Design support device

Abstract

A design support device (1) comprises a test item extraction unit (20) that creates a test item (4) for a security and safety test on the basis of: an attack tree (2) describing, in terms of a tree structure, an event that a security attack provides to functional blocks forming a to-be-designed object; and a fault tree (3) describing, in terms of the tree structure, an event that a safety failure provides to the functional blocks forming the to-be-designed object. The test item extraction unit (20) extracts a security measure and a safety measure having a similarity relationship with each other from the attack tree (2) and the fault tree (3) on the basis of information about the security measure for the event of the leaves of the attack tree (2) and information about the safety measure for the event of the leaves of the fault tree (3), and creates the test item (4), with either one of the security measure and the safety measure having a similarity relationship with each other being excluded.

Description

Design support equipment

[0001] The present disclosure relates to a design support device that supports the design of a product or system, and in particular to a technology for improving the efficiency of security testing and safety testing.

[0002] In recent years, the number of Internet of Things (IoT) systems that connect communication devices that acquire external information with control systems in factories, automobiles, and other devices via the Internet has been increasing, and technologies that provide services that improve the efficiency of control systems (e.g., services that update control system software and services that update information used in control systems) are becoming more widespread. Such IoT systems pose a risk of cyberattacks on devices within the systems, requiring improved security performance. Furthermore, the software that makes up the devices may contain defects known as software vulnerabilities (hereinafter simply referred to as "vulnerabilities"), such as glitches in computer programs or problems with specifications.

[0003] Therefore, service providers, users, and device manufacturers of IoT systems are required to reduce the possibility of security attacks affecting control systems by adding security measures to products from the design to development stage, and by conducting security tests on products to fix vulnerabilities.In addition, even after product shipment, if a new vulnerability affecting the services provided by an IoT system is discovered, measures such as software updates are required.

[0004] However, the judgment of the extent to which security measures need to be implemented in products and systems has to rely on the knowledge of experts, and opinions vary among experts. As a technology to solve this problem, for example, Patent Document 1 listed below proposes a risk assessment and countermeasure planning system that can determine countermeasures to reduce vulnerabilities and security tests.

[0005] International Publication No. 2020 / 202934

[0006] The safety of a product or system includes security, which is a measure to reduce the impact of vulnerabilities, and safety, which is a measure to reduce the impact of failures. For products that require both security and safety measures, the creation of security test specifications and safety test specifications may result in the same test items being executed for the same functional blocks. In such cases, the same test items are executed redundantly in security tests and safety tests, resulting in redundant testing processes. The technology disclosed in Patent Document 1 is designed to create security test specifications, but does not take safety test specifications into consideration.

[0007] The present disclosure has been made to solve the above-mentioned problems, and aims to provide a design support device that can create test items for security and safety tests that do not include redundant test items.

[0008] A design support device according to the present disclosure includes a tree acquisition unit that acquires an attack tree in which events that security attacks cause to functional blocks that constitute the design object are described in a tree structure, and a fault tree in which events that safety failures cause to functional blocks that constitute the design object are described in a tree structure, and a test item extraction unit that creates test items for security and safety testing based on the attack tree and the fault tree, wherein the attack tree includes information on security measures for leaf events of the attack tree, and the fault tree includes information on safety measures for leaf events of the fault tree, and the test item extraction unit extracts security measures and safety measures that are similar to each other from the attack tree and the fault tree based on the information on security measures for leaf events of the attack tree and the information on safety measures for leaf events of the fault tree, and creates test items after excluding one of the similar security measures or safety measures.

[0009] According to the design support device according to the present disclosure, it is possible to create test items for security and safety tests that do not include redundant test items.

[0010] The objects, features, aspects, and advantages of the present disclosure will become more apparent from the following detailed description and the accompanying drawings.

[0011] 1 is a functional block diagram showing the configuration of a design support device according to a first embodiment. FIG. 2 is a diagram showing an example of an attack tree. FIG. 3 is a diagram showing an example of a fault tree. FIG. 4 is a diagram showing an example of a list of security measures for each functional block. FIG. 5 is a diagram showing an example of a list of safety measures for each functional block. FIG. 6 is a diagram showing an example of a list of security measures and safety measures for each functional block. FIG. 7 is a diagram showing an example of test items created without excluding redundant test items. FIG. 8 is a diagram showing an example of test items created by excluding redundant test items. FIG. 9 is a flowchart showing the operation of the design support device according to the first embodiment. FIG. 10 is a functional block diagram showing the configuration of a design support device according to a second embodiment. FIG. 11 is a flowchart showing the operation of the design support device according to the second embodiment. FIG. 12 is a diagram showing an example of the hardware configuration of a design support device.

