Device management system and device management method

Abstract

To provide a device management system capable of reducing a threat in a cyber space and a physical space when an incident occurs in a device.SOLUTION: A device management system 1 includes: a device information management unit 11 for managing device information of each of a plurality of devices existing in a physical space; an incident information input unit 14 for receiving an input of information of an incident occurring in any of the plurality of devices; a valid function selection unit 12 for selecting a function for reducing a threat accompanied by an incident that has occurred based on the device information; a nearby device detection unit 13 for detecting a nearby device in the vicinity of an incident device where the incident has occurred; and an external collaboration unit 15 for instructing the nearby device to execute a function.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a system for reducing damage caused by a device in which a security incident has occurred.

Background Art

[0002] Conventionally, techniques for performing security assessment of an operation technology (OT) system in the real world using a digital twin have been proposed (see, for example, Patent Documents 1 and 2). In this technique, a digital twin is defined as a digital reproduction of an actual OT system as a replica by simulation using a large number of information sources. On this digital twin, various evaluation methods such as active scanning / pentest, vulnerability assessment, and attack graph generation are used to perform security evaluation.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0004] Such conventional techniques relate to preventive security measures using a digital twin. When a security incident actually occurs in an IoT device, countermeasures such as communication interruption or operation stop of the corresponding device are available. On the other hand, after a security incident occurs, there is a possibility that remote operation from the cyber space to the device by an attacker is blocked. Therefore, there has been a problem that necessary responses to the corresponding device cannot be directly implemented remotely.

[0005] Furthermore, many IoT devices, including connected cars, have an impact on the physical space, and the behavior of these devices during a security incident can pose a threat to the safety of the physical space. Therefore, when a security incident occurs, it is necessary to ensure security not only in cyberspace but also in the physical space.

[0006] The present invention aims to provide a device management system that can mitigate threats in cyberspace and physical space when an incident occurs on a device. [Means for solving the problem]

[0007] The device management system according to the present invention comprises: a device information management unit that manages device information for each of a plurality of devices present in physical space; an incident information input unit that receives input of information on an incident that has occurred in any of the plurality of devices; an effective function selection unit that selects a function to mitigate the threat associated with the incident that has occurred based on the device information; a nearby device detection unit that detects nearby devices in the vicinity of the incident device where the incident occurred; and an external cooperation unit that instructs the nearby devices to execute the function.

[0008] The effective function selection unit may select the function based on a predetermined priority according to the type of incident.

[0009] The external communication unit may instruct the nearby devices to perform the function via the server that manages the nearby devices.

[0010] The nearby device detection unit may detect nearby devices based on at least one of the distance definitions of physical distance, cyber distance, and account distance.

[0011] The nearby device detection unit may detect nearby devices by weighting the distance definition based on a predetermined priority according to the function.

[0012] The aforementioned physical distance may be the physical distance between devices, or a logical distance based on the number of connection hops.

[0013] The aforementioned cyber distance may be a distance based on the number of hops between devices on the network, or a distance based on the similarity or differentity of the connected hosts or domains.

[0014] The aforementioned account distance may be based on whether the account managing the device belongs to the same user or to the same organization.

[0015] The aforementioned function may also involve shutting down the incident device.

[0016] The aforementioned function may also include raising awareness in the vicinity of the incident device.

[0017] The device management method according to the present invention involves a computer performing the following steps in a digital twin that holds device information for each of a plurality of devices existing in physical space: an incident information input step that receives input of information about an incident that has occurred in any of the plurality of devices; an effective function selection step that selects a function to mitigate the threat associated with the incident based on the device information; a nearby device detection step that detects nearby devices that are close to the incident device where the incident occurred; and an external cooperation step that instructs the nearby devices to execute the function. [Effects of the Invention]

[0018] According to the present invention, when an incident occurs in a device, threats in cyberspace and physical space can be mitigated. [Brief explanation of the drawing]

[0019] [Figure 1] It is a diagram showing the functional configuration of the device management system in the embodiment. [Figure 2] It is a diagram exemplifying the configuration of the device targeted in the embodiment. [Figure 3] It is a diagram exemplifying the management form of device information by the device information management unit in the embodiment. [Figure 4] It is a diagram showing the detailed functional configuration of the nearby device detection unit in the embodiment. [Figure 5] It is a diagram showing the detailed functional configuration of the physical distance output unit in the embodiment. [Figure 6] It is a diagram showing the detailed functional configuration of the cyber distance output unit in the embodiment. [Figure 7] It is a diagram showing the detailed functional configuration of the account distance output unit in the embodiment. [Figure 8] It is a flowchart showing the implementation procedure of the device management method in the embodiment.

