JP2001344206A - Security diagnosis system and its method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security diagnosis system and its method capable of preventing diagnostic information from being intercepted due to the direct transmission of the diagnostic information to an infrastructure line as raw data and preventing the strength of security from being weakened on the contrary to intention due to the execution of security strength diagnosis. SOLUTION: In the case of executing computer security strength diagnosis by remote control through the infrastructure line 10 periodically or in real time, a diagnostic procedure (program) is ciphered and sent to a device 2 to be diagnosed through the line 10, so that the diagnostic procedure can be surely concealed from third person's intercepting action on the line 10. Since diagnostic result information (data) is ciphered and sent to a diagnostic device 1 through the line 10, the diagnostic result information can be surely concealed from third person's intercepting action.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security diagnosis system and method, and more particularly, to a security diagnosis system and method for periodically or in real time evaluating security strength of a computer network system such as a private LAN via an infrastructure.

[0002]

2. Description of the Related Art Conventionally, when a program of a diagnostic procedure or data of a diagnostic result (hereinafter referred to as "diagnosis information") for a security diagnosis for a computer network system is communicated via a communication line such as an infrastructure line, the infrastructure No specific measures were taken to protect the security of the diagnostic information on the line.

In the conventional method, a diagnostic device for performing a security diagnosis and a device to be diagnosed as a target of the security diagnosis are directly connected via an infrastructure line or the like.
As a result, diagnostic information considered to be the most important in terms of security was transmitted as raw data over infrastructure lines that are most likely to be intercepted by third parties. On the contrary, there has been a problem that the diagnostic information that should be preserved is intercepted, which may weaken the security strength.

[0004]

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to solve the above-mentioned problem. The diagnostic information is not transmitted as raw data on an infrastructure line, but the diagnostic information is intercepted. An object of the present invention is to provide a security diagnosis system and method capable of preventing the security strength from being weakened by performing security strength diagnosis.

[0005]

A security diagnosis system according to the present invention comprises a device to be diagnosed whose security is to be diagnosed and a diagnostic device which diagnoses the security of the device to be diagnosed at predetermined intervals via a communication line. A security diagnosis system having a first communication device connected between the diagnosis device and the communication line, and a first communication device connected between the diagnosis target device and the communication line. A second communication device, wherein the first communication device is connected to the diagnostic device, and when detecting that diagnostic procedure information indicating a security diagnostic procedure is transmitted from the diagnostic device, A diagnostic device interface unit that outputs detection information indicating the detection, and the diagnostic device interface unit is connected to the diagnostic device interface unit, and receives the detection information from the diagnostic device interface unit. A first timing control unit that outputs a synchronization signal used to establish encryption synchronization before performing encrypted communication with the second communication device; a diagnostic device interface unit; and a first timing control unit. A first control unit connected to a timing control unit for inputting the diagnostic procedure information from the diagnostic device interface unit and outputting predetermined encrypted information when the encryption synchronization is established;
And the second communication device connected to the first timing control unit and the first encryption unit, and outputting a synchronization signal output from the first timing control unit via the communication line. And when the encryption synchronization is established, a first communication line interface unit for transmitting the encryption information output from the first encryption unit to the second communication device via the communication line. Wherein the second communication device comprises:
Synchronization, which is connected to the first communication line interface unit via the communication line and indicates that the synchronization signal has been input when the synchronization signal sent from the first communication line interface unit is input. A second communication line interface unit for outputting information and inputting the encrypted information sent from the first communication line interface unit when the encryption synchronization is established; and the second pair communication. When the synchronization information is input from the second communication line interface unit, the first communication device and the second communication device are connected to each other by responding to the first communication device. A second timing control unit for establishing encryption synchronization between the second communication line interface unit and the second timing control unit; A second encryption unit that outputs the diagnostic procedure information obtained by inputting the encryption information from the second communication line interface unit and performing a predetermined decryption when the period is established; A diagnosis target connected to a second timing control unit and the second encryption unit and transmitting the diagnostic procedure information output from the second encryption unit to the device to be diagnosed when the encryption synchronization is established. And a device interface unit.

[0006] The security diagnosis system of the present invention comprises:
A security diagnostic system comprising: a device to be diagnosed for security; and a diagnostic device for diagnosing the security of the device to be diagnosed in real time via a communication line,
The security diagnosis system has a first communication device connected between the diagnosis device and the communication line, and a second communication device connected between the device to be diagnosed and the communication line. When the first communication device is connected to the diagnostic device and detects that diagnostic procedure information indicating a security diagnosis procedure has been sent from the diagnostic device, the first communication device outputs detection information indicating the detection. A diagnostic device interface unit for
When the detection information is input from the diagnostic device interface unit and connected to the diagnostic device interface unit, the synchronization used to establish encryption synchronization before performing encrypted communication with the second communication device. First signal output
The timing control unit, the diagnostic device interface unit, and the first timing control unit are connected to each other, and when the encryption synchronization is established, the diagnostic procedure information is input from the diagnostic device interface unit to a predetermined value. A first encryption unit that outputs encrypted information that has been subjected to the encryption described above, and a synchronization unit that is connected to the first timing control unit and the first encryption unit and that is output from the first timing control unit. A signal is sent to the second communication device via the communication line, and when the encryption synchronization is established, the encrypted information output from the first encryption unit is transmitted to the second communication device via the communication line. A first communication line interface unit for sending to the first communication device, the second communication device being connected to the first communication line interface unit via the communication line, Line When the synchronization signal sent from the interface unit is input, synchronization information indicating that the synchronization signal is input is output. When the encryption synchronization is established, the synchronization information is sent from the first communication line interface unit. A second communication line interface unit for inputting the encrypted information, and the second communication line interface unit is connected to the second communication line interface unit, and when the synchronization information is input from the second communication line interface unit, A second timing control unit that establishes encryption synchronization between the first communication device and the second communication device by responding to a first communication device; and the second communication line interface. And when the encryption synchronization is established, the encryption information is input from the second communication line interface unit and a predetermined A second encryption unit that outputs the diagnostic procedure information obtained by performing the decryption, the second timing control unit and the second encryption unit are connected to each other, and when the encryption synchronization is established, The second
And a diagnostic device interface unit for transmitting the diagnostic procedure information output from the encryption unit to the diagnostic device.

