JP6356075B2 - Log collection system and log collection method - Google Patents

Description

  The present invention relates to a log collection system and a log collection method, and more specifically to a technology that enables secure log collection while appropriately avoiding an increase in load on a control device and a network.

  Control systems that support social infrastructure including railways, electricity, water, and gas operate predetermined mechanisms such as valves and actuators based on sensor measurement information, etc., and set pressures and temperatures that are set in advance. A control operation such as maintenance of this is required. These series of control processes are performed by a control device including a control controller in the control system.

  Such control systems are built in a closed network, and dedicated OSs and protocols have been used, so unlike information systems that have been opened and networked at an early stage, they are not susceptible to security threats such as attacks by viruses. It has been thought that no damage would occur if exposed or attacked.

  However, in recent years, the configuration for connecting the control system to an external network such as the Internet has increased, and the adoption of a general-purpose OS for the network device of the control system has also started. Along with such networking and openness, viruses targeting control systems (specifically, Stuxnet) have also appeared.

  On the other hand, the security standards for control systems have been mainly research institutes and industry organizations in various countries, including US NIST (National Institute of Standards and Technology), UK CPNI (Center for the Protection of National Infrastructure), and national standards. An industry standard was established. In addition, due to the necessity of security standards common to all over the world, in IEC (International Electrotechnical Commission) in 2009, the formulation of international standards related to control system security was started.

  In order to protect the control system from various threats in response to the development of international security standards, it is necessary to introduce security functions and operate security measures similar to those of information systems in control devices including control controllers. ing.

  For example, as a threat to the control device, there is a threat that the communication driver of the control device intentionally transmits a large number of packets from other devices connected to the Ethernet (registered trademark), thereby distorting the communication cycle and the operation timing of the application task. Can be mentioned. As a countermeasure against such a threat, there is a countermeasure for monitoring the operation state and security state of the control controller and providing various logs obtained by this monitoring to the user as audit data. In order to realize this countermeasure, the control device needs to generate a log that is a record of events related to the operating state and the security state.

On the other hand, the above-mentioned control device has a restriction that a large part of control work is occupied in a calculation resource (CPU or memory) under an operating condition in which control processing in a short cycle is frequently executed. It was difficult to execute log generation and accumulation together. Therefore, it is necessary for the control device to only generate and transmit logs, and it is necessary for the log management server to accumulate and analyze this log. However, in the communication path (control LAN, etc.) between the control device and the log management server, There is a risk of tampering attacks that infringe on the authenticity of data, and it is necessary to protect logs by applying security technology.

  As a conventional technique related to log collection via such a network, for example, a common key with a log acquisition terminal is stored in a hardware security module, and the collected log data is encrypted using the above-mentioned common key. The log collection terminal that encrypts and stores it as well as the above-mentioned common key is stored in the hardware security module, the encrypted log data is obtained from the log collection terminal, and the obtained encrypted log data is decrypted using the common key A log acquisition system (see Patent Document 1) including a log acquisition terminal to be converted has been proposed. According to this prior art, it is possible to encrypt and protect the communication log, to prevent leakage of log data due to unauthorized acquisition of the encryption key, and to prevent falsification of the log information and to reference the correct log information. .

WO2008 / 117556

  However, the following problems exist in the prior art.

  In other words, it is necessary to execute encryption processing for log protection along with log generation processing in the control device during operation of the control system, which increases processing load on the control device and delays control work that requires real-time performance. There is a risk of adverse effects such as. In addition, the processing load accompanying the above-described log encryption processing has a property of increasing according to the log generation amount, and there is a possibility that the risk of the above-mentioned adverse effects is further increased depending on the operation cycle of the control device.

  Further, regarding the communication packet transmitted from the control device to the log management server, there is no consideration regarding the storage form of the log and the compression of the network bandwidth at the time of communication. There is a risk of pressure.

  Therefore, an object of the present invention is to provide a technique that enables secure log collection while appropriately avoiding an increase in load on a control device and a network.

The log collection system of the present invention that solves the above problems holds a log authentication table including at least a plurality of indexes corresponding to authentic or dummy logs in a storage device, and selects an index in the log authentication table by a predetermined algorithm And determining whether to transmit a genuine or dummy log based on the selected index, and communication including the determined log and the selected index which is verification data for verifying the authenticity of the log An information processing apparatus that executes processing for transmitting a packet to a log management server, the log authentication table is held in a storage device, a communication packet is received from the information processing apparatus, and the selection index included in the received communication packet Is compared with the log authentication table shared for the information processing device The selection index is determined or not corresponding to any of the logs authentic or dummy, log containing the said communication packet is verified whether it is a log of authentic or dummy, executes the process of collecting the authenticity log And a log management server.

Also, in the log collection method of the present invention, the information processing apparatus holds a log authentication table including at least a plurality of indexes corresponding to each authentic or dummy log in a storage device, and the index in the log authentication table is stored in a predetermined algorithm. To determine whether to transmit a genuine or dummy log based on the selected index, and to determine the selected log and the selected index that is verification data for verifying the authenticity of the log. The communication management packet is transmitted to the log management server, the log management server holds the log authentication table in the storage device , receives the communication packet from the information processing device , and includes the received communication packet. The selected index is referred to the log authentication table shared with respect to the information processing apparatus. And said selection index are determined or not corresponding to any of the logs authentic or dummy, executes processing log containing the said communication packet is verified whether it is a log of authentic or dummy, is collected for authenticity log It is characterized by.

  According to the present invention, secure log collection is possible while appropriately avoiding an increase in load on the control device and the network. In particular, encryption processing for each communication packet is not required, and low-load and secure processing can be performed by using a log authentication table prepared in advance at a timing when it is difficult to place a load on the control device and the network.

