Monitoring apparatus, monitoring system, monitoring method, and program

Abstract

This invention appropriately determines the state of a device while suppressing information leakage and an increase in the computation load. This monitoring apparatus includes: an acquisition unit that acquires first encrypted data, which is data obtained by encrypting first data relating to a device to be monitored by using a first method, which is a TFHE method, and acquires second encrypted data, which is data obtained by encrypting time-series second data relating to the device by using a second method, which is different from the first method; an index value calculation unit that calculates, on the basis of the second encrypted data, a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method; a conversion unit that converts the second encrypted index value into a first encrypted index value encrypted using the first method; and a determination unit that calculates, on the basis of the first encrypted data and the first encrypted index value, an encryption determination result, which is a determination result with respect to the state of the device encrypted using the first method.

Description

Monitoring device, monitoring system, monitoring method and program

[0001] This disclosure relates to monitoring devices, monitoring systems, monitoring methods, and programs.

[0002] To suppress information leakage about monitored devices, there are known technologies that encrypt device data and monitor devices based on the encrypted data. For example, Patent Document 1 describes a method in which user system data is encrypted and transmitted to a non-decryption cloud service, where the non-decryption cloud service determines whether the encrypted data meets the specifications and outputs the result of that determination. Non-Patent Document 1 describes a technology in which secure computation is performed using data encrypted with TFHE (Fully Homomorphic Encryption), and the determination result for that data is output in a TFHE encrypted state. Non-Patent Document 2 describes a technology in which secure computation is performed using data encrypted with CKKS (Cheon-Kim-Kim-Song) to calculate an index value used to determine whether or not there is a device abnormality, the result is converted to TFHE, secure computation is performed on the converted data to TFHE to determine if there is an abnormality, and the determination result is output in a TFHE encrypted state.

[0003] Patent No. 6900340 R. Banno et al. , “Oblivious Online Monitoring for Safety LTL Specification via Fully Homomorphic Encryption,” in Computer Aided Verification - 34th International Conference, CAV 2022, Proceedings, Part I, S. Shoham and Y. Vizel, Eds. , Springer, 2022, pp. 447.468. Masaki Waga et al. , “Oblivious Monitoring for Discrete-Time STL via Fully Homomorphic Encryption”

[0004] In Patent Document 1, although leakage of device data can be suppressed, since the determination result is output in an unencrypted state, there is a risk that the determination result may leak. In Non-Patent Document 1, by using the TFHE method, the determination result can be output in an encrypted state, so leakage of the determination result can be suppressed. However, in the secret calculation of the TFHE method, although it is possible to determine whether the data itself is abnormal, it is not possible to determine the state of the device that is not apparent in the device data itself. Also, in Non-Patent Document 2, although it is possible to perform an abnormality determination on the index value calculated from the device data, since the process of converting the CKKS ciphertext to the TFHE cipher has a high computational load, it is desirable to encrypt only the data related to the calculation of the index value with CKKS. Therefore, there is room for improvement in appropriately determining the state of the device while appropriately suppressing information leakage and an increase in computational load.

[0005] The present disclosure solves the above-described problems, and an object thereof is to provide a monitoring device, a monitoring system, a monitoring method, and a program capable of appropriately determining the state of a device while appropriately suppressing information leakage and an increase in computational load.

[0006] The monitoring device according to the present disclosure includes an acquisition unit that acquires first encrypted data that is first data related to a device to be monitored and encrypted by a first method that is the TFHE method, and second encrypted data that is time-series second data related to the device and encrypted by a second method different from the first method; an index value calculation unit that calculates a second encrypted index value, which is an index value indicating the state of the device encrypted by the second method, based on the second encrypted data; a conversion unit that converts the second encrypted index value into a first encrypted index value encrypted by the first method; and a determination unit that calculates an encrypted determination result, which is a determination result of the state of the device encrypted by the first method, based on the first encrypted data and the first encrypted index value.

[0007] The monitoring system according to the present disclosure includes the monitoring device and a management device that encrypts the first data to generate the first encrypted data, encrypts the second data to generate the second encrypted data, and transmits the first encrypted data and the second encrypted data to the monitoring device.

[0008] The monitoring method relating to this disclosure includes the steps of: acquiring first encrypted data, which is data encrypted using a first method in which first data relating to a device to be monitored is the TFHE method; and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; calculating a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; converting the second encrypted index value into a first encrypted index value encrypted using the first method; and calculating an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

[0009] The program relating to this disclosure causes a computer to perform the following steps: acquire first encrypted data, which is data encrypted using a first method in which first data relating to a monitored device is the TFHE method; second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; calculate a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; convert the second encrypted index value into a first encrypted index value encrypted using the first method; and calculate an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

[0010] According to this disclosure, it is possible to appropriately determine the status of the equipment while appropriately suppressing information leakage and increased computational load.

