Communication system, switching device, switching method, and program

Abstract

Provided is a communication system in which communication is performed between a plurality of nodes through a brokerless publishing / subscription model, wherein when it is detected that invalid data is delivered from one application that is preferentially handled on the subscription side, among one or more applications that function as the publishing side and that are redundant in the one or more nodes, and delivery of the invalid data is detected, the application preferentially handled on the subscription side is switched to another application among the one or more applications that is different from the one application.

Description

[Technical Field]

[0001] The present invention relates to a technique for switching a Pub to be given priority on the Sub side in response to the occurrence of invalid data. [Background technology]

[0002] In recent years, efforts to realize smart factories have been progressing by connecting devices on information networks with devices on control networks. In the future, it is expected that communication models that enable interconnection of devices and lightweight, flexible one-to-many and many-to-one communication will become more widespread.

[0003] The Publish / Subscribe communication (hereafter referred to as Pub / Sub communication) model has been proposed as a lightweight and flexible communication model for the above. In Pub / Sub communication, there is a Publisher, which is a client that creates and sends (distributes) messages called events, and a Subscriber, which is a client that receives (subscribes to) messages.

[0004] Pub / Sub communication has three properties: spatial separation, temporal separation, and asynchronous processing. Spatial separation means that the publisher and subscriber do not need to know of each other's existence. Temporal separation means that data can be sent and received even if the publisher and subscriber are not on the network at the same time. Asynchronous processing means that event sending and receiving can be processed asynchronously with other processing by the publisher or subscriber.

[0005] There are two types of Pub / Sub communication models: broker and brokerless. A broker-type configuration places a function called a broker between Pub and Sub, which is responsible for spatial separation, temporal separation, and asynchronous processing. A brokerless configuration is a distributed configuration in which all nodes (Pub and Sub) have the functions to handle spatial separation, temporal separation, and asynchronous processing. The above brokerless configuration can be realized by deploying a function called DDS (Data Distribution Service) in each node. The Pub / Sub communication model is also called a publish / subscribe model. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] What's in the DDS Standard, Internet<URL:https: / / www.dds-foundation.org / omg-dds-standard / > Summary of the Invention [Problem to be solved by the invention]

[0007] In a communication system that uses DDS for pub / sub communication, the basic functions of DDS make it possible to make pubs redundant. For example, it is possible to automatically switch which of multiple pubs in a redundant configuration is treated as the priority pub (hereinafter referred to as the priority pub).

[0008] However, this switching occurs when a failure occurs in the Priority Pub and communication with the Sub is lost. For this reason, the basic functionality of DDS cannot automatically switch the Priority Pub if, for example, a third party with malicious intent takes over the Priority Pub and starts sending malicious data (such as data intended to attack the Sub).

[0009] The present invention has been made in consideration of the above points, and aims to provide a technology in a communication system that performs Pub / Sub communication that switches the Pub that is given priority on the Sub side in response to the occurrence of invalid data. [Means for solving the problem]

[0010] According to the disclosed technology, there is provided a communication system for communicating among a plurality of nodes using a brokerless publish / subscribe model, comprising: an unauthorized data occurrence detection unit that detects unauthorized data being distributed from one application that is given priority on the subscriber side among one or more applications that function as publishers and are redundantly configured on one or more of the nodes; a switching unit that switches an application that is given priority on the subscriber side to another application different from the one application among the one or more applications when distribution of the unauthorized data is detected; A communication system is provided having: [Effects of the Invention]