Mode for Carrying Out the Invention

[0020] Hereinafter, an example of an embodiment of the present invention will be described. The device management system of the present embodiment uses a nearby device estimated using a digital twin to reduce the threat (damage) caused by a device where an incident has occurred (incident device) in order to improve cyber-physical security. Here, the device targeted by the present embodiment is an IoT device that can communicate remotely, or a device that can be monitored and controlled by an IoT device, and is reproduced as a digital twin in the cyber space.

[0021] The digital twin used in this embodiment is a replica of the real world composed of multiple information sources obtained from physical space and cyberspace. The digital twin holds the information necessary for the device management system to perform the following processes. • Detection of effective measures against incident devices. • Detection of devices in the vicinity of an incident device. • Actions on incident devices using nearby devices.

[0022] Figure 1 shows the functional configuration of the device management system 1 in this embodiment. Device management system 1 consists of one or more information processing devices such as servers, and constitutes part of the digital twin. Specifically, the device management system 1 includes a device information management unit 11, an effective function selection unit 12, a nearby device detection unit 13, an incident information input unit 14, and an external cooperation unit 15 in order to implement the device management method of this embodiment.

[0023] The device information management unit 11 is a functional unit that manages various types of information held by the digital twin regarding the group of devices in the physical space under management.

[0024] Figure 2 is a diagram illustrating the configuration of the device targeted in this embodiment. A device may be a single product, or it may be a product composed of multiple devices. Furthermore, the various chips included in these devices may also be considered devices.

[0025] The digital twin in this embodiment holds the following information about each device in the physical space. However, it is not necessary to hold all information for each device. Some information may not be obtainable for certain devices, and the device management system 1 will use the information held in the digital twin to perform appropriate processing on the incident device.

[0026] [Device Information] • Device type: Device product name, model number, manufacturer information, etc. Device ID: An identifier that uniquely identifies a device, such as an ID assigned to various interfaces (e.g., MAC address). • Input / Output Interface Type: The physical forms of inputs and outputs that a device can accept, such as Ethernet connections, audio input / output (audible and inaudible sounds), and optical input / output (visible and invisible light).

[0027] [Information obtained from the physical space] • Physical connectivity between devices: The connection relationships between devices (chips) that make up a product.

[0028] [Information obtained from cyberspace] ·Location information: Information indicating the device's physical location, such as GPS-based latitude and longitude information and wireless base station information. • Nearby device ID: A list of device IDs (e.g., MAC addresses) collected by scanning nearby devices using proximity wireless technologies such as Bluetooth® and Zigbee®. • Account information: Information indicating the device's owner, affiliation, etc.

[0029] Figure 3 illustrates the device information management configuration by the device information management unit 11 in this embodiment. For each managed device, device information, information obtained from the physical space, and information obtained from cyberspace are linked and stored as described above. Furthermore, if physical or logical connectivity between devices can be obtained based on information acquired from physical space or cyberspace, the information may be stored as a graph structure as shown in the figure.

[0030] The active function selection unit 12 selects an input method (e.g., voice input, optical input) that a specific device (e.g., incident device) requiring safety measures can respond to under specific circumstances, such as when an incident occurs.

[0031] The proximity device detection unit 13 detects nearby devices for a given device. For example, the following may be used to define proximity: physical distance, cyber distance, account distance, etc.

[0032] [Physical distance] • Physical distance between devices: If device location information can be obtained, a group of devices whose location information is within a certain distance from the incident device will be designated as the nearby device group. If a neighboring device ID can be obtained from the incident device, the group of devices with these device IDs will be designated as the neighboring device group. Candidate devices that could be nearby devices are instructed to search for nearby devices, and the group of devices whose search results include the device ID of the incident device are designated as the group of nearby devices. • Logical distance within the device: In the case of a device composed of multiple devices, each component device and chip are considered a neighboring device. In this case, the physical distance may be calculated from the number of connection hops, etc.