[0011] Figure 1 is a schematic block diagram of the monitoring system according to the embodiment. Figure 2 is a schematic block diagram of the management device. Figure 3 is a schematic block diagram of the monitoring device. Figure 4 is a flowchart explaining key acquisition. Figure 5 is a flowchart explaining automaton generation. Figure 6 is a schematic diagram explaining the monitoring process. Figure 7 is a flowchart explaining the processing flow of the monitoring process according to the embodiment. Figure 8 is a schematic diagram explaining the monitoring process in the second embodiment.

[0012] Preferred embodiments of the present disclosure will be described in detail below with reference to the attached drawings. However, this disclosure is not limited to these embodiments, and if there are multiple embodiments, they may be combinations of these embodiments.

[0013] (Monitoring System) Figure 1 is a schematic block diagram of the monitoring system according to this embodiment. The monitoring system 1 according to this embodiment is a system that monitors whether there is an abnormality in the operation of the equipment 100 to be monitored. As shown in Figure 1, the monitoring system 1 includes a management device 10 and a monitoring device 12. In the example of Figure 1, there is one equipment 100 to be monitored, but there may be multiple equipment 100s, and the monitoring system 1 may monitor multiple equipment 100s. In this embodiment, the monitoring device 12 is installed in a location separate from the equipment 100 and the management device 10 (in a different facility), and the managing entity of the monitoring device 12 is different from the managing entity of the equipment 100 and the management device 10. Also, both the equipment 100 and the management device 10 may be installed in separate locations (in a different facility), and the managing entity of the equipment 100 and the managing entity of the management device 10 may be different. However, the managing entity of the equipment 100 and the managing entity of the management device 10 may be the same.

[0014] (Equipment) Equipment 100 is a device that is monitored by the monitoring system 1. Equipment 100 may consist of one device or a system consisting of multiple devices. Equipment 100 may be a device for any purpose, for example, it may be equipment installed in a plant, or it may be a mobile device, etc.

[0015] In this embodiment, the monitoring system 1 monitors the device 100 based on device data. The device data is data relating to the device 100.

[0016] (Management Device) Figure 2 is a schematic block diagram of the management device. The management device 10 is a device that acquires device data from the device 100, and can also be said to be a device that manages the device 100. The management device 10 may be a device that also functions as a control device that controls the device 100 (i.e., a device integrated with the control device), or it may be a device different from the control device that controls the device 100 (i.e., a device separate from the control device). As shown in Figure 2, the management device 10 is a computer and has an input unit 20, an output unit 22, a communication unit 24, a storage unit 26, and a control unit 28. The management device 10 may be a standalone device, may be integrated with other devices, or may be configured as a system combining various devices such as an arithmetic unit and a data server, and is not particularly limited.

[0017] The input unit 20 is a device that accepts user input and may be, for example, a mouse, keyboard, or touch panel. The output unit 22 is a device that outputs information and may be, for example, a display that shows images. The communication unit 24 is a module that communicates with external devices such as equipment 100 or monitoring device 12 and may include, for example, an antenna. In this embodiment, the communication method used by the communication unit 24 is wireless communication, but the communication method may be arbitrary.

[0018] The storage unit 26 is a memory that stores various information such as the calculation contents and programs of the control unit 28, and includes at least one of the following: a main memory device such as RAM (Random Access Memory) and ROM (Read Only Memory), and an external memory device such as an HDD (Hard Disk Drive). The program for the control unit 28 stored in the storage unit 26 may be stored on a recording medium that can be read by the management device 10.

[0019] The control unit 28 is an arithmetic unit and includes arithmetic circuits such as a CPU (Central Processing Unit) and a GPU (Graphics Processing Unit). The control unit 28 executes processing by reading and executing a program (software) from the storage unit 26.

[0020] The control unit 28 includes a key generation unit 30, a data acquisition unit 32, an encryption unit 34, a decryption unit 36, and an output control unit 38. The control unit 28 reads a program (software) from the storage unit 26 and executes it to realize the key generation unit 30, the data acquisition unit 32, the encryption unit 34, the decryption unit 36, and the output control unit 38, and then executes their processing. The control unit 28 may execute these processes using a single arithmetic circuit, or it may have multiple arithmetic circuits and execute the processing using those multiple arithmetic circuits. Furthermore, at least a portion of the processing of the key generation unit 30, the data acquisition unit 32, the encryption unit 34, the decryption unit 36, and the output control unit 38 may be realized by hardware circuits.

[0021] The processing performed by the control unit 28 will be described later.

[0022] (Monitoring Device) Figure 3 is a schematic block diagram of the monitoring device. The monitoring device 12 is a device that monitors the equipment 100. As shown in Figure 3, the monitoring device 12 is a computer and has an input unit 40, an output unit 42, a communication unit 44, a storage unit 46, and a control unit 48. The monitoring device 12 may be configured as a standalone device, as an integral part of other devices, or as a system combining various devices such as a computing unit and a data server, and is not particularly limited.

[0023] The input unit 40 is a device that accepts user input and may be, for example, a mouse, keyboard, or touch panel. The output unit 42 is a device that outputs information and may be, for example, a display that shows images. The communication unit 44 is a module that communicates with external devices such as the management device 10 and may include, for example, an antenna. In this embodiment, the communication method used by the communication unit 44 is wireless communication, but the communication method may be arbitrary. In this embodiment, the monitoring device 12 does not communicate directly with the device 100 and is configured not to acquire device data from the device 100.