[0012] First Embodiment Fig. 1 is a functional block diagram showing the configuration of a design support device 1 according to a first embodiment. As shown in Fig. 1, an attack tree 2 created to derive security-oriented measures (hereinafter referred to as "security measures") for a product or system to be designed, and a fault tree 3 created to derive safety-oriented measures (hereinafter referred to as "safety measures") for the product or system are input to the design support device 1. The attack tree 2 and the fault tree 3 are created in advance by a user. The design support device 1 generates and outputs test items 4 required for security and safety testing of the product or system based on the attack tree 2 and the fault tree 3.

[0013] 1 , the design support device 1 includes a tree acquisition unit 10 and a test item extraction unit 20. The tree acquisition unit 10 acquires an attack tree 2 and a fault tree 3 input to the design support device 1, and outputs the acquired attack tree 2 and fault tree 3 to the test item extraction unit 20.

[0014] FIG. 2 shows an example of an attack tree 2. The attack tree 2 describes, in a tree structure, the events that a security attack (security attack) causes to the components (functional blocks) of the design target. In the attack tree 2, the event that a security attack (security attack) causes to the design target is at the top (root node), and the behavior of the components of the design target that leads to the events at each node is described in a tree structure. In addition, the attack tree 2 describes, for each leaf, which is the terminal node of the tree, a "countermeasure explanation" that explains the countermeasure for detecting and dealing with the leaf event. The countermeasure explanation for each leaf in the attack tree 2 includes the "target functional block" that is the block that is the target of the countermeasure, the "countermeasure content" that describes the content of the countermeasure, and the "countermeasure operation judgment condition" that is the judgment condition for the countermeasure to be activated.

[0015] FIG. 3 shows an example of a fault tree 3. The fault tree 3 describes, in a tree structure, the events that a safety-oriented failure (safety failure) has on the design object. In the fault tree 3, the event that a safety failure has on the design object is at the top (root node), and the behavior of the components (functional blocks) of the design object that are connected to the events at each node is described in a tree structure. In addition, in the fault tree 3, for the leaves, which are the terminal nodes of the tree, an explanation of countermeasures for detecting and dealing with the leaf events is described. The explanation of countermeasures for each leaf in the fault tree 3 also includes the "target functional block," which is the block that is the target of the countermeasure, the "countermeasure content," which is the content of the countermeasure, and the "determination condition for countermeasure operation," which is the determination condition for the countermeasure to operate.

[0016] The test item extraction unit 20 analyzes each of the attack tree 2 and the fault tree 3 input from the tree acquisition unit 10, and generates test items 4 required for security and safety testing. In doing so, the test item extraction unit 20 extracts combinations of security and safety measures that share a common target functional block and have similar countermeasure contents, and creates test items 4 by excluding one of them, thereby eliminating redundant test items from the test items 4. Hereinafter, security measures and safety measures that share a common target functional block and have similar countermeasure contents will be referred to as "similar security measures and safety measures."

[0017] As shown in FIG. 1, the test item extraction unit 20 includes an attack tree analysis unit 21, a fault tree analysis unit 22, a judgment condition comparison unit 23, and a test item exclusion unit 24.

[0018] The attack tree analysis unit 21 analyzes the attack tree 2 acquired by the tree acquisition unit 10, and extracts from the attack tree 2 target functional blocks for security measures, the content of the measures, and the judgment conditions for the action of the measures. The attack tree analysis unit 21 then creates a list of security measures for each functional block as shown in FIG. 4 (FIG. 4 is a list created from the attack tree 2 in FIG. 2). The list of security measures lists the content of the measures and the judgment conditions for the action of the measures for each functional block in an organized manner. The attack tree analysis unit 21 outputs this list as the analysis result of the security measures.

