JP2019053412A - Information collection device and information collection system - Google Patents

Abstract

To collect information necessary for security risk analysis without an influence upon operations performed in a control system.SOLUTION: An information collection device 20 comprises: a communication packet storage unit 211 which stores therein packets received from a network; an operation flow extraction unit 202 which extracts an operation flow transmitted and received within a system, from the packets stored in the communication packet storage unit; a communication pattern extraction unit 203 which extracts a communication pattern transmitted and received within the system, from the packets stored in the communication packet storage unit 211; an inspection command selection unit 206 which uses the communication pattern to estimate an idle time of communication within the system and selects an inspection command which can be executed at such a timing that the operation flow extracted by the operation flow extraction unit is not influenced; and a countermeasure situation estimation unit 207 which transmits the selected inspection command to another device being an object of information collection within the system and estimates a countermeasure situation of this device on the basis of an acquired result.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information collection device and an information collection system that support security risk analysis.

  Control systems used in social infrastructure such as electric power, railways, water supply and gas and in automobiles are required to operate devices such as valves and actuators based on sensor information and maintain preset pressure and temperature. Ru. In order to realize this operation, in a built-in device such as a controller, periodically acquire information from the sensor, check the status, notify other controllers, servers, etc., and perform control as necessary. Is required. For this reason, in the control system, communication is periodically generated, and processing is usually performed based on the communication data. If this cycle is disturbed, in the worst case, the control itself may stop.

  On the other hand, the control system has so far used a dedicated operating system (OS) or a dedicated protocol, and is installed in an isolated state in an area that can not be accessed from an external network such as the Internet. It has been considered as irrelevant from cyber attacks such as Service attack). However, cases of using a general-purpose OS or a general-purpose protocol for cost reduction are increasing, and connection with an information system is also in progress for improving efficiency. Also, in recent years, computer viruses targeting the control system have been discovered, and the control system also needs security countermeasure technology for detecting infection such as malware and unauthorized access from the outside like the information system. . However, there are many cases where the control system is large in system scale, and it is necessary to recognize the security risk based on the configuration of the system and the state of the countermeasure, and to clarify the contents and the location of the necessary countermeasure. It was difficult to carry out.

  In order to solve such problems, there is known a technique of introducing current analysis means and asset analysis means in the system and performing system risk analysis and countermeasure planning from the information of vulnerability and property included in the system (for example, , Patent Document 1).

WO 2008/004498

  Since the control system requires availability for internally executed operations, when information is collected without considering the characteristics of operations as in the prior art, the delay or stoppage of operations due to the influence of information collection, etc. Could be caused and was difficult to apply.

  An object of the present invention is to provide an information collecting apparatus and an information collecting system capable of collecting information necessary for security risk analysis without affecting operations performed in a control system. .

  An information collecting apparatus according to the present invention is an information collecting apparatus for collecting information in a system required to extract a security risk inherent in a control system, wherein the information collecting apparatus receives a packet received from a network. A communication packet storage unit for storing, a business flow extraction unit for extracting a business flow to be transmitted / received in the system from the packets stored in the communication packet storage unit, and a system from the packets stored in the communication packet storage unit A communication pattern extraction unit that extracts a communication pattern to be transmitted / received inside, and an operation free time of communication in the system using the communication pattern extracted by the communication pattern extraction unit, and the business flow extracted by the business flow extraction unit Command selection unit that selects a test command that can be executed at a timing that does not affect And a countermeasure status estimation unit configured to transmit the selected inspection command to another device in the system that is to collect the information, and to estimate the countermeasure status of the other device based on the acquired result. It is comprised as an information gathering device characterized by the above.

  Further, the present invention is also understood as an information collection system having the above-described information collection apparatus.

  According to the present invention, it is possible to collect information required for security risk analysis without affecting the operations performed by the control system.

It is a figure which illustrates the composition of the security risk analysis support system to which this embodiment was applied. It is a figure which illustrates the hardware constitutions of the control apparatus shown in FIG. It is a figure which illustrates the hardware constitutions of the monitoring and inspection apparatus shown in FIG. It is a figure which illustrates the hardware constitutions of the analysis server shown in FIG. In the security risk analysis support system to which this embodiment is applied, it is a figure which illustrates the processing flow performed at the time of work. In the security risk analysis support system to which this embodiment is applied, it is a figure which illustrates the processing flow which extracts a communication pattern using a monitoring and inspection device. The security risk analysis support system to which this embodiment was applied WHEREIN: It is a figure which illustrates the processing flow which collects the countermeasure condition of a control apparatus using a monitoring and an inspection apparatus. FIG. 8 is a diagram illustrating a process flow of risk analysis by transmitting the task flow and the countermeasure status stored in the monitoring and inspection device to the analysis server in the security risk analysis support system to which the present embodiment is applied. The security risk analysis support system to which this embodiment was applied WHEREIN: It is a figure which illustrates the setting screen of the inspection policy stored in a monitoring and inspection apparatus. The security risk analysis support system by which this embodiment was applied WHEREIN: It is a figure which illustrates the test condition confirmation screen output from a monitoring and a test | inspection apparatus. In the security risk analysis support system to which this embodiment is applied, it is a figure which illustrates the composition of the communication packet stored in the communication packet storage of the monitoring and inspection device. In the security risk analysis support system to which this embodiment is applied, it is a figure which illustrates the composition of the work flow stored in the work flow storage part of a monitoring and inspection device. The security risk analysis support system to which this embodiment was applied WHEREIN: It is a figure which illustrates the structure of the communication pattern stored in the communication pattern storage part of a monitoring and inspection apparatus. The security risk analysis support system to which this embodiment was applied WHEREIN: It is a figure which illustrates the structure of the test | inspection policy stored in the test | inspection policy storage part of monitoring / inspection apparatus. The security risk analysis support system to which this embodiment was applied WHEREIN: It is a figure which illustrates the structure of the test | inspection command stored in the test | inspection command storage part of a monitoring and a test | inspection apparatus. The security risk analysis support system to which this embodiment was applied WHEREIN: It is a figure which illustrates the structure of the countermeasure status stored in the countermeasure status storage part of a monitoring and an inspection apparatus.

