Security monitoring system, security monitoring method, and program

Abstract

This security monitoring system (100) is characterized by comprising: a security monitoring device (1) that monitors a security state of operational technology apparatuses that include control apparatuses (4-1, 4-2) and controlled apparatuses (3); and a monitoring relay device (2) that is provided corresponding to the control apparatus (4-2), spontaneously collects attribute information about the operational technology apparatuses from the control apparatus (4-2) with a method that does not impair the availability of the control apparatuses (4-1, 4-2), and transmits the collected attribute information to the security monitoring device (1), the monitoring relay device (2) sharing management items of the attribute information to be collected with the security monitoring device (1), and collecting the attribute information from the control apparatus (4-2) in accordance with the shared management items.

Description

Security monitoring systems, security monitoring methods, and programs

[0001] This disclosure relates to a security monitoring system, security monitoring method, and program for monitoring OT devices.

[0002] OT devices, an abbreviation for Operational Technology devices, are devices that control hardware in industrial and social infrastructure. OT devices require real-time capabilities and were traditionally often used in closed environments not connected to external networks. However, in recent years, the use of OT devices connected to external networks has increased, making it crucial to monitor the security status of OT devices. To monitor the security status of OT devices, it is essential to first thoroughly identify all monitored devices, including OT devices, used in the monitored environment to visualize the assets, and then collect and manage attribute information such as the model, serial number, firmware, and OS (Operating System) version of the monitored devices. Collecting attribute information of monitored devices makes it possible to understand areas within the system that are likely to lead to vulnerabilities and what kinds of risks may arise.

[0003] As methods for visualizing assets, there are generally a method called passive scanning and a method called active scanning. In passive scanning, since communication is observed from the outside to extract information about assets, it has the advantage of not affecting the operation of the system. However, in passive scanning, it is difficult to obtain information about devices that do not perform communication, and furthermore, the information necessary for asset management is not necessarily communicated, and there are cases where specific communication cannot be observed depending on the location of observation. In active scanning, since information about assets is actively acquired, there is an advantage that it is possible to collect information about devices that do not perform communication without omission, but there is a concern about the risk of affecting the operation of the system. In a system including OT devices, since availability is emphasized, the risk of affecting the operation of the system tends to be avoided. Therefore, it has been required to accurately identify the attribute information of the monitored device without affecting the operation of the system.

[0004] Patent Document 1 discloses a method in which an agent set in a management target server, which is a monitored device, notifies information of the monitored device to an integrated management server as a method for visualizing assets. By the agent notifying the integrated management server of the state of the monitored device in real time, the integrated management server can grasp the state of the monitored device in real time.

[0005] Japanese Patent Translation of PCT International Publication No. 2010-532503

[0006] However, with the conventional technology described above, an agent must be set up on every monitored device, which presents a problem in that it may not be possible to collect attribute information of monitored devices comprehensively without affecting system operation. For example, by operating the agent to send notifications without affecting system operation, it is possible to collect information on devices to which the agent is set up without affecting system operation. However, if the existence of a monitored device is unknown and no agent is set up, or if the monitored device is a low-function OT device such as a sensor that does not support an agent, it was not possible to collect attribute information of the monitored device comprehensively.

[0007] This disclosure is made in view of the above, and aims to provide a security monitoring system that can extract attribute information of monitored devices without affecting the operation of the system.

[0008] To solve the aforementioned problems and achieve the objectives, the security monitoring system according to this disclosure comprises a security monitoring device that monitors the security status of operational technology equipment, including control equipment and controlled equipment, and a monitoring relay device provided in correspondence with the control equipment, which voluntarily collects attribute information of operational technology equipment from the control equipment in a manner that does not impair the availability of the control equipment, and transmits the collected attribute information to the security monitoring device. The monitoring relay device shares management items for the attribute information to be collected with the security monitoring device, and collects attribute information from the control equipment in accordance with the shared management items.

[0009] The security monitoring system described in this disclosure does not affect the operation of the system and has the effect of being able to extract attribute information of monitored devices without any omissions.

