Detection system, detection device, response device, and detection method

Abstract

A detection system comprising a response device and a detection device which detects an abnormality in a network containing the response device and transmission paths, wherein: the detection device transmits response data generation information to be used in the generation of response data to the response device via a first transmission path; the response device generates response data on the basis of the response data generation information received from the detection device and transmits the generated response data to the detection device via a second transmission path; the detection device detects an abnormality in the network on the basis of the response data and reference information based on the configuration of the network; and at least one of the first transmission path and the second transmission path includes a main transmission path for transmitting a main signal in the network.

Description

Detection system, detection device, response device and detection method

[0001] This application claims priority from Japanese Patent Application No. 2023-125266, filed August 1, 2023, the disclosure of which is incorporated herein in its entirety by reference.

[0002] Patent Document 1 (Japanese Patent Laid-Open Publication No. 2003-191804) discloses the following vehicular communication system: That is, the vehicular communication system is configured such that a plurality of electrical devices mounted on a vehicle are provided with communication means for performing data communication via communication lines wired in the vehicle, thereby enabling data transmission and reception between the electrical devices, and each of the electrical devices is provided with a plurality of communication means for communicating the same data using different communication lines, and a selection means for selecting normal received data from a plurality of received data obtained through communication using the plurality of communication means, and one of the plurality of communication means is designated as low-speed communication means for performing data communication at a communication speed slower than the other communication means, thereby making the reliability of data communication by the low-speed communication means higher than that of the other communication means.

[0003] Japanese Patent Application Laid-Open No. 2003-191804

[0004] The detection system of the present disclosure comprises a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, wherein the detection device transmits response data generation information used to generate response data to the response device via a first transmission path, the response device generates the response data based on the response data generation information received from the detection device and transmits the generated response data to the detection device via a second transmission path, the detection device detects an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

[0005] One aspect of the present disclosure can be realized not only as a detection system equipped with such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that realizes part or all of the detection system.

[0006] FIG. 1 is a diagram illustrating a configuration of a detection system according to a first embodiment of the present disclosure. FIG. 2 is a diagram illustrating a configuration of a detection device in the detection system according to the first embodiment of the present disclosure. FIG. 3 is a diagram illustrating a configuration of a response device in the detection system according to the first embodiment of the present disclosure. FIG. 4 is a diagram illustrating a configuration of a detection system according to a first modification of the first embodiment of the present disclosure. FIG. 5 is a diagram illustrating a configuration of a detection system according to a second modification of the first embodiment of the present disclosure. FIG. 6 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the first embodiment of the present disclosure. FIG. 7 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the first modification of the first embodiment of the present disclosure. FIG. 8 is a diagram illustrating a configuration of a detection system according to a second embodiment of the present disclosure. FIG. 9 is a diagram illustrating a configuration of a detection device in the detection system according to the second embodiment of the present disclosure. FIG. 10 is a diagram illustrating a configuration of a response device in the detection system according to the second embodiment of the present disclosure. FIG. 11 is a diagram illustrating a configuration of a detection system according to a third modification of the second embodiment of the present disclosure. FIG. 12 is a diagram illustrating a configuration of a response device in the detection system according to the third modification of the second embodiment of the present disclosure. 13 and 14 are diagrams illustrating an example of a sequence of a detection process in a detection system according to a second embodiment of the present disclosure.

[0007] Conventionally, techniques have been developed to improve the reliability of data communication in a network.

[0008] [Problem to be Solved by the Present Disclosure] There is a demand for a technology that can improve security in a network beyond the technology described in Patent Document 1.

[0009] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a detection system, a detection device, a response device, and a detection method that can improve security in a network.

[0010] [Effects of the Present Disclosure] According to the present disclosure, it is possible to improve security in a network.

[0011] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described.

[0012] (1) A detection system according to an embodiment of the present disclosure includes a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, wherein the detection device transmits response data generation information used to generate response data to the response device via a first transmission path, the response device generates the response data based on the response data generation information received from the detection device, and transmits the generated response data to the detection device via a second transmission path, the detection device detects an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

[0013] In this way, by using a configuration that detects network anomalies based on reference information based on the network configuration and response data transmitted over a transmission path, it is possible to detect a change in the network configuration as a network anomaly based on, for example, a comparison result between the reference information and the response data, thereby improving network security.

[0014] (2) In the above (1), the first transmission path may be the main transmission path and the second transmission path may be a dedicated line used to detect abnormalities in the network, or the second transmission path may be the main transmission path and the first transmission path may be a dedicated line used to detect abnormalities in the network.

[0015] With this configuration, it is possible to detect a network abnormality while suppressing the effect on communications using the main transmission line.

[0016] (3) In the above (2), the first transmission line may be the dedicated line, and the second transmission line may be the main transmission line.

[0017] With this configuration, for example, response data generation information can be flexibly transmitted to a plurality of response devices using dedicated lines.

[0018] (4) In any of (1) to (3) above, the response device may generate the response data further based on the unique information of the response device and transmit the generated response data to the detection device via the second transmission path, the reference information may include the unique information, and the detection device may generate generated data based on the unique information included in the reference information and the response data generation information transmitted to the response device, compare the received response data with the generated data, and detect an abnormality in the network based on the comparison result.

[0019] With this configuration, for example, the presence of a fraudulent device masquerading as a response device can be detected as a network abnormality based on the results of comparing response data generated in a response device with response data generated based on reference information in a detection device.

[0020] (5) In any one of (1) to (4) above, the detection device may detect an abnormality in the network based on the number of pieces of response data received.

[0021] With this configuration, for example, if the number of received response data is greater than the number of response devices in the network, it can be determined that a detour has been inserted in the network, and if the number of received response data is less than the number of response devices in the network, it can be determined that a route blockage has occurred in the network.

[0022] (6) In any one of (1) to (5) above, the detection device may detect an abnormality in the network based on a reception timing of the received response data.

[0023] With this configuration, for example, if the timing of receiving the response data differs from the timing corresponding to the timing of sending the response data generation information, it can be determined that a detour route has been inserted to transmit the response data generated in another network.

[0024] (7) In any of (1) to (6) above, the first logical transmission path and the second logical transmission path may be provided using a common physical transmission line, and the detection device and the response device may multiplex and transmit the response data generation information and the response data on the transmission line.

[0025] With this configuration, it is possible to detect abnormalities in the network without using a transmission line separate from the main transmission line in the network.

[0026] (8) In any of (1) to (7) above, the detection system may further include an aggregation device, and the aggregation device may generate aggregated data by aggregating the response data generated by the response devices, and transmit the generated aggregated data to the detection device.

[0027] This configuration can suppress an increase in communication traffic due to the transmission of response data, and can also improve the efficiency of verification of the response data in the detection device.

[0028] (9) A detection system according to an embodiment of the present disclosure includes a first response device, a second response device, and a detection device that detects an abnormality in a network including the first response device, the second response device, and a transmission path, wherein the detection device transmits response data generation information used to generate response data to the first response device and the second response device via a first transmission path, the first response device generates first response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated first response data to the second response device via a second transmission path, and the second response device The apparatus generates second response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated second response data and the first response data received from the first response device to the detection device, and the detection device detects an abnormality in the network based on reference information based on the configuration of the network, the first response data transmitted by the first response device, and the second response data transmitted by the second response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

[0029] In this way, by using a configuration that detects network anomalies based on reference information based on the network configuration and response data transmitted over a transmission path, it is possible to detect a change in the network configuration as a network anomaly based on, for example, a comparison result between the reference information and the response data, thereby improving network security.

[0030] (10) A detection device according to an embodiment of the present disclosure includes a transmitting unit that transmits response data generation information used to generate response data to a response device in a network via a first transmission path; a receiving unit that receives the response data based on the response data generation information, the response data transmitted by the response device, via a second transmission path; and a detection unit that detects an abnormality in the network based on reference information based on the configuration of the network and the response data received by the receiving unit, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

[0031] In this way, by transmitting response data generation information to a response device via a transmission line and detecting a network anomaly based on reference information based on the network configuration and the response data received via the transmission line, a change in the network configuration can be detected as a network anomaly based on the comparison result between the reference information and the response data, thereby improving network security.

[0032] (11) A response device according to an embodiment of the present disclosure is a response device attached to a communication device in a network, and includes a receiving unit that receives response data generation information used to generate response data from a detection device that detects abnormalities in the network via a first transmission path, a generating unit that generates the response data based on the response data generation information received by the receiving unit, and a transmitting unit that transmits the response data generated by the generating unit to another device via a second transmission path, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

[0033] In this way, a response device attached to a communication device in a network is configured to transmit response data based on response data generation information received via a transmission line to another device via the transmission line, so that, for example, the other device can detect a change in the network configuration as a network abnormality based on the comparison result between information based on the network configuration and the response data received from the response device, thereby improving security in the network.

[0034] (12) A response device according to an embodiment of the present disclosure includes a receiving unit that receives response data generation information used to generate response data from a detection device that detects network abnormalities via a first transmission path, a generating unit that generates the response data based on the response data generation information received by the receiving unit, and a transmitting unit that transmits the response data generated by the generating unit to another device via a second transmission path, wherein the first transmission path is a main transmission path that transmits main signals in the network, and the second transmission path is a dedicated line used to detect abnormalities in the network, or the second transmission path is the main transmission path, and the first transmission path is a dedicated line used to detect abnormalities in the network.