In the security diagnosis system according to the present invention, when the encryption synchronization is established, in the first communication device, the first encryption unit transmits the diagnosis procedure information input from the diagnosis device interface unit. The first communication line interface unit outputs the diagnostic procedure information output by the first encryption unit to the second communication device via the communication line. In the second communication device, the second communication line interface unit inputs the diagnostic procedure information sent from the first communication line interface unit,
The diagnostic procedure information is input and output without performing decoding, and when diagnostic result information indicating a diagnostic result of security diagnosis is transmitted from the device to be diagnosed, the second communication device includes: The diagnostic device interface unit outputs the diagnostic result information to the second encryption unit,
The cryptographic unit of the present invention inputs the diagnostic result information and outputs encrypted information of the diagnostic result obtained by performing predetermined encryption, and the second communication line interface unit transmits the diagnostic result of the diagnostic result from the second cryptographic unit. Inputting the encryption information and sending it to the first paired communication line interface unit via the communication line, wherein in the first communication device, the first paired communication line interface unit sets the communication line The first encryption unit inputs the encryption information of the diagnosis result transmitted from the first communication line interface unit and performs predetermined decryption by inputting the encryption information of the diagnosis result transmitted from the first communication line interface unit. The diagnostic result information obtained as described above is output, and the diagnostic device interface unit can input the diagnostic result information from the first encryption unit and output the diagnostic result information to the diagnostic device.

In the security diagnosis system according to the present invention, when diagnosis result information indicating a diagnosis result of the security diagnosis is transmitted from the device to be diagnosed, the interface unit for the device to be diagnosed in the second communication device includes the diagnosis device. And outputting the result information to the second encryption unit. The second encryption unit inputs the diagnosis result information, outputs encrypted information of a diagnosis result obtained by performing predetermined encryption, and outputs the second paired information. A communication line interface unit for inputting the encrypted information of the diagnosis result from the second encryption unit and sending the encrypted information to the first paired communication line interface unit via the communication line; , The first communication line interface unit inputs encrypted information of the diagnosis result sent via the communication line, and the first encryption unit transmits the first communication line interface. And outputs the diagnosis result information obtained by inputting the encrypted information of the diagnosis result from the base unit and performing predetermined decryption. The diagnostic device interface unit outputs the diagnosis result from the first encryption unit. Information can be input and output to the diagnostic device.

In the security diagnosis system according to the present invention, the predetermined encryption performed by the first encryption unit or the second encryption unit can use a hash function.

The security diagnosis method according to the present invention is a security diagnosis method in which the diagnosis device diagnoses the security of the device to be diagnosed at predetermined intervals via a communication line.
The diagnostic device has a first communication device connected to the communication line, and the device to be diagnosed has a second communication device connected to the communication line. One communication device is
When detecting that diagnostic procedure information indicating a procedure of security diagnosis is transmitted from the diagnostic apparatus, a diagnostic apparatus interface step of outputting detection information indicating the detection,
When the detection information is output in the diagnostic device interface step, a synchronization signal used for establishing encryption synchronization before the first communication device performs encrypted communication with the second communication device. A first timing control step of outputting the synchronization signal, a synchronization signal transmission step of transmitting the synchronization signal output in the first timing control step to the second communication device via the communication line, and a synchronization signal transmission step In the case where the synchronization signal is transmitted in the second timing, the second timing for establishing the encryption synchronization between the first communication device and the second communication device by responding to the first communication device A control step;
When the encryption synchronization is established, a first encryption step of outputting encryption information obtained by performing predetermined encryption on the diagnostic procedure information detected in the diagnostic device interface step, and the first encryption step; A first communication line interface step of transmitting the encrypted information output by the step to the second communication device via the communication line; and the encryption transmitted by the first communication line interface step. A second encryption step of outputting the diagnostic procedure information obtained by inputting information and performing a predetermined decryption, and the diagnostic procedure information output by the second encryption step is output to the device to be diagnosed. And a diagnostic device interface step for sending to the device to be diagnosed.

The security diagnosis method according to the present invention is a security diagnosis method in which the diagnosis device diagnoses the security of the device to be diagnosed at predetermined intervals via a communication line,
The diagnostic device has a first communication device connected to the communication line, and the device to be diagnosed has a second communication device connected to the communication line. One communication device is
When detecting that diagnostic procedure information indicating a procedure of security diagnosis is transmitted from the diagnostic apparatus, a diagnostic apparatus interface step of outputting detection information indicating the detection,
When the detection information is output in the diagnostic device interface step, a synchronization signal used for establishing encryption synchronization before the first communication device performs encrypted communication with the second communication device. A first timing control step of outputting the synchronization signal, a synchronization signal transmission step of transmitting the synchronization signal output in the first timing control step to the second communication device via the communication line, and a synchronization signal transmission step In the case where the synchronization signal is transmitted in the second timing, the second timing for establishing the encryption synchronization between the first communication device and the second communication device by responding to the first communication device A control step;
When the encryption synchronization is established, a first encryption step of outputting encryption information obtained by performing predetermined encryption on the diagnostic procedure information detected in the diagnostic device interface step, and the first encryption step; A first communication line interface step of transmitting the encrypted information output by the step to the second communication device via the communication line; and the encryption transmitted by the first communication line interface step. A second encryption step of outputting the diagnostic procedure information obtained by inputting information and performing a predetermined decryption, and the diagnostic procedure information output by the second encryption step is output to the device to be diagnosed. And a diagnostic device interface step for sending to the device to be diagnosed.

