Monitoring system, monitoring method, and program

Abstract

To provide a monitoring system, a monitoring method, and a program which monitor whether or not a computer is operated normally, with suppressing leakage of information dealt by the computer.SOLUTION: In a monitoring system including a target device, a plurality of management apparatus, and a monitoring apparatus, the target device includes: a processing data acquiring unit for reading out processing data; and a concealing unit for generating a plurality of confidential data obtained by concealing the processing data by secret distribution. The management apparatus includes: a confidential data acquiring unit for acquiring one of the plurality of confidential data; a detection formula acquiring unit for acquiring one of a plurality of confidential detection formulae generated by concealing the confidential detection formula by secret distribution; a collation unit for carrying out processing for collating the confidential detection formula and the confidential data; and a collation result transmitting unit for transmitting, to the monitoring apparatus, collation data as a result of the collation processing. The monitoring apparatus includes a monitoring result generating unit for generating a monitoring result indicating whether or not the processing data is abnormal, by decoding the collation data acquired from the respective management apparatus.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a monitoring system, a monitoring method, and a program.

Background Art

[0002] There is known a system for determining whether a person shown in an image is a suspicious person. For example, in Patent Document 1, there is described a collation device that acquires, from a monitoring device, anonymized media information in which characteristic portions of a visitor shown in an image are anonymized, collates the acquired anonymized media information with registered anonymized media information, and outputs the collation result to the monitoring device. According to Patent Document 1, since the anonymized information is transmitted to the collation device, it is possible to determine whether a person shown in an image is a suspicious person while keeping information that can identify an individual anonymized.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Here, not only the person shown in the image but also the computer to be monitored is required to be monitored for whether it is operating normally while suppressing leakage of information handled by the computer.

[0005] The present disclosure solves the above-described problems, and an object thereof is to provide a monitoring system, a monitoring method, and a program that can monitor whether a computer to be monitored is operating normally while suppressing leakage of information handled by the computer.

Means for Solving the Problems

[0006] The monitoring system relating to this disclosure is a monitoring system including a target device which is a computer to be monitored, a plurality of management devices, and a monitoring device, wherein the target device includes a processing data acquisition unit that reads processing data which is data that can be defined by a string output from the target device, and a concealment unit that conceals the processing data by secret sharing to generate a plurality of concealed data, the management device includes a concealed data acquisition unit that acquires one of the plurality of concealed data, a detection formula acquisition unit that acquires one of a plurality of concealed detection formulas generated by concealing a detection formula for checking whether there is an abnormality in the processing data by secret sharing, a matching unit that performs a matching process between the concealed detection formula and the concealed data, and a matching result transmission unit that transmits the matching data which is the result of the matching process to the monitoring device, and the monitoring device includes a monitoring result generation unit that generates a monitoring result indicating whether there is an abnormality in the processing data by decrypting the matching data acquired from each of the management devices.

[0007] The monitoring method relating to this disclosure is a monitoring method for a target device, which is a computer to be monitored, and includes the steps of: reading processing data, which is data definable by a string, output by the target device; generating a plurality of confidential data by secret sharing the processing data by the target device; transmitting the confidential data to each of a plurality of management devices; obtaining a plurality of confidential detection formulas, which are generated by concealing detection formulas for checking whether there is an abnormality in the processing data, by the management device; performing a matching process between the confidential detection formulas and the confidential data by the management device; transmitting matching data, which is the result of the matching process, to the monitoring device; and generating a monitoring result indicating whether there is an abnormality in the processing data by decrypting the matching data obtained from each of the management devices by the monitoring device.

[0008] The program relating to this disclosure is a program that causes a computer to perform a monitoring method for a target device, which is a computer to be monitored, and causes the computer to perform the following steps: reading processing data, which is data definable by a string, output by the target device; the target device concealing the processing data by secret sharing to generate a plurality of concealed data; transmitting the concealed data to each of a plurality of management devices; the management device obtaining a plurality of concealed detection formulas, which are generated by concealing detection formulas for checking whether there is an abnormality in the processing data; the management device performing a comparison process between the concealed detection formulas and the concealed data; transmitting the comparison data, which is the result of the comparison process, to the monitoring device; and the monitoring device decrypting the comparison data obtained from each of the management devices to generate a monitoring result indicating whether there is an abnormality in the processing data. [Effects of the Invention]

[0009] According to this disclosure, it is possible to monitor whether the monitored computer is operating normally while suppressing the leakage of information handled by the computer. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 is a schematic block diagram of the monitoring system according to this embodiment. [Figure 2] Figure 2 is a schematic block diagram of the target device. [Figure 3] Figure 3 is a schematic block diagram of the control device. [Figure 4] Figure 4 is a schematic block diagram of the monitoring device. [Figure 5] Figure 5 is a flowchart illustrating the processing flow of the target device. [Figure 6] Figure 6 is a flowchart illustrating the processing flow of the monitoring process. [Modes for carrying out the invention]

[0011] Preferred embodiments of the present disclosure will be described in detail below with reference to the attached drawings. However, this disclosure is not limited to these embodiments, and where there are multiple embodiments, they may also be combinations of these embodiments.