[0035] In this way, by using the main transmission line and the dedicated line for transmitting the main signal in the network to receive response data generation information and transmit the response data to another device, it is possible to suppress the impact on communications using the main transmission line, and for example, in the other device, based on the comparison result between information based on the network configuration and the response data received from the response device, detect a change in the network configuration as a network abnormality, thereby improving security in the network.

[0036] (13) A detection method according to an embodiment of the present disclosure is a detection method in a detection system including a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, and includes the steps of: the detection device transmitting response data generation information used to generate response data to the response device via a first transmission path; the response device generating the response data based on the response data generation information received from the detection device and transmitting the generated response data to the detection device via a second transmission path; and the detection device detecting an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

[0037] In this way, by using the method for detecting network anomalies based on the reference information based on the network configuration and the response data transmitted via the transmission path, it is possible to detect a change in the network configuration as a network anomaly based on the comparison result between the reference information and the response data, thereby improving network security.

[0038] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0039] First Embodiment [Configuration and Basic Operation] Fig. 1 is a diagram showing the configuration of a detection system according to a first embodiment of the present disclosure. Referring to Fig. 1, a detection system 401 includes response devices 101A and 101B serving as response devices 101, communication devices 111A and 111B serving as communication devices 111, a gateway device 121, and detection devices 301A and 301B serving as detection devices 301. For example, the detection system 401 includes M response devices 101A, M communication devices 111A, N response devices 101B, and N communication devices 111B, where M and N are integers equal to or greater than 2. The detection system 401 may include one response device 101A and one communication device 111A, or one response device 101B and one communication device 111B.

[0040] For example, the detection system 401 is used in a network in an industrial control system such as a factory or plant, etc. In this case, the communication device 111 is, for example, a power supply control unit, a robot, a sensor, or a PLC (Programmable Logic Controller) for controlling an actuator.

[0041] The detection system 401 may be used in a home network or an in-vehicle network. When the detection system 401 is used in an in-vehicle network, the communication device 111 and the detection device 301 are an in-vehicle ECU (Electronic Control Unit).

[0042] For example, the answering device 101 is a connector that can be attached to the communication device 111. In the example shown in Figure 1, each of the communication devices 111A is attached to an answering device 101A, and each of the communication devices 111B is attached to an answering device 101B.

[0043] The gateway device 121 and the response device 101A are connected one-to-many. More specifically, the gateway device 121, the response device 101A, and the detection device 301A are connected to each other via transmission line 2A, which is transmission line 2. The detection device 301A and the response device 101A are connected to each other via transmission line 1A, which is transmission line 1. The transmission lines 1 and 2 are physical transmission paths.

[0044] The gateway device 121 and the response device 101B are connected one-to-many. More specifically, the gateway device 121, the response device 101B, and the detection device 301B are connected to each other via transmission line 2B, which is transmission line 2. Furthermore, the detection device 301B and the response device 101B are connected to each other via transmission line 1B, which is transmission line 1.

[0045] The detection system 401 includes networks NWa and NWb. Network NWa is composed of a gateway device 121, a response device 101A, a communication device 111A, and a transmission line 2A. Network NWb is composed of a gateway device 121, a response device 101B, a communication device 111B, and a transmission line 2B. Hereinafter, each of networks NWa and NWb will also be referred to as network NW.

[0046] The transmission line 2A includes a main transmission path for transmitting a main signal in the network NWa. The transmission line 2B includes a main transmission path for transmitting a main signal in the network NWb. The transmission line 1A is a dedicated line used for detecting an abnormality in the network NWa. The transmission line 1B is a dedicated line used for detecting an abnormality in the network NWb. The transmission line 1 is an example of a first transmission path, and the transmission line 2 is an example of a second transmission path.

[0047] The transmission lines 1 and 2 are transmission lines for serial communication conforming to standards such as RS (Recommended Standard)-232C, RS-422A, and RS-485, for example. Note that the transmission lines 1 and 2 may also be transmission lines conforming to other standards such as CAN (Controller Area Network) (registered trademark) and LIN (Local Interconnect Network).

[0048] The communication device 111A communicates with the gateway device 121 and another communication device 111A via the corresponding response device 101A and transmission line 2A. The communication device 111B communicates with the gateway device 121 and another communication device 111B via the corresponding response device 101B and transmission line 2B. As an example, the communication device 111 transmits a message conforming to Modbus (registered trademark) addressed to the other communication device 111 to the gateway device 121 and another communication device 111 via the corresponding response device 101 and transmission line 2.

[0049] The gateway device 121 performs a relay process to relay, for example, messages exchanged between communication devices 111 connected to different transmission lines 2 via the response device 101, and messages exchanged between the communication devices 111 and an external network (not shown) outside the detection system 401. For example, the communication device 111A sends and receives messages with low confidentiality, and is communicatively connected to the external network via the gateway device 121. On the other hand, the communication device 111B sends and receives messages with high confidentiality, and its communicative connection to the external network is restricted.

[0050] The detection device 301A periodically or irregularly transmits response data generation information Ga, which is used to generate response data Ra, to the response device 101A via the transmission line 1A. Furthermore, the detection device 301B periodically or irregularly transmits response data generation information Gb, which is used to generate response data Rb, to the response device 101B via the transmission line 1B. Hereinafter, each of the response data Ra and Rb will also be referred to as response data R, and each of the response data generation information Ga and Gb will also be referred to as response data generation information G.

[0051] Each response device 101A generates response data Ra based on response data generation information Ga received from the detection device 301A and transmits the generated response data Ra to the detection device 301A via the transmission line 2A. For example, the response device 101A transmits the response data Ra to the detection device 301A by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Ra onto the transmission line 2A over which a main signal in the network NWa is transmitted.

[0052] Furthermore, each response device 101B generates response data Rb based on response data generation information Gb received from the detection device 301B, and transmits the generated response data Rb to the detection device 301B via the transmission line 2B. For example, the response device 101B transmits the response data Rb to the detection device 301B by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Rb onto the transmission line 2B over which a main signal in the network NWb is transmitted.

[0053] The detection device 301A detects an abnormality in the network NWa based on reference information RFa based on the configuration of the network NWa and response data Ra transmitted by the response device 101A. The detection device 301B detects an abnormality in the network NWb based on reference information RFb based on the configuration of the network NWb and response data Rb transmitted by the response device 101B. More specifically, the detection device 301 detects a change in the network configuration of the corresponding network NW as an abnormality in the network NW. That is, the detection device 301 detects a change in the network topology of the network NW as an abnormality in the network NW. Hereinafter, each of the reference information RFa and RFb will also be referred to as reference information RF.

[0054] For example, the detection device 301 detects a path block in the network NW as an abnormality in the corresponding network NW. The path block includes a physical path block caused by cutting the transmission line 1, and a logical path block caused by adding an unauthorized filter device to the transmission line 1 that discards some or all messages.

[0055] Furthermore, for example, the detection device 301 detects, as an abnormality in the network NW, the insertion of a detour route, which is a transmission path between the response device 101A and the response device 101B that does not go through the gateway device 121. The insertion of a detour route includes the insertion of a physical detour route by changing the wiring of the transmission lines 1A and 1B, and the insertion of a logical detour route by inserting an unauthorized repeater that relays a message transmitted on one of the transmission lines 1A and 1B to the other of the transmission lines 1A and 1B.

[0056] As described above, the communication device 111A is communicatively connected to an external network via the gateway device 121, while the communication device 111B has its communication connection to the external network restricted. If a detour route is inserted between the response device 101A and the response device 101B, the communication device 111B will be communicatively connected to the external network via the gateway device 121 and the detour route. Therefore, the detection device 301 detects the insertion of the detour route as an abnormality in the network NW.

[0057] (Transmission of response data generation information G) Fig. 2 is a diagram showing the configuration of a detection device in the detection system according to the first embodiment of the present disclosure. Referring to Fig. 2, the detection device 301 includes a transmitter 31, a receiver 32, a detector 33, and a storage unit 34. Some or all of the transmitter 31, receiver 32, and detector 33 are realized by, for example, a processing circuit including one or more processors. The storage unit 34 is, for example, a non-volatile memory included in the processing circuit.

[0058] The detection unit 33 periodically or irregularly generates response data generation information G and a verification start command, and outputs the generated response data generation information G and verification start command to the transmission unit 31. The response data generation information G may be a random number value of a predetermined length, or may be a predetermined value. For example, when generating response data generation information G of a predetermined value, the detection unit 33 generates response data generation information G of a value different from response data generation information G generated in the past, and outputs the generated response data generation information G to the transmission unit 31. This makes it possible to more reliably detect the presence of an unauthorized device, even if the unauthorized device masquerades as the response device 101 and performs a retransmission attack.

[0059] For example, the detection unit 33 in the detection device 301A generates response data generation information Ga and a verification start command at a predetermined transmission timing ta and outputs them to the transmission unit 31, and the detection unit 33 in the detection device 301B generates response data generation information Gb and a verification start command at a predetermined transmission timing tb different from the transmission timing ta and outputs them to the transmission unit 31.