It is a figure which shows the structural example of the log collection system in 1st Embodiment. It is a figure which shows the hardware structural example of each apparatus in 1st Embodiment. It is a sequence diagram which shows the whole outline | summary of the log collection method in 1st Embodiment. It is a flowchart which shows process sequence example 1 of the log collection method in 1st Embodiment. It is a figure which shows the example of a format of the log analysis result in 1st Embodiment. It is a figure which shows the example of a format of the dummy log in 1st Embodiment. It is a figure which shows the structural example of the log authentication table in 1st Embodiment. It is a flowchart which shows process sequence example 2 of the log collection method in 1st Embodiment. It is a figure which shows the example of a format of the communication packet in 1st Embodiment. It is a flowchart which shows process sequence example 3 of the log collection method in 1st Embodiment. It is a flowchart which shows process sequence example 1 of the log collection method in 2nd Embodiment. It is a figure which shows the format example of the communication packet in 2nd Embodiment. It is a flowchart which shows process sequence example 2 of the log collection method in 2nd Embodiment. It is a figure which shows the structural example of the log collection system in 3rd Embodiment. It is a flowchart which shows process sequence example 1 of the log collection method in 3rd Embodiment. It is a flowchart which shows process sequence example 2 of the log collection method in 3rd Embodiment.

<First Embodiment>
--- System configuration ---

  Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of a log collection system 100 according to the present embodiment. A log collection system 100 illustrated in FIG. 1 is a computer system that enables secure log collection while appropriately avoiding an increase in load on a control device and a network.

  As illustrated in FIG. 1, the log collection system 100 according to the present embodiment generates control packets 110 and 130 that generate and transmit communication packets including logs in infrastructure facilities and the like, and communication including logs from the control devices 110 and 130. It includes a log management server 140 that receives packets and collects logs, and a network 190 that connects the control devices 110 and 130 and the log management server 140. In the present embodiment, the configuration in which the two control devices 110 and 130 can communicate with the log management server 140 via the network 190 is illustrated, but the number of control devices is not limited to this. The number of control devices in the configuration of FIG. 1 is an example. Further, when it is not particularly necessary to distinguish, the control device 110 is represented in the following description regarding the control device.

The control device 110 of the log collection system 100 includes a valve and an actuator (actuator) based on measurement information of a sensor installed in an infrastructure facility or the like.
) And the like, and a control operation such as maintaining a preset pressure and temperature is performed. The communication unit 111, the communication packet generation unit 112, the log generation unit 117, the log transmission control unit 113, An authentic log storage unit 115 and a log authentication table storage unit 116 are included. Such a configuration is the same in the control device 130. Moreover, it can be said that each part mentioned above is a function mounted by executing the program with which the control apparatus 110 is provided. This also applies to the log management server 140.

  Among these, the communication unit 111 described above transmits the communication packet generated by the communication packet generation unit 112 to the log management server 140 via the network 190. Further, the communication packet generation unit 112 generates a communication packet that selectively includes a genuine or dummy log and an index (data for verification) based on the log authentication table 900. Further, the log transmission control unit 113 controls whether to transmit a communication packet including an authentic log or a dummy log based on the log authentication table 900 (predetermined rule). In addition, the authentic log storage unit 115 stores a log (authentic) generated by the control device 110 based on the above-described sensor measurement information (eg, temperature, pressure, etc. of a predetermined part). In addition, the log authentication table storage unit 116 stores a log authentication table 900 (described later based on FIG. 7) provided from the log management server 140 and shared with the log management server 140.

  On the other hand, the log management server 140 is a server device that communicates with the control device 110 and the like via the network 190 as described above to execute sharing of the log authentication table 900 and log collection processing, and the encryption / decryption processing unit 141, The log authentication table generation unit 142, the communication packet verification unit 143, the log analysis unit 148, the log storage unit 144, the key information storage unit 145, the log authentication table storage unit 146, and the communication unit 147 are configured.

Among these, the above-described communication unit 147 receives the above-described communication packet from the control device 110 or the like via the network 190. The encryption / decryption processing unit 141 performs cryptographic processing such as generation of a random number using a random number generation function and decryption processing using a secret key or the like. In addition, the log authentication table generation unit 142 generates a dummy log by using the log analysis result output from the log analysis unit 148 (for example, the log analysis result obtained from the control device 110 during a trial operation of the log collection system). Then, the log authentication table 900 is generated. Further, the communication packet verification unit 143 verifies in the log authentication table 900 based on the index whether the log included in the communication packet received from the control device 110 is genuine or dummy. In addition, the log analysis unit 148 analyzes the log included in the communication packet received from the control device 110. In addition, the log storage unit 144 stores log data that the communication packet verification unit verifies the log included in the communication packet received from the control device 110 and determines as a genuine log. The key information storage unit 145 stores key information used as an input by the encryption / decryption processing unit 141. In addition, the log authentication table storage unit 146 stores a log authentication table 900 that is used as an input by the communication packet verification unit 143 to verify the log.
--Hardware configuration ---

  Next, an example of the hardware configuration of the log management server 140 and the control device 110 that configure the log collection system 100 described above will be described. Here, description will be given as a computer. The computer illustrated in FIG. 2 includes a storage device 11, a CPU 13, an input / output device 14, and a communication device 15.

  Among these, the storage device 11 is a storage device composed of an appropriate non-volatile storage element or the like, and includes a program 12 for implementing functions necessary as the log management server 140 or the control device 110, a log authentication table 900, and the like. It holds various data.

The CPU 13 is an arithmetic unit that executes the program 12 held in the above-described storage device 11 to perform overall control of the computer itself and perform various determinations, calculations, and control processes.

  In addition, the input / output device 14 is assumed not to be provided in the log management server 140 but to be provided in the control device 110. In this case, the measurement signal sent from the sensor installed in the control target is transmitted to the communication device 15. It is a device responsible for processing acquired through the communication device 15 and processing for outputting a signal to a predetermined mechanism such as an actuator through the communication device 15.