In the security diagnosis method according to the present invention, when the encryption synchronization is established, the first encryption step outputs the diagnosis procedure information detected in the diagnosis device interface step without encrypting the information. The first communication line interface step includes transmitting the diagnostic procedure information output in the first encryption step to the second communication device via the communication line, and In the encrypting step, the diagnostic procedure information sent by the first communication line interface step is input and output without performing decryption. When the diagnostic result information is transmitted, the second communication device inputs the diagnostic result information and performs a predetermined encryption on the diagnostic result. The encrypted information is sent to the first communication device via the communication line, and the first communication device inputs the encrypted information of the diagnosis result sent via the communication line, and performs predetermined decryption. The diagnostic result information obtained by performing the conversion can be output to the diagnostic device.

In the security diagnosis method according to the present invention, when diagnosis result information indicating a diagnosis result of the security diagnosis is sent from the device to be diagnosed, the diagnosis result information is input to the second communication device and the predetermined diagnosis result information is input. Sending encrypted information of the encrypted diagnosis result to the first communication device via the communication line;
It is possible to input the encrypted information of the diagnostic result sent via the communication line and output the diagnostic result information obtained by performing predetermined decryption to the diagnostic device.

In the security diagnosis method according to the present invention, the predetermined encryption performed in the first encryption step or the second encryption step can use a hash function.

[0015]

Embodiments of the present invention will be described below in detail with reference to the drawings.

Embodiment 1 FIG. 1 shows a security diagnosis system according to Embodiment 1 of the present invention. In FIG. 1, reference numeral 1 denotes a diagnostic device for performing a security diagnosis;
Reference numeral 1 denotes a monitor unit provided in the diagnostic device 1 for displaying a diagnosis result and the like. Reference numeral 3 denotes a communication device A1 connected to the diagnostic device 1 and a communication interface (hereinafter referred to as "I / F") for a diagnostic device.
Unit 5, timing control unit 6a, encryption unit 7a
And infrastructure I / F (communication line I / F) 8a
2 is a device to be diagnosed that is to be subjected to remote security diagnosis by the diagnostic device 1, and 4 is a communication device A2 connected to the device 2 to be diagnosed,
F section (for communication line I / F section) 8b, timing control section 6
b, a device including the encryption unit 7b and the diagnostic device I / F unit 9, and 10 is an infrastructure line (communication line) that connects between the communication device A1 (3) and the communication device A2 (4).

Next, a description will be given of the inside of the communication device A1 (3). Reference numeral 5 is connected to the diagnostic device 1 and a computer program (diagnostic procedure information) as a security diagnostic procedure is transmitted from the diagnostic device 1. Is detected, the detection information indicating the detection is output, and the diagnostic device I / F unit 6a holding the diagnostic procedure information is connected to the diagnostic device I / F unit 5, and the diagnostic device I / F unit 5 is connected. When the detection information is sent from the / F unit 5, the synchronization used for establishing the encryption synchronization in preparation for performing the encrypted communication between the communication device A1 (3) and the communication device A2 (4) A timing control unit (first timing control unit) 7a that outputs a signal is connected to the diagnostic device I / F unit 5 and the timing control unit 6a, and the diagnostic device I is connected when the above-described encryption synchronization is established.
An encryption unit (first encryption unit) that inputs the diagnostic procedure information held in the / F unit 5 and performs predetermined encryption, and outputs the encrypted diagnostic procedure information (encryption information); 8a is connected to the timing control unit 6a and the encryption unit 7a, and transmits the synchronization signal output from the timing control unit 6a to the communication line 10
To the communication device A2 (4) via the communication unit A2, and when the encryption synchronization is established, the encryption information output from the encryption unit 7a is transmitted to the communication device A2 (4) via the communication line 10 to the communication device A2 (4). / F part.

Next, the inside of the communication apparatus A2 (4) will be described. Reference numeral 8b denotes an infrastructure I / F section 8a and a communication line 10
When the synchronization signal transmitted from the infrastructure I / F unit 8a is input, the synchronization information indicating that the synchronization signal has been input is output. The communication line I / F unit (second communication line I / F unit) 6b for receiving the encrypted information sent from the communication line I / F unit 8a is connected to the communication line I / F unit 8b. When the synchronization information is input from the communication line I / F 8b, the communication device A1 (3) responds to establish the encryption synchronization between the communication device A1 (3) and the communication device A2 (4). Control unit (second timing control unit) 7b is connected to the communication line I / F unit 8b and the timing control unit 6b, and when the encryption synchronization is established, the communication line I / F unit 8b By inputting encryption information from the Encryption unit for outputting diagnostic procedure information that is (the second encryption unit), 9 are connected to a timing control unit 6b and the encryption unit 7b, if the encryption synchronization is established,
The diagnostic procedure information output from the encryption unit 7b is
This is an I / F section for a device to be diagnosed to be sent to.