[0011] According to the disclosed technology, in a communication system that performs Pub / Sub communication, a technology is provided that enables the Sub side to switch the Pub that is given priority in response to the occurrence of invalid data. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating Pub / Sub communication using DDS. [Figure 2] FIG. 1 is a diagram illustrating an example of a system configuration in which a DDS is incorporated. [Figure 3] FIG. 1 is a diagram illustrating an example of the configuration of a system having multiple nodes. [Figure 4] FIG. 1 is a diagram for explaining an outline of an embodiment. [Figure 5] FIG. 1 is a diagram illustrating an example of a system configuration according to an embodiment. [Figure 6]FIG. 1 is a diagram for explaining configuration management. [Figure 7] FIG. 2 is a diagram illustrating an example of the configuration of a detection unit in the embodiment. [Figure 8] FIG. 2 illustrates an example of the configuration of a configuration management unit in the embodiment. [Figure 9] FIG. 2 is a diagram illustrating an example of the configuration of a handling unit in the embodiment. [Figure 10] FIG. 2 is a diagram illustrating an example of the configuration of a DDS operation function unit in the embodiment. [Figure 11] FIG. 1 is a diagram showing a processing flow in an embodiment. [Figure 12] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0014] In the embodiment described below, an example is described in which the present invention is applied to a communication system that performs pub / sub communication using DDS, but the present invention is not limited to application in pub / sub communication using DDS.

[0015] (Pub / Sub communication using DDS) First, the DDS, which is the premise of this embodiment, and Pub / Sub communication using the DDS will be described.

[0016] In this embodiment, the above-mentioned brokerless configuration is adopted, and the brokerless configuration is realized by the DDS taking on the function equivalent to that of a broker.

[0017] Here, we will explain the delivery range management in DDS. In DDS, a delivery network is added to the network interface that a node has. The delivery range set by the user works with this delivery network and a filter within DDS, enabling the sending and receiving of appropriate data to applications that function as Pub or Sub.

[0018] Specifically, based on the data bus and the delivery range set by the user, DDS assigns multicast addresses to the network interfaces available within the node and prepares a delivery network.When specifying the delivery range, it is also possible to set whether to deliver data by unicast using the node's existing IP address or to use a newly assigned multicast address, making it possible to determine the physical data distribution range.

[0019] An example of a delivery range is shown in Figure 1. In the example in Figure 1, domain A and domain B are set as the delivery range. Furthermore, within domain A, a delivery range for topic [I] and a delivery range for topic [R] are set. Furthermore, within the delivery range of topic [I], a delivery range for key [II] is set.

[0020] (Example of a system configuration incorporating DDS) DDS is a program that functions as middleware in a node (which may also be called a computer, communication device, etc.). The basic processing programs required for communication in DDS are provided as a library. By using this library, a DDS program can be generated from a data definition file for generating communications programs, which has as parameters the definitions (type, size, name, QoS, etc.) of the data sent by the application (written as "APP"). Generating DDS itself is an existing technology.

[0021] Figure 2 shows an example of a system configuration in which a DDS is incorporated. Physically, Figure 2 shows a configuration in which multiple nodes (computers) connected to sensors and control valves are connected to a logical bus-type network.

[0022] Nodes 1 and 2 are each connected to a sensor and equipped with an APP that generates the data to be published and a DDS. Nodes 2 and 3 are each connected to a control valve and equipped with an APP that utilizes the subscribed data and a DDS.

[0023] The example in Figure 2 shows a Pub / Sub configuration with redundant QoS settings achieved using DDS. Specifically, the DDS on node 1 configures the primary Pub and secondary Pub 1, while the DDS on node 2 configures secondary Pub 2. The DDS on node 3 configures Subs 1 and 2, and the DDS on node 4 configures Sub 3.

[0024] In the example in Figure 2, the APP is written in Python and the DDS is written in C++, but these are just examples and any programming language can be used. Also, when changing the Pub / Sub configuration, some things, such as QoS, can be changed dynamically, while others require a process restart (including program modifications).

[0025] Hereinafter, examples will be described as examples of the technology according to the present embodiment.

[0026] (Example of system configuration that serves as the base for this embodiment) Next, an example of a communication system that serves as the base of this embodiment will be described. In the communication system that serves as the base of this embodiment, one node may belong to multiple domains. Furthermore, one node may have multiple Pub / Subs. Note that here, Pub refers to an application that generates data to be published, and Sub refers to an application that utilizes subscribed data. Functions related to Pub / Sub communication are handled by DDS.