[0024] The storage unit 46 is a memory that stores various information such as the calculation contents and programs of the control unit 48, and includes at least one of the following: RAM, main memory such as ROM, and external storage device such as HDD. The program for the control unit 48 stored in the storage unit 46 may be stored on a recording medium that can be read by the monitoring device 12.

[0025] The control unit 48 is an arithmetic unit and includes arithmetic circuits such as a CPU and GPU. The control unit 48 executes processing by reading and executing a program (software) from the storage unit 46.

[0026] The control unit 48 includes an acquisition unit 50, a specification setting unit 52, an index value calculation unit 54, a conversion unit 56, a determination unit 58, and an output control unit 60. The control unit 48 reads a program (software) from the storage unit 46 and executes it to realize the acquisition unit 50, the specification setting unit 52, the index value calculation unit 54, the conversion unit 56, the determination unit 58, and the output control unit 60, and performs their processing. The control unit 48 may perform these processing using one arithmetic circuit, or it may have multiple arithmetic circuits and perform the processing using those multiple arithmetic circuits. Furthermore, at least a part of the processing of the acquisition unit 50, the specification setting unit 52, the index value calculation unit 54, the conversion unit 56, the determination unit 58, and the output control unit 60 may be realized by hardware circuits.

[0027] The processing performed by the control unit 48 will be described later.

[0028] (Processing of the monitoring system) The processing of monitoring system 1 will be described below.

[0029] The monitoring system 1 remotely monitors the device 100 by acquiring the device data in an encrypted state using the monitoring device 12 and outputting the determination result of the device 100's status in an encrypted state. More specifically, the management device 10 encrypts the first data from the device data using the first method to obtain the first encrypted data, and encrypts the second data from the device data using the second method to obtain the second encrypted data. The monitoring device 12 then calculates a second encrypted index value, which is an index value indicating the status of the device 100 encrypted using the second method, based on the second encrypted data, and converts the second encrypted index value back into the first encrypted index value encrypted using the first method. The monitoring device 12 then calculates the determination result of the device 100's status in an encrypted state, based on the first encrypted data for the first data and the first encrypted index value for the second data. An explanation of encryption methods such as the first and second methods will be provided later.

[0030] (First Data) The first data may be any data included in the equipment data, but in this embodiment, it is information indicating the operating conditions of the equipment 100 (under what conditions it is operating). In this embodiment, the first data can also be described as a variable whose number of possible values ​​is limited to a predetermined number or less. In this embodiment, the first data is time-series data (data whose value may change as time progresses). For example, the first data may be an index value indicating the state of the environment around the equipment 100 (such as weather, temperature, and atmospheric pressure), a flag indicating the operating conditions of the equipment 100, or information indicating the operating mode of the equipment 100.

[0031] (Second Data) The second data is time-series data (data whose value can change over time) included in the equipment data. The second data may be any time-series data included in the equipment data, but in this embodiment it is different from the first data. More specifically, in this embodiment the second data is data indicating the operating state of the equipment 100 (what state the equipment 100 is in as a result of operation). Also in this embodiment the second data can be said to be a variable in which the number of possible numerical values ​​is greater than that of the first data (greater than a predetermined number). For example the second data may be measured values ​​of the operating state of the equipment 100 (for example, the temperature, pressure, speed, etc. of the equipment 100).

[0032] (Index Value) The index value refers to a value that indicates the state of device 100, calculated from the second data. In other words, the index value is not the data itself contained in the device data, but rather a feature that indicates the state of device 100, calculated using the second data. The index value may be a feature calculated from one type of second data, or it may be a feature calculated from multiple types of second data.

[0033] (Preprocessing) In this embodiment, the monitoring system 1 performs the following preprocessing steps in advance: obtaining an encryption key and generating an automaton for calculating the status determination result of the device 100, in order to monitor the device 100 using the monitoring device 12 (i.e., calculating the result of determining the state of the device 100). In other words, the monitoring system 1 monitors the device 100 after these preprocessing steps are completed. The preprocessing steps will be described in detail below.

[0034] (Key Acquisition) Figure 4 is a flowchart illustrating key acquisition. The key generation unit 30 of the management device 10 acquires the keys necessary for monitoring the equipment 100. Here, the key is data used to execute an algorithm that converts data into other data. As shown in Figure 4, in this embodiment, the key generation unit 30 acquires a first key, which is an encryption key for the first method; a second key, which is an encryption key for the second method, which is different from the first method; a calculation key for calculating an index value indicating the status of the equipment from the equipment data encrypted with the second method; and a conversion key for converting the data encrypted with the second method into data encrypted with the first method (step S10).

[0035] The first key is the encryption key for the first scheme. The first scheme is the TFHE (Fully Homomorphic Encryption) scheme. In other words, the first key is the data used to encrypt data using the first scheme (TFHE scheme) and to decrypt data encrypted using the first scheme (TFHE scheme). The key generation unit 30 may obtain the first key by any method, generate the first key by any method, or obtain the first key from another device.