[0010] Figure 1 shows an example of the configuration of the security monitoring system according to Embodiment 1. Figure 1 shows an example of the management items for attribute information. Figure 2 shows an example of the management items for attribute information after updating. Figure 3 shows an example of the attribute information database. Figure 4 shows an example of the functional configuration of each device shown in Figure 1. Figure 5 is an explanatory diagram of the implementation of the monitoring relay device. Figure 6 shows dedicated hardware for realizing the functions of the security monitoring system. Figure 7 shows the configuration of the control circuit for realizing the functions of the security monitoring system.

[0011] The following describes in detail, with reference to the drawings, the security monitoring system, security monitoring method, and program according to embodiments of the present disclosure.

[0012] Embodiment 1. Figure 1 shows an example of the configuration of a security monitoring system 100 according to Embodiment 1. The security monitoring system 100 has the function of collecting attribute information of OT devices and monitoring the security status of OT devices. The security monitoring system 100 includes a security monitoring device 1 and a monitoring relay device 2.

[0013] The OT (Operational Technology) devices, which are the monitored devices of the security monitoring system 100, are devices that require real-time operation and include the controlled device 3 and the control devices 4-1 and 4-2 that control the controlled device 3. In the following description, only OT devices are considered monitored devices, but other devices may also be included in the monitored devices. In the following description, when there is no need to distinguish between control devices 4-1 and 4-2, they may simply be referred to as control device 4. The control devices 4 are redundant, and the primary control device 4 used under normal circumstances is referred to as control device 4-1, and the secondary control device 4 used when a malfunction occurs in the primary control device 4-1 is referred to as control device 4-2. The control devices 4 are such as PLCs (Programmable Logic Controllers). The controlled devices 3 are such as sensors and actuators, and are connected to the control devices 4 via an industrial switching hub 5 using Ethernet®. Note that the connection between the control devices 4 and the controlled devices 3 is not limited to Ethernet; for example, it may be connected by signal lines.

[0014] The system configuration device 6, also known as an engineering tool, has the function of configuring the system, such as setting up OT equipment. The system configuration device 6 can save system configuration information 6A, which indicates the characteristics of the configured system, on the cloud. In Figure 1, the system configuration device 6 is shown as a device connected to the control device 4-1, but it may also be connected via a network, or the engineering tool function of the system configuration device 6 may be implemented on the cloud.

[0015] The security monitoring device 1 has the function of monitoring the security status of OT devices, including the controlled device 3 and the control device 4. The security monitoring device 1 acquires attribute information of OT devices collected by the monitoring relay device 2 and monitors the security of the OT devices based on the attribute information. The attribute information is information that indicates the characteristics of the OT devices and is used to monitor the security status of the OT devices. The attribute information may include, for example, the model name of the OT device, serial number, firmware version, OS version, IP (Internet Protocol) address, MAC (Media Access Control) address, and the date and time the attribute information was updated. Here, the security status includes, for example, the inventory management status such as the presence or absence of vulnerabilities in the OT device, as well as the status of event monitoring such as internal status monitoring and threat detection. If the security status is an event monitoring status, the attribute information may include the results of event monitoring such as the internal status monitoring results and threat detection results. Note that one piece of information may be associated with one piece of attribute information update date and time for one OT device, or if the attribute information includes multiple pieces of information that can be updated individually, multiple pieces of update date and time information may be provided for one OT device, associated with each piece of information included in the attribute information. For example, if the security status is event monitoring, it can include multiple event update times, such as internal state monitoring and threat detection.

[0016] Security monitoring device 1 shares the management items of the attribute information to be collected with monitoring relay device 2. Security monitoring device 1 manages the management items. When security monitoring device 1 updates the management items by editing, such as adding or deleting attribute information, the management items of monitoring relay device 2 are also updated, and monitoring relay device 2 collects attribute information based on the latest updated management items.

[0017] Figure 2 shows an example of attribute information management items. Security monitoring device 1 has attribute information with management items as shown in Figure 2, and shares these management items with monitoring relay device 2. Security monitoring device 1 manages the attribute information management items shared with monitoring relay device 2. The management items shown in Figure 2 include the model name (attribute information #1), the serial number (attribute information #2), the firmware version (attribute information #3), the firmware version (attribute information #4), the IP address (attribute information #5), and the date and time of attribute information update (attribute information #6).