[0012] (Monitoring system) Figure 1 is a schematic block diagram of the monitoring system according to this embodiment. The monitoring system 1 according to this embodiment is a system that monitors whether there is an abnormality in the operation of the target device 10 to be monitored. As shown in Figure 1, the monitoring system 1 includes the target device 10, a plurality of management devices 12, and a monitoring device 14. In the example of Figure 1, there is one target device 10 to be monitored, but the number of target devices 10 may be multiple, and the monitoring system 1 may monitor multiple target devices 10. Also, in the example of Figure 1, there are three management devices 12A, 12B, and 12C, but the number of management devices 12 is not limited to that. The number of management devices 12 may be two or more, but it is preferable to have three or more. In addition, in this embodiment, the monitoring device 14 is installed at a location separate from the target device 10 and the management devices 12 (in a different facility), and the management entity of the monitoring device 14 is different from the management entity of the target device 10 and the management devices 12. Furthermore, the target device 10 and the management device 12 may be located in separate locations (different facilities), and the managing entity for the target device 10 and the managing entity for the management device 12 may be different. However, the managing entity for the target device 10 and the managing entity for the management device 12 may be the same.

[0013] (Target device) Figure 2 is a schematic block diagram of the target device. The target device 10 is a computer that performs information processing and is the device that is monitored by the monitoring system 1. As shown in Figure 2, the target device 10 has a communication unit 20, a storage unit 22, and a control unit 24. The target device 10 may be a standalone device, may be integrated with other devices, or may be configured as a system combining various devices such as an arithmetic unit and a data server, and is not particularly limited. The target device 10 may also have an input unit that accepts user input and an output unit that outputs information. The input unit may be a mouse, keyboard, touch panel, etc., and the output unit may be a display that displays images, etc.

[0014] The communication unit 20 is a communication module that communicates with external devices, such as an antenna. The target device 10 communicates with external devices wirelessly, but it may also use wired communication, and the communication method is arbitrary. The storage unit 22 is a memory that stores various information such as processing data described later, calculation contents of the control unit 24, and programs, and includes at least one of the following: RAM (Random Access Memory), main memory such as ROM (Read Only Memory), and external memory such as HDD (Hard Disk Drive). The program for the control unit 24 stored in the storage unit 22 may be stored on a recording medium that the target device 10 can read.

[0015] The control unit 24 is an arithmetic unit and includes an arithmetic circuit such as a CPU (Central Processing Unit). The control unit 24 includes a processing unit 30, a processing data acquisition unit 32, a concealment unit 34, and a concealed data transmission unit 36. The control unit 24 reads a program (software) from the storage unit 22 and executes it to realize the processing unit 30, the processing data acquisition unit 32, the concealment unit 34, and the concealed data transmission unit 36, and executes their processing. Note that the control unit 24 may execute these processes by one CPU, or may include a plurality of CPUs and execute the processes with these plurality of CPUs. Also, at least a part of the processes of the processing unit 30, the processing data acquisition unit 32, the concealment unit 34, and the concealed data transmission unit 36 may be realized by a hardware circuit.

[0016] The details of the processing by the control unit 24 will be described later.

[0017] (Management device) FIG. 3 is a schematic block diagram of the management device. The management device 12 is a computer and can also be said to be a server that stores the concealed processing data, which will be described later, transmitted from the target device 10. As shown in FIG. 3, the management device 12 has a communication unit 40, a storage unit 42, and a control unit 44. Note that the management device 12 may be configured as a single device, may be configured integrally with another device, or may be configured as a system combining various devices such as an arithmetic device and a data server, and is not particularly limited. Also, the management device 12 may have an input unit that receives user input and an output unit that outputs information. Here, the configuration of one management device 12 will be described, but other management devices 12 have the same configuration.

