 400. An internal system 20 is made up of the plurality of devices 100 and the communication device 200. The information communication system 10 in the first embodiment has a hierarchical structure with the top-level verification device 400 at the top, and there are a plurality of higher-level verification devices 300 managed by the top-level verification device 400, and there are a plurality of internal systems 20 (communication devices 200) managed by each higher-level verification device 300. The plurality of higher-level verification devices 300 includes a case where there are a plurality of higher-level verification devices 300 in the same layer, and a case where there are higher-level verification devices 30 in a plurality of layers.

[0014] The authenticity of each device 100 is verified by the communication device 200, which is a higher-level verification device, based on the hash values ​​of the components and programs of each device 100 generated when each device is started. The communication device 200 verifies the authenticity of a series of startup operations, including the startup of an OS program, which is started by turning on the power of each device 100. When the communication device 200 detects that the authenticity of any device 100 is abnormal, it notifies the highest-level verification device 400 of an abnormality via the higher-level verification device 300. The information and communication system 10 verifies the authenticity of the device 100, for example, every time the startup operation of the device 100 is started. In this embodiment, authenticity means a state in which only known components and programs that have been tested are operating in each device 100 and no unauthorized tampering has been performed during the device supply or system construction process.

[0015] The internal system 20 is, for example, a system located in a remote location, which becomes a closed environment when a network such as satellite communication or wireless communication with a data center is completely cut off. The internal system 20 is, for example, an equipment system that controls equipment such as vehicles, ships, and aircraft in real time. In the information and communication system 10, the communication device 200 aggregates the verification results of each device 100 and transmits them to the highest-level verification device 400 via the higher-level verification device 300 using satellite communication or wireless communication. The communication device 200 may also transmit the verification results of each device 100 to the highest-level verification device 400 via the higher-level verification device 300 via another communication device 200 under the management of the same higher-level verification device. When the internal system 20 is separated from the information and communication system 10 and becomes a closed environment, an abnormality in the verification result of the device 100 may be notified by a lamp or buzzer provided in the communication device 200, as described below. Furthermore, when the internal system 20 is an equipment system, the verification result may be transmitted by wireless communication via a communication device 200 in another vehicle, ship, or aircraft, and through a higher-level verification device to the top-level verification device 400. Other systems that fall under the category of the internal system 20 include, for example, systems used in connected cars or OT (Operational Technology) in factories.

[0016] Fig. 2 is a diagram showing an example of a hardware configuration in which each of the device 100 and the communication device 200 in the first embodiment of the present disclosure is realized by a computer device 500 including a processor. As shown in Fig. 2, the device 100 and the communication device 200 each include a central processing unit (CPU) 501, memories such as a read only memory (ROM) 502 and a random access memory (RAM) 503, a storage device 505 such as a hard disk for storing a program 504, a communication interface (I / F) 508 for network connection, and an input / output interface 511 for inputting and outputting data.

[0017] The CPU 501 operates the OS to control the entire device 100, the communication device 200, the higher-level verification device 300, and the top-level verification device 400 according to the first embodiment of the present invention. The CPU 501 also reads programs and data from a recording medium 506 mounted in, for example, a drive device 507 into a memory. The CPU 501 also functions as a realization means for each unit provided in the device 100, the communication device 200, the higher-level verification device 300, and the top-level verification device 400 according to the first embodiment, or as a part of these units, and executes processes or commands in the flowchart shown in Fig. 3, which will be described later, based on the programs.

[0018] The recording medium 506 is, for example, an optical disk, a flexible disk, a magneto-optical disk, an external hard disk, or a semiconductor memory. A recording medium that is a part of the storage device is a non-volatile storage device, and the program is recorded therein. The program may also be downloaded from an external computer (not shown) that is connected to a communication network.

[0019] The input device 509 is realized by, for example, a mouse, a keyboard, built-in key buttons, etc., and is used for input operations. The input device 509 is not limited to a mouse, a keyboard, or built-in key buttons, and may be, for example, a touch panel. The output device 510 is realized by, for example, a display, and is used to check the output.

[0020] As described above, the first embodiment shown in Fig. 1 is realized by the computer hardware shown in Fig. 2. However, the means for realizing each unit of the device 100, the communication device 200, the higher-level verification device 300, and the top-level verification device 400 in Fig. 1 are not limited to the configurations described above.

