Processing device, processing method, and processing program

Abstract

To enable easily recognizing the evaluation of the communication environment of an OT network.SOLUTION: A processing device 10 includes: a collection unit 132 that collects communication data of an operational technology (OT) network; a reception unit 131 that receives information indicating the industry and scale of an office where the OT network is constructed; an identification unit 133 that identifies a communication environment of the OT network on the basis of the communication data; an evaluation unit 135 that evaluates the communication environment of the OT network on the basis of a reference value set according to the industry and the scale of the office; and a creation unit 136 that creates a report indicating the result of evaluation by the evaluation unit 135.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a processing device, a processing method, and a processing program. [Background technology]

[0002] In recent years, OT (Operational Technology) networks used to manage and control control systems in buildings, factories, plants, etc. have been moving toward compatibility with general-purpose operating systems (OS), standardization of communication protocols, IP adoption, and external connections. As a result, OT networks are increasingly exposed to security risks.

[0003] As a security measure for this OT network, a system has been proposed that visualizes the communication status of the OT network, the connection status of the terminal, the OS used by the terminal, etc. (see Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] NTT Communications, Introduction to Control System Security and Countermeasure Technology OsecT (Part 1), [online], [Retrieved February 1, 2022], Internet<URL:https: / / engineers.ntt.com / entry / 2021 / 07 / 27 / 112539> Summary of the Invention [Problem to be solved by the invention]

[0005] The system described in Non-Patent Document 1 outputs a list of terminals listing their IP addresses and the operating systems they use, as well as a map showing the communication status between terminals.

[0006] However, OT networks are often designed or managed by people who are not very familiar with IT (Information Technology) or OT. It is difficult for such people to evaluate the communication environment and anticipate security risks by simply looking at a list of terminals or a map showing the communication status between terminals.

[0007] The present invention has been made in view of the above, and aims to provide a processing device, a processing method, and a processing program that can easily recognize an evaluation of the communication environment of an OT network. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems and achieve the objectives, the processing device according to the present invention is characterized by having a collection unit that collects communication data of an OT (Operational Technology) network, an acquisition unit that acquires information indicating the industry and size of the business establishment in which the OT network is constructed, an identification unit that identifies the communication environment of the OT network based on the communication data, an evaluation unit that evaluates the communication environment of the OT network based on standard values set according to the industry and size of the business establishment, and a creation unit that creates a report showing the evaluation results evaluated by the evaluation unit. [Effects of the Invention]

[0009] According to the present invention, it is possible to easily recognize the evaluation of the communication environment of an OT network. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a processing system according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of the configuration of the processing device illustrated in FIG. [Figure 3] FIG. 3 is a diagram showing an example of a format included in the report creation data. [Figure 4] FIG. 4 is a diagram illustrating an example of data included in the specific data. [Figure 5] FIG. 5 is a diagram illustrating an example of data included in the specific data. [Figure 6] FIG. 6 is a diagram illustrating an example of the data configuration of the evaluation data. [Figure 7] FIG. 7 is a diagram illustrating an example of report data. [Figure 8] FIG. 8 is a diagram showing an example of a detailed report. [Figure 9] FIG. 9 is a diagram showing an example of a detailed report. [Figure 10] FIG. 10 is a diagram showing an example of a detailed report. [Figure 11] FIG. 11 is a diagram showing an example of a detailed report. [Figure 12] FIG. 12 is a diagram showing an example of a detailed report. [Figure 13] FIG. 13 is a diagram showing an example of a detailed report. [Figure 14] FIG. 14 is a diagram showing an example of a detailed report. [Figure 15] FIG. 15 is a diagram showing an example of a detailed report. [Figure 16] FIG. 16 is a diagram showing an example of a detailed report. [Figure 17] FIG. 17 is a sequence diagram illustrating an example of a processing procedure of the processing method according to the embodiment. [Figure 18] FIG. 18 is a diagram illustrating a computer that executes a program. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of a processing device, a processing method, and a processing program according to the present application will be described in detail with reference to the accompanying drawings. Note that the processing device, the processing method, and the processing program according to the present application are not limited to these embodiments.

[0012] In the following embodiments, the processing flow of a processing device, a processing method, and a processing program according to the embodiments will be described in order, and finally, the effects of the embodiments will be described.