[0036] The second key is the encryption key for the second method. In other words, the second key is the data used to encrypt data using the second method and to decrypt data encrypted using the second method. The second method is an encryption method different from the first method (TFHE method). More specifically, in this embodiment, the second method is an encryption method that can calculate an index value indicating the state of device 100 based on device data encrypted using that method (second method), while the data is encrypted using that method (second method). In other words, the second method is an encryption method that can calculate an encrypted index value from encrypted device data using secure computation. Furthermore, in this embodiment, the second method is an encryption method that can convert data encrypted using that method (second method) into data encrypted using the first method, or in other words, an encryption method that can directly convert data of the second method into data of the first method without decryption. An example of the second method is the CKKS (Cheon-Kim-Kim-Song) method. The key generation unit 30 may obtain the second key by any method, generate the second key by any method, or obtain the second key from another device.

[0037] The calculation key is a key (data) for calculating an index value indicating the state of device 100 from device data encrypted using the second method, while the index value remains encrypted using the second method. In other words, the calculation key is a key for performing the process of calculating an index value encrypted using the second method from device data encrypted using the second method, using secure computation. In this embodiment, the calculation key is a key for performing a relinaritation process to reduce the dimensionality of the ciphertext, but is not limited to that. The calculation key may be obtained by any method. For example, the key generation unit 30 may set the processing content for calculating the index value from the device data using secure computation based on the type of index value to be calculated and the type of device data used to calculate that index value, and generate data that can execute that processing content as the calculation key.

[0038] As described above, the conversion key is a key (data) for converting data encrypted using the second method back into data encrypted using the first method. In this embodiment, the conversion key is a key for performing bootstrapping, but is not limited to that. The conversion key may be obtained by any method. For example, the key generation unit 30 may generate the conversion key based on the first key and the second key.

[0039] The output control unit 38 of the management device 10 transmits the calculated key and conversion key acquired by the key generation unit 30 to the monitoring device 12 (step S12). The acquisition unit 50 of the monitoring device 12 acquires the calculated key and conversion key from the management device 10 and stores them in the storage unit 46. The monitoring device 12 does not acquire information on the first key and the second key, and does not store the information on the first key and the second key in the storage unit 46. As a result, the monitoring device 12 cannot decrypt the data encrypted using the first or second method, and information leakage of data related to the device 100 can be suppressed.

[0040] (Automata generation) The specification setting unit 52 of the monitoring device 12 generates an automaton for calculating the determination result of the state of the equipment 100 in an encrypted state. The method for generating the automaton will be described below.

[0041] Figure 5 is a flowchart illustrating the generation of an automaton. The specification setting unit 52 acquires information about the specifications (step S14). Here, the specifications refer to the specifications that the index value of the device 100 must satisfy. For example, in this embodiment, the specification setting unit 52 acquires the value indicated by the first data of the device 100 (here, the operating condition) and the numerical range that the index value must satisfy when the first data is that value, as information about the specifications. More specifically, the specification setting unit 52 acquires the value indicated by the first data of the device 100 (here, the operating condition) and the numerical range that the index value must satisfy at the time after the first data was acquired, when the first data is that value, as information about the specifications. That is, for example, if the first data is a flag indicating either true or false, the information about the specifications can be said to be information that shows temporal logic, such as "when the first data (flag) at time t1 is true, the index value at the next time t2 after time t1 is always greater than or equal to a predetermined threshold." Information about the specifications may be set in any way, for example, by the user or automatically by the management device 10. The specification setting unit 52 may acquire information about the specifications in any way, for example, by inputting it into the input unit 40 by the user or by receiving it from the management device 10.

[0042] The specification setting unit 52 sets a linear temporal logic expression representing the specifications based on the information about the specifications (step S16). For example, if the information about the specifications is that "when the first data (flag) at time t1 is true, then the index value at the next time t2 is always greater than or equal to a predetermined threshold," then the linear temporal logic expression can be expressed as G(p0 -> N(p1)). Here, p0 refers to the proposition that the first data is true, and p1 refers to the proposition that the index value at the next time is greater than or equal to a threshold. By inputting the first data and the index value into such a linear temporal logic expression representing the specifications, it is possible to calculate whether or not the index value satisfies the specifications, in other words, the result of determining the state of the device 100, as a solution.

[0043] The specification setting unit 52 converts a linear temporal logic formula indicating the specification into an automaton (step S18). That is, the specification setting unit 52 generates an automaton (i.e., an automaton capable of calculating the determination result of the state of the device 100) that can execute the linear temporal logic formula indicating the specification based on the linear temporal logic formula indicating the specification. The automaton here is preferably a deterministic finite automaton (DFA). By inputting the first data and the index value into such an automaton, it is possible to obtain, as a solution, whether the index value satisfies the specification, or in other words, the determination result of the state of the device 100.

[0044] The specification setting unit 52 constructs an automaton (secret calculation circuit) that can also handle data encrypted in the first method from the generated automaton. That is, the automaton generated by the specification setting unit 52 outputs the determination result of the state of the device 100 (information on whether the index value satisfies the specification) in a state encrypted in the first method when the first data and the index value (the combined ciphertext described later) encrypted in the first method are input.