Next, a specific execution sequence of the security diagnosis method according to the first embodiment of the present invention will be described. As shown in FIG. 1, in the first embodiment, the security strength diagnosis of the diagnosis target device 2 is periodically performed from the diagnosis device 1 by remote control (arrow PD: periodic security diagnosis). At this time, the diagnostic procedure is encrypted (arrow ENC-P). Specifically, first, diagnostic procedure information in the form of a computer program is output from the diagnostic apparatus 1 to the communication apparatus A1 (3). Next, the fact that the diagnostic procedure information is given is detected by the diagnostic device I / F unit 5 in the communication device A1 (3), and the diagnostic procedure information is held in the diagnostic device I / F unit 5 and This is transmitted to the timing control section (6). The timing control unit 6a outputs an encryption synchronization timing signal (synchronization signal) necessary to realize encrypted communication with the communication device A2 (4) and sends the signal to the infrastructure I / F unit 8a. The encryption synchronization timing signal is transmitted to the communication device A2 (4) through the infrastructure line 10.

The infrastructure I / in the communication device A2 (4)
When the F section 8b detects the above-described cryptographic synchronization timing signal, the F section 8b transmits this cryptographic synchronization timing signal to the timing control section 6.
hand over to b. As a result, the timing control unit 6a of the communication device A1 (3) and the timing control unit 6 of the communication device A2 (4)
b, cryptographic synchronization is established, and preparation for encrypted communication via the infrastructure line 10 is completed.

After the preparation for encrypted communication is completed, the diagnostic procedure information passed from the diagnostic apparatus 1 to the communication apparatus A1 (3) and held in the diagnostic apparatus I / F section 5 is input to the encryption section 7a. An encryption process is performed. The diagnostic procedure information (encrypted information) on which the encryption processing has been performed is transmitted to the infrastructure I / F unit 8a.
Is output to the infrastructure line 10 through the network.

The encrypted diagnostic procedure information can be transferred to the communication device A2 (4) while ensuring security even for an intercepting act on the infrastructure circuit 10 from a third party. Communication device A2 (4) with respect to infrastructure I / F unit 8b
The encrypted diagnostic information received in (1) is passed to the encryption section 7b, where the encryption is decrypted (decrypted) and returns to the original diagnostic information.
The decrypted original diagnostic information is passed to the device under diagnosis 2 through the device to be diagnosed I / F unit 9. With the above-described series of sequences, the security strength diagnosis for the device under diagnosis 2 can be executed by remote control. Therefore, even in the infrastructure line 10 that is likely to be intercepted by a third party, the diagnostic procedure information is reliably maintained,
A highly reliable security strength diagnosis can be realized.

As described above, according to the first embodiment, when the computer security strength diagnosis is periodically performed by remote control through the infrastructure line, the diagnosis procedure (program) is encrypted and the device to be diagnosed through the infrastructure line 10 is encrypted. Since the information is sent to the second side, the diagnosis procedure can be securely concealed from the interception of a third party on the infrastructure circuit 10.
For this reason, it is possible to eliminate the problem of performing the security strength diagnosis, which is a conventional problem, that the security strength itself is weakened due to information interception on the infrastructure line.

Embodiment 2 FIG. 2 shows a security diagnosis system according to Embodiment 2 of the present invention. 2 that have the same reference numerals as those in FIG. 1 have the same functions, and a description thereof will be omitted.

In the first embodiment, the communication devices A1 (3) and A2
(4) establishing an encrypted synchronization for encrypted communication with
Thereafter, the communication device A encrypts the diagnostic procedure information by encrypting it.
1 (3) to the communication device A2 (4). In the second embodiment, as shown in FIG. 2, the security strength diagnosis of the diagnosis target device 2 from the diagnosis device 1 is periodically performed by remote control (arrow PD: periodic security diagnosis). This is the same as in the first embodiment, but in this case, instead of the diagnostic procedure, the communication device A2 encrypts the diagnostic result of the diagnosis and performs the diagnosis.
Transmission from (4) to the communication device A1 (3) (arrow ENC
-D).

Next, a specific execution sequence will be described. Until cryptographic synchronization is established, the procedure is performed in the same manner as in the first embodiment. Thereafter, the communication apparatus A1 (3) is similar to the first embodiment except that the diagnosis procedure is not encrypted.
To the communication device A 2 (4), and executes security strength diagnosis for the device under diagnosis 2 by remote control.

The diagnosis result information (data form) in the device under diagnosis 2 is passed from the device under diagnosis 2 to the diagnostic device I / F section 9 in the communication device A 2 (4). Next, the diagnosis result information is passed to the encryption unit 7b, where it is subjected to encryption processing. Thereafter, the data is output to the infrastructure line 10 through the infrastructure I / F unit 8b. At this time, since the encryption processing is effective for the third party intercepting the diagnosis result information on the infrastructure line 10, the diagnosis result information is transmitted to the communication device A1 (3) while ensuring high integrity. Can be The above-described diagnosis result information received by the infrastructure I / F unit 8a in the communication device A1 (3) is decrypted by the encryption unit 7a and is decoded into the original diagnosis result information. The decrypted diagnostic result information is passed to the diagnostic device 1 via the diagnostic device I / F unit 5, and the diagnostic result information can be displayed on the monitor unit 11. Therefore, it is possible to securely maintain the diagnosis result information of the device to be diagnosed 2 on the infrastructure line 10 that is likely to be intercepted by a third party, and to realize a highly reliable security strength diagnosis.