[0018] The security monitoring device 1 can update management items by editing them, such as adding or deleting attribute information management items. Here, we will illustrate the addition of management items. Figure 3 shows an example of management items for attribute information after updating. Figure 3 shows a state where attribute information is collected with the management items shown in Figure 2, and the security monitoring device 1 updates the management items to add the MAC address, which is attribute information #7. When the security monitoring device 1 updates the management items, the management items of the monitoring relay device 2 are also updated, and the state in which attribute information #7 is added, as shown in Figure 3, is reached. When the monitoring relay device 2 updates its management items in response to the update of the management items by the security monitoring device 1, it can acquire the attribute information of the difference in management items caused by the update and transmit it to the security monitoring device 1. For example, according to the management items in the state shown in Figure 2, the monitoring relay device 2 collects attribute information #1 to #6 and transmits it to the security monitoring device 1, and then the security monitoring device 1 updates the management items to add the MAC address as attribute information #7. In this case, the monitoring relay device 2 obtains only the MAC address of attribute information #7, which is the difference, and transmits the obtained attribute information #7 as difference information to the security monitoring device 1.

[0019] The monitoring relay device 2 has the function of collecting attribute information of OT devices from the control device 4 and transmitting the collected attribute information to the security monitoring device 1. In addition, the monitoring relay device 2 may also collect attribute information from system component devices 6 in addition to the control device 4. Furthermore, the monitoring relay device 2 may also have the function of collecting device information, error information, etc. from the control device 4 in addition to attribute information and transmitting them to the security monitoring device 1. The control device 4 and system component devices 6 have previously stored attribute information of OT devices, including the controlled device 3.

[0020] The monitoring relay device 2 is attached to the control device 4 and may be, for example, a separate device from the control device 4 that is connected to the control device 4, or it may be implemented by agent software installed on the control device 4. In Figure 1, the monitoring relay device 2 is connected to the control device 4-2, but the monitoring relay device 2 may be a device connected to the control device 4-1, or it may be implemented by agent software installed on the control device 4-1 or the control device 4-2.

[0021] The monitoring relay device 2 collects attribute information in a manner that does not impair the availability of the control device 4, and transmits the collected attribute information to the security monitoring device 1 in a manner that does not impair the availability of the control device 4. Here, "availability" means that the control device 4 and the controlled device 3 are in a state where they can operate normally when needed and provide the required functions. "A manner that does not impair availability" refers to physical methods that avoid causes that impair availability, such as the operation of the control device 4, the selection of attribute information to be acquired, and the selection of attribute information acquisition rules. Furthermore, "a manner that does not impair availability" is identified based on prior information, which is predetermined information, and information acquired at the time of collecting attribute information. Prior information is information for identifying a manner that does not impair the availability of the control device 4. Prior information may be, for example, information provided by the manufacturer of the control device 4. Prior information provided by the manufacturer of the control device 4 may include a program for controlling the operation of the control device 4 and libraries provided by the manufacturer of the control device 4. Information acquired at the time of collecting attribute information may include information indicating the status of the control device 4 and information indicating the status of the communication path between the monitoring relay device 2 and the security monitoring device 1. In other words, the monitoring relay device 2 can predict the operation of the control device 4 using prior information, and based on this predicted operation, it collects attribute information while avoiding methods that would compromise availability, and transmits the collected attribute information. Furthermore, the monitoring relay device 2 uses information acquired at the time of attribute information collection to grasp the state of the communication path between the monitoring relay device 2 and the security monitoring device 1, and based on this state of the communication path, it collects attribute information in a way that does not affect the state of the communication path, in other words, does not affect the availability of the control device 4, and transmits the collected attribute information.

[0022] "Methods that do not impair availability" include performing processes such as collecting and transmitting attribute information at a time that does not impair the availability of the control device 4. "Times that do not impair availability" include at least one of the following: a time when the control device 4 is not operating as identified by the program that controls the operation of the control device 4; a time when the control device 4 starts up; and a time when the control device 4 modifies its program. Program modifications include modifications to the system controlled by the control device 4.