[0045] In the above description, the specification setting unit 52 generates the linear temporal logic formula and the automaton by itself based on the information regarding the specification. However, it is not limited to generating the linear temporal logic formula and the automaton by itself. For example, the specification setting unit 52 may obtain a linear temporal logic formula generated by another device such as the management device 10, generate an automaton from the obtained linear temporal logic formula, or obtain an automaton generated by another device such as the management device 10.

[0046] (Monitoring process) Next, the monitoring process of the device 100 will be described. FIG. 6 is a schematic diagram for explaining the monitoring process.

[0047] (Obtaining device data) As shown in FIG. 6, the management device 10 obtains the device data of the device 100 by the data acquisition unit 32. The data acquisition unit 32, for example, obtains the device data from the device 100. The data acquisition unit 32 sequentially obtains the device data at predetermined time intervals.

[0048] In this embodiment, the data acquisition unit 32 acquires the first data and the second data as device data. The data acquisition unit 32 acquires device data including the first data and the second data, and classifies the acquired device data into the first data and the second data. In other words, the data acquisition unit 32 extracts the first data and the second data from the acquired device data. However, the process of classifying the acquired device data into the first data and the second data is not essential, and the data acquisition unit 32 may acquire the first data and the second data individually in a state where they are distinguishable from each other.

[0049] The data acquisition unit 32 may acquire one type of first data or a plurality of types of first data. Similarly, the data acquisition unit 32 may acquire one type of second data, but in this embodiment, it is preferable to acquire a plurality of types of second data. Thereby, since an index value (feature amount) can be calculated from a plurality of second data, the state of the device 100 can be determined using the index value considering a plurality of types of second data.

[0050] (Generation of first encrypted data) The management device 10 generates first encrypted data in which the first data is encrypted in the first method by the encryption unit 34. The encryption unit 34 encrypts the first data with the first key to generate the first encrypted data. The encryption unit 34 encrypts the first data every time the first data is acquired to sequentially generate the first encrypted data. Also, when a plurality of types of first data are acquired, the encryption unit 34 may generate the first encrypted data for each first data, or encrypt the data obtained by integrating the plurality of first data to obtain one first encrypted data.

[0051] (Generation of Second Encrypted Data) The management device 10 uses the encryption unit 34 to encrypt the second data using the second method, thereby generating second encrypted data in which the second data has been encrypted using the second method. The encryption unit 34 encrypts the second data using the second key to generate second encrypted data. The encryption unit 34 encrypts the second data each time the second data is acquired, sequentially generating second encrypted data. Furthermore, if multiple types of second data are acquired, the encryption unit 34 may generate second encrypted data for each type of second data, or it may encrypt data that integrates multiple types of second data to create a single second encrypted data.

[0052] (Transmission of encrypted data) The management device 10 transmits the first encrypted data and the second encrypted data generated by the encryption unit 34 to the monitoring device 12 via the output control unit 38. The output control unit 38 transmits the first encrypted data and the second encrypted data to the monitoring device 12 each time the first encrypted data and the second encrypted data are generated.

[0053] (Acquisition of encrypted data) The monitoring device 12 acquires the first encrypted data and the second encrypted data transmitted from the management device 10 using the acquisition unit 50.

[0054] (Calculation of the second encrypted index value) The monitoring device 12 calculates the second encrypted index value based on the second encrypted data using the index value calculation unit 54. The second encrypted index value is an index value indicating the state of the device 100, encrypted using the second method. In this embodiment, the index value calculation unit 54 calculates the second encrypted index value using the calculation key obtained in the preprocessing. That is, the index value calculation unit 54 converts the second encrypted data into the second encrypted index value using the calculation key. It can be said that the index value calculation unit 54 calculates the index value in an encrypted state from the encrypted second encrypted data without decrypting the second encrypted data.

[0055] (Conversion to First Cryptographic Index Value) The monitoring device 12 converts the second cryptographic index value, encrypted using the second method, to the first cryptographic index value, encrypted using the first method, using the conversion unit 56. In other words, the first cryptographic index value can be said to be an index value indicating the state of the device 100, encrypted using the first method. In this embodiment, the conversion unit 56 converts the second cryptographic index value to the first cryptographic index value using the conversion key obtained in the preprocessing. The index value calculation unit 54 calculates the index value in the state encrypted using the first method (first cryptographic index value) from the index value in the state encrypted using the second method (second cryptographic index value) without decrypting the second cryptographic index value.

[0056] (Calculation of encryption determination result) The monitoring device 12 calculates an encryption determination result based on the first encrypted data (first data encrypted in the first method) and the first encrypted index value (index value encrypted in the first method) using the determination unit 58. The encryption determination result refers to the determination result of the state of the device 100 encrypted in the first method. The index value calculation unit 54 calculates the determination result of the state encrypted in the first method (encryption determination result) from the first data and index value (first encrypted data and first encrypted index value) of the state encrypted in the first method without decrypting the first encrypted data and the first encrypted index value. In this embodiment, the determination unit 58 calculates an encrypted determination result as the encryption determination result, which indicates whether the index value shown in the first encrypted index value satisfies the specifications that should be satisfied in the first data (operating conditions) shown in the first encrypted data.