[0060] The transmitting unit 31 transmits response data generation information G to each response device 101 via transmission line 1. More specifically, the transmitting unit 31 in the detecting device 301A receives response data generation information Ga from the detecting unit 33, and transmits the received response data generation information Ga and the verification start command in a message to each response device 101A via transmission line 1A. Also, the transmitting unit 31 in the detecting device 301B receives response data generation information Gb from the detecting unit 33, and transmits the received response data generation information Gb and the verification start command in a message to each response device 101B via transmission line 1B.

[0061] (Transmission of Response Data R) The following describes the transmission of response data R by the response device 101. Unless otherwise specified, the following content regarding the transmission of response data R is common to the response devices 101A and 101B.

[0062] 3 is a diagram showing the configuration of a response device in a detection system according to a first embodiment of the present disclosure. Referring to FIG. 3, the response device 101 includes a connection unit 10 and a response unit 20. The response unit 20 includes a receiving unit 21, a transmitting unit 22, a processing unit 23, and a storage unit 24. The processing unit 23 is an example of a generation unit. The receiving unit 21, the transmitting unit 22, and the processing unit 23 are partly or entirely realized by a processing circuit including one or more processors, for example. The storage unit 24 is, for example, a non-volatile memory included in the processing circuit.

[0063] The connection unit 10 electrically connects the transmission line 2 and the communication device 111. The communication device 111 receives messages transmitted by other communication devices 111 via the transmission line 2 and the connection unit 10, and transmits messages addressed to other communication devices 111 via the connection unit 10 and the transmission line 2.

[0064] The storage unit 24 in the response unit 20 of the response device 101 stores key information K that is unique to the response device 101. The key information K is an example of unique information.

[0065] The receiving unit 21 in the response unit 20 receives response data generation information G from the detection device 301 via the transmission line 1. More specifically, the receiving unit 21 receives a message from the detection device 301 via the transmission line 1 and acquires the response data generation information G from the received message. The receiving unit 21 outputs the acquired response data generation information G to the processing unit 23.

[0066] The processing unit 23 generates response data R based on the response data generation information G. For example, the processing unit 23 generates the response data R further based on the key information K in the storage unit 24. More specifically, the processing unit 23 receives the response data generation information G from the receiving unit 21 and generates the response data R using the received response data generation information G and the key information K in the storage unit 24. The response data R may be a digital signature or a message authentication code. The processing unit 23 outputs the generated response data R to the transmitting unit 22.

[0067] The transmitter 22 transmits the response data R to the detection device 301 via the transmission line 2. More specifically, the transmitter 22 receives the response data R from the processing unit 23, generates a message including the received response data R, and transmits the generated message to the detection device 301 via the connection unit 10 and the transmission line 2.

[0068] 2 again, the receiving unit 32 in the detecting device 301 receives the response data R transmitted by the response device 101 via the transmission line 2. The detecting unit 33 performs a detecting process to detect an abnormality in the network NW based on the reference information RF based on the configuration of the network NW and the response data R received by the receiving unit 32. The detecting process in the detecting device 301A will be described below as a representative example.

[0069] For example, the memory unit 34 in the detection device 301A stores reference information RFa indicating the number of response devices 101A connected to the transmission line 1A, key information K of each response device 101A connected to the transmission line 1A, and the required time TM, which is the time required from when response data generation information Ga is transmitted to the response device 101A until the response device 101A completes transmission of the response data Ra.

[0070] The receiving unit 32 in the detection device 301A receives a message from the response device 101 via the transmission line 2A. The receiving unit 32 acquires response data R from the received message and outputs the acquired response data R and the ID of the response device 101 that sent the response data R to the detection unit 33.

[0071] The detection unit 33 receives response data R from the receiving unit 32 and compares the received response data R with information based on the reference information RFa. For example, the detection unit 33 generates generated data Ma based on the key information K included in the reference information RFa and the response data generation information Ga transmitted to the response device 101A, and compares the response data R received from the receiving unit 32 with the generated data Ma. The detection unit 33 detects an abnormality in the network NWa based on the comparison result of the response data R, the number of response data R received by the receiving unit 32, and the reception timing of the response data R.

[0072] More specifically, the detection unit 33 generates a plurality of pieces of generated data Ma corresponding to the plurality of pieces of response data Ra respectively corresponding to the plurality of response devices 101A connected to the transmission line 2A, using the response data generation information Ga transmitted to the response device 101A via the transmission unit 31 and each piece of key information K in the storage unit 34. For example, the generated data Ma is a hash value.

[0073] The detection unit 33 compares the response data Ra with the generated data Ma for each response device 101A based on the response data Ra and ID received from the receiving unit 32. For example, the detection unit 33 determines that the detection condition C1 is satisfied when at least one of the multiple response data Ra received by the receiving unit 32 does not match the generated data Ma corresponding to the response device 101A that sent the response data Ra. On the other hand, the detection unit 33 determines that the detection condition C1 is not satisfied when the multiple response data Ra received by the receiving unit 32 match each of the multiple generated data Ma that it generated.

[0074] The detection unit 33 also references the reference information RFa and compares the number of response data R received by the receiving unit 32 during a predetermined reception period TRa with the number of response devices 101A connected to the transmission line 1A. For example, the reception period TRa is set in advance based on the transmission timing of the response data generation information G in the detection system 401 and the required time TM indicated by the reference information RFa. As an example, the reception period TRa is the period from the timing ta when the detection device 301A transmits the response data generation information Ga to the timing tb when the detection device 301B transmits the response data generation information Gb. For example, the detection unit 33 determines that the detection condition C2 is satisfied if the number of response data R received by the receiving unit 32 during the reception period TRa does not match the number of response devices 101A connected to the transmission line 1A, i.e., N. On the other hand, the detection unit 33 determines that the detection condition C2 is not satisfied if the number of response data R received by the receiving unit 32 during the reception period TRa is N.

[0075] The detection unit 33 also checks whether or not response data R has been received by the receiving unit 32 in a period other than the reception period TRa. For example, if response data R has been received by the receiving unit 32 in a period other than the reception period TRa, the detection unit 33 determines that detection condition C3 is satisfied. On the other hand, if response data R has not been received by the receiving unit 32 in a period other than the reception period TRa, the detection unit 33 determines that detection condition C3 is not satisfied.

[0076] In the detection process, the detection unit 33 detects an abnormality in the network NWa based on the determination result of whether or not the detection conditions C1, C2, and C3 are satisfied. More specifically, when the detection unit 33 determines that at least one of the detection conditions C1, C2, and C3 is satisfied, it determines that an abnormality has occurred in the network NWa.

[0077] For example, if detection condition C1 is satisfied, the detection unit 33 determines that there is an unauthorized device masquerading as the response device 101A. Furthermore, for example, if detection condition C2 is satisfied and the number of response data R received by the receiving unit 32 during the reception period TRa is less than N, the detection unit 33 determines that a path blockage has occurred in the network NWa. Furthermore, for example, if detection condition C2 is satisfied and the number of response data R received by the receiving unit 32 during the reception period TRa is greater than N, or if detection condition C3 is satisfied, the detection unit 33 determines that a detour has been inserted in the network NWa.

[0078] When the detection unit 33 determines that an abnormality has occurred in the network NWa, it includes abnormality information indicating that an abnormality has occurred in a message and transmits the message to the response device 101A via the transmission line 1A. The detection unit 33 also notifies the user of the detection system 401 that an abnormality has occurred in the network NWa by voice or display. Note that the processing unit 23 may be configured not to transmit the abnormality information to the response device 101A and / or notify the user.

[0079] 3 , for example, when the processing unit 23 in the response device 101A receives abnormality information from the detection device 301A via the transmission line 1A and the receiving unit 21, it notifies the user of the detection system 401 by voice or display that an abnormality has occurred in the network NWa. Also, for example, when the processing unit 23 receives abnormality information from the detection device 301A via the transmission line 1A and the receiving unit 21, it cuts off the electrical connection between the transmission line 2A and the communication device 111A at the connection unit 10. Note that the processing unit 23 may be configured not to notify the user or to cut off the electrical connection between the transmission line 2A and the communication device 111A, or both.

[0080] (Variation 1) FIG. 4 is a diagram illustrating the configuration of a detection system according to Variation 1 of the first embodiment of the present disclosure. Referring to FIG. 4, compared to detection system 401, detection system 402 includes detection device 302 instead of detection device 301A, and includes response device 102A, which is the response device 102, instead of response device 101A. Compared to detection system 401, detection system 402 further includes communication device 111C, which is the communication device 111, response device 102C, which is the response device 102, and aggregation devices 201A and 201C. For example, detection system 402 includes L response devices 102C and L communication devices 111C. In the example illustrated in FIG. 4, a communication device 111C is connected to each of the response devices 102C. L is an integer equal to or greater than 2. Note that detection system 402 may also include one response device 102C and one communication device 111C. Hereinafter, each of the aggregation devices 201A and 201C will also be referred to as aggregation device 201.

[0081] The gateway device 121, the response device 102A, the aggregation device 201A, and the detection device 302 are connected to one another via a transmission line 2A. In addition, the response devices 102A and 102C, the aggregation devices 201A and 201C, and the detection device 302 are connected to one another via a transmission line 1A.

[0082] The gateway device 121, the response device 102C, and the aggregation device 201C are connected to each other via a transmission line 2C, which is the transmission line 2.