The communication device 15 is a device responsible for communication processing with other devices, and a network interface card, a wireless communication unit, or the like can be assumed. In the case of the communication device 15 in the log management server 140, the communication device 15 is connected to the network 190 and communicates with the control device 110. Further, in the case of the communication device 15 in the control device 110, it communicates with the above-described sensor or actuator using a predetermined communication protocol, and also communicates with the log management server 140.
---- Overall overview of log collection method ---

  Hereinafter, the actual procedure of the log collection method according to this embodiment will be described with reference to the drawings. Various operations corresponding to the log collection method described below are realized by the program 12 executed by the above-described control device 110 and log management server 140 constituting the log collection system 100. And this program 12 is comprised from the code | cord | chord for performing various operation | movement demonstrated below.

  FIG. 3 is a sequence diagram illustrating an overall outline of the log collection method according to the first embodiment. Here, an overall outline of log collection processing of the control device 110 and the log management server 140 will be described with reference to the sequence diagram of FIG. 3. Note that the log authentication table 900 described above is used to determine whether a log included in a communication packet is an authentic log or a dummy log. Although details will be described later (FIG. 7), this log authentication table 900 stores an index for designating the transmission order of communication packets including the log, and the data corresponding to each index includes a dummy log or its log. One of constant values indicating that the log received by the index is a genuine log is stored.

  In this case, the control device 110 and the log management server 140 divide into a log authentication table concealment sharing processing phase and a log collection phase, and perform processing according to each phase. First, during “trial operation”, log authentication table concealment sharing processing (S201) is executed between the log management server 140 and the control device 110, and prior concealment sharing of the log authentication table 900 is performed. The trial operation is a state where the normal operation of the control device 110 (operation unrelated to the log collection operation of the present invention) is not performed or is not in a production environment, and the log collection system 100 of the present embodiment is experimentally tested. It is the timing for generating and sharing the log authentication table 900 by operating it. In other words, the timing at which the influence on the control device 110 is minimized.

  In the log authentication table concealment sharing process (S201) described above, the control device 110 generates a communication packet including a log and transmits it to the log management server 140 (S313).

  On the other hand, the log management server 140 receives the communication packet described above from the control device 110 (S411), and generates a dummy log based on the log included in the communication packet (S413). Next, the log management server 140 performs a random number generation process (S414), generates a log authentication table 900 including an index, and transmits the log authentication table 900 to the control device 110 (S416).

  On the other hand, the control device 110 receives the log authentication table 900 from the log management server 140 (S314) and stores it in the log authentication table storage unit 116. Details of the above log authentication table concealment sharing process will be described later with reference to FIG.

  After execution of the above-described log authentication table concealment sharing process, during normal operation, the control device 110 refers to the log authentication table 900 (S502), and logs transmission control process (S318) determines whether the log is authentic or dummy. After determining whether to include in the communication packet, the log transmission process (S202) is executed.

  On the other hand, the log management server 140 refers to the log authentication table 900 (S603), and verifies whether the corresponding log is genuine or dummy based on the index included in the communication packet received from the control device 110 described above. A verification process (S318) is executed, and a log collection process (S203) for storing the genuine log in the log storage unit 144 is executed. Details of the log transmission process (S202) and the log collection process (S203) will be described later with reference to FIGS.

-Log authentication table confidential sharing process ---

  FIG. 4 is a flowchart showing a processing procedure example 1 of the log collection method in the first embodiment. Specifically, the log authentication table concealment sharing process (FIG. 3: S201) performed in the log collection system at the time of a test run. It is a detailed flow.

  In this case, the log generation unit 117 of the control device 110 generates a log from values relating to the operation state, security state, etc. of the control device itself obtained with an existing function (eg, system monitoring function in the OS) provided in advance. This is stored in the authentic log storage unit 115 (S311).

  Next, the communication packet generation unit 112 of the control device 110 acquires data from a control application that operates on the control device itself (eg, an application for controlling infrastructure equipment or the like that is the original operation as the control device). (Example: data such as control results), the authentic log generated by the log generating unit 117 described above, and information corresponding to “authentic” output by the log transmission control unit 113 in response to transmission of the authentic log Is set to a predetermined packet according to the communication protocol, and a communication packet is generated (S312).

  The communication unit 111 transmits the communication packet generated by the communication packet generation unit 112 to the log management server 140 via the network 190 (S313).

  On the other hand, the communication unit 147 of the log management server 140 receives the communication packet described above from the control device 110, acquires an authentic log from the communication packet, and stores it in the log storage unit 144 (S411).

  Subsequently, the log analysis unit 148 of the log management server 140 creates a log analysis result by analyzing the above-described authentic log stored in the log storage unit 144 using a predetermined algorithm (S412). Details of the log analysis result are shown in FIG.

  The log analysis result 700 illustrated in FIG. 5 indicates a distribution range of each value of the device state A, the device state B, the security state C, and the security state D included in each of the plurality of genuine logs, for example. This is a result specified by the log analysis unit 148 as “a possible value”. In the example of the log analysis result in FIG. 5, the above-described four types of log items are shown, but the present invention is not limited to this.

Among the log analysis results 700, the device state A 700-1 and the device state B 700-2 are information indicating the operation state of the device in which the control device 110 is installed. The state of such equipment is generally monitored from multiple viewpoints such as temperature and pressure. Here, it is assumed that there are a state A and a state B. The security status C700-3 and the security status D700-4 are information indicating the security status of the device in which the control device 110 is installed. The security status of a device is generally monitored from a plurality of viewpoints. Here, it is assumed that there is a security state C and a security state D.

  In the example of the log analysis result 700 in FIG. 5, it can take a value from 0 to 10 for the log item of the device status A700-1, and 50 to 70 for the log item of the device status B700-2. Can take a value, can take a value of 10 to 30 for a log item of security state C700-3, and can take a value of 80 to 90 for a log item of security state D700-4. Each shows that.

  Now, the description returns to the flow of FIG. Next, the encryption / decryption processing unit 141 of the log management server 140 performs a predetermined encryption process using the key information stored in the key information storage unit 145 as an input of a predetermined function, and generates a random number sequence (S414).