[0013] [Embodiment Mode] First, an embodiment will be described. In the embodiment, a processing system will be described that evaluates the communication environment of an OT (Operational Technology) network used for managing and controlling control systems in business establishments such as buildings, factories, and plants, and creates a report showing the evaluation results.

[0014] [Processing system configuration] The configuration of a processing system according to an embodiment will be described. Fig. 1 is a schematic diagram showing an example of the configuration of a processing system according to an embodiment. In the embodiment, an OT network 20 constructed in a factory F1 will be described as an example.

[0015] The OT network 20 shown in Figure 1 is divided into Level 0, where sensors and actuators are located; Level 1, where PLCs (Programmable Logic Controllers) / RTUs (Remote Terminal Units) are located; Level 2, where switches (SWs) 22-1 and 22-2, SCADA (Supervisory Control And Data Acquisition) devices, and HMIs (Human Machine Interfaces) are located; and Level 3, where SWs 21 and EWSs (Engineering Workstations) are located. The devices located at Levels 0 to 3 are communication devices capable of communicating with other devices. The OT network 20 also includes a DMZ (Demilitarized Zone) between Level 3 and the operator's servers (Levels 4 / 5), which are capable of communicating with external networks.

[0016] The processing device 10 collects packet data from the OT network 20. In the processing system, for example, a mirror port is provided in SW21, and packet data (communication data) transmitted and received by SW21 is mirrored to the processing device 10 (arrow Y1 in FIG. 1).

[0017] The processing device 10 identifies the communication environment of the business establishment based on the collected packet data of the OT network 20. The processing device 10 evaluates the communication environment of the OT network 20 based on standard values set according to the business establishment's industry and size, and creates a report showing the evaluation results. Even a person in charge who is not familiar with IT and OT can easily recognize the evaluation of the communication environment of the OT network 20 by checking this report.

[0018] When evaluating a communication environment of Level 2 or lower of the OT network 20, for example, a mirror port may be provided in SW22-1 and 22-2, and packet data transmitted and received by SW22-1 and 22-2 may be mirrored to the processing device 10 (arrow Y2 in FIG. 1).

[0019] [Processing equipment] Next, the processing device 10 will be described. Fig. 2 is a block diagram showing an example of the configuration of the processing device 10 shown in Fig. 1. As shown in Fig. 2, the processing device 10 has a communication unit 11 that controls communication related to various information, a memory unit 12 that stores data and programs required for various processes by a control unit 13, the control unit 13 that executes various processes, and an input / output unit 14.

[0020] The communication unit 11 is a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The communication unit 11 is realized by a NIC (Network Interface Card) or the like, and performs communication between the other devices and the control unit 13 (described later) via electric communication lines such as a LAN (Local Area Network) or the Internet. For example, the communication unit 11 receives packet data from SW21.

[0021] The input / output unit 14 receives input of information and outputs information. The input / output unit 14 is a device such as a mouse or a keyboard that receives input of various instruction information to the processing device 10 in response to an input operation by a user. The input / output unit 14 is realized, for example, by a liquid crystal display or the like, and displays and outputs a screen whose display is controlled by the processing device 10. The input / output unit 14 may also be realized, for example, by a printer or the like.

[0022] The storage unit 12 is a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The storage unit 12 may also be a data-rewritable semiconductor memory such as a RAM (Random Access Memory), a flash memory, or an NVSRAM (Non-Volatile Static Random Access Memory). The storage unit 12 stores an OS (Operating System) and various programs executed by the processing device 10. The storage unit 12 also stores various information used in the execution of the programs. The storage unit 12 stores a packet data group 121, business establishment data 122, report creation data 123, identification data 124, evaluation data 125, and report data 126.

[0023] The packet data group 121 is a plurality of packet data mirrored from the SW 21 of the OT network 20. The packet data was collected during the target period of the communication environment evaluation of the OT network 20.

[0024] The establishment data 122 includes data indicating the type of business and size of each establishment. The type of business may be, for example, assembly and processing, chemicals, food, machinery, electricity, information and communications, etc. The business size may be, for example, the number of employees, annual sales, etc. The establishment data 122 is registered in advance. The establishment data 122 may also be obtained from, for example, another database.