[0057] The determination unit 58 may calculate the determination result (encryption determination result) of the state encrypted by the first method in any way based on the first encrypted data and the first encrypted index value, but an example of the calculation method in this embodiment will be described below. In this embodiment, the determination unit 58 combines the first encrypted data and the first encrypted index value to generate a combined ciphertext. The combined ciphertext refers to data (string) that includes the first encrypted data and the first encrypted index value, and can be said to be data that includes the first data and index value in the state encrypted by the first method. The determination unit 58 then inputs the combined ciphertext into the automaton acquired in the preprocessing, and obtains the data output from the automaton as the determination result (encryption determination result) of the state encrypted by the first method. Since the automaton executes temporal logic formulas as described above, the determination unit 58 calculates data as the encryption determination result that indicates whether the index value satisfies the temporal logic formula (for example, whether the index value satisfies the numerical range that it should satisfy at a time after the first data was acquired).

[0058] Each time the first encrypted data and the second encrypted data are acquired, the monitoring device 12 executes the process described above and sequentially calculates the encryption determination result.

[0059] (Transmission of encryption determination result) The monitoring device 12 transmits the encryption determination result to the management device 10 via the output control unit 60. The output control unit 60 transmits the encryption determination result to the management device 10 each time an encryption determination result is calculated.

[0060] (Decryption of encryption judgment results) The management device 10 decrypts the encryption judgment results obtained from the monitoring device 12 using the decryption unit 36 ​​to obtain the decrypted judgment result. The decryption unit 36 ​​decrypts the encryption judgment result with the first key to obtain the judgment result. The decryption unit 36 ​​decrypts the encryption judgment result each time an encryption judgment result is obtained to obtain the judgment result. As a result, the management device 10 can output the decrypted judgment result, so the management device 10 can check the judgment result of the status of the equipment 100 and manage the equipment 100 appropriately.

[0061] (Processing Flow) The monitoring process flow described above will now be explained. Figure 7 is a flowchart illustrating the monitoring process flow according to this embodiment. As shown in Figure 7, the management device 10 acquires device data of the device 100 (step S20) and generates first encrypted data and second encrypted data (step S22). The management device 10 encrypts the first data from the device data using the first method to generate first encrypted data, and encrypts the second data from the device data using the second method to generate second encrypted data. The management device 10 transmits the first encrypted data and the second encrypted data to the monitoring device 12.

[0062] The monitoring device 12 obtains the first encrypted data and the second encrypted data from the management device 10 (step S24). The monitoring device 12 calculates the second encrypted index value, which is an index value encrypted using the second method, from the second encrypted data (step S26), and converts the second encrypted index value to the first encrypted index value, which is an index value encrypted using the first method (step S28). Then, the monitoring device 12 combines the first encrypted data and the first encrypted index value to generate a combined ciphertext (step S30), inputs the combined ciphertext into an automaton, and calculates the encryption determination result (the determination result of the device 100 encrypted using the first method) (step S32). The monitoring device 12 transmits the encryption determination result to the management device 10.

[0063] The management device 10 decrypts the encryption determination result obtained from the monitoring device 12 to obtain the determination result of the decrypted device 100 (step S34).

[0064] (Effects) In this embodiment, the first data not used to calculate the index value is encrypted using the first method, which is the TFHE method, and the second data used to calculate the index value is encrypted using the second method, which is capable of secure computation. Then, the second encrypted index value (index value encrypted with the second method) is calculated from the second data (second encrypted data) encrypted with the second method by secure computation, and this is converted into the first encrypted index value encrypted with the first method. Then, using both the first encrypted index value (index value encrypted with the first method) and the first encrypted data (first data encrypted with the first data), the judgment result of the device 100 is calculated in an encrypted state using the first method. According to this embodiment, since the judgment result of the device 100 is calculated in an encrypted state, the leakage of the judgment result can be suppressed. Furthermore, by calculating a second encrypted index value from the second encrypted data encrypted using the second method using secure computation and converting it to a first encrypted index value using the first method, the state of the device, which is not expressed in the device data (second data) itself, can be determined using the second encrypted index value. Therefore, according to this embodiment, the state of the device 100 can be appropriately determined. Moreover, since the conversion process from the second encrypted data to the first encrypted data is computationally intensive, the overall computational load can be suppressed by encrypting only the data used to calculate the index value using the second method, calculating the index value using secure computation and converting it to the first encrypted data, while encrypting the data not used to calculate the index value using the first method and combining it with the first encrypted data obtained by conversion. Therefore, according to this embodiment, the state of the device 100 can be appropriately determined while suppressing information leakage and an increase in computational load.

[0065] (Second Embodiment) Next, a second embodiment will be described. The second embodiment differs from the first embodiment in that multiple automata are set up and the determination results from each automaton are obtained. In the second embodiment, the parts that have the same configuration as the first embodiment will not be explained.