[0027] Furthermore, both Pub and Sub may exist in one node, or Pub and Sub across multiple domains may exist in one node. Furthermore, multiple Pubs or multiple Subs may exist in one APP. Furthermore, each Pub and each Sub in the same APP are identifiable. Furthermore, in the communication system of this embodiment, communication is in plaintext.

[0028] 3 shows an example of the configuration of a communication system that serves as the base of this embodiment. As shown in FIG. 3, this communication system includes nodes 10 to 18, L2SWs (Layer 2 switches) 20 and 21, an L3SW (Layer 3 switch) 30, a packet analysis device 40, and a detection unit 50.

[0029] In the example of Figure 3, nodes 10, 11, 12, 15, 16, and 17 belong to domain D1, and nodes 12, 13, 17, and 18 belong to domain D2. The domain to which the node belongs is indicated, for example, D1 in "DDS_D1" of node 10. Nodes 12 and 17 belong to both domain D1 and domain D2.

[0030] For example, in node 10, "Pub1 (APP I)" is an application that publishes data for topic [I] and functions as Pub1 (Publisher 1) in Pub / Sub communication. In node 10, there are two pubs, Pub1 (APP I) and Pub2 (APP I). This indicates that although there is only one APP, it functions as two pubs due to the functionality of DDS. The same is true for Sub, as shown in node 15.

[0031] Node 11 has both a Pub and a Sub, Pub 3 and Sub 4. Nodes 12 and 14 have multiple APPs functioning as multiple Pubs, and nodes 17 and 18 have multiple APPs functioning as multiple Subs.

[0032] 3, Pub1 (APP I) to Pub4 (APP I) exist, and Pub "APP I" is made redundant. Similarly, Pub5 (APP R) to Pub6 (APP R) exist, and Pub "APP R" is also made redundant.

[0033] Furthermore, the L3SW 30 is connected to the Internet 55, and each node can communicate with the Internet 55. Furthermore, a packet analysis device 40 is connected to the L2SWs 20 and 21, and a detection unit 50 can perform anomaly detection based on the packet analysis results.

[0034] (Outline of this Example) For example, consider a case where a certain topic is redundantly shared among three pubs (pub 1, pub 2, and pub 3), and each of the subs (subs 1, 2, and 3) treats pub 1 as the priority pub. In this case, data is distributed to each sub from pub 1, pub 2, and pub 3, but only data distributed from pub 1 is passed to the sub's app.

[0035] The basic functionality of DDS allows each Sub to switch its preferred Pub to the second or third Pub if a failure occurs in the first Pub. However, as mentioned above, if the first Pub is taken over by a third party and begins sending fraudulent data (such as data intended to attack the Sub), the basic functionality of DDS cannot switch its preferred Pub to the second or third Pub.

[0036] In this embodiment, a mechanism is provided that allows the priority pub to be switched when the priority pub is sending data with fraudulent content (hereinafter referred to as fraudulent data). Figure 4 shows an overview of this mechanism. The example in Figure 4 shows how the priority pub, Pub 1, is switched to Pub 3 when the priority pub, Pub 1, is hijacked by a cyber attack and is sending fraudulent data. This switching allows each Sub to pass data delivered from Pub 3 to the App.

[0037] (System configuration example in this embodiment) Fig. 5 shows an example of the configuration of a communication system in this embodiment. As shown in Fig. 5, in addition to the base communication system shown in Fig. 3, each node is provided with a DDS operation function unit, and also has a configuration management unit 60 and a handling unit 70. The DDS operation function unit realizes the function of switching the priority pub in response to an instruction from the handling unit 70. Fig. 5 shows an example in which nodes 10 to 18 are provided with DDS operation function units 101 to 109, respectively. Hereinafter, when there is no need to distinguish between nodes, they will be referred to as DDS operation function unit 100.