[0018] The communication unit 40 is a communication module that communicates with external devices, such as an antenna. The management device 12 communicates with external devices via wireless communication, but wired communication may also be used, and the communication method may be arbitrary. The storage unit 42 is a memory that stores various types of information such as the anonymization processing data described later, the calculation content of the control unit 44, and programs, and includes at least one of, for example, a main storage device such as a RAM and a ROM, and an external storage device such as an HDD. The program for the control unit 44 stored in the storage unit 42 may be stored in a recording medium readable by the management device 12.

[0019] The control unit 44 is an arithmetic device and includes an arithmetic circuit such as a CPU. The control unit 44 includes a private data acquisition unit 50, a detection formula acquisition unit 52, a verification unit 54, and a verification result transmission unit 56. The control unit 44 reads and executes a program (software) from the storage unit 42 to realize the private data acquisition unit 50, the detection formula acquisition unit 52, the verification unit 54, and the verification result transmission unit 56, and executes their processes. Note that the control unit 44 may execute these processes by one CPU, or may include a plurality of CPUs and execute the processes with these plurality of CPUs. Also, at least a part of the processes of the private data acquisition unit 50, the detection formula acquisition unit 52, the verification unit 54, and the verification result transmission unit 56 may be realized by a hardware circuit.

[0020] The details of the processing by the control unit 44 will be described later.

[0021] (Monitoring device) FIG. 4 is a schematic block diagram of the monitoring device. The monitoring device 14 is a computer and is a device that monitors the target device 10. As shown in FIG. 4, the monitoring device 14 includes a display unit 60, a communication unit 62, a storage unit 64, and a control unit 66. Note that the monitoring device 14 may be configured as a single device, may be configured integrally with other devices, or may be configured as a system combining various devices such as an arithmetic device and a data server, and is not particularly limited. Also, the monitoring device 14 may have an input unit that receives user input.

[0022] The display unit 60 is a display that shows information. The communication unit 62 is a communication module that communicates with external devices, such as an antenna. The monitoring device 14 communicates with external devices wirelessly, but it may also use wired communication, and the communication method is arbitrary. The storage unit 64 is a memory that stores various information such as the calculation contents and programs of the control unit 66, and includes at least one of the following: RAM, main memory such as ROM, and external storage device such as HDD. The program for the control unit 66 stored in the storage unit 64 may be stored on a recording medium that the monitoring device 14 can read.

[0023] The control unit 66 is an arithmetic unit and includes arithmetic circuits such as a CPU. The control unit 66 includes a matching request unit 70, a detection type setting unit 72, a monitoring result generation unit 74, and a monitoring result output unit 76. The control unit 66 reads a program (software) from the storage unit 64 and executes it to realize the matching request unit 70, the detection type setting unit 72, the monitoring result generation unit 74, and the monitoring result output unit 76, and executes their processing. The control unit 66 may execute these processes with a single CPU, or it may have multiple CPUs and execute the processing with those multiple CPUs. In addition, at least a part of the processing of the matching request unit 70, the detection type setting unit 72, the monitoring result generation unit 74, and the monitoring result output unit 76 may be realized with hardware circuits.

[0024] (Processing by the monitoring system) The following describes the processing of monitoring system 1.

[0025] (Processed data) The target device 10 executes predetermined information processing using the processing unit 30 and outputs processing data indicating the content of that information processing. The processing data can also be described as data indicating the history of executed information processing (data indicating the operation history of the target device 10). In other words, the processing data is data that can be defined as a string and is output from the target device 10. Examples of processing data include logs of operation data output from the target device 10 and logs of packet data used for communication with other devices. The data format of the processing data may be, for example, binary format. The processing unit 30 stores the processing data output from the target device 10, that is, the executed processing data used for information processing, in the storage unit 22. Each time the processing is executed, that is, each time processing data is output, the processing unit 30 sequentially stores that processing data in the storage unit 22.

[0026] (Reading processed data) The processing data acquisition unit 32 of the target device 10 reads the processing data input to the storage unit 22. In other words, the processing data acquisition unit 32 reads the completed processing data used for information processing by the processing unit 30.