  The present embodiment will be described.

  FIG. 1 is a block diagram of a security risk analysis support system in the present embodiment.

In the security risk analysis support system of the present embodiment, as illustrated in FIG. 1, control devices 10 ₁ to 10 _n , monitoring and inspection devices 20 _{1 to} 20 _n , network devices 30 ₁ to 30 _n, and an external network 40 and an analysis server 50.

The control devices 10 ₁ to 10 _n are devices that are targets for collecting information necessary for security risk analysis, and include control processing units 101 _{1 to} 101 _n that perform control processing, network devices 30 ₁ to 30 _{n, and the} like. Communication units 102 _{1 to} 102 _n that perform communication.

Monitoring and inspection apparatus ₂₀ 1 to 20 _n includes a communication packet acquisition unit ₂₀₁ 1 _{~201 n} to obtain a communication packet from the network device ₃₀ 1 to 30 _n, a series of data flow between a particular device from the acquired communication packet a workflow extracting section 202 ₁ to 202 _n for extracting certain business flow, the communication pattern extraction unit 203 ₁ ~203 _n for extracting the timing of the communication from the acquired communication packets is performed, is utilized for business from acquired communication packet Device list extractors 204 _{1 to} 204 _n for extracting a list of active devices, time information acquisition units 205 _{1 to} 205 _n for acquiring current time information, and an inspection for selecting an inspection command to be transmitted to each device and a command selecting unit ₂₀₆ 1 -206 _n, from the response of the test command transmitted to each device, measures each device And countermeasure state estimation unit ₂₀₇ 1 to 207 _n to estimate the situation, the network ₃₀ 1 to 30 and the internal communication unit ₂₀₈ 1 _{~208 n} that communicates with the _n, external communication unit ₂₀₉ 1 that communicates with an external network 40 ~209 _n When one inspection status output unit ₂₁₀ that outputs a collection status of the business flow and measure status to 210 _n and the communication packet storing unit ₂₁₁ 1 for storing the communication packet acquired by the communication packet acquisition unit ₂₀₁ 1 _{~201 n ~211 n} If, stores communication pattern for storing the operation flow storage unit ₂₁₂ 1 -212 _n for storing business flow extracted by the workflow extracting section ₂₀₂ 1 to 202 _n, the extracted communication pattern in the communication pattern extraction unit ₂₀₃ 1 _{~203 n} and part ₂₁₃ 1 _{~213 n,} in selecting an inspection command in the inspection command selection unit ₂₀₆ 1 -206 _n An inspection policy storage unit ₂₁₄ 1 -214 _n for storing inspection policy to irradiation, the test command storage unit ₂₁₅ 1 to 215 _n for storing a list of test commands to be selected by checking the command selecting unit ₂₀₆ 1 -206 _n, measure status And countermeasure status storage units 216 _{1 to} 216 _n that store the countermeasure status of each device estimated by the estimation units 207 _{1 to} 207 _n .

Network device ₃₀ 1 to 30 _n, the controller and ₁₀ 1 to 10 _n and the communication unit ₃₀₁ 1 to 301 _n that performs communication, monitoring and inspection apparatus ₂₀ 1 to 20 packet replication communication unit ₃₀₂ that performs _n communication 1-302 _{and n} .

The analysis server 50 inputs the input information confirmation unit 501 for verifying respect shortage situation of the business flows and measure status received from the monitoring and inspection apparatus 20 ₁ to 20 _n, the lack of information when it is determined that there is insufficient When the shortage information input unit 502, the risk analysis unit 503 that performs risk analysis using the input information, the result output unit 504 that outputs the result of the risk analysis, and the input information verification unit 501 verify the input information And a communication unit 506 for communicating with the external network 40.

FIG. 2 is a diagram illustrating the hardware configuration of the control devices 10 ₁ to 10 _n . In the control devices 10 ₁ to 10 _n , the communication device 11, the input / output device 12, the storage device 13, the CPU (Central Processing Unit) 14, and the memory 15 are connected by an internal communication line 16 such as a bus. It is configured.

Figure 3 is a diagram illustrating the hardware configuration of the monitoring and inspection apparatus ₂₀ 1 to 20 _n. The monitoring and inspection devices 20 _{1 to} 20 _{n each} have the internal communication device 21, the internal communication device 22, the storage device 23, the input / output device 24, the CPU 25, and the memory 26 via an internal communication line 27 such as a bus. It is connected and configured.