[0025] The report creation data 123 is data including a report format for describing the communication environment evaluation of the OT network 20. FIG. 3 is a diagram showing an example of a format included in the report creation data 123.

[0026] As shown in Table 123-1 in Fig. 3, the report creation data 123 has the following items: index, expected risk, number, ratio, and evaluation. Of these items, the contents of the index are preset. The contents of the expected risk are also preset in accordance with the contents of the index.

[0027] The indicators are the evaluation contents evaluated by the evaluation unit 135 (described later), and relate to the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used in the OT network, the number of communication devices with DHCP (Dynamic Host Configuration Protocol) server functionality, and / or the number of communication devices that are communicating for less than a specified time.

[0028] For example, indicator "1" is the "number and percentage of PCs with an old OS installed." Indicator "2" is the "number and percentage of hosts deleted / added during the specified period." Indicator "3" is the "type and percentage of old ports." Indicator "4" is the "number and percentage of PCs using old ports." Indicator "5" is the "number of terminals that are DHCP parents (with DHCP server functionality)." Indicator "6" is "terminals that communicated for less than 60 seconds."

[0029] Indicator "1" is associated with the risk that "an unsupported OS may become a security hole." Indicator "2" is associated with the risk that "an unmanaged host may be connected." Indicators "3" and "4" are associated with the risk that "a security hole may occur, leading to the takeover of PCs or production equipment." Indicator "5" is associated with the risk that "a rogue WiFi may be connected." Indicator "5" is associated with the risk that "a wrong connection may have occurred."

[0030] In Table 123-1, the number, percentage, and evaluation items corresponding to each indicator "1" to "6" contain information identified or evaluated by the identification unit 133 (described below) and the evaluation unit 135 (described below) according to each indicator.

[0031] The identification data 124 is data indicating the communication environment of the OT network 20 identified by the identification unit 133. The identification data 124 includes various data such as a list of communication devices of the OT network 20. For example, the list of communication devices of the OT network 20 is a list that associates, for example, the IP address, MAC address, OS, vendor information, role of this communication device (client, server, or both), protocol and port number, host identification information, and communication observation time of each communication device.

[0032] 4 and 5 are diagrams showing examples of data included in the identification data 124. As shown in Fig. 4, the identification data 124 includes map data in which communication devices are represented as nodes and communications between communication devices are displayed as links. IP addresses are also listed for the nodes. Furthermore, as shown in Fig. 5, the identification data 124 includes matrix data in a matrix format in which each cell is color-coded according to vendor information, OS, or the role of the communication device.

[0033] The evaluation data 125 is data indicating the reference value of each evaluation by the evaluation unit 135. The reference value of each evaluation is set depending on the type of business and the scale of the establishment. Fig. 6 is a diagram showing an example of the data configuration of the evaluation data 125.

[0034] As shown in Figure 6, as shown in Table 125-1, the evaluation data 125 has the following items: business type, size, index, average value, standard value, and evaluation judgment rule of the establishment. Indicators "1" to "6" correspond to indicators "1" to "6" in Table 125-1. The average value is the average value of the index shown in this row for multiple establishments of the business type and size of that row. The standard value is set for each of indicators "1" to "6" according to the business type and size of the establishment. The standard value is a value that is considered desirable for establishments of that business type and size to meet.

[0035] In the embodiment, an evaluation standard range is set for each stage depending on the type of business and size of the establishment, so that the evaluation can be made in stages, for example, in the order of evaluation A to F. Each evaluation standard range is set based on the average value or reference value of each index depending on the type of business and size of the establishment.

[0036] Let's take the contents of the first line of Table 125-1 as an example. The first line corresponds the average value of "50" for indicator "1" for establishments in the food industry with 100 to 500 employees, the reference value "40," and the evaluation judgment rules. The first line indicates that, for indicator "1," for example, if the "number of PCs with an old OS" is "less than 20," the evaluation is A; if it is "20 to less than 40," the evaluation is B; if it is "40 to less than 50," the evaluation is C; if it is "50 to less than 60," the evaluation is D; if it is "60 to less than 70," the evaluation is E; and if it is "70 or more," the evaluation is F.