  Further, the log authentication table generation unit 142 of the log management server 140 generates an index and a log authentication table 900 associated therewith, and stores the log authentication table 900 in the log authentication table storage unit 146 (S415). . More specifically, the log authentication table generation unit 142 generates, for example, an index group that is a sequence of 1 to n (n is an integer of 0 <n), and the index group is obtained in step S414 described above. The index corresponding to the value of the predetermined digit of the random number sequence is determined as an index corresponding to the authentic log, and the other indexes are determined as indexes corresponding to the dummy log. In addition, the log authentication table generation unit 142 uses a dummy value (eg, a random number generation function) that falls within a range that the log item can take for each log item indicated by the log analysis result obtained in step S412 described above. A random log is generated by setting a random number value obtained in the corresponding range), a record is generated by associating this with an index corresponding to the dummy log among the above-mentioned indexes, and a log authentication table 900. On the other hand, for the index corresponding to the authentic log, for example, the value of each log item described above is set to “0”, a record is generated, and stored in the log authentication table 900. In this way, the log authentication table 900 is generated.

  A specific example of the above-described dummy log is shown in FIG. 6, and a specific example of the log authentication table 900 is shown in FIG. The dummy log column 800 illustrated in FIG. 6 indicates a dummy log 801, a dummy log 802, and a dummy log 803, and each dummy log includes the above-described device state A700-1, device state B700-2, and security state C700. -3 and security state D700-4, values randomly selected from a range of possible values are set. For example, the range of values that can be taken by the device status A 700-1 is a value of “0 to 10” from the log analysis result 700, so the device status A 700-1 in each of the dummy log 801, dummy log 802, and dummy log 803. The fields corresponding to are “5”, “8”, and “2”, respectively. The same applies to other log items.

  In addition, the log authentication table 900 illustrated in FIG. 7 includes, as an authentic log, the random number sequence generated by the encryption / decryption processing unit 141 in step S414 and indexes having values “2”, “5”, and “11” as values. The other indexes “1”, “3”, “4”, “6” to “10” are indexes corresponding to the dummy logs, and the dummy log generating unit 149 includes the indexes corresponding to the dummy logs. Data of the generated dummy log 801, dummy log 802, and dummy log 803 is set as “value”. On the other hand, a constant value (0, 0, 0, 0) or the like is set in the index corresponding to the authentic log.

  When the log authentication table log is used up, the log authentication table may be regenerated. From the viewpoint of the security of cryptographic random numbers, log so that the sum of the number of indexes of all generated log authentication tables is larger than the cycle of cryptographic random numbers derived from the security required by the system. The number of authentication table generations may be determined. For example, if a log authentication table having a random number period p and the number of each index D is generated s times, s is a number satisfying p <D × s.

  Here, the description returns to the flow of FIG. Next, the communication unit 147 of the log management server 140 transmits the log authentication table 900 stored in the log authentication table storage unit 146 to the control device 110 via the network 190 (S416).

On the other hand, the communication unit 111 of the control device 110 receives the log authentication table 900 transmitted from the log management server 140 described above, stores it in the log authentication table storage unit 116 (S314), and ends the flow. Through the processing so far, the log authentication table 900 is shared between the log management server 140 and the control device 110.
--- Log transmission of control device ---

  FIG. 8 is a flowchart showing a processing procedure example 2 of the log collection method according to the first embodiment. Specifically, the flowchart shows a log transmission process (S202) in the control device 110. Here, a series of processing in which the control device 110 during normal operation shown in the sequence of FIG. 3 generates a communication packet including a genuine or dummy log and transmits the communication packet to the log management server 140 will be described.

  In this case, the log transmission control unit 113 of the control device 110 refers to the value of the variable k (initial value is 1) held in the storage area secured in the storage device 11, for example, Obtained as an index to be set in the communication packet to be transmitted (S501). The log transmission control unit 113 increments the value of the variable k after the index acquisition process.

  Next, the log transmission control unit 113 refers to the log authentication table 900 stored in the log authentication table storage unit 116, and acquires data corresponding to the index obtained in step S501 described above (S502). The acquired data becomes “value” and “log type” in the log authentication table 900.

  The log transmission control unit 113 determines whether the value of the “log type” obtained in step S502 is “authentic”, that is, the corresponding index corresponds to the authentic log (S503). As a result of the determination, if the corresponding index corresponds to the genuine log (S503: YES), the log transmission control unit 113 acquires the authentic log from the authentic log storage unit 115 (S504). On the other hand, as a result of the above determination, if the corresponding index does not correspond to the genuine log (S503: NO), the log transmission control unit 113 acquires the “value” obtained in step S502, that is, the dummy log. (S505).

  Subsequently, the communication packet generation unit 112 of the control device 110 performs the process of the log transmission control unit 113 in step S504 or S505 described above on the data acquired from the control application running on the control device itself (described with reference to FIG. 4). A communication packet is generated by adding the acquired data (authentic log or dummy log) and the corresponding index (obtained in step S501) (S506).

A specific example of the communication packet generated by the communication packet generation unit 112 is shown in FIG. A communication packet 1000 illustrated in FIG. 9 includes a header (for example, a storage destination of information such as a packet transmission source, a transmission destination IP address, and a protocol type), a control data storage area (a storage destination of data obtained from a control application). , An index (the value of the index obtained in step S501 described above), and a log storage area (a genuine or dummy log obtained in step S504 or S505 described above).

  Of these communication packets 1000, the communication packet 1001 is a communication packet that includes the genuine log with the index obtained in step S 501 described above, that is, a genuine log “7” obtained from the authentic log storage unit 115 in step S 504 described above. , 60, 20, 90 "are communication packets set in the log storage area.

  On the other hand, the communication packet 1002 among the communication packets 1000 is a communication packet whose index obtained in the above-described step S501 is “3”, that is, a dummy log, and is obtained from the log authentication table 900 in the above-described step S505, for example, the dummy log 802 ( (See FIG. 6) “8, 52, 15, 90” are communication packets set in the log storage area.