  FIG. 4 is a diagram illustrating the hardware configuration of the analysis server 50. As shown in FIG. In the analysis server 50, the communication device 51, the input / output device 52, the storage device 53, the CPU 54, the memory 55, and the reading device 56 for reading the storage medium 57 are connected by an internal communication line 58 such as a bus. It is configured.

The processing flow in the security risk analysis support system of this embodiment will be described. Process flow described below, control device ₁₀ 1 to 10 _n and monitoring and inspection apparatus ₂₀ 1 to 20 _n or the network device ₃₀ 1 to 30 _n and analysis program stored in the storage device of the server 50 is loaded into memory, By being executed by the CPU, it is executed by each processing unit embodied on an apparatus constituting the security risk analysis support system. Also, each program may be stored in advance in a storage device, or may be introduced as needed via another storage medium or communication medium (network or carrier wave propagating through the network).

Figure 5 is the security risk analysis support system to which this embodiment is applied, using the monitoring and inspection apparatus 20 ₁ to 20 _n, a diagram showing a processing flow performed in collecting communication packets flowing network is there.

_First , the control device 101 generates a control command (S501 (expressed as S501; the same applies hereinafter)). Next, the controller 10 ₁ transmits the generated control command to (A 501) to the network device 30 ₁ (S502).

Then, the network apparatus 30 _1, replicates the received control commands (A 501) from the controller 10 ₁ (S503). Then, the network apparatus 30 ₁ transmits the duplicated control command (A 501) monitoring and inspection apparatus 20 ₁ and the control device 10 ₂ (S504).

The monitoring and inspection apparatus 20 ₁ stores the communication packet received from the network apparatus 30 ₁ to the communication packet storage unit 211 ₁ (S505). Here, the configuration of the communication packet will be described in detail in FIG. 11 below.

Next, the control unit 10 ₂ processes the control commands received from the network apparatus _{30 1 (A501) (S506)} . Next, the control unit 10 _2, based on the results of processing, and generates a control command (S507). Next, the control unit 10 ₂ transmits the generated control command to (A 502) to the control unit 10 _n (S508).

Then, the network device 30 _n replicates the control command received (A 502) from the control device 10 ₂ (S509). Next, the network device 30 _n transmits the copied control command (A 502) to the monitoring and inspection device 20 _n and the control device 10 _n (S 510).

Next, the monitoring and inspection apparatus 20 _n stores the communication packet received from the network device 30 _n in the communication packet storage unit 211 _n (S 511). Here, the configuration of the communication packet will be described in detail in FIG. 11 below.

Next, the control device 10 _n processes the control command (A 502) received from the network device 30 _n (S 512). Next, the control device 10 _n transmits a response indicating the result of processing (A503) to the control unit 10 ₂ (S513).

Next, the network device 30 _n duplicates the received response (A 503) (S 514). Then, the network device 30 _n transmits replicated response (A503) monitoring and inspection apparatus 20 _n and the control unit 10 ₂ (S515).

Next, the monitoring and inspection apparatus 20 _n stores the communication packet received from the network device 30 _n in the communication packet storage unit 211 _n (S 516). Here, the configuration of the communication packet will be described in detail in FIG. 11 below.

Next, the control unit 10 ₂ processes the response (A503) received from the network device 30 _n (S517). Next, the control unit 10 ₂ transmits a response indicating the result of processing (A 504) to the control apparatus 10 ₁ (S518).

Then, the network apparatus 30 ₁ replicates the response (A 504) was received (S519). Then, the network apparatus 30 ₁ transmits replicated response to (A 504) in the monitoring and inspection apparatus 20 ₁ and the control apparatus 10 ₁ (S520).

The monitoring and inspection apparatus 20 ₁ stores the communication packet received from the network apparatus 30 ₁ to the communication packet storage unit 211 ₁ (S521). Here, the configuration of the communication packet will be described in detail in FIG. 11 below.

Figure 6 is the security risk analysis support system to which this embodiment is applied, using the monitoring and inspection apparatus 20 ₁ to 20 _n, a diagram illustrating a process flow for extracting the communication pattern carried out after the collection of a communication packet is there. The process is performed at an arbitrary timing after the process shown in FIG.

_First , the monitoring and inspection devices 20 _{1 to} 20 _n start communication pattern extraction processing (S601). Next, the monitoring and inspection devices 20 _{1 to} 20 _n acquire communication packets from the communication packet storage units 211 _{1 to} 211 _n (S602). Next, the monitoring and inspection devices 20 _{1 to} 20 _n extract a business flow that is a series of data flows that are continuous in time from the acquired communication packets (S603). Here, as the determination condition of the temporal continuity, for example, the fact that the transmission and reception interval of the communication packet is within several hundred milliseconds is used. Next, the monitoring and inspection devices 20 _{1 to} 20 _n store the extracted business flows in the business flow storage units 212 _{1 to} 212 _n (S 604). Here, the configuration of the business flow will be described in detail in FIG. 12 below.