As described above, according to the second embodiment, when the computer security strength diagnosis is periodically performed by remote control through an infrastructure line, the diagnosis result information (data) is encrypted and the diagnostic device is transmitted through the infrastructure line 10. Since the information is sent to the first side, the diagnosis result information can be securely concealed from the interception of a third party on the infrastructure line 10. For this reason, it is possible to eliminate the problem of performing the security strength diagnosis, which is a conventional problem, that the security strength itself is weakened due to information interception on the infrastructure line.

Embodiment 3 FIG. 3 shows a security diagnosis system according to Embodiment 3 of the present invention. 3 that have the same reference numerals as those in FIG. 1 have the same functions, and a description thereof will be omitted.

In the first embodiment described above, the communication devices A1 (3) and A2
(4) establishing an encrypted synchronization for encrypted communication with
Thereafter, the communication device A encrypts the diagnostic procedure information by encrypting it.
1 (3) to the communication device A2 (4). In the third embodiment, as shown in FIG. 3, the security strength diagnosis of the diagnosis target device 2 from the diagnosis device 1 is periodically performed by remote control (arrow PD: periodic security diagnosis). The point that the procedure information is encrypted and transmitted from the communication device A2 (4) to the communication device A1 (3) is the same as in the first embodiment. The result of the diagnosis is encrypted and transmitted from the communication device A2 (4) to the communication device A1 (3) (arrow ENC-PD). That is, the third embodiment is a combination of the first and second embodiments.

Next, a specific execution sequence will be described. Until cryptographic synchronization is established, the procedure is performed in the same manner as in the first embodiment.

After the preparation for the encrypted communication is completed, the diagnostic procedure information passed from the diagnostic apparatus 1 to the communication apparatus A1 (3) and held in the diagnostic apparatus I / F section 5 is input to the encryption section 7a. An encryption process is performed. The diagnostic procedure information (encrypted information) on which the encryption processing has been performed is transmitted to the infrastructure I / F unit 8a.
Is output to the infrastructure line 10 through the network.

The encrypted diagnostic procedure information can be transferred to the communication device A2 (4) while ensuring security even for an intercept operation on the infrastructure circuit 10 from a third party. Communication device A2 (4) with respect to infrastructure I / F unit 8b
The encrypted diagnostic information received in (1) is passed to the encryption section 7b, where the encryption is decrypted (decrypted) and returns to the original diagnostic information.
The decrypted original diagnostic information is passed to the device under diagnosis 2 through the device to be diagnosed I / F unit 9. With the above-described series of sequences, the security strength diagnosis for the device under diagnosis 2 can be executed by remote control. Therefore, even in the infrastructure line 10 that is likely to be intercepted by a third party, the diagnostic procedure information is reliably maintained,
A highly reliable security strength diagnosis can be realized.

The diagnosis result information (data form) in the device under diagnosis 2 is passed from the device under diagnosis 2 to the diagnostic device I / F unit 9 in the communication device A 2 (4). Next, the diagnosis result information is passed to the encryption unit 7b, where it is subjected to encryption processing. Thereafter, the data is output to the infrastructure line 10 through the infrastructure I / F unit 8b. At this time, since the encryption processing is effective for the third party intercepting the diagnosis result information on the infrastructure line 10, the diagnosis result information is transmitted to the communication device A1 (3) while ensuring high integrity. Can be The above-described diagnosis result information received by the infrastructure I / F unit 8a in the communication device A1 (3) is decrypted by the encryption unit 7a and is decoded into the original diagnosis result information. The decrypted diagnostic result information is passed to the diagnostic device 1 via the diagnostic device I / F unit 5, and the diagnostic result information can be displayed on the monitor unit 11. Therefore, it is possible to securely maintain the diagnosis result information of the device to be diagnosed 2 on the infrastructure line 10 that is likely to be intercepted by a third party, and to realize a highly reliable security strength diagnosis.

As described above, according to the third embodiment, when the computer security strength diagnosis is periodically performed by remote control through the infrastructure line, the diagnosis procedure (program) is encrypted and the device to be diagnosed through the infrastructure line 10 is encrypted. Since the information is sent to the second side, the diagnosis procedure can be securely concealed from the interception of a third party on the infrastructure circuit 10.
Furthermore, since the diagnosis result information (data) is encrypted and sent to the diagnosis device 1 via the infrastructure line 10, the diagnosis result information can be securely concealed from the interception of a third party on the infrastructure line 10. For this reason, it is possible to eliminate the problem of performing the security strength diagnosis, which is a conventional problem, that the security strength itself is weakened due to information interception on the infrastructure line.

Embodiment 4 FIG. 4 shows a security diagnosis system according to Embodiment 4 of the present invention. 4 that have the same reference numerals as those in FIG. 1 have the same functions, and a description thereof will be omitted.

In the first embodiment described above, the security strength diagnosis of the device to be diagnosed 2 is periodically performed from the diagnostic device 1 by remote control (arrow PD in FIG. 1). The difference is that the security diagnosis is performed in real time (arrow RD in FIG. 4). By performing the security diagnosis in real time, it is possible to construct a more reliable system capable of promptly responding to unauthorized access as compared with the periodic diagnosis of the first embodiment. In other respects, as in the first embodiment, cryptographic synchronization is established, and then the diagnostic procedure is encrypted and transmitted from the communication device A1 (3) to the communication device A.
2 (4), and executes security strength diagnosis for the device under diagnosis 2 by remote control.