[0027] (Anonymization process) The security unit 34 of the target device 10 secures the processing data read by the processing data acquisition unit 32 by secret sharing to generate multiple secure data pieces D. Secret sharing is a method of encrypting and dividing the data to be secured (in this case, processing data) into multiple secure data pieces D. For example, the method shown in ISO / IEC 19592-2 may be used. In other words, secure data pieces D are data obtained by secret sharing the processing data, and are encrypted so that the processing data cannot be decrypted from a single secure data piece D. The security unit 34 may use any method for secret sharing, but in this embodiment, the replication-additive secret sharing method shown in ISO / IEC 19592-2 is used to secure the processing data and generate multiple secure data pieces D. The number of secure data pieces D generated from the processing data may be any number of two or more, but it is preferable to have three or more. The number of secure data pieces D is preferably less than or equal to the number of management devices 12, for example.

[0028] (Transmission of confidential data) The confidential data transmission unit 36 ​​of the target device 10 transmits each generated confidential data D to the management device 12. The confidential data transmission unit 36 ​​transmits separate confidential data D to each management device 12. That is, for example, as shown in the example in Figure 1, if three confidential data DA, DB, and DC are generated from one processing data, the confidential data transmission unit 36 ​​transmits confidential data DA to the management device 12A, confidential data DB to the management device 12B, and confidential data DC to the management device 12C. The confidential data transmission unit 36 ​​may also store each generated confidential data D in the storage unit 22.

[0029] The target device 10 may perform the processes described above (processing data reading process, processing data concealment process, and concealed data transmission process) sequentially, or it may perform these processes as a trigger, for example, when a command to perform the process is input by the user.

[0030] The processing flow of the target device 10 described above will now be explained. Figure 5 is a flowchart illustrating the processing flow of the target device. As shown in Figure 5, the target device 10 reads processing data using the processing data acquisition unit 32 (step S10), encrypts the read processing data using the encryption unit 34 to generate multiple encrypted data D (step S12), and transmits each encrypted data D to the management device 12 using the encrypted data transmission unit 36 ​​(step S14).

[0031] In this way, the target device 10 transmits the confidential data, which has already been concealed, to the management device 12 without transmitting the processing data itself to the management device 12 or the monitoring device 14. Therefore, the leakage of the contents of the processing data (information handled by the target device 10) can be suppressed.

[0032] (Acquisition of confidential data) The confidential data acquisition unit 50 of the management device 12 acquires (receives) confidential data D from the target device 10 and stores it in the storage unit 42. The confidential data acquisition unit 50 acquires one confidential data D from among multiple confidential data D generated by the target device 10 from one processing data. In this embodiment, the confidential data transmission unit 36 ​​of management device 12A receives confidential data DA, the confidential data transmission unit 36 ​​of management device 12B receives confidential data DB, and the confidential data transmission unit 36 ​​of management device 12C receives confidential data DC. It is preferable that each management device 12 does not acquire confidential data D transmitted to another management device 12. That is, for example, it is preferable that management device 12A does not acquire confidential data DB and DC. As a result, even if data in one management device 12 is leaked, multiple confidential data D will not be leaked, and the risk of processing data leakage can be reduced.

[0033] (Monitoring of target devices) As described above, the monitoring device 14 monitors whether the target device 10 is malfunctioning. Specifically, the monitoring device 14 monitors whether there are abnormalities in the processing data. That is, for example, if the operation of the target device 10 is abnormal, the processing data indicating that operation is often also abnormal. Therefore, by determining whether there are abnormalities in the processing data, the malfunction of the target device 10 can be monitored.

[0034] Whether there is an abnormality in the processed data can be confirmed by comparing (matching) the processed data with a detection formula used to check for abnormalities. However, in order for the monitoring device 14 to compare the processed data with the detection formula, the monitoring device 14 needs to acquire the processed data, which creates a risk of leakage of the processed data. Therefore, in this embodiment, the monitoring device 14 determines whether there is an abnormality in the processed data without directly using the processed data. This process will be described in detail below.

[0035] (Acquisition of trigger information and detection formula) The matching request unit 70 of the monitoring device 14 acquires trigger information, which is information that triggers the start of matching the processing data with the detection formula, and information about the detection formula to be used for matching. The matching request unit 70 may acquire the trigger information and the detection formula information using any event as a trigger. For example, the matching request unit 70 may acquire the trigger information and the detection formula information at predetermined intervals, or it may acquire the trigger information and the detection formula information when a command to request matching and the detection formula information are input by the user.

[0036] The detection expression acquired by the matching request unit 70 is a logical expression for checking whether there is an abnormality in the processing data. In this embodiment, the detection expression is an expression for checking whether a predetermined string is included in the processing data. An example of a detection expression is "curl.exe AND \\-F\\". In this example, the detection expression checks whether the processing data contains the string "curl.exe" AND the processing data contains the string "-F". However, the content of the detection expression may be arbitrary and may be set appropriately according to the type of abnormality to be detected. Also, the data format of the detection expression may be, for example, binary format.