[0021] <Equipment 100> Each of the devices 100 (100a, 100b) includes a program execution unit 101 (101a, 101b), a security function unit 102 (102a, 102b), and a transmission unit 103 (103a, 103b). Although the number of the multiple devices 100 illustrated in FIG. 1 is two, the number of the multiple devices 100 is not limited to two. The number of the multiple devices 100 corresponds to the number of devices actually existing in the internal system 20.

[0022] The program execution unit 101 executes the boot program of the device 100 and generates hash values ​​of the components and the boot program. For example, when the device 100 is powered on, the program execution unit 101 executes the programs in the order of a boot loader, a BIOS (Basic Input Output System) or UEFI (Unified Extensible Firmware Interface), and an OS. However, the programs to be executed are not limited to this. The program may be a program in which only a boot loader exists, or a program in which the boot loader itself is multi-stage. When the program execution unit 101 generates hash values ​​of components such as a CPU and hash values ​​of each boot program while executing each program, it inputs the generated hash values ​​to the security function unit 102. Note that the hash values ​​may be digitally signed to ensure the authenticity of the hash value itself.

[0023] The security function unit 102 includes a tamper-resistant storage area. The security function unit 102 is an area that is difficult to tamper with by a malicious third party. The security function unit 102 stores each hash value input from the program execution unit 101, and may have an encryption key required for encryption processing to safely transmit the hash value to the communication device 200, or an attribute certificate that defines the source of information. The security function unit 102 is configured, for example, by a TPM (Trusted Platform Module), but is not limited to this as long as the configuration can achieve tamper resistance. The TPM has a characteristic that makes it difficult to tamper with the OS, hardware, or physical hacking from the outside, and therefore has high tamper resistance.

[0024] The transmission unit 103 transmits the hash value stored in the security function unit 102 to the communication device 200, requesting verification of the authenticity of the device 100.

[0025] <Communication Device 200> The communication device 200 includes a transmission / reception unit 201, an authentication information storage unit 202, a verification unit 203, and a notification unit 204. Note that the communication device 200 may be configured as a virtualized server in which one device is operated as multiple servers.

[0026] The transmitting / receiving unit 201 receives data transmitted from the device 100 and transmits the data to the higher-level verification device 300. The transmitting / receiving unit 201 may have a firewall function within the internal system 20. That is, the transmitting / receiving unit 201 determines whether or not to allow network communication with the outside of the internal system 20, and permits or denies the communication.

[0027] The authentication information storage unit 202 stores the hash expected values ​​of the components and programs of each device 100. The hash expected value is a normal hash value that is generated when the components and startup programs have not been illegally tampered with. The authentication information storage unit 202 stores in advance the hash expected values ​​received from each device 100 via the transmission / reception unit 201.

[0028] The verification unit 203 verifies the authenticity of the components of each device 100 and the boot program executed by each device 100. The verification unit 203 makes a binary determination as to whether or not the authenticity is guaranteed, for example. When the verification unit 203 receives a verification request from any of the devices 100, it compares a hash value generated when the boot program is executed with a hash expected value stored in the authentication information storage unit 202. However, the verification method by the verification unit 203 is not limited to this, and any method can be used as long as it can confirm that the hash value when the boot program is executed is a normal hash value.

[0029] If the hash value acquired at the time of startup is identical to the expected hash value, the verification unit 203 determines that the device is authentic, and outputs the verification result to the notification unit 204. If the acquired hash value is different from the expected hash value, the verification unit 203 determines that the device is not authentic, and outputs the verification result to the notification unit 204. If the hash value of any program in the device 100 does not match the expected hash value, the verification unit 203 may determine that the device is not authentic at that point in time, and output the verification result to the notification unit 204.