  In addition, the component and size of a communication packet are not limited to the example of FIG. Further, the order of the constituent elements of the communication packet is not limited to the example of FIG.

  Returning to the description of the flow in FIG. Next, the communication unit 111 of the control device 110 transmits the communication packet generated by the communication packet generation unit 112 in step S506 described above to the log management server 140 via the network 190 (S507), and the flow ends.

--- Log collection performed by log management server ---

  Next, details of the log collection processing (FIG. 3: S203) executed by the log management server 140 will be described with reference to FIG. In this case, the communication unit 147 of the log management server 140 receives the communication packet transmitted from the control device 110 via the network 190 (S601), and acquires the log included in the communication packet (S610). Also, the communication unit 147 acquires an index from the communication packet received in step S601 (S602).

  Subsequently, the communication packet verification unit 143 of the log management server 140 refers to the log authentication table 900 stored in the log authentication table storage unit 146 using the index obtained in step S602 described above as a key (S603), and the corresponding index. Whether the log obtained in step S610 is a genuine log or a dummy log is verified based on whether the value of the “log type” in the record corresponding to “dummy” or “authentic” is determined (S604).

  As a result of the verification in step S604, if it is determined that the corresponding log is an authentic log (S605: YES), the communication packet verification unit 143 stores the log acquired in step S610 in the log storage unit 144 as an authentic log. (S607).

On the other hand, as a result of the verification in step S604 described above, if it is determined that the corresponding log is not an authentic log, that is, a dummy log (S605: NO), the communication packet verification unit 143 discards the log acquired in step S610 ( S608), the process returns to step S601. A series of processing indicated by this flow is continued while the log management server 140 is operating.
Second Embodiment

In the first embodiment described above, by including the index of the log authentication table 900 in the communication packet, the transmission order of the communication packet is synchronized between the control device 110 and the log management server 140, and it corresponds to the authentic log or the dummy log. It was possible to verify whether to do. On the other hand, in the second embodiment, an index is not set for the communication packet, and the transmission order of the communication packet is synchronized by using information shared by the control device 110 and the log management server 140, for example, time information. An example of verifying whether it corresponds to a log or a dummy log will be described.

In the second embodiment, the configuration of the log collection system 100 (the log management server 140 and the control device 110), the hardware configuration of the computer, the overall outline, and the log authentication table concealment sharing process are the same as in the first embodiment. is there. Therefore, in the second embodiment, processing that is a difference from the first embodiment will be described.
--- Log transmission of control device ---

  Here, the log transmission processing in the control device 110 of the second embodiment will be described with reference to FIG. In this case, the log transmission control unit 113 of the control device 110 acquires the current time value from the clock function provided in the OS of the control device 110, for example, as time information of the communication packet to be transmitted next time (S1501).

  Next, the log transmission control unit 113 inputs the time information acquired in step S1501 described above to, for example, the function f (t) of the time information t, and acquires the output value of the function f (t) as an index (S1502). ). This function f (t) is shared in advance between the control device 110 and the log management server 140 in the same way as the log authentication table 900, and the time included in a time zone between certain times t1 and t2. When input, an index “1” is output, and when a time included in a certain time period t3 to t4 is input, an index “2” is output.

  Subsequently, the log transmission control unit 113 refers to the log authentication table stored in the log authentication table storage unit 116 using the index value calculated in step S1502 described above as a key, and sets the data (value and log) corresponding to the corresponding index. Type) is acquired (S1503). The log transmission control unit 113 determines whether the corresponding index corresponds to the authentic log based on the “log type” of the data obtained here as “authentic” or “dummy” (S1504).

  As a result of the above determination, when the index calculated in step S1502 corresponds to the authentic log (S1504: YES), the log transmission control unit 113 acquires the authentic log from the authentic log storage unit 115 (S1505). ). On the other hand, as a result of the above determination, if the corresponding index does not correspond to the intrinsic log (S1504: NO), the log transmission control unit 113 acquires the “value” obtained in step S1503, that is, the dummy log. (S1506).

  Subsequently, the communication packet generation unit 112 of the control device 110 applies the log transmission control unit 113 to the data acquired from the control application running on the control device itself (described with reference to FIG. 4) in step S1505 or S1506 described above. The acquired data (authentic log or dummy log) is added to generate a communication packet (S1507).

  A specific example of the communication packet generated by the communication packet generator 112 is shown in FIG. A communication packet 2000 illustrated in FIG. 12 includes a header (for example, a storage destination of information such as a packet transmission source, a transmission destination IP address, a protocol type), a control data storage area (a storage destination of data obtained from a control application). , And a log storage area (authentic or dummy log obtained in step S1505 or S1506 described above).

Of these communication packets 2000, the communication packet 2001 is a communication packet including an authentic log, and the authentic log “7” obtained from the authentic log storage unit 115 in step S1505 described above.
, 60, 20, 90 "are communication packets set in the log storage area. On the other hand, the communication packet 2002 among the communication packets 2000 is a communication packet including a dummy log, and is obtained from the log authentication table 900 in the above-described step S1506, for example, dummy log 802 (see FIG. 6) “8, 52, 15, 90”. Is a communication packet set in the log storage area.

  Returning to the description of the flow in FIG. Next, the communication unit 111 of the control device 110 transmits the communication packet generated by the communication packet generation unit 112 in step S1507 described above to the log management server 140 via the network 190 (S1508), and the flow ends.

--- Log collection processing in the log management server ---

  Next, log collection processing executed by the log management server 140 in the second embodiment will be described with reference to FIG. In this case, the communication unit 147 of the log management server 140 receives the communication packet transmitted from the control device 110 via the network 190 (S1601).

  Subsequently, the communication packet verification unit 143 of the log management server 140 acquires the value of the transmission time from the communication packet received in step S1601 described above, or determines the current time from the clock function provided in the OS of the log management server 140. A value is acquired (S1602). Further, the communication packet verification unit 143 acquires a log from the received communication packet (S1603).