[0038] The configuration management unit 60 manages configuration information (network configuration information) of the communication system, and the handling unit 70 executes processing to switch the priority pub in response to detection of fraudulent data by the detection unit 50. At this time, the handling unit 70 uses the configuration information to determine which of the redundant pubs will be the priority pub. The detection unit 50, configuration management unit 60, and handling unit 70 may be included in the packet analysis device 40, or may be included in a device different from the packet analysis device 40. In this embodiment, it is assumed that the packet analysis device 40 includes the detection unit 50, configuration management unit 60, and handling unit 70.

[0039] (About configuration management) The configuration information of the communication system must be managed in the configuration management unit 60. Such configuration information may be created and managed by any method, but in this embodiment, the configuration information is created and managed by combining multiple pieces of relationship information that can be created from the communications (traffic) flowing between nodes.

[0040] Three types of relationship information are created: an "IP relationship layer," a "participant relationship layer," and a "Pub / Sub relationship layer," which represent the topology of the horizontal axis of the network. The IP relationship layer and the participant relationship layer are associated, and the participant relationship layer and the Pub / Sub relationship layer are associated, so all three layers are ultimately associated, and by combining these three layers, a "composite layer" is obtained that represents the topology of the vertical axis of the network. Configuration information is managed by retaining multiple generations of this composite layer. Note that a generation refers to a division, for example, based on a certain time period or event. However, retaining multiple generations is not required; for example, it is possible to retain only the most recent generation.

[0041] Figure 6 shows examples of the IP relationship layer, participant relationship layer, Pub / Sub relationship layer, and composition layer. As shown in Figure 6, the IP relationship layer is represented by a graph structure with IP addresses as vertices and IP-level data transmission / reception relationships as branches. In the IP relationship layer, a branch between vertices indicates a data transmission / reception relationship between the nodes having the IP addresses represented by that vertex. Note that a single node may have multiple IP addresses (for example, a unicast IP address and a multicast IP address). The participant relationship layer represents the GUID held by a node with a single symbol (a triangle or inverted triangle symbol), and each symbol indicates the domain to which each GUID belongs and whether it is a Pub or Sub. The Pub / Sub relationship layer represents the GUID held by a node as vertices and the relationship of whether or not the nodes belong to the same topic as branches, indicating the relationship between the topics to which each GUID belongs. The participant relationship layer is also represented by a graph structure with the above symbols (a triangle or inverted triangle symbol) as vertices. In the example of Figure 6, the graph structure representing the participant relationship layer does not have branches, but it may also be represented by connecting vertices belonging to the same domain with branches, for example.

[0042] The Pub / Sub relationship layer can be created using information obtained from data distribution communications, and the participant relationship layer can be created using information obtained from DDS operational communications. On the other hand, the IP relationship layer can be created using information obtained from both data distribution communications and DDS operational communications. Note that DDS operational communications include communications performed when a node participates in Pub / Sub communications, communications performed when searching for other nodes, and communications performed when agreeing on distribution content.

[0043] In the IP relationship layer, one vertex is associated with a 5-tuple (src / dst IP address, src / dst port number, protocol number) containing the IP address of the node. In the participant relationship layer, one symbol (triangle or inverted triangle symbol) is associated with a GUID and a port number. In the Pub / Sub relationship layer, one vertex is associated with a GUID and a topic name. A GUID is an identifier used in DDS, and is generated from an IP address, port number, etc. Note that one node may have multiple GUIDs (for example, if one node functions as both a pub and sub, or if one node belongs to multiple domains or multiple topics).

[0044] Therefore, it is possible to associate the IP-related layer and the participant-related layer with a port number, and it is possible to associate the participant-related layer and the Pub / Sub-related layer with a GUID. By combining these three layers through these associations, a composite layer is obtained as the network configuration information for a communication system that performs Pub / Sub communication. This composite layer is retained, for example, for multiple generations.