[0030] When an abnormality in the authenticity of any of the devices 100 among the multiple devices managed by the communication device 200 is detected, the notification unit 204 notifies the upper verification device 300 of an abnormality report of the device 100. The notification unit 204 may notify the upper verification device 300 of the abnormality report at the timing when the verification result indicating inauthenticity is received from the verification unit 203. Furthermore, the notification unit 204 may notify the upper verification device 300 of the abnormality report when a transmission request for the verification result of authenticity is made from the top-level verification device 400 via the upper verification device 300. Furthermore, the notification unit 204 may control the output device 510 such as a display device to display information indicating the abnormality report of the device 100. Furthermore, when the notification unit 204 receives the verification result indicating inauthenticity, the notification unit 204 may notify the abnormality by a lamp or a buzzer provided in the communication device 200. In this case, even if the internal system 20 is separated from the information and communication system 10 and a closed environment is created, an abnormality in the device 100 can be notified.

[0031] <Higher Verification Device 300> The upper level verification device 300 includes a transmission / reception unit 301, and upon receiving an abnormality report from the communication device 200, notifies the highest level verification device 400 of the abnormality report as is.

[0032] <Top-level Verification Device 400> The top-level verification device 400 includes a receiving unit 401 and an output unit 402. The receiving unit 401 receives an anomaly report from the top-level verification device 300. The output unit 402 outputs the received anomaly report. The output unit 402 outputs a message indicating that the anomaly report has been received to an output device 510 such as a display device.

[0033] The operation of the information communication system 10 configured as above will be described with reference to the flowchart of FIG.

[0034] 3 is a flowchart showing an outline of the operation of the information communication system 10 in the first embodiment. Note that the processing according to this flowchart may be executed based on program control by the above-mentioned processor.

[0035] As shown in FIG. 3, first, the program execution unit 101 of the device 100 executes the startup program, generates hash values ​​of the components and the startup program (step S101), and stores the generated hash value in the security function unit 102 (step S102). The transmission unit 103 transmits the hash value stored in the security function unit 102 to the communication device 200 (step S103). Next, the transmission / reception unit 201 of the communication device 200 receives the generated hash value (step S104). Next, the verification unit 203 compares the generated hash value with the hash expected value stored in the authentication information storage unit 202 (step S105). If the generated hash value matches the hash expected value (S105; YES), the verification unit 203 determines that the device is authentic (step S106) and ends the flow. On the other hand, if the generated hash value does not match the expected hash value (S105; NO), the verification unit 203 determines that there is no authenticity (step S107), and the notification unit 204 notifies the top-level verification device 400 of an abnormality report via the higher-level verification device 300 (step S108). With this, the information communication system 10 ends the information communication operation.

[0036] In the first embodiment, when any of the devices 100 managed by the communication device 200 is determined to be inauthentic, the notification unit 204 notifies the top-level verification device 400 of an abnormality report via the higher-level verification device 300. Therefore, the top-level verification device 400 can identify that the device 100 under the management of the higher-level verification device 300 that received the abnormality report is abnormal. Therefore, even if the configuration of the system to be verified is hierarchical, it is possible to identify which device is under the management of the device 100 in which the abnormality was detected.

[0037] Next, a modified example of the first embodiment of the present disclosure will be described. In the first embodiment, when an anomaly in authenticity is detected in any of the devices 100 managed by the communication device 200, the top-level verification device 400 is notified of the anomaly report via the top-level verification device 300. In this case, the top-level verification device 400 may request the top-level verification device 300 to transmit information identifying the communication device 200 that notified the anomaly report at the timing of receiving the anomaly report. Furthermore, the top-level verification device 400 may request the communication device 200 to transmit information identifying the device 100 in which an anomaly in authenticity is detected via the top-level verification device 300. In this way, the top-level verification device 400 can notify the administrator managing the information communication system 10 of information identifying the device 100 in which an anomaly is detected or the communication device 200 managing the device 100.

[0038] Next, a second embodiment of the present disclosure will be described. Below, the description of the second embodiment will be omitted to the extent that the description of the present embodiment is not unclear. Each component in each embodiment of the present disclosure can be realized by hardware as well as a computer device based on program control and software, similar to the computer device shown in FIG. 2.

[0039] 4 is a diagram showing a configuration of an information communication system 11 in the second embodiment. The second embodiment differs from the first embodiment in the configuration of the notification unit 214 of the communication device 210 and the configurations of the higher-level verification device 310 and the top-level verification device 410. The higher-level verification device 310 includes a transmission / reception unit 311, an authentication information storage unit 312, a verification unit 313, and a notification unit 314. The top-level verification device 410 includes a reception unit 411, an authentication information storage unit 412, a verification unit 413, and an output unit 414.