[0037] In this embodiment, the detection expression consists of a string to be matched and a logical AND or logical OR. String matching is performed using exclusive OR (XOR). Because strings are matched using exclusive OR, the detection expression in this embodiment, among logical AND, logical OR, and exclusive OR (i.e., strings), has the most exclusive ORs. Note that the detection expression may include both logical AND and logical OR, or only one of them. For example, in the above detection expression, the logical expression determining whether the processing data contains the string "curl.exe" and the logical expression determining whether the processing data contains the string "F" are exclusive ORs, while AND is a logical AND. Therefore, in the above detection expression, there are two exclusive ORs and one logical AND, resulting in the most exclusive ORs. In this embodiment, for the detection expression with the largest number of exclusive OR operations, a replication-type additive secret sharing method is used, which can perform exclusive OR operations at high speed and reduce communication load. This allows for high-precision verification of whether there are anomalies in the processed data while keeping the computation load down. In other words, the replication-type additive secret sharing method is particularly suitable for detection expressions like the one in this embodiment.

[0038] (Detection method concealment) The detection formula setting unit 72 of the monitoring device 14 conceals an arbitrarily set detection formula by secret sharing to generate multiple concealed detection formulas F. The detection formula setting unit 72 conceals the detection formula by secret sharing using the same method as the secret sharing performed by the concealment unit 34 of the target device 10 to generate multiple concealed detection formulas F. In other words, in this embodiment, the detection formula setting unit 72 conceals the detection formula using a replication-type additive secret sharing method.

[0039] (Sending a matching request) The matching request unit 70 acquires trigger information and detection formula information, and when a confidential detection formula F is generated, it sends a matching request, which is a command requesting a matching process between the confidential data and the confidential detection formula F, and the generated confidential detection formula F to the management device 12. The detection formula setting unit 72 sends separate confidential detection formulas F to each management device 12. That is, for example, as shown in the example in Figure 1, the matching request unit 70 sends a matching request and a confidential detection formula FA, which has been confidentialized using the same method as the confidential data DA, to the management device 12A. The matching request unit 70 also sends a matching request and a confidential detection formula FB, which has been confidentialized using the same method as the confidential data DB, to the management device 12B. The matching request unit 70 also sends a matching request and a confidential detection formula FC, which has been confidentialized using the same method as the confidential data DC, to the management device 12C. The matching request unit 70 may also store each generated confidential detection formula F in the storage unit 64.

[0040] Furthermore, when a matching process using a detection formula used in the past is requested, the management device 12 and the monitoring device 14 may already have a confidential detection formula F stored for that detection formula. Therefore, the monitoring device 14 checks whether a confidential detection formula F generated from the same detection formula as the detection formula acquired this time is stored in the storage unit 64. If it is stored, it may send the matching request and information indicating the confidential detection formula F to be used for matching to the respective management device 12 without setting a new confidential detection formula F.

[0041] (Obtaining a matching request) The management device 12 receives a verification request from the monitoring device 14. Once a verification request is received, the management device 12 reads the confidential data D to be verified from the storage unit 42 using the confidential data acquisition unit 50, and obtains one confidential detection formula F to be used for verification using the detection formula acquisition unit 52. Furthermore, if a verification process using a detection formula that has not been used in the past is requested, the management device 12 receives the verification request and the confidential detection formula F from the monitoring device 14, and once it has received the verification request and the confidential detection formula F, it reads the confidential data D to be verified from the storage unit 42. Also, if a verification process using a detection formula that has been used in the past is requested, the management device 12 receives the verification request and information indicating the confidential detection formula F to be used for verification from the monitoring device 14. Once the management device 12 has received the verification request and information indicating the confidential detection formula F to be used for verification, it reads the confidential data D to be verified and the confidential detection formula F to be used for the current verification from the storage unit 42.

[0042] (Verification process) When a matching request is received and the confidential data D and confidential detection formula F are read out, the matching unit 54 of the management device 12 matches the confidential data D and confidential detection formula F and generates matching data E that shows the result of the matching. Since the matching data E is data that shows the result of matching the confidential data DA and confidential detection formula FA, it is not possible to decode the content of the processing data or the monitoring result indicating whether there is an abnormality in the processing data from a single matching data E.