[0037] In the second row of Table 125-1, for establishments in the food industry with 100 to 500 employees, the average value of "20" for indicator "2" and the standard value of "20" are associated with each evaluation rule corresponding to A to F. In this way, Table 125-1 associates each of indicators "1" to "6" with the average value, standard value, and each evaluation rule corresponding to A to F.

[0038] Table 125-1 also associates the average value, standard value, and evaluation and judgment rules corresponding to A to F with each of the indicators "1" to "6" for business establishments of other industries and other scales. The average value and standard value of each indicator "1" to "6" and the evaluation and judgment rules corresponding to A to F are set according to the industry and scale and the required security level. In the example of Figure 6, the standard value is different from the average value, but the standard value may be the same as the average value. The standard value may also be a statistical value other than the average value.

[0039] The report data 126 is a report that shows the evaluation results of the OT network 20 created by the creation unit 136 (described later). Fig. 7 is a diagram showing an example of the report data 126. As shown in Fig. 7, the report 126-1 is a report in which, among the items of the table 123-1 in Fig. 3, the number and ratio corresponding to each indicator identified by the identification unit 133 are entered in the number and ratio columns, and the evaluation by the evaluation unit 135 of each indicator is entered in the evaluation column (see box W1).

[0040] The control unit 13 controls the entire processing device 10. The control unit 13 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 13 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory. The control unit 13 also functions as various processing units by running various programs. The control unit 13 has a receiving unit 131, a collecting unit 132, an identifying unit 133, an estimating unit 134, an evaluating unit 135, and a creating unit 136.

[0041] The reception unit 131 receives data input by a manager or the like of the business establishment where the OT network 20 is established. For example, the reception unit receives input of information indicating the business type and scale of the business establishment where the OT network 20 is installed.

[0042] The collection unit 132 collects mirrored packet data from the SW 21 of the OT network 20 and stores it in the storage unit 12.

[0043] The identification unit 133 identifies the communication environment of the OT network 20 based on packet data mirrored from SW21 of the OT network 20. Based on the packet data, the identification unit 133 identifies the IP address, MAC address, OS, vendor information, role of this communication device (client, server, or both), protocol and port number, host identification information, communication sender and receiver, and observation time of each communication device located on the OT network 20. Based on the packet data, the identification unit 133 identifies the amount of communication and type of communication between communication devices located on the OT network 20. For example, the identification unit 133 identifies which communication terminals are performing name resolution communication. Furthermore, the identification unit 133 specifies any two periods and identifies changes in the communication status.

[0044] Then, based on the packet data, the identification unit 133 identifies the number of communication devices in the OT network 20, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during the specified period, the type and quantity of ports used in the OT network 20, the number of communication devices with DHCP server functionality, and / or the number of communication devices that are communicating for less than a specified time.

[0045] The estimation unit 134 estimates the size of the business establishment where the OT network 20 is installed based on the number of communication devices of the business establishment of the OT network 20 identified by the identification unit 133. For example, the estimation unit 134 estimates the size of the business establishment by referring to a correspondence table that associates the size of the business establishment with the number of communication devices.

[0046] The evaluation unit 135 evaluates the communication environment of the OT network 20 based on reference values set according to the type of business and size of the establishment. The evaluation unit 135 evaluates the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices with a DHCP server function, and / or the number of communication devices performing communication for a predetermined time or less.

[0047] For example, the evaluation unit 135 evaluates the above-mentioned indicators "1" to "6" in stages from A to F, with reference to Table 125-1 illustrated in Fig. 6. In this case, the identification unit 133 uses the identification result by the identification unit 133 to calculate the percentage of communication devices equipped with an OS version older than a predetermined version, the percentage of hosts deleted and / or added during a specified period, and the number and percentage of ports older than a predetermined generation. The predetermined period is a period set as an evaluation period for the OT network 20.

[0048] Then, the evaluation unit 135 refers to the section of Table 125-1 that corresponds to the industry and size of the business establishment where the OT network 20 to be evaluated is constructed. The evaluation unit 135 compares the content identified by the identification unit 133 with each of the evaluation criteria A to F set for each indicator, and determines whether the evaluation is A to E.

[0049] An example will be described in which the establishment to be evaluated is a food processing company with 120 employees. In this case, the evaluation unit 135 refers to the standard determination rules in rows 1 to 6 of Table 125-1, which correspond to the industry "food" and the size "100 to 500 people," and performs evaluation for each of the indicators "1" to "6."