[0045] Here, when we focus on a certain node in the composition layer, this node corresponds to one or more vertices (5-tuples including an IP address) in the IP relation layer, and each of these one or more vertices is associated with one or more vertices (port number and GUID) in the participant relation layer. Also, each of the one or more vertices in the participant relation layer is associated with zero or more vertices (GUID and topic name) in the Pub / Sub relation layer. In other words, in the composition layer, for each node, a tree structure is obtained with the node as the vertex (a tree structure with the IP address at the top level, the port number at the next level, the GUID at the next level, and the topic name at the last level), and this tree structure represents the vertical axis topology.

[0046] (Configuration example of each part in this embodiment) In this embodiment, a mechanism is provided that uses the above configuration information to switch the priority pub when the priority pub is sending invalid data.

[0047] Fig. 7 shows an example of the configuration of the detection unit 50. As shown in Fig. 7, the detection unit 50 has an incorrect data occurrence detection unit 510. The operation of the incorrect data occurrence detection unit 510 will be described in the sequence section below.

[0048] Fig. 8 shows an example of the configuration of the configuration management unit 60. As shown in Fig. 8, the configuration management unit 60 has a relationship recording unit 610 in which at least one generation of configuration information (IP relationship layer, participant relationship layer, Pub / Sub relationship layer, and composition layer) is recorded. It is assumed that the configuration information is created in advance and recorded in the relationship recording unit 610.

[0049] Fig. 9 shows an example of the configuration of the handling unit 70. As shown in Fig. 9, the handling unit 70 has a switching candidate selection unit 710, a switching instruction output unit 720, and a switching candidate selection condition recording unit 730. The operation of each of these units will be explained in the sequence section described later.

[0050] Fig. 10 shows an example of the configuration of the DDS operation function unit 100. As shown in Fig. 10, the DDS operation function unit 100 has a switching unit 110. The operation of the switching unit 110 will be explained in the sequence section described later.

[0051] In this embodiment, the occurrence of invalid data is detected by the above-mentioned components, and the Pub to be given priority on the Sub side is switched in response to this detection.

[0052] (Example of sequence in this embodiment) Next, an example of the operation of the communication system in this embodiment will be described with reference to the sequence diagram of FIG.

[0053] The fraudulent data occurrence detection unit 510 detects the occurrence of fraudulent data in the communication system and the location of the occurrence (i.e., the Pub that transmitted the fraudulent data) (S101). Fraudulent data is data with fraudulent content (i.e., data with content that is not originally intended). Examples of fraudulent data include data sent by a Pub that has been hijacked by a malicious third party with the purpose of attacking a Sub, numerical data that is not originally intended to be transmitted by a Pub-side APP, and data with content that cannot be properly recognized even when received by a Sub-side APP. The occurrence of such fraudulent data and the detection of its location are performed using existing technology.

[0054] The fraudulent data occurrence detection unit 510 notifies the switching candidate selection unit 710 of the location where the fraudulent data occurred (i.e., the Pub that transmitted the fraudulent data) (S102). The switching candidate selection unit 710 searches for switching conditions from the switching candidate selection condition recording unit 730 based on the location of the fraudulent data, and acquires the corresponding switching conditions as the search results (S103 to S104).

[0055] Here, the switching candidate selection condition recording unit 730 records switching conditions for switching a pub transmitting invalid data to another pub in the redundant configuration. Such switching conditions may be recorded, for example, for each pub, for each domain or topic, or for each other information (e.g., GUID, etc.).

[0056] There are various possible switching conditions, including the following:

[0057] Switch to a Pub that has been designated in advance as a switching target among other Pubs in the redundant configuration. When this switching condition is used, it is not necessary to execute the processes of S105 to S107 described below.

[0058] Switch to another pub in the redundant configuration on a different node from the pub sending the invalid data.

[0059] Switch to a pub in the redundant configuration that is on a different node from the pub sending the invalid data and that is on the node with the least amount of distributed data.

[0060] However, the above switching conditions are only examples, and various conditions can be adopted as long as they are conditions for switching to another Pub in the redundant configuration.