[0043] In this embodiment, the matching unit 54 of the management device 12A matches the confidential data DA with the confidential detection type FA and generates matching data EA showing the matching result between the confidential data DA and the confidential detection type FA. The matching unit 54 of the management device 12B matches the confidential data DB with the confidential detection type FB and generates matching data EB showing the matching result between the confidential data DB and the confidential detection type FB. The matching unit 54 of the management device 12C matches the confidential data DC with the confidential detection type FC and generates matching data EC showing the matching result between the confidential data DC and the confidential detection type FC.

[0044] (Sending matching data) The matching result transmission unit 56 of the management device 12 transmits the matching data E generated by the matching unit 54 to the monitoring device 14. In the example in Figure 1, the matching result transmission unit 56 of management device 12A transmits the matching data EA to the monitoring device 14, the matching result transmission unit 56 of management device 12B transmits the matching data EB to the monitoring device 14, and the matching result transmission unit 56 of management device 12C transmits the matching data EC to the monitoring device 14. The matching result transmission unit 56 may also transmit time information indicating the time when the confidential data D, which is the source of the matching data E, was acquired to the monitoring device 14. The matching result transmission unit 56 may also transmit identification information (for example, an identifier such as the name or ID of the target device) that identifies the target device 10 that acquired the confidential data D to the monitoring device 14.

[0045] (Generating monitoring results) The monitoring result generation unit 74 of the monitoring device 14 acquires (receives) the matching data E from each management device 12. The monitoring result generation unit 74 may also receive time information indicating the time when the confidential data D was acquired. The monitoring result generation unit 74 generates a monitoring result, which is information indicating whether the processed data is abnormal, by performing a decryption process using the matching data E received from each management device 12. In other words, the monitoring result is data decrypted using each matching data E, and is information indicating the matching result between the detection formula and the processed data. The monitoring result does not include the content of the processed data, and can be said to be information that only indicates the matching result between the detection formula and the processed data. Here, since the confidential data D and the confidential detection formula F, which are the sources of the matching data E, are encrypted using the same secret sharing method, by collecting matching data E obtained by matching confidential data D and confidential detection formula F in numbers equal to the number of confidential data D (number of secret sharing instances), the matching data E can be decrypted, and information indicating the matching result between the detection formula and the processed data can be obtained.

[0046] The monitoring result output unit 76 of the monitoring device 14 outputs information of the monitoring results generated by the monitoring result generation unit 74. For example, the monitoring result output unit 76 may display the monitoring result information on the display unit 60, or it may transmit the monitoring result information to another device. In addition, the monitoring result output unit 76 may output time information indicating the time when the matching data E was acquired, and identification information of the target device 10, which is the source of the confidential data D, along with the monitoring result information. By outputting the time information and identification information, it becomes possible to identify, for example, the time period and device in which the abnormality occurred.

[0047] Thus, in this embodiment, when monitoring abnormalities in processing data, the monitoring device 14 obtains matching data E from each management device 12 and decodes the matching data E to obtain a monitoring result indicating an abnormality in processing data. Therefore, according to this embodiment, it is possible to monitor for abnormalities without transmitting processing data to the monitoring device 14, making it possible to monitor whether the target device 10 is operating normally while suppressing the leakage of information. The management device 12 and the monitoring device 14 may perform the processes described above sequentially, or they may perform these processes as a trigger, for example, when a command to perform the processes is input by the user.

[0048] Furthermore, it is preferable that the monitoring device 14 does not receive any data based on processing data other than the matching data E. For example, it is preferable that the monitoring device 14 does not receive processing data or confidential data D from the target device 10, and that processing data or confidential data D is not stored in the storage unit 64. Also, for example, it is preferable that the monitoring device 14 does not receive confidential data D from the management device 12, and that confidential data D is not stored in the storage unit 64. By preventing the monitoring device 14 from receiving processing data or confidential data D in this way, the leakage of information from the target device 10 can be effectively suppressed.

[0049] (Processing flow) The processing flow of the monitoring process is explained below. Figure 6 is a flowchart illustrating the processing flow of the monitoring process. As shown in Figure 6, once the monitoring device 14 acquires trigger information and detection formula information, it sends a matching request to each management device 12 to perform a matching process (step S20). Once each management device 12 receives the matching request, it acquires confidential data D (step S22) and confidential detection formula F (step S24). The order in which steps S22 and S24 are performed is arbitrary. Each management device 12 performs a matching process between the acquired confidential data D and confidential detection formula F to generate matching data E (step S26), and sends the generated matching data E to the monitoring device 14 (step S28). Once the monitoring device 14 acquires the matching data E from each management device 12, it generates a monitoring result by combining the respective matching data E (step S30), and outputs the monitoring result (step S32). This completes the process, but for example, once trigger information is obtained again, the same process may be repeated to continue monitoring the target device 10.