As described above, according to the fourth embodiment, when the computer security strength diagnosis is performed in real time by remote control through an infrastructure line, the diagnosis procedure (program) is encrypted and the device to be diagnosed 2 is encrypted via the infrastructure line 10. Since the information is sent to the side, the diagnosis procedure can be securely concealed from the interception of a third party on the infrastructure circuit 10. For this reason, it is possible to eliminate the problem of performing the security strength diagnosis, which is a conventional problem, that the security strength itself is weakened due to information interception on the infrastructure line.
Further, a system can be constructed which is more reliable and can quickly respond to unauthorized access as compared with a regular diagnosis.

Fifth Embodiment FIG. 5 shows a security diagnosis system according to a fifth embodiment of the present invention. 5 having the same reference numerals as those in FIG. 2 have the same functions, and the description thereof will be omitted.

In the above-described second embodiment, the security strength diagnosis of the device to be diagnosed 2 is periodically performed by the remote control from the diagnosis device 1 (arrow PD in FIG. 2). The difference is that security diagnosis is performed in real time (arrow RD in FIG. 5). By performing the security diagnosis in real time, it is possible to construct a more reliable system capable of promptly responding to unauthorized access as compared with the periodic diagnosis according to the second embodiment. Otherwise, as in the second embodiment, cryptographic synchronization is established, and then the diagnosis procedure is transmitted from the communication device A1 (3) to the communication device A2 (4) without encryption, and Execute security strength diagnosis by remote control. The diagnostic device 1 encrypts the diagnostic result information (data) and transmits it via the infrastructure line 10.
Send to the side.

As described above, according to the fifth embodiment, when computer security strength diagnosis is performed in real time by remote control via an infrastructure line, the diagnosis result information (data) is encrypted, and the diagnostic device 1 is encrypted via the infrastructure line 10. Since the information is sent to the side, the diagnosis procedure can be securely concealed from the interception of a third party on the infrastructure circuit 10. For this reason, it is possible to eliminate the problem of performing the security strength diagnosis, which is a conventional problem, that the security strength itself is weakened due to information interception on the infrastructure line. Further, a system can be constructed which is more reliable and can quickly respond to unauthorized access as compared with a regular diagnosis.

Embodiment 6 FIG. 6 shows a security diagnosis system according to Embodiment 6 of the present invention. 6 having the same reference numerals as those in FIG. 3 have the same functions, and the description thereof will be omitted.

In the above-described third embodiment, the security strength diagnosis of the device to be diagnosed 2 is periodically performed by the remote control from the diagnosis device 1 (arrow PD in FIG. 3). The difference is that the security diagnosis is performed in real time (arrow RD in FIG. 6). By performing the security diagnosis in real time, it is possible to construct a more reliable system capable of promptly responding to unauthorized access as compared with the periodic diagnosis according to the third embodiment. In other respects, as in the third embodiment, cryptographic synchronization is established, and then the diagnostic procedure is encrypted and transmitted from the communication device A1 (3) to the communication device A.
2 (4), and executes security strength diagnosis for the device under diagnosis 2 by remote control. The diagnostic device 1 encrypts the diagnostic result information (data) and transmits it via the infrastructure line 10.
Send to the side.

As described above, according to the sixth embodiment, in the case where the computer security strength diagnosis is performed in real time by remote control through an infrastructure line, the diagnosis procedure (program) is encrypted and the diagnosis target device 2 is encrypted via the infrastructure line 10. Since the information is sent to the side, the diagnosis procedure can be securely concealed from the interception of a third party on the infrastructure circuit 10. Further, since the diagnosis result information (data) is encrypted and sent to the diagnosis device 1 via the infrastructure line 10, the diagnosis procedure can be securely concealed from the interception of a third party on the infrastructure line 10. For this reason, conducting security strength diagnosis, which has been a problem in the past,
It is possible to eliminate the adverse effect that the security strength itself is weakened by information interception on the infrastructure line. Further, a system can be constructed which is more reliable and can quickly respond to unauthorized access as compared with a regular diagnosis.

In the first to sixth embodiments, the encryption performed by the encryption units 7a and 7b can use, for example, a hash function. Further, other encryption methods such as a public key encryption method and a common key encryption method can be used, and the present invention is not limited to a specific encryption method.

[0046]

As described above, according to the security diagnosis system and method of the present invention, encrypted diagnostic information is transmitted over an infrastructure line and / or encrypted diagnostic result information is transmitted. Accordingly, it is possible to provide a security diagnosis system and a method capable of preventing the diagnostic information from being intercepted and preventing the security strength from being weakened by performing the security strength diagnosis.

[Brief description of the drawings]

FIG. 1 is a diagram showing a security diagnosis system according to a first embodiment of the present invention.

FIG. 2 is a diagram illustrating a security diagnosis system according to a second embodiment of the present invention.

FIG. 3 is a diagram showing a security diagnosis system according to a third embodiment of the present invention.

FIG. 4 is a diagram showing a security diagnosis system according to a fourth embodiment of the present invention.

FIG. 5 is a diagram showing a security diagnosis system according to a fifth embodiment of the present invention.

FIG. 6 is a diagram showing a security diagnosis system according to a sixth embodiment of the present invention.

[Explanation of symbols]

1 diagnostic device, 2 device to be diagnosed, 3 communication device A
1, 4 communication device A2, 5 pair diagnostic device I / F section,
6a, 6b Timing control unit, 7a, 7b encryption unit, 8a, 8b Infra I / F unit, 9 Diagnostic device I / F unit, 10 Infrastructure line, 11 Monitor unit.