[0019] The fault tree analysis unit 22 analyzes the fault tree 3 acquired by the tree acquisition unit 10, and extracts from the fault tree 3 the target functional blocks for safety measures, the content of the measures, and the judgment conditions for the action of the measures.The fault tree analysis unit 22 then creates a list of safety measures for each functional block as shown in FIG. 5 (FIG. 5 is a list created from the fault tree 3 in FIG. 3).The list of safety measures lists the content of the measures and the judgment conditions for the action of the measures in an organized manner for each functional block.The fault tree analysis unit 22 outputs this list as the analysis result of the safety measures.

[0020] The judgment condition comparison unit 23 creates a list of security measures and safety measures for each functional block as shown in Fig. 6 from the list of security measures for each functional block created by the attack tree analysis unit 21 and the list of safety measures for each functional block created by the fault tree analysis unit 22 (Fig. 6 is a list created from the lists of Fig. 4 and Fig. 5). In the list of security measures and safety measures, the contents of security measures and judgment conditions for their operation, and the contents of safety measures and judgment conditions for their operation are organized and described for each functional block.

[0021] When creating the list, the judgment condition comparison unit 23 compares the list of security measures with the list of safety measures to search for security measures and safety measures that share a common target functional block and have similar countermeasure contents, i.e., combinations of security measures and safety measures that are similar to each other.The judgment condition comparison unit 23 then lists items related to security measures and safety measures that are similar to each other in the same row of the list.

[0022] Furthermore, the judgment condition comparison unit 23 evaluates whether there are differences in the judgment conditions for the countermeasure actions between security measures and safety measures that are similar to each other, and incorporates the evaluation results (presence or absence of differences) into a list, as shown in Fig. 6. The judgment condition comparison unit 23 outputs this list as the comparison result of the judgment conditions for security measures and safety measures that are similar to each other.

[0023] The test item exclusion unit 24 creates test items 4 for security and safety tests of each functional block based on the list of security measures and safety measures for each functional block created by the judgment condition comparison unit 23.

[0024] Security and safety testing tests whether the countermeasure content is correctly implemented when the judgment conditions for the countermeasure operation are satisfied. Therefore, the test content in security and safety testing corresponds to the countermeasure content in security and safety measures, and the judgment conditions for security and safety testing correspond to the judgment conditions for the countermeasure operation in security and safety measures. Therefore, for example, if test items are simply created from the list in FIG. 6, test items like those in FIG. 7 are created. The test items in FIG. 7 are redundant because identical or similar items are duplicated. The reason test items are redundant is because identical or similar test items are generated from security and safety measures that are similar to each other.

[0025] Therefore, the test item exclusion unit 24 creates test item 4 after excluding one of the security measures and safety measures that are similar to each other from the list of security measures and safety measures. Which of the security measures and safety measures that are similar to each other to exclude can be determined based on whether there is a difference in the judgment conditions for the countermeasure operation. For example, if there is a difference in the judgment conditions for the countermeasure operation between the security measures and safety measures that are similar to each other, the one with the stricter judgment conditions for the countermeasure operation is adopted, and the one with the looser judgment conditions is excluded. Furthermore, if there is no difference in the judgment conditions for the countermeasure operation between the security measures and safety measures that are similar to each other, it makes no difference whether either one is excluded, so either one may be excluded.

[0026] For example, if test item 4 is created by excluding one of the security measures and safety measures that are similar to each other from the list in Fig. 6, test item 4 as shown in Fig. 8 is created. Test item 4 in Fig. 8 does not include any redundant test items.

[0027] In this way, the design support device 1 according to the first embodiment can create test items 4 for security and safety testing that do not include redundant test items, thereby reducing the number of steps required for security and safety testing.

[0028] 9 is a flowchart showing the operation of the design support device 1 according to the first embodiment. The operation of the design support device 1 will be described below with reference to the flowchart in Fig. 9. It is assumed that the attack tree 2 and the fault tree 3 have been created in advance by the user.

[0029] When the design support device 1 is started and the user inputs the attack tree 2 and the fault tree 3 to the design support device 1, the tree acquisition unit 10 acquires the input attack tree 2 and the fault tree 3 (step S1).

[0030] The tree acquisition unit 10 reads the countermeasure explanations written for each leaf of the attack tree 2 and the fault tree 3, and checks whether the countermeasure explanations for all leaves include the target functional block, the countermeasure content, and the judgment conditions for the countermeasure operation (step S2). If the countermeasure explanation for any leaf contains an omission (NO in step S2), the design support device 1 notifies the user of this fact (step S3), and ends the process.