[0083] The detection system 402 differs from the detection system 401 in that it includes a network NW1a instead of the network NWa and further includes a network NWc. The network NW1a is configured with a gateway device 121, a response device 102A, a communication device 111A, and a transmission line 2A. The network NWc is configured with a gateway device 121, a response device 102C, a communication device 111C, and a transmission line 2C.

[0084] The detection device 302 transmits response data generation information Ga to the response devices 102A and 102C and the aggregation devices 201A and 201C via the transmission line 1A.

[0085] The response device 102A includes response data Ra based on response data generation information Ga received from the detection device 302 in a message and transmits the message to the aggregation device 201A via the transmission line 2A. For example, the response device 102A transmits the response data Ra to the aggregation device 201A by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Ra onto the transmission line 2A over which a main signal in the network NWa is transmitted.

[0086] Furthermore, the response device 102C transmits response data Rc based on the response data generation information Ga received from the detection device 302 to the aggregation device 201C via the transmission line 2C, including the response data Rc in a message. For example, the response device 102C transmits the response data Rc to the aggregation device 201C by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Rc onto the transmission line 2C over which a main signal in the network NWc is transmitted.

[0087] The aggregation device 201A generates aggregated data RxA by aggregating multiple pieces of response data Ra generated by multiple response devices 102A, and transmits the generated aggregated data RxA to the detection device 302.

[0088] More specifically, the aggregation device 201A receives a message from the response device 102A via transmission line 2A. The aggregation device 201A acquires multiple pieces of response data Ra from the multiple messages received during the reception period TRa. The aggregation device 201A performs predetermined processing on the acquired multiple pieces of response data Ra to generate aggregated data RxA with a data volume smaller than the total data volume of the multiple pieces of response data Ra. The aggregation device 201A includes the generated aggregated data RxA in a message and transmits it to the detection device 302 via transmission line 1A.

[0089] The aggregation device 201C also generates aggregated data RxC by aggregating the multiple pieces of response data Rc generated by the multiple response devices 102C, and transmits the generated aggregated data RxC to the detection device 302.

[0090] More specifically, the aggregation device 201C receives a message from the response device 102C via the transmission line 2C. The aggregation device 201C acquires multiple pieces of response data Rc from the multiple messages received during the reception period TRa. The aggregation device 201C performs predetermined processing on the acquired multiple pieces of response data Rc to generate aggregated data RxC with a data volume smaller than the total data volume of the multiple pieces of response data Rc. The aggregation device 201C includes the generated aggregated data RxC in a message and transmits it to the detection device 302 via the transmission line 1A.

[0091] The detection device 302 receives the aggregated data RxA and RxC from the aggregation devices 201A and 201C via the transmission line 1A. The detection device 302 performs detection processing based on reference information RFac based on the configurations of the networks NW1a and NW1c and the aggregated data RxA and RxC received from the aggregation devices 201A and 201C.

[0092] More specifically, the detection device 302 generates a plurality of generated data Ma corresponding to a plurality of response devices 102A connected to the transmission line 2A, and a plurality of generated data Mc corresponding to a plurality of response devices 102C connected to the transmission line 2C.

[0093] The detection device 302 collates the aggregated data RxA with the generated data Ma for each response device 102A, and collates the aggregated data RxC with the generated data Mc for each response device 102C.

[0094] The detection device 302 determines that the detection condition C1 is satisfied when at least one of the multiple response data Ra aggregated in the aggregated data RxA does not match the generated data Ma corresponding to the response device 102A that sent the response data Ra. Also, the detection device 302 determines that the detection condition C1 is satisfied when at least one of the multiple response data Rc aggregated in the aggregated data RxC does not match the generated data Mc corresponding to the response device 102C that sent the response data Rc.

[0095] On the other hand, the detection device 302 determines that the detection condition C1 is not satisfied if the multiple response data Ra aggregated in the aggregated data RxA match the multiple generated data Ma generated, and if the multiple response data Rc aggregated in the aggregated data RxC match the multiple generated data Mc generated.

[0096] The aggregating device 201A may be configured to generate response data R based on response data generation information Ga received from the detecting device 302, and generate aggregated data RxA by performing predetermined processing on the plurality of response data Ra and the generated response data R. The aggregating device 201C may be configured to generate response data R based on response data generation information Ga received from the detecting device 302, and generate aggregated data RxC by performing predetermined processing on the plurality of response data Rc and the generated response data R.

[0097] Furthermore, similar to the detection device 302, the aggregation device 201 may be configured to detect abnormalities in the networks NW1a and NWc based on the number of received response data R and the timing at which the response data R is received.

[0098] 5 is a diagram illustrating a configuration of a detection system according to Modification 2 of the first embodiment of the present disclosure. Compared to detection system 401, detection system 403 includes detection device 303 instead of detection device 301A, and includes response device 103A instead of response device 101A.

[0099] The gateway device 121, the response device 103A, and the detection device 303 are connected to one another via a transmission line 2A. In addition, logical transmission paths 2A1 and 2A2 are provided using the common physical transmission line 2A.

[0100] The communication device 111A communicates with the gateway device 121 and other communication devices 111A via the response device 103A and the transmission path 2A1. As an example, the communication device 111A transmits a message conforming to Modbus addressed to the other communication devices 111 to the gateway device 121 and other communication devices 111 via the response device 103A and the transmission path 2A1.

[0101] The detector 303 and the response device 103A multiplex and transmit the response data generation information Ga and the response data Ra over the transmission line 2A.

[0102] More specifically, the detection device 303 transmits the response data generation information Ga to the response device 103A via a logically independent transmission path 2A2 that is separate from the transmission path 2A1. For example, the detection device 303 transmits the response data generation information Ga to the response device 103A by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data generation information Ga onto the transmission line 2A through which the main signal in the network NWa is transmitted.

[0103] The response device 103A generates response data Ra based on the response data generation information Ga received from the detection device 303, and transmits the generated response data Ra to the detection device 303 via the transmission path 2A1. For example, the response device 103A transmits the response data Ra to the detection device 303 by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Ra onto the transmission line 2A over which the main signal in the network NWa is transmitted.

[0104] [Operation Flow] Fig. 6 is a diagram showing an example of a sequence of a detection process in the detection system according to the first embodiment of the present disclosure. Fig. 6 shows the detection process in the detection device 301A.

[0105] 6, first, when a predetermined transmission timing ta arrives, the detection device 301 transmits response data generation information Ga to each response device 101A via the transmission line 1A (step S11).

[0106] Next, each response device 101A generates response data Ra using the response data generation information Ga received from the detection device 301A and the key information K (step S12).

[0107] Next, each response device 101A transmits the generated response data Ra to the detection device 301A via the transmission line 2A (step S13).

[0108] Next, the detection device 301A performs detection processing based on reference information RFa based on the configuration of the network NWa and the response data Ra received from the response device 101A. More specifically, the detection device 301A determines whether detection condition C1 is satisfied by comparing the received response data Ra with the generated data Ma for each response device 101A. The detection device 301A also determines whether detection condition C2 is satisfied by referencing the reference information RFa and comparing the number of response data R received during the reception period TRa with the number of response devices 101A connected to the transmission line 1A. The detection device 301A also determines whether detection condition C3 is satisfied based on the reception timing of the response data R. The detection device 301A determines whether an abnormality has occurred in the network NWa based on the determination results for detection conditions C1, C2, and C3 (step S14).

[0109] 7 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the first modification of the first embodiment of the present disclosure.

[0110] Referring to FIG. 7, first, when a predetermined transmission timing ta arrives, the detection device 302 transmits response data generation information Ga to the response devices 102A and 102C and the aggregation devices 201A and 201C via the transmission line 1A (step S21).

[0111] Next, each response device 102A generates response data Ra using the response data generation information Ga and key information K received from the detection device 302. Also, each response device 102C generates response data Rc using the response data generation information Ga and key information K received from the detection device 302 (step S22).

[0112] Next, each response device 102A transmits the generated response data Ra to the aggregation device 201A via the transmission line 2A. Also, each response device 102C transmits the generated response data Rc to the aggregation device 201C via the transmission line 2C (step S23).

[0113] Next, the aggregation device 201A receives the plurality of response data Ra respectively transmitted by the plurality of response devices 102A, and generates aggregated data RxA by aggregating the received plurality of response data Ra. Also, the aggregation device 201C receives the plurality of response data Rc respectively transmitted by the plurality of response devices 102C, and generates aggregated data RxC by aggregating the received plurality of response data Rc (step S24).

[0114] Next, the aggregation device 201A transmits the generated aggregated data RxA via the transmission line 1A to the detection device 302. Furthermore, the aggregation device 201C transmits the generated aggregated data RxC via the transmission line 1A to the detection device 302 (step S25).

[0115] Next, the detection device 302 performs detection processing based on reference information RFac based on the configuration of the networks NW1a and NWc and the aggregated data RxA and RxC received from the aggregation devices 201A and 201C. More specifically, the detection device 302 compares the received aggregated data RxA with the generated data Ma for each response device 102A, and compares the aggregated data RxC with the generated data Mc for each response device 102C to determine whether detection condition C1 is met. The detection device 302 also references the reference information RFa1 and compares the number of response data R aggregated in the aggregated data RxA and RxC with the number of response devices 102A and 102C connected to the transmission lines 2A and 2C, respectively, to determine whether detection condition C2 is met. The detection device 302 also determines whether detection condition C3 is met based on the timing of receiving the response data R. The detection device 302 determines whether or not an abnormality has occurred in the networks NW1a and NWc based on the determination results regarding the detection conditions C1, C2, and C3 (step S26).