The monitoring and inspection apparatus ₂₀ 1 to 20 _n from the acquired communication packet, extracts the communication pattern of each device (S605). Here, as the communication pattern, information such as a cycle in which communication is performed, the frequency of communication, and the time when communication occurs is extracted. Next, the monitoring and inspection devices 20 _{1 to} 20 _n store the extracted communication patterns in the communication pattern storage units 213 _{1 to} 213 _n (S 606). Here, the configuration of the communication pattern will be described in detail in FIG. 13 below. Next, the monitoring and inspection devices 20 _{1 to} 20 _n extract a device list which is a list of devices used for business from the acquired communication packets (S 607). Next, the monitoring and inspection devices 20 _{1 to} 20 _n use the extracted device list to create the countermeasure status of each device (S 608). Here, the countermeasure status to be created is one for which no countermeasure has been confirmed for each device. Next, the monitoring and inspection devices 20 _{1 to} 20 _n store the prepared countermeasure status in the countermeasure status storage units 216 _{1 to} 216 _n (S 609). Here, the configuration of the countermeasure status will be described in detail in FIG. Next, the process ends (S610).

Figure 7 is the security risk analysis support system in the present embodiment, by using the monitoring and inspection apparatus 20 ₁ to 20 _n, a diagram showing a processing flow for collecting measure status of each device. The process is performed at an arbitrary timing after the process shown in FIG.

_First , the monitoring and inspection devices 20 _{1 to} 20 _n acquire the countermeasure status stored in the countermeasure status storage units 216 _{1 to} 216 _n (S 701). Next, among the devices described in the acquired countermeasure status, the monitoring and inspection devices 20 _{1 to} 20 _n determine the presence or absence of the device in which the countermeasure unconfirmed item exists (S702). For example, the monitoring and inspection devices 20 _{1 to} 20 _n acquire the contents of each item such as OS included in the countermeasure status shown in FIG. 16, hardware identifier, presence or absence of authentication at access, availability of Internet connection, presence or absence of packet filter If the contents of all the items can be acquired, it is determined that there is no unconfirmed item. Meanwhile, the monitoring and inspection apparatus 20 ₁ to 20 _n determines that if the content of the at least one item can not be acquired is measures unconfirmed items.

Monitoring and inspection apparatus ₂₀ 1 to 20 _n, the result of the determination, when it is determined that there is no device that measures unconfirmed item exists (S702; No), the process ends (S703). Meanwhile, the monitoring and inspection apparatus 20 ₁ to 20 _n, when it is determined that measures unconfirmed item exists device there is (S702; Yes), out of the measures unconfirmed items there are devices, selects a test target device (S704). Here, as a method of selecting an apparatus, a method of selecting an apparatus having the largest number of unconfirmed countermeasure items or a method of selecting randomly may be considered. Moreover, you may select multiple apparatuses with same test | inspection item as an apparatus to select.

Next, the monitoring and inspection devices 20 _{1 to} 20 _n acquire communication patterns to be implemented by the selected device from the communication pattern storage units 213 _{1 to} 213 _n (S 705). For example, the monitoring and inspection devices 20 _{1 to} 20 _n acquire the contents of each item such as the communication cycle, the communication frequency, and the communication timing included in the communication pattern illustrated in FIG. 13.

Next, the monitoring and inspection devices 20 _{1 to} 20 _n acquire the inspection policy from the inspection policy storage units 214 _{1 to} 214 _n (S706). Here, the inspection policy indicates how much load is applied to perform the inspection, and is set by the system administrator or the like. For example, the monitoring and inspection apparatuses 20 _{1 to} 20 _n acquire the contents of each item such as the inspection timing policy and the inspection content policy included in the inspection policy illustrated in FIG. 14. Testing policy, may also be stored in advance in the inspection policy storage unit 214 ₁ -214 _n, may be set by using an input screen as shown in the subsequent Figure 9. The configuration of the examination policy is described in detail in FIG. 14 below.

Next, the monitoring and inspection devices 20 _{1 to} 20 _n acquire the current time (S 707). The monitoring and inspection apparatus 20 ₁ to 20 _n from the acquired communication pattern inspection policy and the current time information, to estimate the time to be available for inspection at the present time (S 708). Here, the estimation of the testable time can be calculated by the difference between the next predicted communication timing and the current time in the testable time zone set in the test policy.

The monitoring and inspection apparatus ₂₀ 1 to 20 _n, on the basis of the inspectable time estimated, in a test commands stored in the inspection command storage unit ₂₁₅ 1 to 215 _n, the inspectable time or inspection policy And select the inspection command corresponding to the unconfirmed inspection item (S709). For example, the monitoring and inspection apparatus 20 ₁ to 20 _n, of the test command that matches the inspectable time or inspection policy, select a test command shown in FIG. 15 include the same check measures items and the determined measures unconfirmed items S702 Do.

The monitoring and inspection apparatus ₂₀ 1 to 20 _n determines whether the inspection command is selected (S710). As a result, the monitoring and inspection apparatus ₂₀ 1 to 20 _n is, when it is determined that the test command is not selected (S710; No), returns to S707, again, to select the test command. Meanwhile, the monitoring and inspection apparatus ₂₀ 1 to 20 _n is, when it is determined that the test command is selected (S710; Yes), the inspection target device selection has been examined command (A701) (Here, the control device 10 ₁ ) Send (S 711).

Next, the control device 10 _1, based on the test command received (A701), it generates a response to the inspection command (A701) (S712). Next, the controller 10 ₁ transmits the generated response to (A702) monitoring and inspection apparatus ₂₀ 1 _{~20 n} (S713).