[0031] If there are no omissions in the explanation of measures for all leaves (YES in step S2), the attack tree analysis unit 21 creates a list of security measures for each function block (step S4), and the fault tree analysis unit 22 creates a list of safety measures for each function block (step S5). Steps S4 and S5 may be performed in any order, or may be performed in parallel.

[0032] Next, the judgment condition comparison unit 23 creates a list of security measures and safety measures for each functional block from the list of security measures for each functional block created by the attack tree analysis unit 21 and the list of safety measures for each functional block created by the fault tree analysis unit 22 (step S6).The judgment condition comparison unit 23 also evaluates whether there are differences in the judgment conditions for the countermeasure operations for security measures and safety measures that are similar to each other, and incorporates the evaluation result (presence or absence of differences) into the list created in step S6 (step S7).

[0033] Thereafter, the test item exclusion unit 24 creates test items 4 for security and safety tests by excluding one of the security measures and safety measures that are similar to each other from the list of security measures and safety measures for each functional block created by the judgment condition comparison unit 23 (step S8). As a result, test items 4 that do not include redundant test items are created.

[0034] <Embodiment 2> Fig. 10 is a functional block diagram showing the configuration of a design support device 1 according to embodiment 2. The configuration of Fig. 10 is different from the configuration of Fig. 1 shown in embodiment 1 in that a test item display output unit 30 is added to the design support device 1 and a display monitor 5 is connected to the design support device 1. The other configuration is the same as that of Fig. 1, and therefore description thereof will be omitted here.

[0035] The test item display output unit 30 converts the data of the test items 4 created by the test item extraction unit 20 into a data format that can be output to the display monitor 5, and outputs the data to the display monitor 5. The display monitor 5 displays the test items 4 input from the test item display output unit 30 on the screen.

[0036] In addition to the effect of the first embodiment, the design support device 1 according to the second embodiment has the effect of being able to present the test items 4 to the user through the screen of the display monitor 5 .

[0037] Fig. 11 is a flowchart showing the operation of the design support device 1 according to the embodiment 2. The flowchart in Fig. 11 is obtained by adding steps S9 and S10 to the flowchart in Fig. 9 shown in the embodiment 1.

[0038] In step S9, the test item display output unit 30 converts the data of the test item 4 created in step S8 into a data format that can be output to the display monitor 5, and outputs it to the display monitor 5. In step S10, the display monitor 5 displays the test item 4 input from the test item display output unit 30 on the screen.

[0039] The other steps are the same as those in FIG. 9, and therefore will not be described here.

[0040] 12 and 13 are diagrams illustrating examples of the hardware configuration of the design support device 1. The functions of the components of the design support device 1 illustrated in FIG. 1 or 10 are realized, for example, by a processing circuit 50 illustrated in FIG. 12 . That is, the design support device 1 includes a processing circuit 50 for acquiring an attack tree in which events that a security attack will cause on functional blocks constituting the design object are described in a tree structure, and a fault tree in which events that a safety failure will cause on functional blocks constituting the design object are described in a tree structure, and for creating test items for security and safety tests based on the attack tree and the fault tree. The processing circuit 50 may be dedicated hardware, or may be configured using a processor (also referred to as a central processing unit (CPU), processing device, arithmetic unit, microprocessor, microcomputer, or DSP (Digital Signal Processor)) that executes a program stored in a memory.

[0041] When the processing circuitry 50 is dedicated hardware, the processing circuitry 50 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a combination thereof. Each function of the components of the design support device 1 may be realized by a separate processing circuit, or these functions may be realized together by a single processing circuit.

[0042] FIG. 13 shows an example of a hardware configuration of the design support device 1 in which the processing circuit 50 is configured using a processor 51 that executes a program. In this case, the functions of the components of the design support device 1 are realized by software (software, firmware, or a combination of software and firmware). The software is written as a program and stored in memory 52. ​​The processor 51 realizes the functions of each unit by reading and executing the program stored in memory 52. ​​That is, the design support device 1 includes memory 52 for storing a program that, when executed by the processor 51, results in the following: obtaining an attack tree, which describes, in a tree structure, the events that a security attack will cause on functional blocks constituting the design object; obtaining a fault tree, which describes, in a tree structure, the events that a safety fault will cause on functional blocks constituting the design object; and creating test items for security and safety tests based on the attack tree and the fault tree. In other words, this program can be said to cause a computer to execute the procedures and methods of the operations of the components of the design support device 1.