[0116] In the detection system 401 according to the first embodiment of the present disclosure, the detection device 301A is configured to transmit the response data generation information Ga to the response device 101A via the transmission line 1A, but this is not limited to this. The detection device 301A may be configured to transmit the response data generation information Ga to the response device 101A via the transmission line 2A. In this case, the response device 101A transmits the response data Ra to the detection device 301A via the transmission line 1A.

[0117] Furthermore, in the detection system 401 according to the first embodiment of the present disclosure, the detection device 301 may be configured to transmit the response data generation information G to the response device 101 by wireless communication instead of transmitting the response data generation information G to the response device 101 via the transmission line 1. Furthermore, the response device 101 may be configured to transmit the response data R to the detection device 301 by wireless communication instead of transmitting the response data R to the detection device 301 via the transmission line 1.

[0118] Furthermore, in the detection device 301 according to the first embodiment of the present disclosure, the detection unit 33 is configured to detect an abnormality in the network NW based on the determination result of whether or not the detection conditions C1, C2, and C3 are satisfied, but this is not limited thereto. The detection unit 33 may be configured to detect an abnormality in the network NW based on the determination result of whether or not any one or two of the detection conditions C1, C2, and C3 are satisfied.

[0119] However, there is a demand for technology that can improve security in networks. More specifically, for example, if communications between communication devices on a network are encrypted, problems such as a decrease in communication speed and an increase in costs may arise.

[0120] In contrast, in the detection system according to the first embodiment of the present disclosure, the detection device 301 transmits response data generation information G used to generate response data R to the response device 101 via transmission line 1A. The response device 101 generates response data R based on the response data generation information G received from the detection device 301, and transmits the generated response data R to the detection device 301 via transmission line 1B. The detection device 301 detects an abnormality in the network NW based on reference information RF based on the configuration of the network NW and the response data R transmitted by the response device 101. At least one of the transmission lines 1A and 1B includes a main transmission line that transmits a main signal in the network NW.

[0121] In this way, by configuring the system to detect an abnormality in the network NW based on the reference information RF based on the configuration of the network NW and the response data R transmitted via the transmission path 2A, it is possible to detect a change in the network configuration of the network NW as an abnormality in the network NW, for example, based on the comparison result between the reference information RF and the response data R. Therefore, it is possible to improve the security of the network NW. Furthermore, compared to a configuration in which communications between communication devices 111 in the network NW are encrypted, it is possible to detect an abnormality in the network NW while suppressing a decrease in communication speed and an increase in cost. Furthermore, for example, by configuring the response device 101 as a connector that can be attached to the communication device 111 in the network NW, it is possible to detect an abnormality in the network NW without changing the specifications of the communication device 111.

[0122] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0123] Second Embodiment [Configuration and Basic Operation] This embodiment relates to a detection system 404 in which response devices are connected one-to-one via a transmission path that transmits a main signal, as compared to the detection systems 401, 402, and 403 according to the first embodiment. Except for the contents described below, the detection system 404 is the same as the detection systems 401, 402, and 403 according to the first embodiment.

[0124] 8 is a diagram illustrating a configuration of a detection system according to a second embodiment of the present disclosure. The detection system 404 includes response devices 104A, 104B, 104C, and 104D serving as response devices 104; response devices 105A, 105B, 105C, and 105D serving as response devices 105; communication devices 112A, 112B, 112C, and 112D serving as communication devices 112; switch devices 141A and 141B serving as switch devices 141; a gateway device 122; and detection devices 304A, 304B, 304C, and 304D serving as detection devices 304. The response device 104 is an example of a second response device. The response device 105 is an example of a first response device. The detection system 404 is not limited to a configuration including four detection devices 304, and may include a single detection device 304. In this case, the detection device 304 monitors all networks NW2, which will be described later, in the detection system 404.

[0125] The gateway device 122 is connected to the switch devices 141A and 141B via transmission lines 5A and 5B, respectively. Hereinafter, each of the transmission lines 5A and 5B will also be referred to as a transmission line 5. The transmission line 5 is, for example, an Ethernet (registered trademark) cable.

[0126] For example, response device 104 is a connector that can be attached to switch device 141. In the example shown in Fig. 8, response devices 104A and 104B are attached to two communication ports (not shown) of switch device 141A, respectively, and response devices 104C and 104D are attached to two communication ports (not shown) of switch device 141B, respectively.

[0127] Also, for example, response device 105 is a connector that can be attached to communication device 112. In the example shown in Fig. 8, response device 105A is attached to a communication port (not shown) of communication device 112A, response device 105B is attached to a communication port (not shown) of communication device 112B, response device 105C is attached to a communication port (not shown) of communication device 112C, and response device 105D is attached to a communication port (not shown) of communication device 112D.

[0128] Response devices 104 and 105 are connected one-to-one. More specifically, response devices 104A and 105A are connected to each other via transmission line 4A. Response devices 104B and 105B are connected to each other via transmission line 4B. Response devices 104C and 105C are connected to each other via transmission line 4C. Response devices 104D and 105D are connected to each other via transmission line 4D. Hereinafter, each of transmission lines 4A, 4B, 4C, and 4D will also be referred to as transmission line 4. Transmission line 4 is a physical transmission path.

[0129] The detector 304 and the response devices 104 and 105 are connected to each other. More specifically, the detector 304A and the response devices 104A and 105A are connected to each other via a transmission line 3A. The detector 304B and the response devices 104B and 105B are connected to each other via a transmission line 3B. The detector 304C and the response devices 104C and 105C are connected to each other via a transmission line 3C. The detector 304D and the response devices 104D and 105D are connected to each other via a transmission line 3D. Hereinafter, each of the transmission lines 3A, 3B, 3C, and 3D will also be referred to as a transmission line 3. The transmission line 3 is a physical transmission path.

[0130] The detection system 404 includes networks NW2a and NW2b. Network NW2a is composed of a switch device 141A, response devices 104A, 104B, 105A, and 105B, communication devices 112A and 112B, and transmission lines 4A and 4B. Network NWb is composed of a switch device 141B, response devices 104C, 104D, 105C, and 105D, communication devices 112C and 112D, and transmission lines 4C and 4D. Hereinafter, each of networks NW2a and NW2b will also be referred to as network NW2.

[0131] The transmission lines 4A and 4B include main transmission paths for transmitting main signals in the network NW2a. The transmission lines 4C and 4D include main transmission paths for transmitting main signals in the network NW2b. The transmission lines 3A and 3B are dedicated lines used for detecting abnormalities in the network NW2a. The transmission lines 3C and 3D are dedicated lines used for detecting abnormalities in the network NW2b. The transmission line 3 is an example of a first transmission path, and the transmission line 4 is an example of a second transmission path.

[0132] The transmission line 3 is a transmission line for serial communication conforming to standards such as RS-232C, RS-422A, and RS-485, etc. The transmission line 4 is an Ethernet cable, for example.

[0133] The communication device 112 and the switch device 141 communicate with each other via the corresponding response devices 104, 105 and the corresponding transmission line 4. As an example, the communication device 112 transmits an Ethernet frame addressed to another communication device 112 to the switch device 141 via the corresponding response device 105 and the transmission line 4. The switch device 141 transmits an Ethernet frame received via the corresponding response device 104 to the destination communication device 112 via the corresponding response device 104 and the corresponding transmission line 4, according to the destination address of the Ethernet frame, or transmits it to the gateway device 122 via the corresponding transmission line 5. Furthermore, the switch device 141 transmits an Ethernet frame received from the gateway device 122 to the destination communication device 112 via the corresponding response device 104 and the corresponding transmission line 4, according to the destination address of the Ethernet frame.

[0134] The gateway device 122 performs a relay process to relay, for example, messages exchanged between the communication devices 112 and messages exchanged between the communication devices 112 and an external network (not shown) outside the detection system 404. For example, the communication devices 112C and 112D send and receive messages with low confidentiality and are communicatively connected to the external network via the gateway device 122. On the other hand, the communication devices 112A and 112B send and receive messages with high confidentiality and have limited communicative connections to the external network.

[0135] The detection system 404 performs a detection process to detect abnormalities in the network NW2 during a predetermined detection period Pd. More specifically, during the detection period Pd, the detection device 304A transmits response data generation information Ga, used to generate response data Ra, to the response devices 104A and 105A via transmission line 3A. During the detection period Pd, the detection device 304B transmits response data generation information Gb, used to generate response data Rb, to the response devices 104B and 105B via transmission line 3B. During the detection period Pd, the detection device 304C transmits response data generation information Gc, used to generate response data Rc, to the response devices 104C and 105C via transmission line 3C. During the detection period Pd, the detection device 304D transmits response data generation information Gd, used to generate response data Rd, to the response devices 104D and 105D via transmission line 3D. Hereinafter, each of the response data Ra, Rb, Rc, and Rd will also be referred to as response data R, and each of the response data generation information Ga, Gb, Gc, and Gd will also be referred to as response data generation information G. For example, the detection period Pd is a period during which no communication using the transmission line 4 is performed.