[0066] Figure 8 is a schematic diagram illustrating the monitoring process in the second embodiment. In the second embodiment, the determination unit 58 sets multiple specifications and calculates an encryption determination result for each specification, indicating whether the index value shown in the first encryption index value satisfies the specification. Specifically, in the second embodiment, the management device 10 sets multiple specifications in the preprocessing and generates an automaton for each specification. The specification setting unit 52 acquires information on multiple types of specifications in which at least one of the first data type, the index value type, and the numerical range that the index value should satisfy is different, and generates an automaton for each of those specifications.

[0067] As shown in Figure 8, the monitoring device 12 acquires the first encrypted data and the second encrypted data, generates a first encrypted index value from the second encrypted data, and combines the first encrypted data and the first encrypted index value to generate a combined ciphertext. The determination unit 58 of the monitoring device 12 then inputs the combined ciphertext to each of the multiple automata and obtains the encryption determination result output from each automaton. The monitoring device 12 then transmits each encryption determination result to the management device 10. The management device 10 decrypts each encryption determination result to obtain the respective determination result (i.e., the determination result from each automaton).

[0068] When the monitoring device 12 transmits each encryption determination result to the management device 10, it may transmit each encryption determination result individually to the management device 10, and the management device 10 may perform decryption processing for each encryption determination result. Alternatively, the management device 10 may integrate each encryption determination result to generate an integrated encryption determination result and transmit it to the management device 10. In this case, the management device 10 decrypts the integrated encryption determination result to obtain each determination result. In this case, it is preferable that the management device 10 and the monitoring device 12 store information about the rules for integrating each encryption determination result in the integrated encryption determination result (for example, the order in which they are combined).

[0069] Each automaton is constructed on the premise that the type of first data and the type of index value are common, but the numerical range that the index value must satisfy is different. The monitoring device 12 may input a common combined ciphertext (i.e., the first encrypted data and the first encrypted index value) to each of the multiple automatons and obtain an encryption judgment result. In this case, multiple automatons determine the same index value using different judgment criteria (specifications) to obtain an encryption judgment result. This makes it possible to determine not only a two-stage judgment result of whether the specifications are met or not, but also a more multi-stage judgment result (i.e., degree of abnormality).

[0070] Furthermore, the monitoring device 12 may input different combined ciphertexts (i.e., first encrypted data and first encrypted index value) into each automaton to obtain an encryption determination result. In this case, each automaton is constructed on the premise that at least one of the types of first data and index value is different. In this case, it is preferable that the automaton is associated with the first data and second data (first encrypted data and second encrypted data) of the specifications used to generate the automaton, and that the monitoring device 12 stores this association. The monitoring device 12 inputs the combined ciphertext (i.e., first encrypted data and first encrypted index value) into the automaton of the specifications associated with the first encrypted data and second encrypted data used to generate the combined ciphertext, and calculates an encryption determination result. This makes it possible to determine various states of the device 100.

[0071] (Effects) The monitoring device 12 according to the first aspect of this disclosure includes: an acquisition unit 50 that acquires first encrypted data, which is data encrypted using a first method in which first data relating to the monitored device 100 is the TFHE method, and second encrypted data, which is time-series second data relating to the device 100 encrypted using a second method different from the first method; an index value calculation unit 54 that calculates a second encrypted index value, which is an index value indicating the state of the device 100 encrypted using the second method, based on the second encrypted data; a conversion unit 56 that converts the second encrypted index value into a first encrypted index value encrypted using the first method; and a determination unit 58 that calculates an encrypted determination result, which is the determination result of the state of the device 100 encrypted using the first method, based on the first encrypted data and the first encrypted index value. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0072] The monitoring device 12 according to the second aspect of this disclosure is the monitoring device 12 according to the first aspect, wherein the first data is information indicating the operating conditions of the device 100, and the second data is information indicating the operating state of the device 100. According to this disclosure, the first data indicating the operating conditions of the device 100, which is not used to calculate the index value, is acquired in an encrypted state using the first method, and the second data indicating the operating state of the device 100, which is used to calculate the index value, is acquired in an encrypted state using the second method, thereby suppressing an increase in computational load and enabling appropriate determination of the state of the device 100 by the index value.

[0073] The monitoring device 12 according to the third aspect of this disclosure is the monitoring device 12 according to the first or second aspect, wherein the index value calculation unit 54 calculates a second encrypted index value based on multiple types of second encrypted data. This makes it possible to determine the state of the device 100 by taking into account multiple types of second data.

[0074] The monitoring device 12 according to the fourth aspect of this disclosure is a monitoring device 12 according to any of the first to third aspects, wherein the determination unit 58 calculates an encrypted determination result, in an encrypted state, whether the index value shown in the first encrypted index value satisfies the specifications that the first data (operating conditions) shown in the first encrypted data satisfies, using the first method. According to this disclosure, by determining whether the index value satisfies the specifications that the first data should satisfy in its current state, the state of the device 100 can be appropriately determined according to the first data such as operating conditions.