[0050] For example, if the total number of communication devices in the OT network 20 of this business establishment is 32 and the number of PCs equipped with an OS older than a specified version is 1, the evaluation unit 135 will evaluate the indicator "1" as "A." Regarding the "number and ratio of hosts deleted / added during a specified period," the evaluation is performed based on, for example, the maximum value of the number of deleted hosts and the number of added hosts.

[0051] Then, in the OT network 20 of this business establishment, if the number of hosts deleted during the specified period is 16 and the number of hosts added is 11, the evaluation unit 135 evaluates the index "2" as "B." If there are two types of ports older than the specified generation, the evaluation unit 135 evaluates the index "3" as "C." Similarly, the evaluation unit 135 also evaluates the indexes "4" and onward on a six-level scale from A to F by referring to Table 125-1.

[0052] The creation unit 136 creates a report showing the evaluation results evaluated by the evaluation unit 135. The creation unit 136 creates a report in which the evaluation results evaluated by the evaluation unit 135 are associated with each other regarding the number of communication devices in the OT network 20, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used in the OT network 20, the number of communication devices having a DHCP server function, and / or the number of communication devices performing communication for a predetermined time or less.

[0053] Specifically, the creation unit 136 creates a report in which each evaluation result by the evaluation unit 135 is entered in each item in the frame W1, as shown in report 126-1 in Fig. 7. In the example of the food processing company with 120 employees described above, for indicator "1," the creation unit 136 enters "1 unit" in the "Number (units)" column, "3.12" in the "Ratio" column, and "A" in the "Evaluation" column. The creation unit 136 similarly enters each evaluation result by the evaluation unit 135 for the other indicators "2" to "6," filling in each item in the frame W1.

[0054] In this way, the creation unit 136 does not create a report that simply lists the identification results of the identification unit 133. The creation unit 136 creates a report that clearly states the content of each indicator and the expected risks associated with each indicator, extracts and describes the identification results related to each indicator, and further describes the evaluation of the OT network 20 for each indicator. The creation unit 136 outputs the created report from the input / output unit 14. Alternatively, the creation unit 136 transmits the created report to another device via the communication unit 11.

[0055] By simply referring to this report, the administrator of the OT network 20 can recognize an appropriate evaluation of the communication environment of the OT network 20. The report lists each identification result and evaluation result categorized into multiple indicators, so even if the administrator is not very familiar with IT or OT, the administrator does not need to analyze the identification results, separate them into each content listed in the indicators, and evaluate the communication environment of the OT network 20. Furthermore, the administrator can check the expected risks for each indicator in the report, and can take specific risk avoidance measures based on the content shown in the indicators.

[0056] The creation unit 136 may attach detailed reports such as those shown in Figures 8 to 16 in addition to the report 126-1 in Figure 7. Figures 8 to 16 are diagrams showing examples of detailed reports.

[0057] Figure 8 shows an overview along with the evaluation period. Figure 9 shows a list of hosts added during the evaluation period. Figure 10 shows a list of hosts deleted during the evaluation period. Figure 11 is a communication connection map in which communication devices are used as nodes and communications between communication devices are displayed as links. For example, in the example of Figure 11, boxes W11 to W14 are marked to distinguish between groups with similar communication characteristics, communications between independent groups, communications from one terminal (client) to multiple (servers), and structures that bridge different hub nodes ((1) to (4) in Figure 11).

[0058] Figure 12 shows matrix data in a matrix format, with each cell color-coded according to the OS type. In addition, there is matrix data that displays vendor information and the role of the communication device. Figure 13 shows a list of attribute information for each terminal. Figure 14 is a list of communication terminals that have been communicating for 60 seconds or less. Figure 15 is a list of communication devices with DHCP server functionality. Figure 16 is a list of terminals that are using old ports. The person in charge of managing the OT network 20 can recognize the details of the communication environment of the OT network 20 by checking the detailed reports shown as examples in Figures 8 to 16.

[0059] [Processing procedure] Next, a processing method in the processing system according to the embodiment will be described below. Fig. 17 is a sequence diagram showing an example of the processing procedure of the processing method according to the embodiment.