[0136] The response device 105A generates response data Ra based on the response data generation information Ga received from the detection device 304A, includes the generated response data Ra in an Ethernet frame, and transmits the generated response data Ra to the response device 104A via the transmission line 4A. That is, the response device 105A transmits the response data Ra to the response device 104A by time-division multiplexing the response data Ra onto the transmission line 4A over which the main signal in the network NW2a is transmitted. The response device 104A generates response data Ra based on the response data generation information Ga received from the detection device 304A, aggregates the generated response data Ra with the response data Ra received via the transmission line 4A, and transmits the generated aggregated data Rx2a to the detection device 304A via the transmission line 3A. Note that the detection period Pd may be a period during which communication is performed using the transmission line 4. In this case, the response device 105A transmits the response data Ra to the response device 104A by frequency division multiplexing or code division multiplexing the response data Ra onto the transmission line 4A.

[0137] Similarly to the response device 105A, the response device 105B transmits response data Rb to the response device 104B via transmission line 4B. Similarly to the response device 104A, the response device 104B generates aggregate data Rx2b and transmits it to the detection device 304B via transmission line 3B.

[0138] Similarly to the response device 105A, the response device 105C transmits response data Rc to the response device 104C via transmission line 4C. Similarly to the response device 104A, the response device 104C generates aggregate data Rx2c and transmits it to the detection device 304C via transmission line 3C.

[0139] Similarly to the response device 105A, the response device 105D transmits response data Rd to the response device 104D via transmission line 4D. Similarly to the response device 104A, the response device 104D generates aggregate data Rx2d and transmits it to the detection device 304D via transmission line 3D.

[0140] The response data R generated by the response device 105 is an example of first response data. The response data R generated by the response device 104 is an example of second response data. Hereinafter, each of the aggregated data Rx2a, Rx2b, Rx2c, and Rx2d will also be referred to as aggregated data Rx2.

[0141] The detection device 304A detects an abnormality in network NW2a based on reference information RF2a based on the configuration of network NW2a and aggregated data Rx2a. The detection device 304B detects an abnormality in network NW2a based on reference information RF2a and aggregated data Rx2b. The detection device 304C detects an abnormality in network NW2b based on reference information RF2b based on the configuration of network NW2b and aggregated data Rx2c. The detection device 304D detects an abnormality in network NW2b based on reference information RF2b and aggregated data Rx2d. Hereinafter, each of the reference information RF2a and RF2b will also be referred to as reference information RF2.

[0142] For example, the detection device 304 detects a path blockage in the network NW2 as an abnormality in the corresponding network NW2. The path blockage includes a physical path blockage caused by cutting the transmission line 4, and a logical path blockage caused by adding an unauthorized filter device to the transmission line 4 that discards some or all messages.

[0143] Furthermore, for example, the detection device 304 detects, as an abnormality in the network NW2, the insertion of a detour route, which is a transmission path between the networks NW2a and NW2b that does not pass through the switch device 141 and the gateway device 122. The insertion of a detour route includes the insertion of a physical detour route by changing the wiring between the transmission line 4 in the network NW2a and the transmission line 4 in the network NW2b, and the insertion of a logical detour route by inserting an unauthorized repeater that relays an Ethernet frame transmitted on the transmission line 4 of one of the networks NW2a and NW2b to the transmission line 4 of the other of the networks NW2a and NW2b.

[0144] As described above, the communication devices 112C and 112D are communicatively connected to an external network via the gateway device 122, while the communication devices 112A and 112B have their communication connection to the external network restricted. If a detour route is inserted between the networks NW2a and NW2b, the communication devices 112A and 112B will be communicatively connected to the external network via the gateway device 122, the switch device 141B, and the detour route. Therefore, the detection device 304 detects the insertion of the detour route as an abnormality in the network NW2.

[0145] (Transmission of response data generation information G) Fig. 9 is a diagram showing the configuration of a detection device in a detection system according to a second embodiment of the present disclosure. Referring to Fig. 9, the detection device 304 includes a transceiver 41, a detector 42, and a storage unit 43. The transceiver 41 and the detector 42 are partly or entirely realized by a processing circuit including one or more processors, for example. The storage unit 43 is, for example, a non-volatile memory included in the processing circuit.

[0146] During the detection period Pd, the detection unit 42 generates response data generation information G and a verification start command, and outputs the generated response data generation information G and verification start command to the transmission / reception unit 41 .

[0147] For example, the detection units 42 in the detection devices 304A and 304C generate response data generation information Ga and Gc and a verification start command at transmission timing ta and output them to the transmission / reception unit 41, respectively, and the detection units 42 in the detection devices 304B and 304D generate response data generation information Gb and Gd and a verification start command at transmission timing tb, which is different from the transmission timing ta, and output them to the transmission / reception unit 41, respectively.

[0148] The transmitting / receiving unit 41 transmits the response data generation information G to the corresponding response devices 104, 105 via the transmission line 3. More specifically, the transmitting / receiving unit 41 in the detection device 304A receives the response data generation information Ga from the detection unit 42, and transmits the received response data generation information Ga and a verification start command in a message to the response devices 104, 105 via the transmission line 3A.

[0149] (Transmission of response data R) The following describes the transmission of response data R by the response devices 104 and 105. Unless otherwise specified, the following content regarding the transmission of response data R is common to the response devices 104A, 104B, 104C, 104D, 105A, 105B, 105C, and 105D.

[0150] FIG. 10 is a diagram illustrating the configuration of a response device in a detection system according to a second embodiment of the present disclosure. Referring to FIG. 10 , the response device 104 includes a connection switch 50 and a response unit 60. The response unit 60 includes a communication unit 61, a processing unit 63, and a storage unit 64. The communication unit 61 is an example of a receiving unit and an example of a transmitting unit. The processing unit 63 is an example of a generating unit. A part or all of the communication unit 61 and the processing unit 63 may be realized by, for example, a processing circuit including one or more processors. The storage unit 64 is, for example, a non-volatile memory included in the processing circuit. The storage unit 64 stores key information K unique to the response device 104. The connection switch 50 connects or disconnects the transmission line 4 and the switch device 141. The communication unit 61 and the switch device 141 may or may not be connected via the connection switch 50, and the connection state may be switchable. The transmission line 4 and the communication unit 61 may be always connected via the connection switch 50, or may be disconnected when the transmission line 4 and the switch device 141 are connected.

[0151] The response device 105 includes a connection switch 70 and a response unit 80. The response unit 80 includes a communication unit 81, a processing unit 83, and a storage unit 84. The communication unit 81 is an example of a receiving unit and an example of a transmitting unit. The processing unit 83 is an example of a generating unit. Part or all of the communication unit 81 and the processing unit 83 are realized, for example, by a processing circuit including one or more processors. The storage unit 84 is, for example, a non-volatile memory included in the processing circuit. The storage unit 84 stores key information K unique to the response device 105. The connection switch 70 connects and disconnects the transmission line 4 and the communication device 112. The communication unit 81 and the communication device 112 may or may not be connected via the connection switch 70, or the connection state may be switchable. Note that the transmission line 4 and the communication unit 81 may always be connected via the connection switch 70, or may be disconnected when the transmission line 4 and the communication device 112 are connected.

[0152] The processing unit 63 in the response device 104 outputs a control signal to the connection switch 50, thereby switching the state of the connection switch 50 between a first state in which the transmission line 4 and the switch device 141 are electrically connected, and a second state in which the transmission line 4 and the switch device 141 are not connected and the transmission line 4 is electrically connected to the communication unit 61. The processing unit 63 sets the state of the connection switch 50 to the first state during a communication period Pc, which is a period in which communication is performed using the transmission line 4.

[0153] The processing unit 83 in the response device 105 outputs a control signal to the connection switch 70, thereby switching the state of the connection switch 70 between a third state in which the transmission line 4 and the communication device 112 are electrically connected, and a fourth state in which the transmission line 4 and the communication device 112 are not connected, and the transmission line 4 is electrically connected to the communication unit 81. The processing unit 68 sets the state of the connection switch 70 to the third state during the communication period Pc.

[0154] In the response device 105, the communication unit 81 receives a message from the detection device 304 via the transmission line 3 and acquires response data generation information G from the received message. The communication unit 81 outputs the acquired response data generation information G to the processing unit 83. The processing unit 83 receives the response data generation information G from the communication unit 81 and outputs a control signal to the connection switch 70, thereby switching the state of the connection switch 70 to the fourth state described above. Furthermore, the processing unit 83 uses the response data generation information G and key information K in the storage unit 84 to generate response data R including the ID of the response device 105 that generated the response data R.

[0155] In the response device 104, the communication unit 61 receives a message from the detection device 304 via the transmission line 3 and acquires response data generation information G from the received message. The communication unit 61 outputs the acquired response data generation information G to the processing unit 63. The processing unit 63 receives the response data generation information G from the communication unit 61 and outputs a control signal to the connection switch 50, thereby switching the state of the connection switch 50 to the second state described above. The processing unit 63 also generates response data R including the ID of the response device 104 that generated the response data R, using the response data generation information G and key information K in the storage unit 64. The processing unit 63 also outputs a transmission command to the communication unit 61 indicating that the response data R should be transmitted. The communication unit 61 includes the transmission command received from the processing unit 63 in an Ethernet frame and transmits it to the response device 105 via the connection switch 50 and the transmission line 4.