[0040] <Communication Device 210> In the second embodiment, when the notification unit 214 receives a verification result indicating inauthenticity from the verification unit 213, the notification unit 214 includes information about the device 110 determined to be inauthentic in an anomaly report and notifies the higher-level verification device 310. In this case, the notification unit 214 may, for example, store a hash value of an identifier of the device 110 determined to be inauthentic in a number of a Platform Configuration Register (PCR) not used for authenticity verification in the TPM, and notify the higher-level verification device 310 of the stored hash value.

[0041] <Higher Verification Device 310> When the transmitting / receiving unit 311 receives the abnormality report from the communication device 210, it outputs to the notifying unit 314 that the abnormality report has been received.

[0042] The authentication information storage unit 312 stores the hash expectation values ​​of the components of the communication device 210 and the startup program.

[0043] The verification unit 313 verifies the authenticity of the communication device 210 when the communication device 210 is started. The verification unit 313 verifies the authenticity of the communication device 210 based on a hash value generated when the communication device 210 is started and a hash expected value stored in the authentication information storage unit 312. The method of verifying the authenticity executed by the verification unit 313 is similar to the method of verifying the authenticity of the device 100 by the communication device 200 in the first embodiment. The verification unit 313 outputs the verification result to the notification unit 214 only when it is determined that the communication device 210 is not authentic. On the other hand, when it is determined that the communication device 210 is authentic, the verification unit 313 does not output the verification result to the notification unit 214.

[0044] The notification unit 314 notifies the top-level verification device 410 of the abnormality report. The notification unit 314 also holds the verification result of the authenticity of the communication device 210 input from the verification unit 313. When the abnormality report is input from the transmission / reception unit 311, the notification unit 314 notifies the top-level verification device 410 of the abnormality report, reflecting the verification result of the authenticity of the communication device 210. That is, when the notification unit 314 has received the verification result of the authenticity of the communication device 210 from the verification unit 313, it notifies the communication device 210 of the abnormality report in addition to the abnormality report for the device 110. On the other hand, when the notification unit 314 has not received the verification result of the authenticity of the communication device 210 from the verification unit 313, it notifies only the abnormality report for the device 110.

[0045] The notification unit 314 notifies the top-level verification device 410 of the abnormality report including information on the device 110 and the communication device 210 that are determined to be inauthentic. In this case, the notification unit 314 may also store a hash value of an identifier of the device 110 or the communication device 210 that are determined to be inauthentic in a PCR number that is not used for verifying the authenticity in the TPM, and notify the top-level verification device 410 of the stored hash value. The notification unit 314 may also control the output device 510 such as a display device to display information indicating an abnormality report of the device 110 or the communication device 210. When the notification unit 314 receives a verification result indicating inauthenticity, the notification unit 314 may notify the presence of an abnormality by a lamp or buzzer provided in the top-level verification device 310. In this case, even if the network between the top-level verification device 310 and the top-level verification device 410 is interrupted, the top-level verification device 310 can notify the abnormality of the communication device 210.

[0046] <Top-level Verification Device 410> The top-level verification device 410 includes a receiving unit 411 , an authentication information storage unit 412 , a verification unit 413 , and an output unit 414 .

[0047] When the receiving unit 411 receives an anomaly report including a hash value from the higher-level verification device 310, the receiving unit 411 outputs to the output unit 414 that the anomaly report has been received.

[0048] The authentication information storage unit 412 stores the hash expectation values ​​of the components of the higher-level verification device 310 and the startup program.

[0049] The verification unit 413 verifies the authenticity of the higher-level verification device 310 when the higher-level verification device 310 is started. The verification unit 413 verifies the authenticity of the higher-level verification device 310 based on a hash value generated when the higher-level verification device 310 is started and a hash expected value stored in the authentication information storage unit 412. The method of verifying the authenticity by the verification unit 413 is similar to the method of verifying the authenticity of the device 100 by the communication device 200. When the verification unit 413 determines that the higher-level verification device 310 is not authentic, it outputs the verification result to the output unit 414. On the other hand, when the verification unit 413 determines that the higher-level verification device 310 is authentic, it does not output the verification result to the output unit 414.