  Next, the communication packet verification unit 143 inputs the time information acquired in step S1602 described above to the above-described function f (t), and acquires the output value of this function f (t) as an index (S1604).

  In addition, the communication packet verification unit 143 refers to the log authentication table stored in the log authentication table storage unit 146 using the index calculated in step S1604 as a key (S1605), and “ Whether the log obtained in step S1603 is a genuine log or a dummy log is verified based on the value of “log type” being “dummy” or “authentic” (S1607).

  As a result of the verification in step S1607, when it is determined that the corresponding log is an authentic log (S1607: YES), the communication packet verification unit 143 stores the log acquired in step S1603 in the log storage unit 144 as an authentic log. (S1610).

On the other hand, as a result of the verification in step S1607 described above, when it is determined that the corresponding log is not an authentic log, that is, a dummy log (S1607: NO), the communication packet verification unit 143 discards the log acquired in step S1603 ( In step S1609), the process returns to step S1601. A series of processing indicated by this flow is continued while the log management server 140 is operating.
<Third Embodiment>

  Next, a log collection system that requires encryption processing for communication packets, unlike the first and second embodiments, will be described. FIG. 14 is a diagram illustrating a configuration example of the log collection system 100 according to the third embodiment. The log collection system 100 illustrated in FIG. 14 has no difference in the configuration of the log management server 140 as compared to the system configuration in FIG.

Hereinafter, the case of the control device 110 will be described. Unlike the first embodiment, the control device 110 according to the third embodiment further includes a cryptographic processing unit 2118 and a key information storage unit 2114. In such a configuration, the communication packet generation unit 112 performs encryption processing using input parameters of an encryption algorithm such as encryption key information and initial vectors stored in the key information storage unit 2114 and a mask described later, or the payload of the communication packet or This is done for some or all of the headers. Here, it is assumed that data specifying an area for performing encryption processing in a communication packet is named a mask, and the mask is stored in the key information storage unit 2114.

  In addition, the area for performing the above-described encryption processing in the communication packet is, for example, an index storage area, and encryption processing is applied for the purpose of concealing the communication packet index.

In this case, the communication unit 111 transmits the communication packet subjected to the encryption process to the log management server 140 via the network 190.
--- Log transmission of control device ---

  The control device 110 according to the third embodiment executes a log transmission process that is partially different from the log transmission process (S202) according to the first embodiment. This log transmission process will be described with reference to FIG. In addition, each process of step S501-S503 demonstrated in 1st Embodiment is the same also in 3rd Embodiment, and abbreviate | omits description.

  In this case, after acquiring the authentic log or the dummy log in steps S504 and S505, the encryption processing unit 2118 described above performs at least the index among the header, the control data storage area, the index, and the log storage area constituting the communication packet. Then, encryption processing such as encryption processing or MAC generation processing based on the encryption key of the key information storage unit 2114 is executed (S2506).

  Thereafter, the communication packet generation unit 112 uses the data acquired by the log transmission control unit 113 in step S504 or S505 described above (data already described with reference to FIG. 4) from the control application that runs on the control device itself. (Authentication log or dummy log) and at least the index encrypted in step S2506 are added to generate a communication packet (S506). In addition, the communication unit 111 transmits the communication packet generated by the communication packet generation unit 112 in step S506 described above to the log management server 140 via the network 190 (S507), and the flow ends.

--- Log collection performed by log management server ---

  The log management server 140 according to the third embodiment executes a log collection process that is partially different from the log collection process (S203) according to the first embodiment. This log collection process will be described with reference to FIG. In this case, the communication unit 147 of the log management server 140 receives the communication packet transmitted from the control device 110 via the network 190 (S601), and the encryption / decryption processing unit 141 receiving the communication packet The decryption process or the MAC verification process or the like is executed on the value (index) of the area encrypted in step S2506 using the decryption key stored in the key information storage unit 114 (S2610). The object to be decoded here is all or part of the header, the control data storage area, the index, and the log storage area constituting the communication packet, but at least the index needs to be included.

  After at least decoding the index as described above, processing similar to steps S602 to S610 in FIG. 10 is executed, and the authentic log is stored in the log storage unit 144.

Although the best mode for carrying out the present invention has been specifically described above, the present invention is not limited to this, and various modifications can be made without departing from the scope of the invention.

  According to each of the first, second, and third embodiments, designing the configuration of a communication packet including a log at the time of system design, pre-processing for log data authentication processing, and authentication data Generation and settings prevent network bandwidth pressure due to an increase in communication packets during system operation, and each control device performs log communication packet protection processing using cryptographic technology with low resources. By efficiently verifying the authenticity, it is possible to provide a safe log generation / collection method against communication path tampering attacks. The original purpose of log collection is for the controller to notify the server of its normal state or abnormal state by transmitting the log to the management server. According to the present invention, this object can be achieved even in a situation where a tampering attack exists between the server and the controller.

  More specifically, regarding the load on the network bandwidth, a packet configuration that stores a log in an empty area of the communication packet eliminates the need to separately process a log collection communication packet, resulting in an increase in the amount of communication packets. Network bandwidth pressure can be avoided. In addition, a log authentication table used when verifying whether a log included in a communication packet is a genuine log or a dummy log is generated and distributed at a timing that does not place a load on the original operation of the control device, for example, during a system test run, In communication packet generation and transmission / reception, efficient processing based on the index of the log authentication table is executed instead of conventional encryption / decryption processing, and each processing during system test operation and normal operation The load can be appropriately controlled. In addition, regarding tamper resistance in the communication path between the control device and the log management server, the communication packet including the authentic log or dummy log is transmitted and received based on the index of the log authentication table shared between the control device and the log management server. Thus, it is difficult for an attacker who does not have a log authentication table to distinguish between a genuine log and a dummy log, and good tamper resistance can be achieved.

  That is, secure log collection is possible while appropriately avoiding an increase in load on the control device and the network.