[0023] Furthermore, "methods that do not impair availability" include collecting and transmitting attribute information via hardware that does not affect availability. Hardware that does not affect availability may be OT equipment that does not affect availability, for example, a non-operating secondary control device 4-2 among redundant control devices 4-1 and 4-2, or components such as buffer memory, data registers, special relays, timers, counters, internal relays, input relays, and output relays that can be safely read at any time and do not affect availability.

[0024] The monitoring relay device 2 collects attribute information according to the management items shared with the security monitoring device 1. The monitoring relay device 2 collects attribute information that can be obtained for the target OT device from the control device 4, etc., among the attribute information managed by the management items. The monitoring relay device 2 transmits the collected attribute information to the security monitoring device 1.

[0025] When the security monitoring device 1 obtains attribute information from the monitoring relay device 2, it generates an attribute information database. In Figure 1, the security monitoring device 1 is shown to obtain attribute information from one monitoring relay device 2, but depending on the system configuration, it may collect attribute information from multiple monitoring relay devices 2.

[0026] Figure 4 shows an example of an attribute information database. Here, we show an attribute information database that is generated when the management items shown in Figure 2 are shared with the security monitoring device 1. Of the attribute information managed by the management items, the values ​​of the attribute information that could be obtained for each monitored device are included.

[0027] Figure 5 shows an example of the functional configuration of each device shown in Figure 1.

[0028] The security monitoring device 1 includes a security function unit 10, an input / output unit 11, a management item management unit 12, an attribute information management unit 13, a monitored device management unit 14, and an attribute information storage unit 15.

[0029] The security function unit 10 realizes the essential function of the security monitoring device 1, which is to monitor the security status of the monitored device based on information collected from the monitored device. The input / output unit 11 performs data input and output with external devices such as the monitoring relay device 2. For example, the input / output unit 11 acquires attribute information from the control device 4 and system component devices 6 via the monitoring relay device 2. The input / output unit 11 may also perform data input and output with other units other than the monitoring relay device 2 and the control device 4.

[0030] The Management Item Management Unit 12 manages the management items of attribute information shared with the Monitoring Relay Device 2. The Management Item Management Unit 12 accepts updates to the management items. Specifically, when updating management items, the Management Item Management Unit 12 accepts changes to the management items and shares the updated management items with the Monitoring Relay Device 2. The Attribute Information Management Unit 13 manages the attribute information obtained by the Input / Output Unit 11 according to the management items of the Management Item Management Unit 12. The Attribute Information Management Unit 13 stores the attribute information obtained by the Input / Output Unit 11 in the Attribute Information Storage Unit 15. At this time, if the attribute information acquired via the Monitoring Relay Device 2 is duplicated, the Attribute Information Management Unit 13 may discard some of the acquired attribute information to eliminate the duplication before managing it. Furthermore, if the attribute information acquired via the Monitoring Relay Device 2 is duplicated, the Attribute Information Management Unit 13 can control the Monitoring Relay Device 2 so that it does not collect duplicate attribute information, or so that it discards duplicate attribute information.

[0031] The monitored device management unit 14 creates a management list of monitored devices based on the attribute information stored in the attribute information storage unit 15. The monitored device management unit 14 can create a management list of monitored devices based on the model name and serial number in the attribute information. The monitored device management unit 14 can also create a Software Bill of Materials (SBM), which is a security software bill of materials, based on the firmware version of the collected attribute information. The monitored device management unit 14 may extract firmware information from the attribute information to create and manage a new SBOM, or it may extract firmware information from the attribute information to update the information of an already constructed SBOM.

[0032] The monitoring relay device 2 includes a unit control unit 20, an information acquisition unit 21, a management item management unit 22, an attribute information extraction unit 23, an attribute information storage unit 24, and an attribute information transmission unit 25. The monitoring relay device 2, control equipment 4, and other units shown in Figure 5 may be implemented using the same hardware, such as a PLC. The monitoring relay device 2 may also be a device with a different enclosure from the control equipment 4, such as a PC (Personal Computer).