[0050] The output unit 414 outputs the verification result of the authenticity of the device 110, the communication device 210, and the higher-level verification device 310 constituting the information communication system 11. The output unit 414 also holds the verification result of the authenticity of the higher-level verification device 310 input from the verification unit 413. When the output unit 414 receives an anomaly report from the higher-level verification device 310, the output unit 414 identifies the presence or absence of an anomaly in the configuration in each layer of the information communication system 11 based on the hash value included in the anomaly report and the verification result input from the verification unit 413, and displays the identified presence or absence of anomaly on the output device 510 such as a display device. In this case, the output unit 414 decrypts the hash value included in the anomaly report to identify the device 110 and the communication device 210 in which an anomaly has been detected. The output unit 414 also identifies the presence or absence of an anomaly in the higher-level verification device 310 based on the presence or absence of the verification result of the higher-level verification device 310 received from the verification unit 413. That is, when the output unit 414 receives the verification result of the higher-level verification device 310 from the verification unit 413, it determines that the higher-level verification device 310 is abnormal. On the other hand, when the output unit 414 does not receive the verification result of the higher-level verification device 310 from the verification unit 413, it determines that the higher-level verification device 310 is normal.

[0051] 5 and 6 are examples of output of the verification result by the output unit 414. Fig. 5 shows the configuration of the information communication system 11, and Fig. 6 shows the configuration and verification result of the device 110 managed by the communication device X. For example, when the output unit 414 detects that the communication device X in Fig. 5 has been selected, it displays the presence or absence of an abnormality and the verification time of each device 110 managed by the communication device X as shown in Fig. 6. Furthermore, the output unit 414 may highlight the device 110 in which an abnormality has been detected, as shown in Fig. 6.

[0052] The operation of the information communication system 11 configured as above will be described with reference to the flowchart of FIG.

[0053] 7 is a flowchart showing an outline of the operation of the information communication system 11 in the second embodiment. The information communication system 11 in the second embodiment starts operation when the verification unit 213 of the communication device 210 verifies the authenticity of the devices 110 and determines that any of the devices 110 is not authentic. Note that the processing according to this flowchart may be executed based on program control by the above-mentioned processor.

[0054] As shown in FIG. 7, first, when the verification unit 213 of the communication device 210 judges that any of the devices is not authentic (step S201), the notification unit 214 notifies the upper level verification device 310 of the hash value of the device 110 judged to be not authentic (step S202). Next, the transmission / reception unit 311 of the upper level verification device 310 receives the hash value received from the communication device 210 (step S203). Next, the notification unit 314 reflects the verification result of the authenticity of the communication device 210 (step S204). Next, the notification unit 314 notifies the top level verification device 410 of an anomaly report including the hash values ​​of the device 110 and the communication device judged to be not authentic (step S205). When the reception unit 411 of the top level verification device 410 receives the anomaly report including the hash value (step S206), the output unit 414 reflects the verification result of the authenticity of the upper level verification device 310 (step S207). Next, the verification result of the authenticity of the components (the device 110, the communication device 210, and the higher-level verification device 310) included in the information communication system 11 is output (step S208). With the above, the information communication system 11 ends the information communication operation.

[0055] In the information communication system 11 of this embodiment, the communication device 210, the higher-level verification device 310, and the top-level verification device 410 each verify the authenticity of a device or apparatus (communication device) present in a layer below itself, and notify an abnormality report up to the top-level verification device 410, including information specifying the device or apparatus determined to be inauthentic. In addition, the output unit 414 of the top-level verification device 410 outputs a verification result of the authenticity of the configuration included in the information communication system 11. This allows the administrator of the information communication system 11 to grasp the authenticity of the configuration included in the information communication system 11.

[0056] In the second embodiment, when an abnormality is detected in the authenticity of any of the devices 110, each verification unit of the upper level verification device 310 and the top-level verification device 410 sequentially verifies the authenticity of the lower communication device 210 and the top-level verification device 310. However, the verification timing of this embodiment is not limited to this. For example, when the communication device 210 and the top-level verification device 310 start up, the communication device 210 and the top-level verification device 310 may request the respective top-level devices to verify the authenticity, and each top-level device may verify the authenticity of the communication device 210 or the top-level verification device 310. In this case, as in the second embodiment, an abnormality report including a hash value that identifies the communication device 210 or the top-level verification device 310 that has been determined to be inauthentic is transmitted to the top-level verification device 410.