[0061] Next, the switching candidate selection unit 710 searches for switching candidate pubs using the configuration information recorded in the relationship recording unit 610 and displays the search results (S105-S106). Here, the switching candidate pubs can be found by searching for pubs that deliver data on the same topic as the pub sending the invalid data (i.e., other redundant pubs) that satisfy the above switching conditions. Here, it is assumed that one or more pubs that satisfy these switching conditions are found.

[0062] Next, the switching candidate selection unit 710 determines a switching destination pub from the one or more pubs found above (S107). This may be determined randomly from the one or more pubs found above, or may be determined using some criteria (for example, a predetermined order among the pubs in the redundant configuration).

[0063] Next, the switching candidate selection unit 710 transmits a command generation instruction to the switching instruction output unit 720 to set the switching destination Pub determined above as the priority Pub (S108). Upon receiving the command generation instruction, the switching instruction output unit 720 generates a command (hereinafter, a switching command) to set the switching destination Pub determined above in S107 as the priority Pub, and transmits it to the switching unit 110 (S109). Note that the switching candidate selection unit 710 transmits switching commands to both the switching unit 110 of the switching destination Pub and the Sub that receives data from this switching destination Pub. However, the content of the switching command may be different between the switching destination Pub and the Sub that receives data from this switching destination Pub.

[0064] Then, when the switching unit 110 receives the switching command, it executes the switching command to the DDS (S110). At this time, it may also restart the process as needed. As a result, the priority pub is switched from the pub sending the invalid data to the switching destination pub.

[0065] Here, there are several possible specific methods for making the switching destination Pub the priority Pub, and for example, any of the following methods (1) to (3) is possible.

[0066] (1) Set the OWNERSHIP_STRENGTH value of the target pub to a value higher than that of the current preferred pub.

[0067] (2) Instruct the candidate Pub and all Subs receiving data sent from the current preferred Pub to stop their current processes and run a program with the Ownership setting changed from Exclusive to Shared.

[0068] (3) The switch candidate pub and all subs receiving data from the current priority pub are instructed to stop sending and receiving the topic name that was used when the occurrence of invalid data was detected, change it to the topic name of the switch candidate, and execute the program. At this time, key information may also be set to recognize the switch candidate as the only distribution destination.

[0069] While the above method (1) allows for rapid response to the detection of the occurrence of fraudulent data, there is a risk that the Sub may receive fraudulent data again if the OWNERSHIP_STRENGTH value of the Pub sending the fraudulent data is set to a higher value. In contrast, the above methods (2) and (3) are less rapid than the above method (1), but after the response is made, the Sub will not receive fraudulent data again. Therefore, which of the above methods (1) to (3) to adopt can be determined appropriately, taking into account factors such as the rapidity of the response. Alternatively, for example, the method (1) may be temporarily used to respond, and then the method (2) or (3) may be used to respond.

[0070] (Example of hardware configuration) The node having the DDS operation function unit 100 in this embodiment and the packet analysis device 40 having the detection unit 50, configuration management unit 60, and response unit 70 can be realized, for example, by having a computer execute a program that describes the processing content described in this embodiment.

[0071] The above program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The above program can also be provided via a network such as the Internet or email.

[0072] Fig. 12 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 12 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, and an output device 1008, all of which are interconnected via a bus B.

[0073] A program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0074] The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions of each of the above-mentioned units in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations. Note that the node or packet analysis device 40 may not have either or both of the display device 1006 and the input device 1007.

[0075] (Effects of the embodiment) According to the technology of this embodiment, it becomes possible to switch the Pub to be given priority on the Sub side in response to the occurrence of invalid data.