  At least the following will be clarified by the description of the present specification. That is, in the log collection system according to the present embodiment, the information processing apparatus performs verification data for verifying the authenticity of the log based on the predetermined rule in the process of transmitting the communication packet to the log management server. Is further included in the communication packet, and the log management server receives the information from the information processing apparatus during the process of verifying whether the log included in the communication packet is a genuine log or a dummy log. The verification data included in the communication packet may be verified based on the predetermined rule shared with respect to the information processing apparatus, and whether the log included in the communication packet is an authentic log or a dummy log may be verified. .

  According to this, verification of whether the log of the communication packet is genuine or dummy can be executed with the above-described verification data, and the processing efficiency can be improved.

Further, in the log collection system of the present embodiment, the information processing apparatus holds, as the predetermined rule, a log authentication table including at least a plurality of indexes corresponding to each genuine or dummy log in a storage device, and the communication In the process of transmitting the packet to the log management server, an index in the log authentication table is selected with a predetermined algorithm, and whether to authenticate or dummy is transmitted based on the selected index, the determined log, The communication packet including the selection index that is the verification data is transmitted to a log management server, the log management server holds the log authentication table in a storage device, and the log included in the communication packet In the process of verifying whether the log is genuine or dummy, The selected index included in the communication packet received from the information processing device is checked against the log authentication table shared with respect to the corresponding information processing device to determine whether the selected index corresponds to a genuine log or a dummy log. The log included in the communication packet may be verified as a genuine log or a dummy log.

  According to this, it becomes possible to determine whether the log of the communication packet to be transmitted next is genuine or dummy and to verify the authenticity / dummy of the log of such communication packet by using the log authentication table, which is secure. Processing efficiency in log collection is improved.

  In the log collection system according to the present embodiment, the log management server performs processing for generating the log authentication table using a predetermined algorithm, holding the log authentication table in a storage device, and transmitting the log authentication table to the information processing device. In addition, the information processing apparatus may receive the log authentication table from the log management server and hold the log authentication table in a storage device.

  This makes it possible to generate a log authentication table in the log management server and share the log authentication table in the information processing apparatus and the log management server.

  In the log collection system of the present embodiment, the log management server generates an index corresponding to either a genuine or dummy log based on a random number when generating the log authentication table, and the dummy log of the indexes The log authentication table may be generated by associating and storing a dummy log generated by a predetermined algorithm with an index corresponding to.

  This makes it possible to generate and store dummy logs in the log authentication table, and to efficiently generate communication packets including dummy logs in the information processing apparatus.

  In the log collection system according to the present embodiment, the log management server generates the dummy log by applying analysis result data obtained by analyzing the log obtained from the information processing apparatus to a predetermined algorithm when generating the dummy log. It may be a thing.

  According to this, for example, it becomes possible to generate a dummy log with a configuration similar to the data configuration of the authentic log, making it more difficult to discriminate between the dummy log and the authentic log, and log collection becomes more secure.

  Further, in the log collection system of the present embodiment, the log management server executes the generation of the log authentication table at a predetermined timing at which the influence on the normal operation in the information processing apparatus is a predetermined level or less. The number of log authentication table generations may be determined so that the sum of the number of indexes of all generated log authentication tables is larger than the cycle of cryptographic random numbers derived from security required in .

  According to this, it is possible to further reduce the processing load accompanying the log collection by suppressing the load for generating and sharing the log authentication table to the minimum.

Further, in the log collection system according to the present embodiment, the information processing apparatus, in the process of transmitting the communication packet to the log management server, if the selected index corresponds to a genuine log, the authenticity stored in the storage device. When the communication packet including a log, predetermined data acquired from a control application that operates according to the original purpose of the information processing apparatus, and the corresponding index is generated, and the selection index corresponds to a dummy log, the selection A communication packet including a dummy log held in the log authentication table regarding the index, predetermined data acquired from the control application, and the corresponding index may be generated.

  According to this, it becomes possible to efficiently generate and transmit communication packets in the information processing apparatus based on the index in the log authentication table.

  In the log collection method of the present embodiment, when the information processing apparatus transmits the communication packet to the log management server, the verification data for verifying the authenticity of the log based on the predetermined rule, The log management server includes the communication packet received from the information processing apparatus in the process of verifying whether the log included in the communication packet is a genuine log or a dummy log. The verification data may be verified based on the predetermined rule shared with respect to the corresponding information processing apparatus, and whether the log included in the communication packet is an authentic log or a dummy log may be verified.

  In the log collection method according to the present embodiment, the information processing apparatus holds, as the predetermined rule, a log authentication table including at least a plurality of indexes corresponding to authentic or dummy logs in a storage device, and the communication In the process of transmitting the packet to the log management server, an index in the log authentication table is selected with a predetermined algorithm, and whether to authenticate or dummy is transmitted based on the selected index, the determined log, A communication packet including the selection index that is the verification data is transmitted to a log management server, and the log management server holds the log authentication table in a storage device;

  In the process of verifying whether the log included in the communication packet is genuine or dummy, the log authentication sharing the selection index included in the communication packet received from the information processing apparatus with respect to the information processing apparatus A table may be collated to determine whether the selected index corresponds to a genuine or dummy log, and to verify whether the log included in the communication packet is a genuine or dummy log.

  In the log collection method according to the present embodiment, the log management server generates the log authentication table using a predetermined algorithm, holds the log authentication table in a storage device, and transmits the log authentication table to the information processing device. Further, the information processing apparatus may receive the log authentication table from the log management server and hold it in a storage device.

  Further, in the log collection method of the present embodiment, the log management server generates an index corresponding to either a genuine or dummy log based on a random number when generating the log authentication table, and the dummy log of the indexes The log authentication table may be generated by associating and storing a dummy log generated by a predetermined algorithm with an index corresponding to.

  In the log collection method according to the present embodiment, the log management server generates the dummy log by applying analysis result data obtained by analyzing the log obtained from the information processing apparatus to a predetermined algorithm when generating the dummy log. It is good.