Claims (10)

[Claims] 1. A security diagnostic system comprising: a device to be diagnosed for security; and a diagnostic device for diagnosing the security of the device to be diagnosed at predetermined intervals via a communication line. Has a first communication device connected between the diagnostic device and the communication line, and a second communication device connected between the device to be diagnosed and the communication line, The first communication device is connected to the diagnostic device, and when detecting that diagnostic procedure information indicating a security diagnostic procedure is transmitted from the diagnostic device, outputs the detection information indicating the detection. An interface unit, connected to the diagnostic device interface unit, and when the detection information is input from the diagnostic device interface unit, before performing encrypted communication with the second communication device. Output the synchronization signal used to establish the encrypted synchronization of
A timing control unit, connected to the diagnostic device interface unit and the first timing control unit, and when the encryption synchronization is established, inputting the diagnostic procedure information from the diagnostic device interface unit to a predetermined A first encryption unit that outputs encrypted information that has been subjected to encryption, a synchronization unit that is connected to the first timing control unit and the first encryption unit, and that is output from the first timing control unit. A signal is sent to the second communication device via the communication line, and when the encryption synchronization is established, the encrypted information output from the first encryption unit is transmitted to the second communication device via the communication line. A first communication line interface unit for transmitting to the first communication device, the second communication device is connected to the first communication line interface unit via the communication line, and the first communication device Times When the synchronization signal sent from the line interface unit is input, synchronization information indicating that the synchronization signal is input is output, and when the encryption synchronization is established, the synchronization information is sent from the first communication line interface unit. A second communication line interface unit for inputting the obtained encrypted information; and a second communication line interface unit connected to the second communication line interface unit, wherein the synchronization information is input from the second communication line interface unit. A second timing control unit that establishes encryption synchronization between the first communication device and the second communication device by responding to the first communication device; and the second communication line pair. The encryption unit is connected to the interface unit and the second timing control unit, and when the encryption synchronization is established, the encryption information is input from the second communication line interface unit; A second encryption unit that outputs the diagnostic procedure information obtained by performing a constant decryption, is connected to the second timing control unit and the second encryption unit, and the encryption synchronization is established. And a diagnostic device interface unit for transmitting the diagnostic procedure information output from the second encryption unit to the device to be diagnosed. 2. A security diagnostic system comprising: a device to be diagnosed for security; and a diagnostic device for diagnosing the security of the device to be diagnosed in real time via a communication line. A first communication device connected between the diagnostic device and the communication line; and a second communication device connected between the device to be diagnosed and the communication line.
The first communication device is connected to the diagnostic device, and when detecting that diagnostic procedure information indicating a security diagnostic procedure is transmitted from the diagnostic device, the first communication device performs the detection. A diagnostic device interface unit that outputs detection information indicating, the diagnostic device interface unit is connected to the diagnostic device interface unit, and when the detection information is input from the diagnostic device interface unit, the second communication device is encrypted. A first output of a synchronization signal used for establishing encryption synchronization before communication is performed
A timing control unit, connected to the diagnostic device interface unit and the first timing control unit, and when the encryption synchronization is established, inputting the diagnostic procedure information from the diagnostic device interface unit to a predetermined A first encryption unit that outputs encrypted information that has been subjected to encryption, a synchronization unit that is connected to the first timing control unit and the first encryption unit, and that is output from the first timing control unit. A signal is sent to the second communication device via the communication line, and when the encryption synchronization is established, the encrypted information output from the first encryption unit is transmitted to the second communication device via the communication line. A first communication line interface unit for transmitting to the first communication device, the second communication device is connected to the first communication line interface unit via the communication line, and the first communication device Times When the synchronization signal sent from the line interface unit is input, synchronization information indicating that the synchronization signal is input is output, and when the encryption synchronization is established, the synchronization information is sent from the first communication line interface unit. A second communication line interface unit for inputting the obtained encrypted information; and a second communication line interface unit connected to the second communication line interface unit, wherein the synchronization information is input from the second communication line interface unit. A second timing control unit that establishes encryption synchronization between the first communication device and the second communication device by responding to the first communication device; and the second communication line pair. The encryption unit is connected to the interface unit and the second timing control unit, and when the encryption synchronization is established, the encryption information is input from the second communication line interface unit; A second encryption unit that outputs the diagnostic procedure information obtained by performing a constant decryption, is connected to the second timing control unit and the second encryption unit, and the encryption synchronization is established. And a diagnostic device interface unit for transmitting the diagnostic procedure information output from the second encryption unit to the device to be diagnosed. 3. When the encryption synchronization is established, in the first communication device, the first encryption unit does not encrypt the diagnostic procedure information input from the diagnostic device interface unit. The first communication line interface unit outputs the diagnostic procedure information output by the first encryption unit to the second communication device via the communication line. In the communication device, the second paired communication line interface unit inputs the diagnostic procedure information sent from the first paired communication line interface unit, inputs the diagnostic procedure information, and performs no decoding. Outputting diagnostic result information indicating a result of security diagnosis from the device to be diagnosed, in the second communication device, the interface with the device to be diagnosed performs the diagnosis. And outputs the result information to the second encryption unit. The second encryption unit inputs the diagnosis result information, outputs encrypted information of the diagnosis result obtained by performing predetermined encryption, and outputs the second paired information. A communication line interface unit for inputting the encrypted information of the diagnosis result from the second encryption unit and transmitting the encrypted information to the first paired communication line interface unit via the communication line; In the first communication line interface unit, the encrypted information of the diagnosis result sent via the communication line is input, and the first encryption unit receives the encrypted information