[0043] Here, the memory 52 may be, for example, a non-volatile or volatile semiconductor memory such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Memory), or an EEPROM (Electrically Erasable Programmable Read Only Memory), a HDD (Hard Disk Drive), a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), and a drive device for such a disk, or any other storage medium that will be used in the future.

[0044] The above describes a configuration in which the functions of the components of the design support device 1 are realized either by hardware or software, etc. However, the present invention is not limited to this, and the configuration may be such that some components of the design support device 1 are realized by dedicated hardware and other components are realized by software, etc. For example, the functions of some components may be realized by the processing circuit 50 as dedicated hardware, and the functions of other components may be realized by the processing circuit 50 as the processor 51 reading and executing a program stored in the memory 52.

[0045] As described above, the design support device 1 can realize the above-described functions by hardware, software, or a combination of these.

[0046] It is possible to freely combine the embodiments, and to modify or omit the embodiments as appropriate.

[0047] The above description is illustrative in all respects, and it is understood that countless variations not illustrated can be envisioned.

[0048] 1 Design support device, 2 Attack tree, 3 Fault tree, 4 Test item, 5 Display monitor, 10 Tree acquisition unit, 20 Test item extraction unit, 21 Attack tree analysis unit, 22 Fault tree analysis unit, 23 Judgment condition comparison unit, 24 Test item exclusion unit, 30 Test item display output unit, 50 Processing circuit, 51 Processor, 52 Memory.

Claims

1. a tree acquisition unit that acquires an attack tree in which events that a security attack will cause to a functional block that constitutes a design object are described in a tree structure, and a fault tree in which events that a safety failure will cause to the functional block that constitutes the design object are described in a tree structure; a test item extraction unit that creates test items for security and safety testing based on the attack tree and the fault tree; Equipped with the attack tree includes information on security measures for events at the leaves of the attack tree; the fault tree includes information on safety measures for events at leaves of the fault tree; the test item extraction unit extracts the security measures and the safety measures that are similar to each other from the attack tree and the fault tree, as candidates for exclusion of the test items, based on information on the security measures of the leaf events of the attack tree and information on the safety measures of the leaf events of the fault tree. Design support equipment.

2. The test item extraction unit creates the test items after excluding either one of the security measures and the safety measures that are in the similar relationship. The design support device according to claim 1 .

3. the information on the security measures for the leaf events of the attack tree includes target functional blocks of the security measures, the contents of the measures, and judgment conditions for the actions of the measures; the information on the safety measures for the leaf events of the fault tree includes target functional blocks of the security measures, the contents of the measures, and judgment conditions for the actions of the measures; the test item extraction unit extracts the security measures and the safety measures that share the target functional block and have a similar relationship to each other in terms of the measure content as the security measures and the safety measures that have the similar relationship; 3. The design support device according to claim 1.

4. the test item extraction unit, when the judgment conditions for the countermeasure actions in the security measure and the safety measure that are in the similar relationship are different, excludes the one with a looser judgment condition for the countermeasure action; The design support device according to claim 3.

5. The test item extraction unit an attack tree analysis unit that creates a list of security measures for each of the functional blocks of the design target from the attack tree; a fault tree analysis unit that creates a list of the safety measures for each of the functional blocks of the design object from the fault tree; a judgment condition comparison unit that creates a list of the security measures and the safety measures for each functional block from the list of the security measures for each functional block created by the attack tree analysis unit and the list of the safety measures for each functional block created by the fault tree analysis unit; a test item exclusion unit that creates the test items based on the list of the security measures and the safety measures for each of the functional blocks created by the judgment condition comparison unit; Equipped with 3. The design support device according to claim 1.

6. the test item exclusion unit excludes one of the security measures and the safety measures that are in the similar relationship from the list of the security measures and the safety measures for each of the functional blocks created by the judgment condition comparison unit, and creates the test items based on the list from which the one of the security measures and the safety measures that are in the similar relationship has been excluded. The design support device according to claim 5.

7. a test item display output unit that converts the test item data created by the test item extraction unit into a data format that can be output to a display monitor and outputs the data to the display monitor; 3. The design support device according to claim 1.