[0060] 17, the processing device 10 receives input of business type information of the business establishment where the OT network 20 to be evaluated is constructed. Then, the processing device 10 receives mirrored packet data from SW21 of the OT network 20 (step S1) and collects packet data of the OT network 20 (step S2). The processing device 10 identifies the communication environment of the OT network 20 based on the packet data (step S3).

[0061] The processing device 10 estimates the size of the business establishment to be evaluated based on the number of communication devices in the OT network 20 (step S4). Note that if the business establishment size information has been input in advance along with the business type information of the business establishment to be evaluated, the processing device 10 omits the processing of step S4.

[0062] The processing device 10 evaluates the communication environment of the OT network 20 identified in step S3 based on standard values set according to the business type and scale of the business (step S5). Then, the processing device 10 creates and outputs a report (step S6) showing the evaluation results evaluated in the evaluation process (step S5).

[0063] [Effects of the embodiment] In this way, the processing device 10 according to the embodiment collects packet data of the OT network 20, identifies the communication environment of the OT network 20 based on the packet data, and identifies the communication environment of the OT network 20 based on the packet data. Then, the processing device 10 evaluates the communication environment of the OT network 20 based on reference values set according to the type of business and size of the establishment, and creates a report showing the evaluation results.

[0064] Therefore, by simply referring to this report, the person in charge of managing the OT network 20 can recognize the evaluation of the communication environment of the OT network 20. The report shows the results of the evaluation of the communication environment of the OT network 20 according to the type of industry and size of the business establishment. Therefore, by simply referring to this report, the person in charge of managing the OT network 20 can recognize the evaluation that has been appropriately determined according to the type of industry and size of the business establishment.

[0065] The processing device 10 evaluates indicators related to the number of communication devices in the OT network 20, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used in the OT network, the number of communication devices with DHCP server functionality, and / or the number of communication devices communicating for less than a specified time, and creates a report that associates each evaluation result.

[0066] Therefore, the report describes each identification result and evaluation result categorized into multiple indicators, so that even if the person in charge of managing the OT network 20 is not very familiar with IT or OT, he or she does not need to analyze the identification results or evaluate the communication environment of the OT network 20 while categorizing the contents of the indicators.

[0067] Furthermore, the report includes evaluation results divided into levels A to F, for example, so that the person in charge of managing the OT network 20 can recognize the level of the communication environment of the OT network 20 that he or she manages compared to the communication environments of OT networks of other business establishments of a similar industry and scale. Furthermore, the processing device 10 includes in the report the anticipated risks for each indicator. Therefore, the person in charge of managing the OT network 20 can confirm the anticipated risks for each indicator in the report and can take specific risk avoidance measures based on the contents indicated by the indicators.

[0068] [System configuration, etc.] Furthermore, the components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of each device can be functionally or physically distributed and integrated in any unit depending on various loads and usage conditions. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU or GPU and a program analyzed and executed by the CPU or GPU, or can be realized as hardware using wired logic.

[0069] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0070] [program] It is also possible to create a program in which the processes executed by the processing device 10 described in the above embodiment are written in a language executable by a computer. For example, it is also possible to create a program in which the processes executed by the processing device 10 in the above embodiment are written in a language executable by a computer. In this case, the same effects as those of the above embodiment can be obtained by having a computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize processes similar to those of the above embodiment.

[0071] 18 is a diagram showing a computer that executes a program. As shown in the example of FIG. 18, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

[0072] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012, as exemplified in FIG. 18. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090, as exemplified in FIG. 18. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0073] 18, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above programs are stored on the hard disk drive 1090, for example, as program modules in which instructions to be executed by the computer 1000 are written.

[0074] The various data described in the above embodiment are stored as program data, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed, and executes various processing procedures.

[0075] Note that the program module 1093 and program data 1094 related to the program are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 related to the program may be stored in another computer connected via a network (such as a LAN (Local Area Network) or WAN (Wide Area Network)) and read by the CPU 1020 via the network interface 1070.