[0033] [Cyber ​​Distance] • Number of hops between devices: When representing the communication path of devices graphically, the number of nodes traversed to reach the incident device is defined as the number of hops. Note that direct communication between devices results in 0 hops. • Servers on the same server or domain: For devices connecting to a server (host), devices connecting to the same server or a server in the same domain are considered neighboring devices.

[0034] [Account distance] • Same account: Devices belonging to the same account are considered nearby devices. • Neighborhood by account affiliation: Devices belonging to the same organization are considered nearby devices.

[0035] Figure 4 shows the detailed functional configuration of the nearby device detection unit 13 in this embodiment. The nearby device detection unit 13 includes a physical distance output unit 131, a cyber distance output unit 132, an account distance output unit 133, and a device-to-device distance calculation unit 134.

[0036] The physical distance output unit 131 outputs the aforementioned physical distance as a quantitative value, the cyber distance output unit 132 outputs the aforementioned cyber distance as a quantitative value, and the account distance output unit 133 outputs the aforementioned account distance as a quantitative value. The device distance calculation unit 134 combines these values ​​using predetermined weightings and calculates the distance between devices.

[0037] Figure 5 shows the detailed functional configuration of the physical distance output unit 131 in this embodiment. The physical distance output unit 131 comprises a position information distance calculation unit 1311, a nearby device search unit 1312, a physical configuration calculation unit 1313, and a physical distance calculation unit 1314.

[0038] The location information distance calculation unit 1311 calculates and outputs the distance between the location information of the devices. The nearby device search unit 1312 sets and outputs a predetermined distance based on whether or not it was found to be a nearby device of the incident device. The physical configuration calculation unit 1313 calculates and outputs the distance within the device based on the number of hops, etc. The physical distance calculation unit 1314 calculates the physical distance by combining the distances output from the position information distance calculation unit 1311, the nearby device search unit 1312, and the physical configuration calculation unit 1313 using predetermined weighting.

[0039] Figure 6 shows the detailed functional configuration of the cyber distance output unit 132 in this embodiment. The cyber distance output unit 132 comprises a hop count calculation unit 1321, a server search unit 1322, and a cyber distance calculation unit 1323.

[0040] The hop count calculation unit 1321 calculates and outputs the distance between devices based on the number of hops. The server search unit 1322 sets and outputs a predetermined distance based on the search results, which determine whether or not it is connected to the same server or a server in the same domain. The cyber distance calculation unit 1323 calculates the cyber distance by combining the distances output from the hop count calculation unit 1321 and the server search unit 1322 using a predetermined weighting.

[0041] Figure 7 shows the detailed functional configuration of the account distance output unit 133 in this embodiment. The account distance output unit 133 comprises an account search unit 1331 and an account distance calculation unit 1332.

[0042] The account search unit 1331 outputs search results indicating whether or not the user belongs to the same account or organization. The account distance calculation unit 1332 sets a predetermined distance based on the output of the account search unit 1331 and outputs it.

[0043] The incident information input unit 14 accepts input information regarding the device where the incident occurred. The information to be input includes, for example, the following device information and incident information. [Device Information] • Model number, product name, manufacturer name, etc. [Incident Information] • A vulnerable application or service. Vulnerability information, such as CVE (Common Vulnerabilities and Exposures) numbers. Vulnerability information or incident information provided from external sources such as security vendors, manufacturers, university research labs, and users.

[0044] The external communication unit 15 is a functional unit responsible for communication with devices under management in the physical space, as well as external servers, and performs the following data communication. [Information input from external sources] • Receiving device information. [Commands to the device] • Commands delivered via APIs or other means provided by the platform managing the device. • Direct commands to nearby devices.

[0045] Figure 8 is a flowchart showing the procedure for implementing the device management method in this embodiment. Furthermore, it is assumed that various information regarding the managed devices in the physical space has already been acquired and that a digital twin has been configured.

[0046] In step S1, when a security incident occurs on any device, the incident information input unit 14 detects the security incident based on the input information and identifies the incident device on the digital twin.

[0047] Here, the method of inputting information about the incident device into the digital twin is not specified, but for example, the following methods can be considered. • Security applications installed on the device detect anomalies, and incident information is entered into the digital twin via security vendors and other means. Security devices with network monitoring capabilities, such as IDS (Intrusion Detection System), detect anomalies, and incident information is entered into the digital twin through security vendors and other means.