[0076] (Summary of the embodiment) This specification discloses at least the following communication systems, switching devices, switching methods, and programs. (Section 1) A communication system for communicating among multiple nodes using a brokerless publish / subscribe model, an unauthorized data occurrence detection unit that detects unauthorized data being distributed from one application that is given priority on the subscriber side among one or more applications that function as publishers and are redundantly configured on one or more of the nodes; a switching unit that switches an application that is given priority on the subscriber side to another application different from the one application among the one or more applications when distribution of the unauthorized data is detected; A communication system having: (Section 2) a determination unit that determines the other application to be preferentially handled on the subscriber side based on a predetermined switching condition and configuration information that represents a network configuration of the communication system; The switching unit is 2. The communication system according to claim 1, wherein, when the distribution of the fraudulent data is detected, the application that is given priority on the subscriber side is switched to the other application determined by the determination unit. (Section 3) The switching condition is: A communication system as described in paragraph 2, wherein the condition indicates that an application on a node different from the one application among the one or more applications will be treated as an application given priority by the subscriber, or a condition indicates that an application on a node different from the one application and having the least amount of distribution data among the one or more applications will be treated as an application given priority by the subscriber. (Section 4) A switching device connected to a plurality of nodes that communicate using a brokerless publish / subscribe model, an unauthorized data occurrence detection unit that detects unauthorized data being distributed from one application that is given priority on the subscriber side among one or more applications that function as publishers and are redundantly configured on one or more of the nodes; a switching instruction unit that, when the distribution of the unauthorized data is detected, transmits an instruction to switch the application that is given priority on the subscriber side to another application different from the one application among the one or more applications; A switching device having: (Section 5) a determination unit that determines the other application to be preferentially handled on the subscriber side based on a predetermined switching condition and configuration information that represents a network configuration of the communication system made up of the plurality of nodes, The switching instruction unit The switching device described in paragraph 4, which, when the distribution of the fraudulent data is detected, sends an instruction to switch the application that is given priority on the subscriber side to the other application determined by the determination unit. (Section 6) The switching condition is: A switching device as described in paragraph 5, wherein the condition indicates that an application on a node different from the one application among the one or more applications will be treated as an application given priority on the subscribing side, or a condition indicates that an application on a node different from the one application and having the least amount of distribution data among the one or more applications will be treated as an application given priority on the subscribing side. (Section 7) A switching device connected to a plurality of nodes communicating in a brokerless publish / subscribe model, an invalid data occurrence detection step for detecting that invalid data is being distributed from one application that is given priority on the subscriber side among one or more applications that are redundantly configured on one or more of the nodes and function as a publisher; a switching instruction step of transmitting an instruction to switch an application that is given priority on the subscriber side to another application different from the one application among the one or more applications when the distribution of the unauthorized data is detected; A switching method to perform the above. (Section 8) A program that causes a computer to function as the switching device according to any one of claims 4 to 6.

[0077] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0078] 10 to 18 nodes 20, 21 L2SW 30 L3SW 40 Packet analyzer 50 Detection unit 55 Internet 60 Configuration Management Department 70 Response Department 100 DDS operation function section 110 Switching section 510 Incorrect data occurrence detection unit 610 Relationship Records Department 710 Switching candidate selection unit 720 Switching instruction output unit 730 Switching candidate selection condition recording section 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. A communication system for communicating among a plurality of nodes using a brokerless publish / subscribe model, an invalid data occurrence detection unit that detects invalid data being distributed from one application that is given priority on the subscriber side among one or more applications that are redundantly configured on one or more of the nodes and function as a publisher; a determining unit that determines another application to be given priority on the subscriber side when the distribution of the unauthorized data is detected; a switching unit that switches the application that is given priority on the subscription side to the determined other application; and The determination unit Among the one or more applications, an application on a node different from the one application and on a node with the least amount of distribution data is determined as another application to be given priority by the subscriber side; The switching unit is performing a first switching operation for temporarily switching the application that is given priority on the subscription side to the other application, and then performing a second switching operation or a third switching operation for fully switching to the other application; the first switching includes switching the application that is given priority on the subscribing side to the other application by setting a value of a parameter that indicates the strength of ownership of data of the other application to a value higher than the value of the parameter of the one application; the second switching includes stopping processes of the other application and the application receiving data from the one application, changing settings related to data ownership, and then re-executing the other application and the application receiving data from the one application, thereby switching the application that is given priority on the subscribing side to the other application; The third switching is a communication system in which the application that is given priority on the subscribing side is switched to the other application by stopping the distribution and reception of the topic name that was used when the distribution of the fraudulent data was detected for the other application and the application receiving data from the one application, changing it to the topic name of the other application, and re-executing the other application and the application receiving data from the one application.