[0076] The above-described embodiments and their modifications are included in the technology disclosed in this application, as well as in the scope of the invention described in the claims and their equivalents. [Explanation of symbols]

[0077] 10 Processing equipment 11 Communications Department 12 Storage section 13 Control Unit 14 Input / output section 121 Packet Data Group 122 Business Data 123 Data for creating reports 124 Specific Data 125 Evaluation Data 126 Report Data 131 Reception 132 Collection Department 133 Specific part 134 Estimation Department 135 Evaluation Department 136 Creation Department

Claims

1. a collection unit that collects communication data of an OT (Operational Technology) network; an acquisition unit that acquires information indicating the type of business and the size of the establishment in which the OT network is established; an identification unit that identifies a communication environment of the OT network based on the communication data; An evaluation unit that evaluates the communication environment of the OT network based on standard values set according to the business type and scale of the business; a creating unit that creates a report showing the evaluation results obtained by the evaluation unit; and The identification unit identifies, based on the communication data, the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices having a DHCP (Dynamic Host Configuration Protocol) server function, and / or the number of communication devices performing communication for a predetermined time or less; the evaluation unit evaluates the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices having a DHCP server function, and / or the number of communication devices performing communication for a predetermined time or less; The creation unit creates a report that associates the evaluation results evaluated by the evaluation unit with the number of communication devices on the OT network, the type of OS used on the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used on the OT network, the number of communication devices with DHCP server functionality, and / or the number of communication devices that are communicating for less than a specified time.

2. The processing device according to claim 1 , further comprising an estimation unit that estimates the scale of the establishment based on the number of communication devices on the OT network.

3. The processing device according to claim 1 or 2, characterized in that each reference value is set according to the type of industry and the size of the business establishment for each of the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used in the OT network, the number of communication devices with DHCP server functionality, and / or the number of communication devices performing communication for a specified period of time or less.

4. The processing device according to any one of claims 1 to 3, characterized in that the creation unit creates a report in which the content indicating the expected risks for each of the following items is associated with the evaluation results evaluated by the evaluation unit: the number of communication devices on the OT network; the type of OS used on the communication devices; the number of communication devices equipped with an OS version older than a specified version; the number of hosts deleted and / or added during a specified period; the type and quantity of ports used on the OT network; the number of communication devices with DHCP server functionality; and / or the number of communication devices communicating for less than a specified time.

5. A processing method executed by a processing device, Collecting communication data from an OT (Operational Technology) network; acquiring information indicating the type of business and the size of the establishment in which the OT network is established; identifying a communication environment of the OT network based on the communication data; evaluating the communication environment of the OT network based on standard values set according to the type of business and size of the establishment; creating a report showing the evaluation results obtained in the evaluation step; Including, The step of identifying includes, based on the communication data, identifying the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices having a DHCP (Dynamic Host Configuration Protocol) server function, and / or the number of communication devices performing communication for a predetermined time or less; The step of performing the evaluation includes evaluating the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices having a DHCP server function, and / or the number of communication devices performing communication for a predetermined time or less; The creating step is a processing method characterized by creating a report that associates each evaluation result evaluated in the evaluating step with the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used in the OT network, the number of communication devices with DHCP server functionality, and / or the number of communication devices that are communicating for less than a specified time.

6. Collecting communication data of an OT (Operational Technology) network; acquiring information indicating the type of business and the size of the establishment in which the OT network is established; Identifying a communication environment of the OT network based on the communication data; evaluating the communication environment of the OT network based on a standard value set according to the type of business and the size of the business; creating a report showing the evaluation results obtained in the evaluation step; on the computer, The step of identifying includes, based on the communication data, identifying the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices having a DHCP (Dynamic Host Configuration Protocol) server function, and / or the number of communication devices performing communication for a predetermined time or less; The step of performing the evaluation includes evaluating the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a predetermined version, the number of hosts deleted and / or added during a specified period, the type and number of ports used in the OT network, the number of communication devices having a DHCP server function, and / or the number of communication devices performing communication for a predetermined time or less; The creating step is a processing program for creating a report that associates each evaluation result evaluated in the evaluating step with the number of communication devices in the OT network, the type of OS used in the communication devices, the number of communication devices equipped with an OS version older than a specified version, the number of hosts deleted and / or added during a specified period, the type and quantity of ports used in the OT network, the number of communication devices with DHCP server functionality, and / or the number of communication devices that are communicating for less than a specified time.

Images