[0048] In step S2, the effective function selection unit 12 selects and lists effective functions for the incident device from the incident device information. For example, for an incident device that accepts optical input, the optical output function is listed.

[0049] If an incident device accepts multiple types of input, a score may be assigned to each function to determine its priority. For example, if it accepts both optical and audio input, the optical output function may be prioritized based on its transmission distance. Furthermore, if the speed of countermeasures is required depending on the magnitude of the threat, the measures may be limited to only the most effective functions. For example, in the event of a serious accident, measures such as shutting down power sources like electricity or physically shutting down devices may be selected for safety. Furthermore, if the function selection unit 12 is unable to select a function that is effective for the incident device, the result will be "no effective function."

[0050] The selection of such functions is carried out, for example, based on predefined criteria, machine learning models, or predictive simulations on a digital twin. Furthermore, the system may accept selection input from an administrator, and for added security, it may also accept confirmation input for functions automatically selected by the active function selection unit 12.

[0051] In step S3, the nearby device detection unit 13 detects nearby devices of the incident device that have the function selected in step S2. In this case, the conditions to be emphasized may be selected from the definition of proximity (physical distance, cyber distance, account distance) according to predetermined conditions corresponding to the effective function of the incident device. For example, the priorities may be adjusted as follows:

[0052] • When voice input is required, it is necessary to use a device that is within a portable distance, thus emphasizing physical proximity. • If it is essential to cut off power to the incident device and it is impossible to issue commands to this device, then the physical vicinity is prioritized. When alerting people in the vicinity, devices with means of communication to people, such as digital signage, monitors, or speakers, are considered important.

[0053] In step S4, the neighboring device detection unit 13 selects the optimal neighboring device with an effective function from the group of neighboring devices detected in step S3. In this case, since there may be multiple candidate nearby devices, the nearby device detection unit 13 selects the optimal nearby device by multiplying the type of function and the definition of nearby (physical nearby, cyber nearby, account nearby) by a coefficient.

[0054] Furthermore, the priority of neighboring devices may be set as follows: If there are multiple candidate devices within physical proximity of the incident device and within signal range, to avoid impacting third parties, devices belonging to the same account (same owner) as the incident device, or public devices, will be given priority. • If alerting the surrounding area is also important, nearby devices will be selected to issue alerts, in addition to selecting nearby devices to take action against the incident device.

[0055] In step S5, the external communication unit 15 issues a command to the optimal nearby device selected in step S4. The nearby device then takes action to bring the incident device into a safe state in accordance with this command. For example, if the emergency stop signal for an incident device is set to a specific optical signal, the external communication unit 15 commands nearby devices to output that optical signal.

[0056] Here, commands from the external communication unit 15 to nearby devices can be transmitted in the following ways, but are not limited to these. • Sends commands directly to nearby devices. Commands are transmitted to a server that manages nearby devices via the management platform's API, and these servers then transmit the commands to the devices.

[0057] The appropriate content of the command may be determined by the device management system 1 through predictive simulations or other means based on the information held by the digital twin, or by the device management system 1 using the information on the management server of each device. The judgment conditions may be predetermined or determined by AI (Artificial Intelligence), but if insufficient, the administrator may intervene. Alternatively, more simply, a command to stop the operation of the incident device may be selected.

[0058] The device management system 1 determines whether the incident device has become safe as a result of the command in step S5. If it is not safe, it selects a different nearby device than the one selected in step S4 and executes the command in step S5. Alternatively, it may select a different effective function than the one selected in step S2 and execute steps S3 and beyond. For example, if external input signals such as audio and optical signals are not effective, possible functions could include shutting down the incident device's power source (e.g., cutting off the power), or physically stopping or destroying the incident device, such as surrounding the runaway vehicle with another vehicle to bring it to a stop. Whether or not a safe state has been achieved may be determined by simulation on a digital twin, or more simply, by whether or not there is a response to a command.

[0059] In this example, the procedure involves selecting the effective functions first, followed by the detection and selection of nearby devices. However, this is not the only procedure; it may also involve detecting a group of nearby devices for the incident device and then selecting the effective functions provided by these devices.