[0057] In the information communication system 11 of the second embodiment, only the higher-level verification device 310 exists between the communication device 210 and the top-level verification device 410, but multiple higher-level verification devices 310 may exist between the communication device 210 and the top-level verification device 410. Even in this case, each higher-level verification device 310 includes a verification unit 313 that verifies the authenticity of the communication device 210 or the higher-level verification device 310 existing below the higher-level verification device 310 itself, and a notification unit 314 that notifies the higher-level verification device 310 or the top-level verification device 410 existing above itself of an anomaly report when an anomaly is detected in the verification result of the authenticity.

[0058] [Third embodiment] Next, a third embodiment of the present disclosure will be described. Below, the description of the contents overlapping with the above description will be omitted to the extent that the description of this embodiment is not unclear. Each component in each embodiment of the present disclosure can be realized by a computer device based on program control or software, as well as by hardware, as in the computer device shown in FIG. 2.

[0059] In the third embodiment, the program of the device 120 for which an abnormality has been reported in the second embodiment is restored.

[0060] Fig. 8 is a diagram showing a configuration of an information communication system 12 in the first embodiment. As shown in Fig. 8, the information communication system 12 includes an API (Application Programming Interface) for program recovery between a communication device 220 and a top-level verification device 420 for a device in which an abnormality has been detected. The top-level verification device 420 further includes a control unit 425. A recovery program is encrypted and stored in a storage device 505 in the communication device 220.

[0061] The top-level verification device 420 includes a receiving unit 421 , an authentication information storage unit 422 , a verification unit 423 , an output unit 424 , and a control unit 425 .

[0062] The control unit 425 controls the communication device 220 that manages the device 120 in which the verification unit 423 has detected an anomaly in authenticity, and executes a recovery operation for the device 120. The control unit 425 may start an alternative device provided in the internal system 22. In this case, the control unit 425 physically or logically separates the device 120 in which the anomaly has been detected from the network, and starts the alternative device in the internal system 22 by remote execution. The control unit 425 may also instruct the communication device 220 to recover the program of the device 120 in which the anomaly has been detected, via an API. Upon receiving an instruction from the control unit 425, the communication device 220 decrypts the recovery program stored in the storage device 505, and controls the communication device 220 to install the program in the device 120 in which the anomaly has been detected.

[0063] FIG. 9 is an example of an output of the verification result of the authenticity by the output unit 424. As shown in FIG. 9, the verification result of each configuration of the information communication system 12 is displayed by drilling down. The example of FIG. 9 is a display of the system configurations shown in FIG. 5 and FIG. 6 by drilling down. Each configuration of the system shown in FIG. 5 corresponds to List 5 in FIG. 9, and each configuration of the system shown in FIG. 6 corresponds to List 6 in FIG. 9. In addition, it is shown that the system configuration shown in FIG. 9 corresponds to System C that performs satellite communication with Satellite C. As shown in FIG. 9, the output unit 424 may highlight the display parts of the device 120 in which an abnormality is detected, the name of the communication device that manages the device 120, the name of the system in which the communication device is installed, and the name of the satellite with which the system communicates by adding color. Note that the name and display method of each configuration of the information communication system 12 are not limited to the example of FIG. 9. For example, instead of the system name in FIG. 9, the name of the organization that uses the system or the name of the place where the system is installed may be displayed.

[0064] 9, a recovery button is provided next to the display of the device in which the abnormality was detected (device C). When control unit 425 detects that this recovery button has been clicked, it instructs communication device 220 to recover the program.

[0065] Furthermore, the control unit 425 may stop communication with the communication device 220 (internal system 22) that manages the device in which an abnormality in authenticity has been detected by the verification unit 423, by rewriting the certificate information. For example, the control unit 425 uses the mechanism of RFC5755 to rewrite the attribute certificate of the communication device 220 in the internal system 22 in which the abnormality has been detected. The control unit 425 may reconfigure the information communication system 10 excluding the internal system 22 in which the abnormality has been detected, and may control the information communication system 12 to perform degenerate operation.