  In the log collection method according to the present embodiment, the log management server generates the log authentication table at a predetermined timing at which the influence on the normal operation of the information processing apparatus is a predetermined level or less, and is obtained by the system. The number of log authentication table generations may be determined such that the sum of the numbers of indexes of all generated log authentication tables is larger than the cycle of cryptographic random numbers derived from security.

  Further, in the log collection method according to the present embodiment, when the information processing apparatus transmits the communication packet to the log management server and the selected index corresponds to the authentic log, the authenticity stored in the storage device is stored. When the communication packet including a log, predetermined data acquired from a control application that operates according to the original purpose of the information processing apparatus, and the corresponding index is generated, and the selection index corresponds to a dummy log, the selection A communication packet including a dummy log held in the log authentication table regarding the index, predetermined data acquired from the control application, and the corresponding index may be generated.

11 Storage device 12 Program 13 CPU
14 I / O device 15 Communication device 100 Log collection system 110 Control device 111 Communication unit 112 Communication packet generation unit 113 Log transmission control unit 115 Authentic log storage unit 116 Log authentication table storage unit 117 Log generation unit 130 Control device 131 Communication unit 132 Communication Packet generation unit 133 Log transmission control unit 135 Authentic log storage unit 136 Log authentication table storage unit 137 Log generation unit 140 Log management server 141 Encryption / decryption processing unit 142 Log authentication table generation unit 143 Communication packet verification unit 144 Log storage unit 145 Key information Storage unit 146 Log authentication table storage unit 147 Communication unit 148 Log analysis unit 149 Dummy log generation unit

Claims (12)

A log authentication table including at least a plurality of indexes corresponding to each genuine or dummy log is held in a storage device, and an index in the log authentication table is selected by a predetermined algorithm, and either genuine or dummy is selected based on the selected index. Information to determine whether to transmit the log and to transmit a communication packet including the determined log and the selected index that is verification data for verifying the authenticity of the log to the log management server A processing device;
The log authentication table is stored in a storage device, a communication packet is received from the information processing device, and the selection index included in the received communication packet is collated with the log authentication table shared with respect to the information processing device And determining whether the selected index corresponds to a genuine or dummy log, verifying whether the log included in the communication packet is a genuine or dummy log, and executing processing to collect the genuine log Log management server to
A log collection system comprising: The log management server
The log authentication table is generated by a predetermined algorithm and held in a storage device, and further the process of transmitting the log authentication table to the information processing device is executed.
The information processing apparatus includes:
The log authentication table is received from the log management server and held in a storage device.
The log collection system according to claim 1. The log management server
When generating the log authentication table, an index corresponding to either a genuine or dummy log is generated based on a random number, and a dummy log generated by a predetermined algorithm is associated with an index corresponding to the dummy log among the indexes And storing the log authentication table.
The log collection system according to claim 2. The log management server
When generating the dummy log, the dummy log is generated by applying analysis result data obtained by analyzing the log obtained from the information processing apparatus to a predetermined algorithm.
The log collection system according to claim 3. The log management server
The log authentication table is generated at a predetermined timing whose influence on normal operation in the information processing apparatus is a predetermined level or less, and is generated from a cycle of cryptographic random numbers derived from security required by the system. The number of log authentication table generations is determined so that the sum of the number of indexes of all log authentication tables increases.
The log collection system according to claim 2. The information processing apparatus includes:
In the process of transmitting the communication packet to the log management server,
If the selected index corresponds to an authentic log, communication including an authentic log held in a storage device, predetermined data acquired from a control application that operates according to the original purpose of the information processing apparatus, and the corresponding index Generate packets,
When the selected index corresponds to a dummy log, a communication packet including a dummy log held in the log authentication table regarding the selected index, predetermined data acquired from the control application, and the corresponding index is generated. is there,
The log collection system according to claim 3. Information processing device
A log authentication table including at least a plurality of indexes corresponding to each genuine or dummy log is held in a storage device, and an index in the log authentication table is selected by a predetermined algorithm, and either genuine or dummy is selected based on the selected index. A process of transmitting a communication packet including the determined log and the selection index that is verification data for verifying the authenticity of the log to the log management server,
Log management server
The log authentication table is stored in a storage device, a communication packet is received from the information processing device, and the selection index included in the received communication packet is collated with the log authentication table shared with respect to the information processing device And determining whether the selected index corresponds to a genuine or dummy log, verifying whether the log included in the communication packet is a genuine or dummy log, and executing processing to collect the genuine log To
Log collection method characterized by the above. The log management server is
The log authentication table is generated by a predetermined algorithm and stored in a storage device, and further processing for transmitting the log authentication table to the information processing device is performed.
The information processing apparatus is
Receiving the log authentication table from the log management server and holding it in a storage device;
The log collection method according to claim 7. The log management server is
When generating the log authentication table, an index corresponding to either a genuine or dummy log is generated based on a random number, and a dummy log generated by a predetermined algorithm is associated with an index corresponding to the dummy log among the indexes And store and generate the log authentication table,
The log collection method according to claim 8, wherein: The log management server is
When generating the dummy log, the analysis result data obtained by analyzing the log obtained from the information processing apparatus is applied to a predetermined algorithm to generate the dummy log.
The log collection method according to claim 9. The log management server is
The log authentication table is generated at a predetermined timing whose influence on normal operation in the information processing apparatus is a predetermined level or less, and is generated from a cycle of cryptographic random numbers derived from security required by the system. Determine the number of log authentication table generations so that the sum of the number of indexes of all log authentication tables increases.
The log collection method according to claim 8, wherein: The information processing apparatus is
In the process of transmitting the communication packet to the log management server,
If the selected index corresponds to an authentic log, communication including an authentic log held in a storage device, predetermined data acquired from a control application that operates according to the original purpose of the information processing apparatus, and the corresponding index Generate packets,
When the selected index corresponds to a dummy log, a communication packet including a dummy log held in the log authentication table with respect to the selected index, predetermined data acquired from the control application, and the corresponding index is generated.
The log collection method according to claim 9.

Images