[0033] The unit control unit 20 implements the essential functions of the sequencer unit. The information acquisition unit 21 acquires information, including attribute information, from the control equipment 4, system component equipment 6, etc. The information acquisition unit 21 is realized by executing a program that acquires attribute information corresponding to each controlled device 3. The management item management unit 22 shares attribute information management items with the security monitoring device 1 and manages the management items.

[0034] The attribute information extraction unit 23 extracts attribute information from the information acquired by the information acquisition unit 21 according to the latest management items managed by the management item management unit 22. The attribute information extraction unit 23 stores the extracted attribute information in the attribute information storage unit 24. The attribute information transmission unit 25 transmits the attribute information stored in the attribute information storage unit 24 to the security monitoring device 1.

[0035] The control device 4 includes a unit control unit 40, a unit information storage unit 41, a device information storage unit 42, and a program storage unit 43. The control device 4 is implemented by the CPU (Central Processing Unit) unit of the sequencer.

[0036] The unit control unit 40 implements the essential functions of the sequencer's CPU unit. The unit information storage unit 41 stores unit information such as the model name, serial number, and firmware version of the control device 4. The device information storage unit 42 stores device information. The program storage unit 43 stores the program for controlling the controlled device 3, which is an OT device.

[0037] The system component 6 includes an engineering tool unit 60 and a system configuration information storage unit 61.

[0038] The engineering tool unit 60 implements the essential functions of the system components 6 as engineering tools. The system configuration information storage unit 61 stores system configuration information 6A that shows the configuration of the system, including the control equipment 4 and the controlled equipment 3. The system configuration information 6A may be stored on the cloud, as shown in Figure 1. Furthermore, the functions of the engineering tool unit 60 may also be implemented on the cloud.

[0039] The information acquisition unit 21 of the monitoring relay device 2 acquires attribute information in a manner that does not impair the availability of the control device 4. The information acquisition unit 21 of the monitoring relay device 2 acquires attribute information stored in at least one of the unit information storage unit 41, device information storage unit 42, and program storage unit 43 of the control device 4, and the system configuration information storage unit 61 of the system configuration device 6. The attribute information transmission unit 25 transmits the attribute information to the security monitoring device 1 in a manner that does not impair the availability of the control device 4.

[0040] When the monitoring relay device 2 acquires attribute information from an OT device, the information acquisition unit 21 must have specifications that enable it to acquire attribute information from the OT device. The configuration of the information acquisition unit 21 to have such a function will be described below.

[0041] FIG. 6 is an explanatory diagram of the implementation of the monitoring relay device 2. As shown in FIG. 6, the information acquisition unit 21 in FIG. 5 is individually mounted with firmware for each of the controlled devices 3, which are OT devices and IoT (Internet of Things) devices, on a common interface (IF), and is configured to acquire attribute information from each of the controlled devices 3.

[0042] Note that the function of the information acquisition unit 21 is realized by individual mounting and the common IF, the function of the attribute information extraction unit 23 is realized by the attribute information acquisition function, and the function of the attribute information transmission unit 25 is realized by the attribute information transmission function.

[0043] Returning to the description of FIG. 5. The attribute information extraction unit 23 extracts attribute information corresponding to the management items managed by the management item management unit 22. The attribute information extraction unit 23 needs to identify not only the management items of the attribute information to be acquired but also the OT devices from which the attribute information is to be acquired. The attribute information extraction unit 23 identifies the OT devices that are the control targets of the CPU unit from the unit information stored in the unit information storage unit 41, the device information stored in the device information storage unit 42, and the programs stored in the program storage unit 43 of the CPU unit having the function of the control device 4, and acquires the attribute information of the identified OT devices.

[0044] As described above, according to the first embodiment, a security monitoring system 100 can be provided, which includes a security monitoring device 1 for monitoring the security status of OT devices including the control device 4 and the controlled device 3, and a monitoring relay device 2 provided corresponding to the control device 4, which spontaneously collects the attribute information of the OT devices from the control device 4 in a manner that does not harm the availability of the control device 4 and transmits the collected attribute information to the security monitoring device 1. The monitoring relay device 2 shares the management items of the attribute information to be collected with the security monitoring device 1, and can collect the attribute information from the control device 4 according to the management items shared with the security monitoring device 1.