[0050] (effect) As described above, the monitoring system 1 according to the first aspect of this disclosure includes a target device 10 which is a computer to be monitored, a plurality of management devices 12, and a monitoring device 14. The target device 10 includes a processing data acquisition unit 32 which reads processing data which is data that can be defined by a string output from the target device 10, and a concealment unit 34 which conceals the processing data by secret sharing and generates a plurality of concealed data D. The management device 12 includes a concealed data acquisition unit 50 which acquires one of the plurality of concealed data D, a detection formula acquisition unit 52 which acquires one of a plurality of concealed detection formulas F which are generated by concealing a detection formula for checking whether there is an abnormality in the processing data by secret sharing, a matching unit 54 which performs a matching process between the concealed detection formula F and the concealed data D, and a matching result transmission unit 56 which transmits the matching data E, which is the result of the matching process, to the monitoring device 14. The monitoring device 14 includes a monitoring result generation unit 74 which generates a monitoring result indicating whether there is an abnormality in the processing data by decrypting the matching data E acquired from each management device 12. According to this disclosure, it is possible to generate monitoring results without transmitting processing data to the monitoring device 14, thereby enabling monitoring of whether the target device 10 is operating normally while suppressing information leakage. Furthermore, by sending the matching data E, which is the result of matching the confidential data D, to the monitoring device 14 without sending each confidential data D to the monitoring device 14, information leakage of the target device 10 can be suitably suppressed. In addition, by distributing the processing data into multiple confidential data D and having them held by multiple management devices 12, information leakage of the target device 10 can be suitably suppressed.

[0051] The monitoring system 1 according to the second aspect of this disclosure is the monitoring system 1 according to the first aspect, wherein the detection formula acquisition unit 52 of the management device 12 acquires a secure detection formula F that has been secured by the same secret sharing method as the secret sharing method used by the security unit 34. Since the secure data D and the secure detection formula F are created by the same secret sharing method, multiple matching data E can be decoded to obtain information indicating the matching result between the detection formula and the processing data.

[0052] The monitoring system 1 according to the third aspect of this disclosure is the monitoring system 1 according to the second aspect, wherein the concealment unit 34 of the target device 10 conceals the processing data using a replication-type additive secret sharing method. By using a replication-type additive secret sharing method, it becomes possible to monitor whether the target device 10 is operating normally while suppressing the communication burden. In particular, using a replication-type additive secret sharing method that can suppress the communication burden is especially effective when the target device 10, the management device 12, and the monitoring device 14 are located far apart.

[0053] The monitoring system 1 according to the fourth aspect of this disclosure is the monitoring system 1 according to any of the first to third aspects, wherein the monitoring device 14 does not receive data based on processing data other than the matching data E. According to this disclosure, since data related to processing data other than the matching data E is not received, information leakage can be more effectively suppressed.

[0054] The monitoring system 1 according to the fifth aspect of this disclosure is the monitoring system 1 according to any of the first to fourth aspects, wherein the detection expression has the largest number of exclusive OR operations among logical AND, logical OR, and exclusive OR. By using such a detection expression, it becomes possible to appropriately monitor whether the target device 10 is operating normally.

[0055] The monitoring method of this disclosure is a monitoring method for a target device 10, which is a computer to be monitored, and includes the steps of: reading processing data, which is string-definable data, output by the target device 10 in order to operate the target device 10; generating a plurality of confidential data D by secret sharing the processing data by the target device 10; transmitting the confidential data D to each of the plurality of management devices 12; obtaining a plurality of confidential detection formulas F, which are generated by concealing detection formulas for checking whether there is an abnormality in the processing data, by the management devices 12; performing a comparison process between the confidential detection formulas F and the confidential data D by the management devices 12; transmitting the comparison data E, which is the result of the comparison process, to the monitoring device 14; and generating a monitoring result indicating whether there is an abnormality in the processing data by decrypting the comparison data obtained from each management device 12 by the monitoring device 14. According to this disclosure, it is possible to monitor whether the target device 10 is operating normally while suppressing the leakage of information.