[0066] In the third embodiment, the control unit 425 instructs the communication device 220 to restore the program of the device 120 in which an abnormality has been detected through a restoration API. By providing a restoration API from the highest level verification device 420 as in the third embodiment, even if the internal system 22 is in a remote location and it is difficult to immediately go there and perform restoration measures, it is possible to take measures to continue the functions of the internal system 22.

[0067] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0068] For example, although a plurality of operations are described in sequence in the form of a flow chart, the order of description does not limit the order of performing the plurality of operations. Therefore, when implementing each embodiment, the order of the plurality of operations can be changed within a range that does not interfere with the content. In the third embodiment, the control unit 425 of the highest level verification device 420 instructs the communication device 220 to restore the program of the device 120 in which an abnormality is detected through the recovery API. However, when the communication device 220 detects an abnormality in any of the devices 120 managed by the communication device 220, the control unit of the communication device 220 (not shown) may control the device 220 to decrypt the recovery program stored in the storage device 505 and install the program in the device 120 in which an abnormality in authenticity is detected. In this case, when the communication device 220 detects an abnormality in the authenticity of the device 120, measures can be taken automatically within the internal system 22 to continue the function.

[0069] In the third embodiment, when an anomaly is detected in the authenticity of the communication device 220 or the upper verification device 320, the control unit 425 may similarly control a recovery operation for the communication device 220 or the upper verification device 320 in which the anomaly is detected. In this case, the control unit 425 may start a substitute device prepared in advance in the information communication system 12, or may stop communication with the communication device 220 or the upper verification device 320 in which the anomaly is detected. The control unit 425 may also instruct recovery of the program of the communication device 220 or the upper verification device 320 in which the anomaly is detected through the above-mentioned API. Each recovery program is stored in the storage device 505 of the communication device 220 and the upper verification device 320, respectively.

[0070] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.

[0071] (Appendix 1) An information and communication system comprising a communication device and a verification device that verifies authenticity of the communication device, An information and communication system comprising: a verification means for verifying the authenticity of each of a plurality of devices managed by a communication device; and a notification means for notifying the verification device of an abnormality report of the device when an abnormality in the authenticity of any of the plurality of devices is detected.

[0072] (Appendix 2) one or more higher-level verification devices are provided between the communication device and a highest-level verification device; The information and communication system according to claim 1, wherein the higher-level verification device is provided with a verification means for verifying authenticity of the communication device or the higher-level verification device that is subordinate to the higher-level verification device, and a notification means for notifying an abnormality report to a higher-level verification device or a top-level verification device that is subordinate to the higher-level verification device when an abnormality is detected in the verification result of the authenticity.

[0073] (Appendix 3) The information and communication system according to claim 1 or 2, wherein the abnormality report includes information identifying the device, communication device, or higher-level verification device in which the abnormality was detected.

[0074] (Appendix 4) The top-level verification device An information and communication system as described in Appendix 2, comprising: a verification means for verifying authenticity of a communication device or a higher-level verification device existing below the highest-level verification device; and an output means for outputting a verification result of any of the equipment, communication device, and higher-level verification device constituting the information and communication system.

[0075] (Appendix 5) 5. The information and communication system according to claim 4, wherein the output means in the highest level verification device displays the verification results of the equipment, communication device, and higher level verification device constituting the information and communication system by drilling down.

[0076] (Appendix 6) The information and communication system according to claim 4 or 5, wherein the top-level verification device further comprises a control means for controlling an operation of a communication device that manages a device in which an anomaly in authenticity has been detected.

[0077] (Appendix 7) 7. The information communication system according to claim 6, wherein the control means stops communication with the communication device by rewriting an attribute certificate of the communication device.

[0078] (Appendix 8) Further, an API for recovery of a device in which an abnormality is detected is provided between the communication device and the highest level verification device, A recovery program is encrypted and stored in the storage means of the communication device, The information and communication system according to claim 6, wherein the control means instructs the communication device, via the API, to restore a program of the device in which the abnormality was detected.

[0079] (Appendix 9) The information and communication system according to any one of appendices 6 to 8, wherein the control means, when an abnormality in the authenticity of the communication device or the higher-level verification device is detected, further controls a recovery operation for the communication device or the higher-level verification device.