[0045] According to the security monitoring system 100, the monitoring relay device 2 provided corresponding to the control device 4 spontaneously collects the attribute information of the OT device from the control device 4. Instead of setting an agent for each monitored device, the "monitoring relay device 2", which is a "device provided corresponding to the control device 4", "spontaneously" collects the attribute information, so that even when the monitored device is a low-function OT device such as a sensor and does not support an agent, or when the security monitoring system 100 does not know the existence of the monitored device in the first place, it is possible to accurately identify the attribute information of the monitored device without omission.

[0046] The monitoring relay device 2 may identify a method that does not harm the availability of the control device 4 based on pre-determined prior information, or may identify a method that does not harm the availability of the control device 4 based on the information obtained when collecting the attribute information. The prior information may be provided by the manufacturer of the control device 4. Also, the prior information may be a library provided by the manufacturer of the control device 4. By using the library provided by the manufacturer of the control device 4, it is possible to collect the attribute information without harming the availability of the control device 4.

[0047] Also, the control device 4 is a programmable logic controller, and the function of the monitoring relay device 2 may be realized by agent software operating on the control device 4.

[0048] In addition to the control device 4, the monitoring relay device 2 can also obtain attribute information from the system configuration device 6 that manages the configuration of the OT device. Therefore, it becomes possible to collect more attribute information.

[0049] The method that does not harm the availability of the control device 4 includes obtaining the attribute information at a timing that does not harm the availability of the control device 4. The timing that does not harm the availability of the control device 4 includes at least one of the timing when the control device 4 does not operate, the timing when the control device 4 starts up, and the timing when the control device 4 modifies the program, which is specified from the program for controlling the operation of the control device 4.

[0050] Security monitoring device 1 can manage the management items of attribute information shared by security monitoring device 1 and monitoring relay device 2. When security monitoring device 1 updates the management items, the management items of monitoring relay device 2 are also updated.

[0051] When the management items of the monitoring relay device 2 are updated in response to updates of management items by the security monitoring device 1, the monitoring relay device 2 acquires attribute information of the differences in management items caused by the update and transmits it to the security monitoring device 1, but does not collect the parts of the attribute information of management items that have not changed due to the update. This reduces the amount of communication of the security monitoring system 100 compared to the case where attribute information of all management items is acquired again every time a management item is updated.

[0052] Furthermore, if the control device 4 is redundant, the monitoring relay device 2 can collect attribute information without compromising the availability of the control device 4 by acquiring attribute information from the dependent control device 4-2 among the redundant control devices 4-1 and 4-2.

[0053] Furthermore, if attribute information acquired via the monitoring relay device 2 is duplicated, it is desirable for the security monitoring device 1 to discard some of the acquired attribute information to eliminate the duplication before managing it. Alternatively, if attribute information acquired via the monitoring relay device 2 is duplicated, the security monitoring device 1 may control the monitoring relay device 2 so that it does not collect duplicate attribute information, or so that it discards the duplicate attribute information. This can reduce the amount of communication for the security monitoring system 100. Also, if the monitoring relay device 2 is controlled so that it does not collect duplicate attribute information, or so that it discards the duplicate attribute information, the storage capacity required by the attribute information storage unit 24 in the monitoring relay device 2 can be reduced.

[0054] Furthermore, by including firmware information in the attribute information, the security monitoring device 1 becomes capable of creating a software parts list for security based on the acquired attribute information.

[0055] Furthermore, according to Embodiment 1, a security monitoring method for monitoring the security status of OT equipment including a control device 4 and a controlled device 3 can be provided, comprising the steps of: a monitoring relay device 2 provided in correspondence with the control device 4 voluntarily collecting attribute information of the OT equipment from the control device 4 in a manner that does not impair the availability of the control device 4; and the monitoring relay device 2 transmitting the collected attribute information to a security monitoring device 1 that monitors the security status of the OT equipment based on the attribute information. The monitoring relay device 2 shares management items for the attribute information to be collected with the security monitoring device 1, and in the step of collecting attribute information, the monitoring relay device 2 collects attribute information from the control device 4 in accordance with the shared management items.