[0156] In the response device 105, the communication unit 81 receives an Ethernet frame from the response device 104 via the transmission line 4 and the connection switch 70, acquires a transmission command from the received Ethernet frame, and outputs the acquired transmission command to the processing unit 83. The processing unit 83 receives the transmission command from the communication unit 81 and outputs response data R generated using response data generation information G and key information K to the communication unit 81. The communication unit 81 includes the response data R received from the processing unit 63 in an Ethernet frame and transmits it to the response device 104 via the connection switch 70 and the transmission line 4. Note that the response device 104 may be configured not to transmit a transmission command to the response device 105. In this case, the response device 105 receives a message including response data generation information G from the detection device 304 and spontaneously transmits the response data R to the response device 104.

[0157] In the response device 104, the communication unit 61 acquires response data R from the Ethernet frame received via the transmission line 4 and the connection switch 50 during the reception period TRa, and outputs the acquired response data R to the processing unit 63. The processing unit 63 receives the response data R from the communication unit 61 and performs predetermined processing on the received response data R and the generated response data R, thereby generating aggregated data Rx2 with a data amount smaller than the total data amount of the two response data R. The processing unit 63 outputs the generated aggregated data Rx2 to the communication unit 61. The communication unit 61 generates a message including the aggregated data Rx2 received from the processing unit 63, and transmits the generated message to the detection device 304 via the transmission line 3.

[0158] 9, the transmitter / receiver 41 in the detection device 304 receives, via the transmission line 3, aggregated data Rx2, which is an aggregate of response data R generated by the response devices 104 and 105. The detection unit 42 performs detection processing to detect an abnormality in the network NW2, based on reference information RF2 based on the configuration of the network NW2 and the aggregated data Rx2 received by the transmitter / receiver 41. The detection processing in the detection device 304A will be described below as a representative example.

[0159] For example, the storage unit 43 in the detection device 304A stores reference information RF2a indicating two types of key information K for the response devices 104A and 105A connected to the transmission line 4A.

[0160] The transmitter / receiver 41 in the detection device 304A receives a message from the response device 104 via the transmission line 3A. The transmitter / receiver 41 acquires aggregated data Rx2a from the received message and outputs the acquired aggregated data Rx2a to the detection unit 42.

[0161] The detection unit 42 uses the response data generation information Ga sent to the response devices 104A, 105A via the transmission / reception unit 41 and each key information K in the memory unit 43 to generate two generated data Ma corresponding to the two response data Ra respectively corresponding to the response devices 104A, 105A connected to the transmission line 3A.

[0162] The detection unit 42 compares the aggregated data Rx2a received from the transmission / reception unit 41 with the generated data Ma corresponding to the response device 104A and the generated data Ma corresponding to the response device 105A. For example, the detection unit 42 determines that the detection condition C1 is satisfied if at least one of the two response data Ra aggregated in the aggregated data Rx2a does not match the corresponding generated data Ma. On the other hand, the detection unit 42 determines that the detection condition C1 is not satisfied if the two response data Ra aggregated in the aggregated data Rx2a received by the transmission / reception unit 41 match the two generated generated data Ma, respectively.

[0163] Furthermore, the detection unit 42 determines that the detection condition C2 is satisfied when the number of response data R aggregated in the aggregated data Rx2a is not 2. On the other hand, the detection unit 42 determines that the detection condition C2 is not satisfied when the number of response data R aggregated in the aggregated data Rx2a is 2.

[0164] The detection unit 42 also checks whether or not response data R has been received by the transmission / reception unit 41 during a period other than the reception period TRa. For example, if response data R has been received by the transmission / reception unit 41 separately from the aggregated data Rx2a, the detection unit 42 determines that detection condition C3 is satisfied. On the other hand, if response data R has not been received by the transmission / reception unit 41 separately from the aggregated data Rx2a, the detection unit 42 determines that detection condition C3 is not satisfied.

[0165] In the detection process, the detection unit 42 detects an abnormality in the network NW2a based on the determination result of whether or not the detection conditions C1, C2, and C3 are satisfied. More specifically, when the detection unit 42 determines that at least one of the detection conditions C1, C2, and C3 is satisfied, it determines that an abnormality has occurred in the network NW2a.

[0166] For example, if detection condition C1 is satisfied, the detection unit 42 determines that there is an unauthorized device masquerading as the response devices 104A and 105A. Furthermore, for example, if detection condition C2 is satisfied and the number of response data R aggregated in the aggregated data Rx2a is less than two, the detection unit 42 determines that a path blockage has occurred in the network NW2a. Furthermore, for example, if detection condition C2 is satisfied and the number of response data R aggregated in the aggregated data Rx2a is more than two, or if detection condition C3 is satisfied, the detection unit 42 determines that a detour has been inserted in the network NW2a.

[0167] When the detection unit 42 determines that an abnormality has occurred in the network NW2a, it includes abnormality information indicating the occurrence of the abnormality in a message and transmits the message to the response devices 104A, 105A via the transmission line 3A. The detection unit 42 also notifies the user of the detection system 404 that an abnormality has occurred in the network NW2a by voice or display. The detection unit 42 may be configured not to transmit the abnormality information to the response devices 104A, 105A and / or notify the user. The detection unit 42 may also be configured to transmit a message indicating that an abnormality has occurred in the network NW2a to a user terminal owned by the user via a network (not shown).

[0168] 10 again, for example, when the processing unit 83 in the response device 105A receives abnormality information from the detection device 304A via the transmission line 3A and the communication unit 81, it cuts off the electrical connection between the transmission line 4A and the communication device 112A in the connection switch 70. Note that the processing unit 83 may be configured not to cut off the electrical connection between the transmission line 4A and the communication device 112A.

[0169] Furthermore, in the response device 104, the processing unit 63 may be configured to output the response data R generated in the response device 105 and the response data R generated by the processing unit 63 to the communication unit 61, instead of generating the aggregate data Rx2. In this case, the communication unit 61 generates a message including the two pieces of response data R received from the processing unit 63, and transmits the generated message to the detection device 304 via the transmission line 3.

[0170] In addition, the response device 104 may be configured, similar to the detection device 304, to detect abnormalities in the networks NW2a and NW2b based on the number of response data R received from the response device 104 and the timing of receiving the response data R.

[0171] Furthermore, in addition to the response devices 104, 105 and the detection device 304, or instead of the response devices 104, 105 and the detection device 304, the detection system 404 may be configured to include two response devices attached to the gateway device 122 and the switch device 141, respectively, and connected to each other via the transmission line 5, and a detection device that detects abnormalities in the network including the gateway device 122, the switch device, and the transmission line 5. In this case, the detection device detects a path interruption and an insertion of a detour between the gateway device 122 and the switch device based on the response data R received from the two response devices.

[0172] Furthermore, as described above, the detection system 404 is not limited to a configuration including four detection devices 304, but may be configured to include one detection device 304 that monitors all of the network NW2. In this case, the detection device 304 transmits response data generation information Ga to the response devices 104A and 105A via transmission line 3A, response data generation information Gb to the response devices 104B and 105B via transmission line 3B, response data generation information Gc to the response devices 104C and 105C via transmission line 3C, and response data generation information Gd to the response devices 104D and 105D via transmission line 3D. The detection device 304 then detects an abnormality in the network NW2a based on the reference information RF2a and the aggregated data Rx2a and Rx2b, and detects an abnormality in the network NW2b based on the reference information RF2b and the aggregated data Rx2c and Rx2d.

[0173] 11 is a diagram illustrating the configuration of a detection system according to Modification 3 of the second embodiment of the present disclosure. With reference to FIG. 11 , detection system 405 includes detection device 305 instead of detection device 304, response devices 106A, 106B, 106C, and 106D that are response device 106 instead of response devices 104A, 104B, 104C, and 104D, and response devices 107A, 107B, 107C, and 107D that are response device 107 instead of response devices 105A, 105B, 105C, and 105D.

[0174] The detector 305 is connected to the gateway device 122 via a transmission line 6. The transmission line 6 is, for example, an Ethernet cable.

[0175] During the detection period Pd, the detection device 305 transmits response data generation information G, which is used to generate response data R, to the response devices 106 and 107. More specifically, the detection device 305 sets detection periods Pda, Pdb, Pdc, and Pdd, which are four periods that divide the detection period Pd. During the detection period Pda, the detection device 305 includes response data generation information Ga in an Ethernet frame and transmits it via multicast to the response devices 106A and 107A. Furthermore, during the detection period Pdb, the detection device 305 includes response data generation information Gb in an Ethernet frame and transmits it via multicast to the response devices 106B and 107B. Furthermore, during the detection period Pdc, the detection device 305 includes response data generation information Gc in an Ethernet frame and transmits it via multicast to the response devices 106C and 107C. Furthermore, the detecting device 305 includes response data generation information Gd in an Ethernet frame and transmits the frame by multicast to the responding devices 106D and 107D during the detection period Pdd.

[0176] 12 is a diagram illustrating the configuration of a response device in a detection system according to a third modification of the second embodiment of the present disclosure. Referring to Fig. 12, the response device 106 is different from the response device 104 in that it includes a relay unit 51 instead of the connection switch 50. The response device 107 is different from the response device 105 in that it includes a relay unit 71 instead of the connection switch 70. The relay units 51 and 71 perform relay processing of Ethernet frames.