2. The determination unit The communication system according to claim 1 , wherein the other applications to be given priority on the subscriber side are determined based on configuration information representing a network configuration of the communication system.

3. A switching device connected to a plurality of nodes that communicate using a brokerless publish / subscribe model, comprising: an invalid data occurrence detection unit that detects invalid data being distributed from one application that is given priority on the subscriber side among one or more applications that are redundantly configured on one or more of the nodes and function as a publisher; a determining unit that determines another application to be given priority on the subscriber side when the distribution of the unauthorized data is detected; a switching instruction unit that transmits an instruction to switch the application that is given priority on the subscription side to the determined other application; and The determination unit Among the one or more applications, an application on a node different from the one application and on a node with the least amount of distribution data is determined as another application to be given priority by the subscriber side; The switching instruction unit transmitting a first switching instruction for temporarily switching the application that is given priority on the subscribing side to the other application, and then transmitting a second switching instruction or a third switching instruction for fully switching to the other application; the first switching instruction is a switching instruction for switching an application that is given priority on the subscribing side to the other application by setting a value of a parameter that indicates the strength of ownership of data of the other application to a value higher than the value of the parameter of the one application; the second switching instruction is a switching instruction for stopping processes of the other application and the application receiving data from the one application, changing settings related to data ownership, and then re-executing the other application and the application receiving data from the one application, thereby switching the application that is given priority on the subscribing side to the other application; The third switching instruction is a switching instruction for switching the application that is given priority on the subscribing side to the other application by stopping the distribution and reception of the topic name that was used when the distribution of the unauthorized data was detected for the other application and the application receiving data from the one application, changing it to the topic name of the other application, and re-executing the other application and the application receiving data from the one application, the switching device.

4. The determination unit 4. The switching device according to claim 3, wherein the other application to be preferentially handled on the subscriber side is determined based on configuration information representing a network configuration of the communication system made up of the plurality of nodes.

5. A switching device connected to a plurality of nodes communicating in a brokerless publish / subscribe model, an invalid data occurrence detection step for detecting that invalid data is being distributed from one application that is given priority on the subscriber side among one or more applications that are redundantly configured on one or more of the nodes and function as a publisher; a decision procedure for determining, if the distribution of the fraudulent data is detected, other applications to be given priority at the subscriber side; a switching instruction step of transmitting an instruction to switch the application that is given priority on the subscriber side to the determined other application; Run The determination procedure includes: Among the one or more applications, an application on a node different from the one application and on a node with the least amount of distribution data is determined as another application to be given priority by the subscriber side; The switching instruction procedure includes: transmitting a first switching instruction for temporarily switching the application that is given priority on the subscribing side to the other application, and then transmitting a second switching instruction or a third switching instruction for fully switching to the other application; the first switching instruction is a switching instruction for switching an application that is given priority on the subscribing side to the other application by setting a value of a parameter that indicates the strength of ownership of data of the other application to a value higher than the value of the parameter of the one application; the second switching instruction is a switching instruction for stopping processes of the other application and the application receiving data from the one application, changing settings related to data ownership, and then re-executing the other application and the application receiving data from the one application, thereby switching the application that is given priority on the subscribing side to the other application; The third switching instruction is a switching instruction to switch the application that is given priority on the subscribing side to the other application by stopping the distribution and reception of the topic name that was used when the distribution of the unauthorized data was detected for the other application and the application receiving data from the one application, changing it to the topic name of the other application, and re-executing the other application and the application receiving data from the one application.

6. A program that causes a computer to function as the switching device according to claim 3 or 4.

Images