[0080] (Appendix 10) An information communication method comprising: verifying the authenticity of each of a plurality of devices managed by a communication device; and, if an abnormality in the authenticity of any of the plurality of devices is detected, notifying a verification device located above the communication device of an abnormality report for the device.

[0081] (Appendix 11) A recording medium storing a program that causes a computer to execute the following: verifying the authenticity of each of multiple devices managed by a communication device, and if an abnormality in the authenticity of any of the multiple devices is detected, notifying a verification device that is upstream of the communication device of an abnormality report for the multiple devices. [Explanation of symbols]

[0082] 10, 11, 12 Information and Communication Systems 100, 110, 120 equipment 101, 111, 121 Program Execution Department 102, 112, 122 Security function unit 103, 113, 123 Transmitter 200, 210, 220 Communication equipment 201, 211, 221 Transmitter / receiver 202, 212, 222 Authentication information storage unit 203, 213, 223 Verification Department 204, 214, 224 Notification Department 300, 310, 320 Higher level verification equipment 301, 311, 321 Transmitter / receiver 312, 322 Authentication information storage unit 313, 323 Verification Department 314, 324 Notification Department 400, 410, 420 Top-level verification equipment 401, 411, 421 Receiver 402, 414, 424 Output section 412, 422 Authentication information storage unit 413, 423 Verification Department 425 Control Unit

Claims

1. An information and communication system comprising a communication device and a verification device that verifies authenticity of the communication device, a verification means for verifying authenticity of each of a plurality of devices managed by the communication device, and a notification means for notifying the verification device of an abnormality report of the device when an abnormality in the authenticity of any of the plurality of devices is detected, one or more higher-level verification devices are provided between the communication device and a highest-level verification device; The higher-level verification device includes a verification means for verifying authenticity of the communication device or the higher-level verification device that is subordinate to the higher-level verification device, and a notification means for notifying an abnormality report to a higher-level verification device or a top-level verification device that is subordinate to the higher-level verification device when an abnormality is detected in the result of the verification of the authenticity. Information and communication systems.

2. The top-level verification device 2. The information and communication system according to claim 1, further comprising: a verification means for verifying authenticity of a communication device or a higher-level verification device existing below the highest-level verification device; and an output means for outputting a verification result of any of the equipment, communication device, and higher-level verification device constituting the information and communication system.

3. 3. The information and communication system according to claim 2, wherein the output means in said highest level verification device displays the verification results of the devices, communication devices and higher level verification devices constituting said information and communication system by drilling down.

4. 4. The information and communication system according to claim 2, wherein the top-level verification device further comprises a control unit for controlling an operation of a communication device that manages a device in which an anomaly in authenticity has been detected.

5. 5. The information communication system according to claim 4, wherein the control means stops communication with the communication device by rewriting an attribute certificate of the communication device.

6. An API for recovery of a device in which an abnormality is detected is further provided between the communication device and the highest level verification device, A recovery program is encrypted and stored in the storage means of the communication device, 5. The information communication system according to claim 4, wherein the control means instructs the communication device, via the API, to restore a program of the device in which the abnormality has been detected.

7. The information and communication system according to any one of claims 4 to 6, wherein the control means further controls a recovery operation for the communication device or the higher-level verification device when an abnormality in the authenticity of the communication device or the higher-level verification device is detected.

8. verifying the authenticity of each of a plurality of devices managed by the communication device, and when an abnormality in the authenticity of any of the plurality of devices is detected, notifying a verification device present at a higher level of the communication device of an abnormality report of the device; One or more higher level verification devices are provided between the communication device and the highest level verification device, a verification means for verifying authenticity of the communication device or the higher-level verification device present below the higher-level verification device, and when an abnormality is detected in the verification result of the authenticity, notifying an abnormality report to a higher-level verification device or a top-level verification device present above the higher-level verification device; Information and communication methods.

9. a computer is caused to verify the authenticity of each of a plurality of devices managed by the communication device, and when an abnormality in the authenticity of any of the plurality of devices is detected, to notify a verification device present at a higher level of the communication device of an abnormality report of the device; One or more higher level verification devices are provided between the communication device and the highest level verification device, a verification means for verifying authenticity of the communication device or the higher-level verification device that is subordinate to the higher-level verification device, and when an abnormality is detected in the verification result of the authenticity, the computer is further caused to execute the following: program.

Images