[0056] Furthermore, according to Embodiment 1, a program can be provided that causes a computer, which functions as a monitoring relay device 2 provided in correspondence with the control device of the OT equipment including the control device 4 and the controlled device 3, to spontaneously collect attribute information of the OT equipment from the control device 4 in a manner that does not impair the availability of the control device 4, and to transmit the collected attribute information to a security monitoring device 1 that monitors the security status of the OT equipment based on the attribute information. This program shares management items of the attribute information to be collected with the security monitoring device 1, and in the step of collecting the attribute information, it causes the control device 4 to collect attribute information according to the shared management items.

[0057] Next, the hardware configuration for realizing the functions of the security monitoring system 100 will be described. The functions of the security monitoring device 1 and the monitoring relay device 2 are realized using processing circuits. The processing circuits may be realized by dedicated hardware or by a control circuit using a CPU.

[0058] When the above processing circuits are implemented using dedicated hardware, they are implemented using the processing circuit 90 shown in Figure 7. Figure 7 is a diagram showing dedicated hardware for realizing the functions of the security monitoring system 100. The processing circuit 90 may be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0059] When the above processing circuit is implemented using a CPU-based control circuit, this control circuit is, for example, a control circuit 91 with the configuration shown in Figure 8. Figure 8 is a diagram showing the configuration of a control circuit 91 for realizing the functions of the security monitoring system 100. As shown in Figure 8, the control circuit 91 comprises a processor 92 and a memory 93. The processor 92 is a CPU, also called a processing unit, arithmetic unit, microprocessor, microcomputer, DSP (Digital Signal Processor), etc. The memory 93 is, for example, a non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable ROM), EEPROM (Registered Trademark) (Electrically EPROM), magnetic disk, flexible disk, optical disk, compact disk, minidisc, DVD (Digital Versatile Disk), etc.

[0060] When the above processing circuit is implemented using the control circuit 91, it is implemented by the processor 92 reading and executing the program corresponding to the processing of each component, which is stored in the memory 93. The memory 93 is also used as temporary memory for each process executed by the processor 92. The program may be provided stored on a storage medium or provided via a communication channel such as the internet.

[0061] The configurations shown in the above embodiments are merely examples, and can be combined with other known technologies. It is also possible to omit or modify parts of the configuration without departing from the gist of the invention.

[0062] Figure 1 shows an example of controlled equipment 3, such as actuators and sensors mainly used in a factory. However, the devices monitored by the security monitoring system 100 are not limited to equipment used in a factory. For example, the devices monitored by the security monitoring system 100 can be OT equipment that requires real-time performance, such as equipment used in control systems for mobile objects like autonomous vehicles.

[0063] 1 Security monitoring device, 2 Monitoring relay device, 3 Controlled equipment, 4, 4-1, 4-2 Control equipment, 5 Industrial switching hub, 6 System component equipment, 6A System configuration information, 10 Security function unit, 11 Input / output unit, 12, 22 Management item management unit, 13 Attribute information management unit, 14 Monitored device management unit, 15, 24 Attribute information storage unit, 20, 40 Unit control unit, 21 Information acquisition unit, 23 Attribute information extraction unit, 25 Attribute information transmission unit, 41 Unit information storage unit, 42 Device information storage unit, 43 Program storage unit, 60 Engineering tool unit, 61 System configuration information storage unit, 90 Processing circuit, 91 Control circuit, 92 Processor, 93 Memory, 100 Security monitoring system.

Claims

1. A security monitoring system comprising: a security monitoring device that monitors the security status of operational technology equipment including control equipment and controlled equipment; and a monitoring relay device provided in correspondence with the control equipment, which voluntarily collects attribute information of the operational technology equipment from the control equipment in a manner that does not impair the availability of the control equipment, and transmits the collected attribute information to the security monitoring device, wherein the monitoring relay device shares management items for the attribute information to be collected with the security monitoring device, and collects the attribute information from the control equipment in accordance with the shared management items.