[0060] As described above, according to this embodiment, the device management system 1 acquires information on the incident device from the digital twin, selects a set of functions that are effective for the incident device, and detects devices nearby the incident device and selects nearby devices that have effective functions. The device management system 1 then sends appropriate commands, such as a stop command to the incident device, to the selected nearby devices, thereby making the incident device physically safe. This allows the device management system 1 to use nearby devices to mitigate threats in cyberspace and physical space when an incident occurs on a device.

[0061] The device management system 1 can ensure safety by selecting effective functions based on predetermined priorities according to the type of incident, thereby enabling more appropriate nearby devices and commands. Furthermore, the device management system 1 may send commands to nearby devices via a server that manages nearby devices. This reduces the information management burden on the digital twin side while allowing for the selection of more appropriate command content.

[0062] The device management system 1 can select the appropriate nearby device depending on the situation by using multiple distance definitions such as physical distance, cyber distance, and account distance. Furthermore, by weighting the distance definition based on a predetermined priority according to the selected effective functions and calculating the overall distance, threats can be more reliably mitigated using appropriate nearby devices.

[0063] The device management system 1 can ensure greater security by having nearby devices shut down the incident device, even when, for example, commands cannot be adequately sent to the incident device. Furthermore, the device management system 1 can further mitigate threats associated with an incident by alerting those around the incident device.

[0064] Furthermore, this embodiment can, for example, mitigate threats in cyberspace and physical space associated with security incidents, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0065] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0066] The device management method by the device management system 1 is implemented by software or hardware circuits. If implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may be distributed by recording them on removable media such as a CD-ROM, or by downloading them to a computer via a network. [Explanation of symbols]

[0067] 1. Device Management System 11. Device Information Management Department 12 Effective Function Selection Unit 13. Nearby device detection unit 14. Incident Information Input Section 15 External Liaison Department 131 Physical Distance Output Unit 132 Cyber ​​distance output unit 133 Account distance output section 134 Device Distance Calculation Unit 1311 Location information distance calculation section 1312 Nearby Device Search Unit 1313 Physical configuration calculation section 1314 Physical Distance Calculation Unit 1321 Hop Count Calculation Unit 1322 Server Search Section 1323 Cyber ​​Distance Calculation Unit 1331 Account Search Section 1332 Account Distance Calculation Unit

Claims

1. A device information management unit manages the device information of each of the multiple devices present in physical space, An incident information input unit that receives input of information about an incident that occurred on any of the aforementioned multiple devices, Based on the device information, an effective function selection unit selects a function to mitigate the threat associated with the incident that occurred, A proximity device detection unit detects nearby devices in the vicinity of the incident device where the incident occurred. The system includes an external cooperation unit that instructs the nearby device to perform the function, The aforementioned effective function selection unit is a device management system that limits functions to predetermined ones according to the magnitude of the threat caused by the incident.

2. The device management system according to claim 1, wherein the external cooperation unit instructs the nearby devices to perform the function via a server that manages the nearby devices.

3. The device management system according to claim 1, wherein the nearby device detection unit detects the nearby device based on at least one of the distance definitions of physical distance, cyber distance, and account distance.

4. The device management system according to claim 3, wherein the nearby device detection unit weights the distance definition based on a predetermined priority according to the function and detects the nearby device.

5. The device management system according to claim 3 or 4, wherein the physical distance is the physical distance between devices or a logical distance based on the number of connection hops.

6. The device management system according to claim 3 or 4, wherein the cyber distance is the distance based on the number of hops between devices on the network, or the distance based on the same or different connected hosts or domains.

7. The device management system according to claim 3 or 4, wherein the account distance is a distance based on whether the accounts managing the devices belong to the same user or to the same organization.

8. The device management system according to any one of claims 1 to 4, wherein the function is to shut down the incident device.

9. The device management system according to any one of claims 1 to 4, wherein the function is to alert the surroundings of the incident device.

10. In a digital twin that holds device information for each of multiple devices existing in physical space, An incident information input step that receives input of information about an incident that occurred on any of the aforementioned multiple devices, Based on the device information, an effective function selection step is performed to select a function to mitigate the threat associated with the incident that occurred, A neighboring device detection step for detecting nearby devices in the vicinity of the incident device where the incident occurred, The computer performs an external cooperation step instructing the nearby device to perform the function, A device management method in which, in the above-mentioned effective function selection step, the device is limited to predetermined functions according to the magnitude of the threat caused by the incident.

Images