[0177] 11 , the response device 106 receives response data generation information G from the detection device 305 via the gateway device 122 and the corresponding switch device 141, and generates response data R based on the received response data generation information G. The response device 106 includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the corresponding switch device 141 and gateway device 122.

[0178] The response device 107 receives response data generation information G from the detection device 305 via the gateway device 122, the corresponding switch device 141, and the corresponding response device 106, and generates response data R based on the received response data generation information G. The response device 107 includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the corresponding response device 106, the corresponding switch device 141, and the gateway device 122.

[0179] Similar to the detection device 304, the detection device 305 detects an abnormality in the network NW2 based on reference information RF2 based on the configuration of the network NW2 and response data R transmitted by the response devices 106 and 107. Unlike the detection system 404, the detection system 405 can detect an abnormality in the network NW2 without using the transmission line 3.

[0180] The detection system 405 may be configured to include two response devices, in addition to or instead of the response devices 106 and 107, that are attached to the gateway device 122 and the switch device 141, respectively, and connected to each other via the transmission line 5. In this case, the detection device 305 detects a path interruption and an insertion of a detour between the gateway device 122 and the switch device, based on the response data R received from the two response devices.

[0181] [Operation Flow] Fig. 13 is a diagram showing an example of a sequence of a detection process in the detection system according to the second embodiment of the present disclosure. Fig. 13 shows the detection process in the detection device 304A.

[0182] 13, first, when transmission timing ta arrives, detection device 304A transmits response data generation information Ga to response devices 104A and 105A via transmission line 3A (step S31).

[0183] Next, the response device 104A switches the state of the connection switch 50 to the second state described above, and the response device 105A switches the state of the connection switch 70 to the fourth state described above (step S32).

[0184] Next, the response devices 104A and 105A generate response data Ra using the response data generation information Ga received from the detection device 304A and the key information K (step S33).

[0185] Next, the response device 104A transmits the transmission command to the response device 105A via the transmission line 4A (step S34).

[0186] Next, the response device 105A receives the transmission command and transmits the response data Ra to the response device 104A via the transmission line 4A (step S35).

[0187] Next, the response device 104A generates aggregated data Rx2a in which the response data Ra received from the response device 105A and the generated response data Ra are aggregated (step S36).

[0188] Next, the response device 104A transmits the generated aggregate data Rx2a to the detection device 304A via the transmission line 3A (step S37).

[0189] Next, the detecting device 304A performs a detecting process based on the reference information RF2a based on the configuration of the network NW2a and the aggregated data Rx2A received from the response device 104A (step S38).

[0190] FIG. 14 is a diagram illustrating an example of a sequence of a detection process in a detection system according to a third modification of the second embodiment of the present disclosure.

[0191] 14, first, when transmission timing ta arrives, detection device 305 includes response data generation information Ga in an Ethernet frame and transmits the frame by multicast to response devices 106A and 107A (step S41).

[0192] Next, the response devices 106A and 107A generate response data Ra using the response data generation information Ga received from the detection device 305 and the key information K (step S42).

[0193] Next, the response device 106A includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the switch device 141A and the gateway device 122 (step S43).

[0194] The response device 107A also includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the response device 106A, the switch device 141A, and the gateway device 122 (step S44).

[0195] Next, the detecting device 305 performs a detecting process based on the reference information RF2a based on the configuration of the network NW2a and the response data Ra received from the response devices 106A and 107A (step S45).

[0196] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0197] The above description includes the features noted below. [Supplementary Note 1] A detection system comprising: a detection device; and a response device, wherein the detection device transmits response data generation information used to generate response data to the response device via a first transmission path, the response device transmits the response data based on the response data generation information received from the detection device to the detection device via a second transmission path, the detection device detects an abnormality in the network based on reference information based on a network configuration and the response data transmitted by the response device, the first transmission path is a dedicated line used to detect an abnormality in the network, the second transmission path is a main transmission path for transmitting a main signal in the network, and the network includes the response device and the second transmission path.

[0198] 1, 1A, 1B, 2, 2A, 2B, 2C, 3, 3A, 3B, 3C, 3D, 4, 4A, 4B, 4C, 4D, 5, 5A, 5B, 6 Transmission line 2A1, 2A2 Transmission path 10 Connection unit 20 Response unit 21 Reception unit 22 Transmission unit 23 Processing unit (generation unit) 24 Memory unit 31 Transmission unit 32 Reception unit 33 Detection unit 34 Memory unit 41 Transmission / reception unit (transmission unit, reception unit) 42 Detection unit 43 Memory unit 50 Connection switch 51 Relay unit 60 Response unit 61 Communication unit (transmission unit, reception unit) 63 Processing unit (generation unit) 64 Memory unit 70 Connection switch 71 Relay unit 80 Response unit 81 Communication unit (transmission unit, reception unit) 83 Processing unit (generation unit) 84 Storage unit 101, 101A, 101B, 102, 102A, 102C, 103A, 104, 104A, 104B, 104C, 104D, 105, 105A, 105B, 105C, 105D, 106, 106A, 106B, 106C, 106D, 107, 107A, 107B, 107C, 107D Response device 111, 111A, 111B, 111C, 112, 112A, 112B, 112C, 112D Communication equipment 121, 122 Gateway device 141, 141A, 141B Switch device 201, 201A, 201B Aggregation device 301, 301A, 301B, 302, 303, 304, 304A, 304B, 304C, 304D, 305 Detection device 401, 402, 403, 404, 405 Detection system NW, NWa, NWb, NWc, NW1a, NW2, NW2a, NW2b Network

Claims

1. A detection system comprising: a response device; and a detection device that detects an abnormality in a network including the response device and a transmission path, wherein the detection device transmits response data generation information used to generate response data to the response device via a first transmission path, the response device generates the response data based on the response data generation information received from the detection device and transmits the generated response data to the detection device via a second transmission path, and the detection device detects an abnormality in the network based on reference information based on a configuration of the network and the response data transmitted by the response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

2. The detection system of claim 1, wherein the first transmission path is the main transmission path and the second transmission path is a dedicated line used for detecting abnormalities in the network, or the second transmission path is the main transmission path and the first transmission path is a dedicated line used for detecting abnormalities in the network.

3. The detection system according to claim 2, wherein the first transmission path is the dedicated line, and the second transmission path is the main transmission path.

4. A detection system as described in any one of claims 1 to 3, wherein the response device generates the response data further based on unique information of the response device and transmits the generated response data to the detection device via the second transmission path, the reference information includes the unique information, and the detection device generates generated data based on the unique information included in the reference information and the response data generation information transmitted to the response device, compares the received response data with the generated data, and detects an abnormality in the network based on the comparison result.

5. A detection system according to any one of claims 1 to 4, wherein the detection device detects an anomaly in the network based on the number of response data received.

6. A detection system according to any one of claims 1 to 5, wherein the detection device detects an anomaly in the network based on a reception timing of the received response data.

7. A detection system as described in any one of claims 1 to 6, wherein the first logical transmission path and the second logical transmission path are provided using a common physical transmission line, and the detection device and the response device multiplex and transmit the response data generation information and the response data on the transmission line.

8. The detection system according to any one of claims 1 to 7, further comprising an aggregation device, which generates aggregated data by aggregating the response data respectively generated by the response devices, and transmits the generated aggregated data to the detection device.

9. A system comprising: a first response device; a second response device; and a detection device that detects an abnormality in a network including the first response device, the second response device, and a transmission path, wherein the detection device transmits response data generation information used for generating response data to the first response device and the second response device via a first transmission path, the first response device generates first response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated first response data to the second response device via a second transmission path, the second response device generates second response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated second response data and the first response data received from the first response device to the detection device, A detection system, wherein the detection device detects an abnormality in the network based on reference information based on a configuration of the network, the first response data transmitted by the first response device, and the second response data transmitted by the second response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

10. A detection device comprising: a transmitting unit that transmits response data generation information used to generate response data to a response device in a network via a first transmission path; a receiving unit that receives the response data based on the response data generation information, the response data transmitted by the response device via a second transmission path; and a detection unit that detects an abnormality in the network based on reference information based on the configuration of the network and the response data received by the receiving unit, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

11. A response device attached to a communication device in a network, comprising: a receiving unit that receives response data generation information used to generate response data from a detection device that detects an abnormality in the network via a first transmission path; a generating unit that generates the response data based on the response data generation information received by the receiving unit; and a transmitting unit that transmits the response data generated by the generating unit to another device via a second transmission path, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

12. A response device comprising: a receiving unit that receives response data generation information used to generate response data from a detection device that detects network abnormalities via a first transmission path; a generating unit that generates the response data based on the response data generation information received by the receiving unit; and a transmitting unit that transmits the response data generated by the generating unit to another device via a second transmission path, wherein the first transmission path is a main transmission path that transmits a main signal in the network, and the second transmission path is a dedicated line used to detect abnormalities in the network, or the second transmission path is the main transmission path, and the first transmission path is a dedicated line used to detect abnormalities in the network.

13. A detection method in a detection system comprising a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, comprising the steps of: the detection device transmitting response data generation information used to generate response data to the response device via a first transmission path; the response device generating the response data based on the response data generation information received from the detection device and transmitting the generated response data to the detection device via a second transmission path; and the detection device detecting an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

Images