2. The security monitoring system according to claim 1, characterized in that the monitoring relay device identifies a method that does not impair the availability of the control equipment based on prior information which is predetermined information.

3. The security monitoring system according to claim 2, characterized in that the monitoring relay device uses the prior information provided by the manufacturer of the control equipment to identify a method that does not impair the availability of the control equipment.

4. The security monitoring system according to claim 1, characterized in that the monitoring relay device collects attribute information without impairing the availability of the control device by using a library provided by the manufacturer of the control device.

5. The security monitoring system according to any one of claims 1 to 4, characterized in that the control device is a programmable logic controller, and the functions of the monitoring relay device are realized by agent software running on the control device.

6. The security monitoring system according to any one of claims 1 to 5, characterized in that the monitoring relay device identifies a method that does not impair availability based on information acquired at the time of collecting the attribute information.

7. The security monitoring system according to any one of claims 1 to 6, characterized in that the monitoring relay device acquires attribute information from a system configuration device that manages the configuration of the operational technology device, in addition to the control device.

8. A method that does not impair the availability of the control device includes acquiring the attribute information at a time that does not impair the availability of the control device, wherein the time that does not impair the availability of the control device includes at least one of the following: a time when the control device is not operational as determined from a program for controlling the operation of the control device; a time when the control device is started up; and a time when the control device modifies the program. This is the security monitoring system according to any one of claims 1 to 7.

9. The security monitoring system according to any one of 1 to 8, characterized in that the security monitoring device manages the management items of the attribute information shared by the security monitoring device and the monitoring relay device, and when the security monitoring device updates the management items, the management items of the monitoring relay device are also updated.

10. The security monitoring system according to claim 9, characterized in that when the monitoring relay device updates the management items in response to the security monitoring device updating the management items, the monitoring relay device acquires the attribute information of the difference in the management items caused by the update and transmits it to the security monitoring device.

11. The security monitoring system according to any one of claims 1 to 10, characterized in that the control devices are redundant, and the monitoring relay device collects attribute information without impairing the availability of the control devices by acquiring the attribute information from the dependent control device among the redundant plurality of control devices.

12. The security monitoring system according to any one of claims 1 to 11, characterized in that, when the attribute information acquired via the monitoring relay device is duplicated, the security monitoring device discards a portion of the acquired attribute information to resolve the duplication before managing it.

13. The security monitoring system according to any one of claims 1 to 11, characterized in that, when the attribute information acquired via the monitoring relay device is duplicated, the monitoring relay device controls the monitoring relay device so as not to collect the duplicate attribute information or so as to discard the duplicate attribute information.

14. The security monitoring system according to any one of claims 1 to 13, characterized in that the security monitoring device creates a software parts list for security based on the acquired attribute information.

15. A security monitoring method for monitoring the security status of operational technology equipment, including control equipment and controlled equipment, comprising: a step of a monitoring relay device provided in correspondence with the control equipment voluntarily collecting attribute information of the operational technology equipment from the control equipment in a manner that does not impair the availability of the control equipment; and a step of the monitoring relay device transmitting the collected attribute information to a security monitoring device that monitors the security status of the operational technology equipment based on the attribute information, wherein the monitoring relay device shares management items for the attribute information to be collected with the security monitoring device, and in the step of collecting the attribute information, the monitoring relay device collects the attribute information from the control equipment in accordance with the shared management items.

16. A program characterized in that a computer, which functions as a monitoring relay device provided in correspondence with a control device of an operational technology device including a control device and a controlled device, performs the steps of: spontaneously collecting attribute information of the operational technology device from the control device in a manner that does not impair the availability of the control device; and transmitting the collected attribute information to a security monitoring device that monitors the security status of the operational technology device based on the attribute information; sharing the management items of the attribute information to be collected with the security monitoring device; and in the step of collecting the attribute information, causing the computer to collect the attribute information from the control device in accordance with the shared management items.

Images