The monitoring and inspection apparatus 20 ₁ to 20 _n, when there are a plurality of inspection target device, wherein the test command (in this case, the control device 10 _n) next inspection target apparatus with respect to, was selected (A703) is transmitted (S714).

Next, based on the received inspection command (A703), the control device 10 _n generates a response to the inspection command (A703) (S715). Next, the control device 10 _n transmits the generated response (A 704) to the monitoring and inspection devices 20 _{1 to} 20 _n (S 716).

Next, the monitoring and inspection devices 20 _{1 to} 20 _n estimate the countermeasure status of each device from the received responses (A 702 and A 704) (S 717). Here, the countermeasure status refers to items such as the type of OS, the type of hardware, and whether there is an authentication request when accessing a specific communication port, and can be estimated from the contents of the response to the inspection command or the presence or absence of the response. Points to

Next, the monitoring and inspection devices 20 _{1 to} 20 _n store the estimated countermeasure status in the countermeasure status storage units 216 _{1 to} 216 _n (S 718). Here, the configuration of the countermeasure status will be described in detail in FIG. Next, the monitoring and inspection devices 20 _{1 to} 20 _n output the current inspection status (S719). Here, the inspection status includes the number of extracted business flows and / or inspection items and / or required inspection time, etc., and will be described in detail in FIG. 10 below. Also, if the monitoring and inspection device 20 output device ₁ to 20 _n is not present, it may be recorded inside the log, the first place may not be output.

The monitoring and inspection apparatus ₂₀ 1 to 20 _n, with respect to the target device selected in S704, by determining whether the measures unconfirmed items, to verify there are no remaining measures unconfirmed item (S720). As a result, the monitoring and inspection apparatus ₂₀ 1 to 20 _n, when it is determined that there remain measures unconfirmed item (S720; Yes), returns to S707, performs the transmission and selection of test commands. Meanwhile, the monitoring and inspection apparatus ₂₀ 1 to 20 _n, when it is determined that there remains no measures unconfirmed items; stored (S720 No), then the measure status storing unit ₂₁₆ 1 _{~216 n} measures By referring to the situation and judging the presence or absence of the countermeasure unconfirmed device, it is verified whether or not the countermeasure unconfirmed device exists (S721). The presence or absence of the countermeasure unconfirmed device may be determined, for example, by the IP address included in the countermeasure status. As a result, the monitoring and inspection apparatus ₂₀ 1 to 20 _n, when it is determined that the measures unidentified devices are present (S721; Yes), returns to S704, the target device selection, and sending test command selection performed. Meanwhile, the monitoring and inspection apparatus ₂₀ 1 to 20 _n, when it is determined that the measures unidentified device does not exist (S721; No), the process ends.

Figure 8 is the security risk analysis support system to which this embodiment is applied, using business flow collected by the monitoring and inspection apparatus 20 ₁ to 20 _n and the measure status, showing a processing flow for performing risk analysis in analysis server FIG. In the following, a case has been described where the analysis server performs risk analysis, monitoring and inspection apparatus 20 ₁ to 20 _n may perform the same processing.

First, the monitoring and inspection apparatus ₂₀ 1 to 20 _n obtains business flow by the collected timing from the business flow storage unit _{212 1 ~212 n (S801 1 ~S801} n). Next, the monitoring and inspection devices 20 _{1 to} 20 _n acquire the countermeasure status from the countermeasure status storage units 216 _{1 to} 216 _n at the collected timing (S802 ₁ to S802 _n ). Next, the monitoring and inspection devices 20 _{1 to} 20 _n transmit the acquired task flow and the countermeasure status (A801 _{1 to A} 801 _n ) to the analysis server 50 (S 803 _{1 to} S 803 _n ).

Then, the analysis server 50 performs butt with the information necessary for risk analysis are stored as needed information storage unit 505 the received business flow and measure status (A801 ₁ ~A801 _n), needed for risk analysis The input information is confirmed by determining whether the information is insufficient (S804). As a result, when the analysis server 50 determines that there is a shortage of information (S804; Yes), the shortage information is input (S805). Here, the reason for confirming the input information is that, for example, there are cases where all items included in the countermeasure status can not be acquired because business is frequently performed. Assuming such a case, if the information necessary for risk analysis is insufficient, the relevant item is input as the insufficient information in order to supplement the item. The input of the shortage information may be directly input to the analysis server 50 or may be transmitted remotely. In addition, when it is difficult to input lack information, for example, an item or a default value that increases the level of security risk may be automatically selected. On the other hand, when the analysis server 50 determines that there is no shortage of information (S804; No), nothing is particularly implemented.

Then, the analysis server 50, the received business flow and measure status _(A801 1 _{~A801 n),} using the information entered in S804, performs risk analysis (S806). Here, risk analysis can be performed by, for example, extracting security threats inherent in the business flow by the 5 W method, etc., estimating the likelihood of threats from the countermeasure status, and calculating the risk level, etc. It is not limited. Next, the analysis server 50 outputs the result of the risk analysis (S807).

Figure 9 is the security risk analysis support system to which the present embodiment is applied, the screen to be used when registering the inspection policy to store monitoring and inspection apparatus 20 ₁ to 20 _n examination policy storage unit 214 ₁ -214 _n of FIG.