from the first communication line interface unit. Inputting the encrypted information of the diagnostic result and outputting the diagnostic result information obtained by performing predetermined decryption, the diagnostic device interface unit inputs the diagnostic result information from the first encryption unit To the diagnostic device Security diagnostic system of claim 1, wherein that. 4. When the diagnosis result information indicating the diagnosis result of the security diagnosis is transmitted from the device to be diagnosed, in the second communication device, the interface to the device to be diagnosed transmits the diagnosis result information to the second communication device. The second encryption unit inputs the diagnosis result information and outputs encryption information of a diagnosis result obtained by performing predetermined encryption, and the second communication line interface unit outputs The second communication unit inputs encrypted information of the diagnosis result from the second encryption unit and sends the encrypted information to the first communication line interface unit via the communication line. The communication line interface unit inputs the diagnosis result encryption information sent via the communication line, and the first encryption unit transmits the diagnosis result encryption information from the first communication line interface unit. Enter And outputting the diagnostic result information obtained by performing the predetermined decryption, and the diagnostic device interface unit inputs the diagnostic result information from the first encryption unit and outputs the information to the diagnostic device. The security diagnosis system according to claim 1 or 2, wherein 5. The security diagnosis system according to claim 1, wherein the predetermined encryption performed by the first encryption unit or the second encryption unit uses a hash function. 6. A security diagnosis method in which a diagnostic device diagnoses security of a device to be diagnosed at predetermined intervals via a communication line, wherein the diagnostic device is connected to a first line connected to the communication line. A communication device, wherein the device to be diagnosed has a second communication device connected to the communication line, and a first communication device performs a diagnosis from the diagnosis device to indicate a security diagnosis procedure. When detecting that the procedure information has been sent, the diagnostic device interface step of outputting detection information indicating the detection, and the first communication device when the detection information is output in the diagnostic device interface step A first timing control step of outputting a synchronization signal used for establishing encryption synchronization before performing encrypted communication with the second communication apparatus; and a first timing control step of outputting a synchronization signal. Transmitting the synchronization signal output in the step to the second communication device through the communication line; and transmitting the synchronization signal in the synchronization signal transmitting step, the first communication being performed. A second timing control step of establishing encryption synchronization between the first communication device and the second communication device by responding to the device; and performing the diagnosis when the encryption synchronization is established. A first encryption step of outputting encrypted information obtained by performing predetermined encryption on the diagnostic procedure information detected in the device interface step; and transmitting the encrypted information output in the first encryption step to the communication. A first paired communication line interface step for sending to the second communication device via a line; and a first paired communication line interface step. A second encryption step of outputting the diagnostic procedure information obtained by inputting the encryption information and performing a predetermined decryption, and the diagnostic procedure information output by the second encryption step A diagnostic device interface step for sending to the device to be diagnosed. 7. A security diagnosis method in which a diagnostic device diagnoses security of a device to be diagnosed at predetermined intervals via a communication line, wherein the diagnostic device is connected to a first line connected to the communication line. A communication device, wherein the device to be diagnosed has a second communication device connected to the communication line, and a first communication device performs a diagnosis from the diagnosis device to indicate a security diagnosis procedure. When detecting that the procedure information has been sent, the diagnostic device interface step of outputting detection information indicating the detection, and the first communication device when the detection information is output in the diagnostic device interface step A first timing control step of outputting a synchronization signal used for establishing encryption synchronization before performing encrypted communication with the second communication apparatus; and a first timing control step of outputting a synchronization signal. Transmitting the synchronization signal output in the step to the second communication device through the communication line; and transmitting the synchronization signal in the synchronization signal transmitting step, the first communication being performed. A second timing control step of establishing encryption synchronization between the first communication device and the second communication device by responding to the device; and performing the diagnosis when the encryption synchronization is established. A first encryption step of outputting encrypted information obtained by performing predetermined encryption on the diagnostic procedure information detected in the device interface step; and transmitting the encrypted information output in the first encryption step to the communication. A first paired communication line interface step for sending to the second communication device via a line; and a first paired communication line interface step. A second encryption step of outputting the diagnostic procedure information obtained by inputting the encryption information and performing a predetermined decryption, and the diagnostic procedure information output by the second encryption step A diagnostic device interface step for sending to the device to be diagnosed. 8. When the encryption synchronization is established, the first encrypting step outputs the diagnostic procedure information detected in the diagnostic device interface step without encrypting the information, and outputs the first diagnostic procedure information without encrypting the diagnostic procedure information. The communication line interface step sends the diagnostic procedure information output in the first encryption step to the second communication device via the communication line, and the second encryption step includes: The diagnostic procedure information transmitted by the first communication line interface step is input and output without decoding, and diagnostic result information indicating a security diagnostic diagnosis result is transmitted from the device to be diagnosed. In the second communication device, the diagnosis result information is input, and the encrypted information of the diagnosis result obtained by performing predetermined encryption is previously transmitted via the communication line. Sending to the first communication device, wherein in the first communication device, the diagnosis result obtained by inputting the encrypted information of the diagnosis result sent via the communication line and performing predetermined decryption; 8. The security diagnosis method according to claim 6, wherein information is output to the diagnosis device. 9. When the diagnosis result information indicating the diagnosis result of the security diagnosis is transmitted from the device to be diagnosed, the second communication device inputs the diagnosis result information and performs a predetermined encryption. Sending the encrypted information of the result to the first communication device via the communication line, and inputting the encrypted information of the diagnosis result sent via the communication line in the first communication device, 8. The security diagnostic method according to claim 6, wherein the diagnostic result information obtained by performing the decryption is output to the diagnostic device. 10. The method according to claim 6, wherein the predetermined encryption performed in the first encryption step or the second encryption step uses a hash function. Security diagnostic method.