[0075] The monitoring device 12 according to the fifth aspect of this disclosure is the monitoring device 12 according to the fourth aspect, wherein the determination unit 58 calculates an encryption determination result by inputting a combined ciphertext including the first encrypted data and the first encrypted index value into an executable linear temporal logic formula that shows the specifications. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0076] The monitoring device 12 according to the sixth aspect of this disclosure is the monitoring device 12 according to the fourth or fifth aspect, wherein the determination unit 58 sets multiple specifications and calculates an encryption determination result for each specification, indicating whether the index value shown in the first encryption index value satisfies the specification. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0077] A monitoring system according to the seventh aspect of this disclosure comprises a monitoring device 12 according to any of the first to sixth aspects, and a management device 10 that encrypts first data to generate first encrypted data, encrypts second data to generate second encrypted data, and transmits the first encrypted data and the second encrypted data to the monitoring device 12. According to this disclosure, the status of the equipment 100 can be appropriately determined while suppressing information leakage.

[0078] A monitoring method according to the eighth aspect of this disclosure includes the steps of: acquiring first encrypted data, which is data encrypted using a first method in which first data relating to the monitored device 100 is TFHE method, and second encrypted data, which is time-series second data relating to the device 100 encrypted using a second method different from the first method; calculating a second encrypted index value, which is an index value indicating the state of the device 100 encrypted using the second method, based on the second encrypted data; converting the second encrypted index value to a first encrypted index value encrypted using the first method; and calculating an encrypted determination result, which is the determination result of the state of the device 100 encrypted using the first method, based on the first encrypted data and the first encrypted index value. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0079] A program according to the ninth aspect of this disclosure causes a computer to perform the following steps: acquire first encrypted data, which is data encrypted using a first method in which first data relating to the monitored device 100 is TFHE method, and second encrypted data, which is time-series second data relating to the device 100 encrypted using a second method different from the first method; calculate a second encrypted index value, which is an index value indicating the state of the device 100 encrypted using the second method, based on the second encrypted data; convert the second encrypted index value to a first encrypted index value encrypted using the first method; and calculate an encrypted determination result, which is the determination result of the state of the device 100 encrypted using the first method, based on the first encrypted data and the first encrypted index value. According to this disclosure, the state of the device 100 can be appropriately determined while suppressing information leakage.

[0080] Although embodiments of the present disclosure have been described above, the embodiments are not limited to those described herein. Furthermore, the aforementioned components include those that can be easily conceived by those skilled in the art, those that are substantially the same, and those that fall within the so-called equivalent range. Moreover, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the embodiments described above.

[0081] 1 Monitoring system 10 Management device 12 Monitoring device 50 Acquisition unit 52 Specification setting unit 54 Indicator value calculation unit 56 Conversion unit 58 Judgment unit 100 Equipment

Claims

1. A monitoring device comprising: an acquisition unit that acquires first encrypted data, which is data encrypted using a first method in which first data relating to a monitored device is TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; an index value calculation unit that calculates a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; a conversion unit that converts the second encrypted index value into a first encrypted index value encrypted using the first method; and a determination unit that calculates an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

2. The monitoring device according to claim 1, wherein the first data is information indicating the operating conditions of the device, and the second data is information indicating the operating state of the device.

3. The monitoring device according to claim 1, wherein the index value calculation unit calculates the second encrypted index value based on a plurality of types of the second encrypted data.

4. The monitoring device according to claim 1, wherein the determination unit calculates a determination result as the encryption determination result, in an encrypted state, whether the index value shown in the first encryption index value satisfies the specifications that the first data shown in the first encryption data should satisfy, in the first encryption method.

5. The monitoring device according to claim 4, wherein the determination unit calculates the encryption determination result by inputting a combined ciphertext including the first encrypted data and the first encrypted index value into an automaton capable of executing a linear temporal logic formula representing the specifications.

6. The monitoring device according to claim 4, wherein the determination unit sets a plurality of specifications and calculates an encryption determination result for each specification indicating whether the index value shown in the first encryption index value satisfies the specification.

7. A monitoring system comprising: a monitoring device according to any one of claims 1 to 6; and a management device that encrypts the first data to generate the first encrypted data, encrypts the second data to generate the second encrypted data, and transmits the first encrypted data and the second encrypted data to the monitoring device.

8. A monitoring method comprising: acquiring first encrypted data, which is data encrypted using a first method in which first data relating to a monitored device is TFHE method, and second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; calculating a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; converting the second encrypted index value to a first encrypted index value encrypted using the first method; and calculating an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

9. A program that causes a computer to perform the following steps: 1) obtain first encrypted data, which is data encrypted using a first method in which first data relating to a monitored device is TFHE method; 2) obtain second encrypted data, which is time-series second data relating to the device encrypted using a second method different from the first method; 3) calculate a second encrypted index value, which is an index value indicating the state of the device encrypted using the second method, based on the second encrypted data; 4) convert the second encrypted index value into a first encrypted index value encrypted using the first method; and 5) calculate an encrypted determination result, which is the determination result of the state of the device encrypted using the first method, based on the first encrypted data and the first encrypted index value.

Images