  The examination policy setting screen (A901) is composed of an examination timing policy (A902) and an examination content policy (A903). The inspection timing policy (A 902) is used to specify at what timing the inspection command is to be executed. For example, business stop date, business stop time, business flow non-execution time, etc. can be considered. It is not something to be done. The inspection content policy (A 903) specifies the content of the inspection command. For example, only passive inspection without direct inspection, direct inspection with small load, direct inspection And the load is also high, etc., but it is not limited thereto. The constituent elements of the inspection policy setting screen (A 901) are not limited to the above, and at least the above-described elements may be included. Further, the order of the components of the inspection policy setting screen (A 901) is not limited to the above.

10, in the security risk analysis support system to which this embodiment is applied is a diagram showing an inspection status confirmation screen monitoring and inspection apparatus 20 ₁ to 20 _n outputs.

  The inspection status confirmation screen (A1001) is composed of the inspection status (A1002). The inspection status (A1002) is output at S710 of FIG. 7 with the number of business flows extracted at S603 of FIG. 6 (A1003), the number of inspection target devices and inspected devices output at S710 of FIG. 7 (A1004) Although the number of items to be examined and the number of examined items (A1005) and the estimated remaining time (A1006) are included, the present invention is not limited thereto. The estimated remaining time (A1006) may be estimated, for example, from the required processing time included in the inspection command shown in FIG. The constituent elements of the inspection status confirmation screen (A1001) are not limited to the above, and at least the above-described elements may be included. Moreover, the order of the components of the inspection status confirmation screen (A1001) is not limited to the above.

Figure 11 is the security risk analysis support system to which this embodiment is applied, a diagram illustrating the structure of a communication packet stored monitoring and inspection apparatus ₂₀ 1 to 20 _n communication packet storage unit ₂₁₁ 1 _{~211 n} of is there.

  The communication packet (A1101) includes the date and time (A1102) at which the packet was received and the header (A1103) of the packet. Here, the header (A1103) includes a transmission source (A1104), a transmission destination (A1105), a protocol (A1106), and a port number (A1107), but is not limited thereto. The components of the communication packet (A1101) are not limited to the above, and at least the above-described components may be included. In addition, the order of the components of the communication packet (A1101) is not limited to the above.

12, the security risk analysis support system to which this embodiment is applied, a diagram illustrating the configuration of a business flow stored monitoring and inspection apparatus ₂₀ 1 to 20 _n operation flow storage unit ₂₁₂ 1 -212 _n of is there.

The business flow (A1201) includes an identifier (A1202) for identifying the business flow, the IP address (A1203) of the device starting the business flow, the IP address (A1204) of the device ending the business flow, and the start IP address It comprises the number (A 1205) of IP addresses passed between the end IP addresses and the group of IP addresses (A 1206) passed according to the number. For example, the series of processing (S501~S521) one business flow between the control device 10 ₁ and the control apparatus 10 _n in FIG. Here, the components of the business flow (A 1201) are not limited to the above, and at least the above components may be included. Further, the order of the components of the business flow (A1201) is not limited to the above.

13, the security risk analysis support system to which this embodiment is applied, a diagram illustrating the configuration of a communication patterns stored monitoring and inspection apparatus ₂₀ 1 to 20 _n communication pattern storage unit ₂₁₃ 1 _{~213 n} of is there.

  The communication pattern (A1301) includes an IP address (A1302) of the control device, a communication cycle (A1303), a communication frequency (A1304), and a communication timing (A1305). Here, the timing at which communication is performed (A1305) is the timing at which communication occurred on a daily basis, an hourly basis, a minute basis, a second basis, or the like. The communication cycle (A1303) is, for example, every 3 seconds, every 10 seconds, etc., and the communication frequency (A1304) is the number of times of communication per unit time, for example, 5 When communicating with the frequency of every second, it becomes 720 times per unit time per hour. The constituent elements of the communication pattern (A1301) are not limited to the above, and at least the above-described elements may be included. In addition, the order of the components of the communication pattern (A1301) is not limited to the above.

14, the security risk analysis support system to which this embodiment is applied, a diagram illustrating the configuration of a testing policy is stored in the inspection policy storage unit ₂₁₄ 1 -214 _n of the monitoring and inspection apparatus ₂₀ 1 to 20 _n is there.

  The inspection policy (A1401) includes an inspection timing policy (A1402) indicating timing at which the inspection may be performed, and an inspection content policy (A1403) indicating contents that the inspection may be performed. Here, a test | inspection timing policy is a policy of permitting a test | inspection, when not communicating in a specific period, such as a day unit and a time unit. The inspection content policy is a policy that specifies the level of load that may be given to the network or the device. The constituent elements of the inspection policy (A1401) are not limited to the above, and at least the above-described elements may be included. Moreover, the order of the components of the inspection policy (A1401) is not limited to the above.

15, in the security risk analysis support system to which this embodiment is applied, a diagram illustrating the configuration of a test command to be stored in the inspection command storage unit ₂₁₅ 1 to 215 _n of the monitoring and inspection apparatus ₂₀ 1 to 20 _n is there.

  The inspection command (A1501) transmits an inspection packet, an inspection packet pattern (A1502) indicating the contents of an inspection packet to be transmitted to the control device, a countermeasure item (A1503) that can be confirmed by the inspection packet, and an inspection packet. A processing time (A1504) required until reception, an assumed communication load (A1505) accompanying the transmission of the inspection packet, and an estimated CPU load (A1506) accompanying the processing of the inspection packet. The constituent elements of the inspection command (A1501) are not limited to the above, and at least the above-described elements may be included. Further, the order of the components of the inspection command (A1501) is not limited to the above.