[0056] The program of this disclosure is a program that causes a computer to perform a monitoring method for a target device 10, which is a computer to be monitored, and causes the computer to perform the following steps: reading processing data, which is data definable by a string, output by the target device 10 in order to operate the target device 10; the target device 10 concealing the processing data by secret sharing to generate a plurality of confidential data D; transmitting the confidential data D to each of the plurality of management devices 12; the management devices 12 acquiring a plurality of confidential detection formulas F, which are generated by concealing detection formulas for checking whether there is an abnormality in the processing data; the management devices 12 performing a comparison process between the confidential detection formulas F and the confidential data D; transmitting the comparison data E, which is the result of the comparison process, to the monitoring device 14; and the monitoring device 14 decrypting the comparison data acquired from each management device 12 to generate a monitoring result indicating whether there is an abnormality in the processing data.According to this disclosure, it is possible to monitor whether the target device 10 is operating normally while suppressing the leakage of information.

[0057] Although embodiments of the present disclosure have been described above, the embodiments are not limited to those described herein. Furthermore, the aforementioned components include those that can be easily conceived by those skilled in the art, those that are substantially the same, and those that fall within the so-called equivalent range. Moreover, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the embodiments described above. [Explanation of Symbols]

[0058] 1. Monitoring System 10 Target devices 12 Management device 14 Monitoring equipment 32 Processing data acquisition unit 34 Confidential Section 50. Confidential Data Acquisition Unit 52 Detection-type acquisition unit 54 Verification section 56. Verification Result Transmission Unit 72 Detection-type setting unit 74 Monitoring result generation section D. Confidential Data E Matching Data F Confidential Detection

Claims

1. A monitoring system including a target device which is a computer to be monitored, multiple management devices, and a monitoring device, The aforementioned target device is A processing data acquisition unit reads processing data, which is data that can be defined as a string, output by the aforementioned target device. A security unit that secures the aforementioned processed data by secret sharing to generate multiple secure data sets, Includes, The aforementioned control device is A confidential data acquisition unit that acquires one of the multiple confidential data, A detection formula acquisition unit acquires one of several confidential detection formulas generated by concealing a detection formula used to check for abnormalities in the aforementioned processed data using secret sharing, A matching unit that performs a matching process between the confidentiality detection formula and the confidentiality data, A matching result transmission unit that transmits matching data, which is the result of the matching process, to the monitoring device, Includes, The aforementioned monitoring device is The system includes a monitoring result generation unit that generates a monitoring result indicating whether there is an abnormality in the processing data by decoding the matching data acquired from each of the management devices, Monitoring system.

2. The monitoring system according to claim 1, wherein the detection formula acquisition unit of the management device acquires the confidential detection formula, which has been concealed by secret sharing using the same method as secret sharing by the concealment unit.

3. The monitoring system according to claim 2, wherein the concealment unit of the target device conceals the processing data using a replication-type additive secret sharing method.

4. The monitoring device does not receive any data based on the processing data other than the matching data, according to claim 1 or 2.

5. The monitoring system according to claim 1 or claim 2, wherein the detection formula has the largest number of exclusive OR operations among logical AND, logical OR, and exclusive OR.

6. A method for monitoring a target device, which is a computer that is the subject of monitoring, The aforementioned target device reads the processing data, which is data that can be defined as a string, output by the aforementioned target device. The target device performs the steps of: concealing the processing data by secret sharing to generate multiple confidential data; The steps include transmitting the confidential data to each of the multiple management devices, The steps include: acquiring multiple confidential detection formulas, which are generated by concealing the detection formula used to check for abnormalities in the processing data, using the management device; The management device performs a step of matching the confidentiality detection formula with the confidentiality data, The steps include: transmitting the matching data, which is the result of the matching process, to a monitoring device; The monitoring device decodes the matching data acquired from each of the management devices to generate a monitoring result indicating whether there is an abnormality in the processing data. including, Monitoring method.

7. A program that causes a target device, which is a computer to be monitored, multiple management devices, and a monitoring device to execute a monitoring method for the target device, The aforementioned target device reads the processing data, which is data that can be defined as a string, output by the aforementioned target device. The target device performs the steps of: concealing the processing data by secret sharing to generate multiple confidential data; The target device transmits the confidential data to each of the multiple management devices, The steps include: acquiring multiple confidential detection formulas, which are generated by concealing the detection formula used to check for abnormalities in the processing data, using the management device; The management device performs a step of matching the confidentiality detection formula with the confidentiality data, The management device transmits the matching data, which is the result of the matching process, to the monitoring device. The monitoring device decodes the matching data acquired from each of the management devices to generate a monitoring result indicating whether there is an abnormality in the processing data. To execute program.

Images