FIG. 16 is a diagram exemplifying the configuration of the countermeasure status stored in the countermeasure status storage units 216 _{1 to} 216 _n of the monitoring and inspection devices 20 _{1 to} 20 _n in the security risk analysis support system to which this embodiment is applied. is there.

  The countermeasure status (A1601) includes the IP address (A1602) of the control device that confirmed the countermeasure status, the OS (A1603), a hardware identifier (A1604) such as MAC (Media Access Control) address, and access by remote connection etc. It is comprised from the presence or absence of authentication (A1605), the presence or absence of Internet connection (A1606), and the presence or absence of packet filter (A1607). The constituent elements of the countermeasure status (A 1601) are not limited to the above, and at least the above-described elements may be included. In addition, the order of the components of the countermeasure status (A1601) is not limited to the above.

  By realizing these configurations, procedures, and data structures, it is possible to collect information necessary for security risk analysis without adversely affecting operations performed by the control system.

  Specifically, a monitoring and inspection device for collecting communication packets flowing in a network in the control system is installed, information on the device on which the operation is performed and the timing thereof is acquired, and the acquired information is used to affect the operation. Collect information on security measures of each device without timing. More specifically, the monitoring and inspection device collects communication packets flowing through the network at the time of operation execution in the control system, and extracts the operation flow and communication pattern between the devices. Thereafter, using the extracted communication pattern, it recognizes the time when no work is being performed, and at that time, selects an inspection item to be completed before the next work execution, and collects countermeasure information of each device, accumulate.

  In the system that collects information inside the system that is necessary to analyze the security risk inherent in the control system by performing such processing, information related to the work flow performed between devices in the control system and each device It is possible to minimize the impact on the control system and realize the collection of information necessary for security risk analysis, without affecting the security system information of the control system.

  In addition, this invention is not limited to said embodiment, A various deformation | transformation is possible within the range of the summary. For example, when the function of the network device is included in the monitoring and inspection device, or when the function of the analysis server is included in the monitoring and inspection device, or the control device or the monitoring and inspection device communicates with the network For example, the function is not included and communication with the network is performed via another device. Also in the case of this embodiment, there is no essential change in the processing performed in the entire system.

10 ₁ to 10 _n : control device, 11: communication device, 12: input / output device, 13: storage device, 14: CPU, 15: memory, 16: internal signal line, 101 _{1 to} 101 _n : control processing unit, 102 ₁ to 102 _n: the communication _unit, 20 1 to 20 _n: monitoring and inspection device, 21: internal communication device, 22: external communication device, 23: storage device, 24: input device, 25: CPU, 26: memory, 27: internal signal line, 201 _{1 to} 201 _n : communication packet acquisition unit, 202 _{1 to} 202 _n : business flow extraction unit, 203 _{1 to} 203 _n : communication pattern extraction unit, 204 _{1 to} 204 _n : device list extraction unit, 205 ₁ to 205 _n: time information acquisition _unit, 206 1 -206 _n: test command selection _unit, 207 1 to 207 _n: measure status estimating _unit, 208 1 _{~208 n:} internal communication unit, 09 ₁ ~209 _n: external communication _unit, 210 1 _{~210 n:} inspection status output _unit, 211 1 _{~211 n:} storage communication _packets, 212 1 _{~212 n:} business flow storage _unit, 213 1 _{~213 n:} Communication pattern storage _unit, 214 1 -214 _n: checking policy storage _unit, 215 1 to 215 _n: inspecting command storage _unit, 216 1 _{~216 n:} measure status storage _section, 30 1 to 30 _n: the network _device, 301 1 to 301 _n: the communication _unit, 302 1 to 302 _n: packet replication communication unit, 40: an external network, 50: analysis server, 51: communication device, 52: input device, 53: storage device, 54: CPU, 55: memory, 56: reader, 57: storage medium, 58: internal signal line, 501: input information confirmation unit, 502, lack information input unit, 503: risk analysis Unit, 504: Result output unit, 505: Necessary information storage unit, 506: Communication unit, A501: Control command, A502: Control command, A503: Response, A504: Response, A701: Inspection command, A702: Response, A703: Inspection command, A704: _response, A801 1 _{~A801 n:} work flow, measures situation, A901: inspection policy setting screen, A902: inspection timing policy, A903: examination content policy, A1001: inspection status confirmation screen, A1002: inspection status, A1003 : Extraction work flow status, A1004: Tested device status, A1005: Tested item status, A1006: Estimated remaining time, A1101: Communication packet, A1102: Reception date and time, A1103: Header, A1104: Send source, A1105: Send destination, A110 6: Protocol, A1107: Port number, A1201: Business flow, A1202: Business flow identifier, A1203: Start IP address, A1204: End IP address, A1205: Number of routed IP addresses, A1206: Routed IP address group, A1301: Communication pattern , A1302: IP address, A1303: communication cycle, A1304: communication frequency, A1305: communication timing, A1401: inspection policy, A1402: inspection timing policy, A1403: inspection content policy, A1501: inspection command, A1502: inspection packet pattern, A1503 : Confirmation countermeasure item, A1504: Required processing time, A1505: Communication load, A1506: CPU load, A1601: Countermeasure status, A1602: IP address, A1603: OS, A1604: Ha Adware identifier, A1605: authentication status, A1606: Internet connection propriety, A1607: packet filter existence.

Claims (12)

An information collecting apparatus for collecting information in a system required to extract security risks inherent in a control system, comprising:
The information collection device
A communication packet storage unit for storing packets received from the network;
A business flow extraction unit that extracts a business flow transmitted / received in the system from the packet stored in the communication packet storage unit;
A communication pattern extraction unit for extracting a communication pattern transmitted / received in the system from the packets stored in the communication packet storage unit;
An examination for estimating an idle time of communication in the system using the communication pattern extracted by the communication pattern extraction unit, and selecting an inspection command that can be executed at a timing that does not affect the business flow extracted by the business flow extraction unit Command selection unit,
A countermeasure status estimation unit that transmits the selected inspection command to another device in the system that is to collect the information, and estimates the countermeasure status of the other device based on the acquired result;
An information collecting apparatus comprising: The information collecting apparatus according to claim 1, wherein
The information collection device
Furthermore, the inspection command selecting unit comprises an inspection policy storage unit for storing an inspection policy to be referred to when selecting an inspection command,
The inspection command selection unit selects the inspection command that satisfies the inspection policy in addition to the idle time of the communication.
An information collecting device characterized by The information collecting apparatus according to claim 1, wherein
The information collection device
And a test status output unit for outputting the collection status of the countermeasure status of the other device estimated by the countermeasure status estimation unit,
The inspection status output unit displays on the display unit the number of business flows extracted by the business flow extraction unit, the total number of devices included in the business flow, and the number of devices for which the countermeasure status estimation unit estimates the countermeasure status Do,
An information collecting device characterized by The information collecting apparatus according to claim 1, wherein
The information collection device
The task flow and the countermeasure status collected from the other device via the network are transmitted to an external analysis server at the collected timing.
An information collecting device characterized by The information collecting apparatus according to claim 1, wherein
The information collection device
And a risk analysis unit that analyzes security risks in the system using the business flow and the countermeasure status.
The risk analysis unit carries out a risk analysis at the timing at which the task flow and the countermeasure status collected from the other device via the network are collected.
An information collecting device characterized by A system for collecting information in a system required to extract security risks inherent in a control system, comprising:
The information collection system
Equipped with a control unit, a network unit, an information collection unit, and a network,
The network device is
A packet duplicating unit that duplicates a communication packet received from the network and sends it to the information collection device and the control device; and a network communication unit that communicates between the information collection device and the control device via the network , And
The information collection device
A communication packet storage unit for storing packets received from the network;
A business flow extraction unit that extracts a business flow transmitted / received in the system from the packet stored in the communication packet storage unit;
A communication pattern extraction unit for extracting a pattern of communication to be transmitted / received in the system from packets stored in the communication packet storage unit;
An examination for estimating an idle time of communication in the system using the communication pattern extracted by the communication pattern extraction unit, and selecting an inspection command that can be executed at a timing that does not affect the business flow extracted by the business flow extraction unit Command selection unit,
A countermeasure status estimation unit configured to transmit the selected inspection command to another control device to collect the information in the system, and estimate a countermeasure status of the other control device based on the acquired result;
An information collecting system comprising: The information collecting system according to claim 6, wherein
The information collection device
Furthermore, the inspection command selecting unit comprises an inspection policy storage unit for storing an inspection policy to be referred to when selecting an inspection command,
The information collection system, wherein the inspection command selection unit selects the inspection command that satisfies the inspection policy in addition to the idle time of the communication. The information collecting system according to claim 6, wherein
The information collection device
And a test status output unit for outputting the collection status of the countermeasure status of the other control device estimated by the countermeasure status estimation unit,
The inspection status output unit displays the number of business flows extracted by the business flow extraction unit, the total number of control devices included in the business flow, and the number of control devices for which the countermeasure status estimation unit estimates the countermeasure status An information gathering system characterized by The information collecting system according to claim 6, wherein
The information collection system
And an analysis server that analyzes security risks in the system using the workflow and the countermeasure status.
The information collection device
A collection device communication unit that transmits, to the analysis server, the task flow and the countermeasure status collected from the other control device via a network in the system;
The analysis server
An input information confirmation unit that confirms whether the information required for analysis is included in the task flow and the countermeasure status received from the information collection device;
An insufficient information input unit for prompting input of additional information when the necessary information is insufficient;
A risk analysis unit that performs risk analysis using the work flow, the countermeasure information, and additional information input from the shortage information input unit;
An information gathering system characterized by comprising: The information collecting system according to claim 9, wherein
The information collection device
The task flow and the countermeasure status collected from the other control device via the network are transmitted to the analysis server at the collected timing.
An information gathering system characterized by The information collecting system according to claim 9, wherein
The analysis server
When the input information is insufficient, the input information confirmation unit does not prompt the user to input additional information, and selects an item that increases security risk or a predetermined item.
An information gathering system characterized by The information collecting system according to claim 9, wherein
The risk analysis unit carries out a risk analysis at the timing at which the task flow and the countermeasure status collected from the other control device via the network are collected.
An information gathering system characterized by

Images