JP2019004352A - Unauthorized access detection device and method - Google Patents

Abstract

To make it possible to detect unauthorized access from the outside.SOLUTION: When a monitoring unit 102 detects specific information targeted by any of facility apparatuses 121 transmitted to a communication line 111, a transmission unit 103 transmits a transmission request for the specific information to a transmission source identified by transmission source information on the specific information detected together with the specific information. A determination unit 105 determines that the specific information detected by the monitoring unit 102 is unauthorized if a response corresponding to the specific information detected by the monitoring unit 102 is not received.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an unauthorized access detection apparatus and method for detecting unauthorized access to an equipment device from an unauthorized device.

  Conventionally, a so-called BACnet system that uses a communication protocol standard for intelligent building networks called BACnet (Building Automation and Control Networking Protocol: registered trademark) as a facility management system for managing various facilities installed in buildings Is spreading.

JP 2007-199798 A

  Such a BACnet system was originally applied to a closed environment, and thus, unauthorized access has not been regarded as important so far. However, in recent years, cooperation with IOT and other systems is progressing, and it is changing to an open environment accessible from the outside. For this reason, there has been a problem that various devices in the BACnet system may be illegally operated when a malicious person can connect to the BACnet system through unauthorized access.

  The present invention has been made to solve the above-described problems, and an object thereof is to detect unauthorized access from the outside.

  An unauthorized access detection device according to the present invention is configured to monitor a communication line to which a plurality of equipment is connected, and detect the transmission of specific information targeted by any equipment to the communication line. A monitoring unit, a transmission unit that transmits a transmission request for specific information to a transmission source specified by the transmission source information of the specific information detected by the monitoring unit together with the specific information in response to detection of the specific information by the monitoring unit, and a transmission A receiving unit configured to receive a response to a request, and a determining unit configured to determine that the specific information detected by the monitoring unit is invalid if a response that matches the specific information detected by the monitoring unit is not received With.

  In the above unauthorized access detection device, the determination unit, after the transmission unit transmits a transmission request, if a response that matches the specific information detected by the monitoring unit is not received within a predetermined time, the determination unit detects the specific information detected by the monitoring unit. You may make it judge that it is fraudulent.

  In the unauthorized access detection device, the determination unit may determine that the specific information detected by the monitoring unit is illegal if a response that matches the specific information detected by the monitoring unit within a set allowable range is not received. It may be.

  In the above unauthorized access detection device, after the determination unit determines that the detected specific information is illegal, the monitoring unit newly specifies the specific information from the same transmission source specified by the transmission source information, and the reception unit A re-determination unit that cancels the determination that the unauthorized access from the outside by the determination unit is detected when the received response matches may be further provided.

  The unauthorized access detection method according to the present invention includes a first step of monitoring a communication line connected to a plurality of equipment and detecting specific information targeted by any equipment sent to the communication line; A second step of transmitting a transmission request for specific information to the transmission source specified by the transmission source information of the specific information detected together with the specific information in the first step in response to detection of the specific information in the first step; And a fourth step of determining that the specific information detected in the first step is illegal when a response matching the specific information detected in the first step is not received.

  In the above-described unauthorized access detection method, in the fourth step, if a response that matches the specific information detected in the first step is not received within a predetermined time after the transmission request is transmitted in the second step, the detection is performed in the first step. The specified information is determined to be illegal.

  In the unauthorized access detection method, in the fourth step, if the response that matches the specific information detected in the first step is not received within the set allowable range, the specific information detected in the first step is determined to be illegal. You may make it judge.

  In the above unauthorized access detection method, after the detected specific information is determined to be illegal in the fourth step, the newly detected specific information from the same transmission source specified by the transmission source information is received in the third step. If the response matches, the fifth step of canceling the determination that the unauthorized access from the outside is detected in the fourth step may be further provided.

  As described above, according to the present invention, when the specific information targeted by any of the equipment transmitted to the communication line is detected, the transmission specified by the transmission source information of the specific information detected together with the specific information Originally, since the transmission request for specific information is transmitted, an excellent effect of detecting unauthorized access from outside can be obtained.

FIG. 1 is a configuration diagram showing a configuration of an unauthorized access detection device according to Embodiment 1 of the present invention. FIG. 2 is a flowchart for explaining the unauthorized access detection method according to the first embodiment of the present invention. FIG. 3 is a configuration diagram showing the configuration of the unauthorized access detection device according to the second embodiment of the present invention. FIG. 4 is a block diagram showing the hardware configuration of the facility management support system according to the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Embodiment 1]
First, an unauthorized access detection apparatus 101 according to Embodiment 1 of the present invention will be described with reference to FIG. The unauthorized access detection device 101 is connected to the communication line 111. A plurality of facility devices 121 are connected to the communication line 111.

  The equipment 121 is a device that constitutes an air conditioning system in a building such as a temperature sensor, an air flow sensor, and an air conditioning control device. In the air conditioning system, the flow rate of the refrigerant is controlled by a valve based on each measurement value measured by a temperature sensor, an air volume sensor, and the like, and the air volume is controlled by a damper operating device.

  Each measured value measured by a temperature sensor, an air volume sensor, etc. is transmitted to an air-conditioning control apparatus by the communication line 111 by a BACnet system, for example. For example, the temperature sensor has a measurement temperature range, measurement type, output type, etc., and based on the set information, the temperature measurement value is transmitted as specific information targeted by this equipment. It is sent to the line 111. For example, in the BACnet system, a temperature measurement value is transmitted as a COV service message by a “COVNotification” service. The temperature measurement value sent to the communication line 111 is received by the air conditioning control device and used for air conditioning control.

  Here, if an incorrect (spoofed) temperature measurement result (specific information) is transmitted from an unauthorized device 131 by a malicious person pretending to be any one of the facility devices 121, the air conditioning system causes an incorrect temperature measurement. Air conditioning will be implemented depending on the result. As a result, there arises a big problem that the user cannot perform comfortable air conditioning control. The unauthorized access detection device 101 detects erroneous information due to such unauthorized access.

  The unauthorized access detection apparatus 101 includes a monitoring unit 102, a transmission unit 103, a reception unit 104, and a determination unit 105.

  The monitoring unit 102 monitors the communication line 111 to which a plurality of facility devices 121 are connected, and detects the transmission of specific information targeted by any of the facility devices 121 to the communication line 111. For example, in the BACnet system, the monitoring unit 102 detects a COV service message flowing through the communication line 111. The COV service message includes the property (specific information) of the object targeted by the equipment device 121 that is the source of transmission (transmission).

  In response to detection of specific information by the monitoring unit 102, the transmission unit 103 transmits a transmission request for specific information to the transmission source specified by the transmission source information of the specific information detected by the monitoring unit 102 together with the specific information. The receiving unit 104 receives a response to the transmission request.

  For example, in the BACnet system, a message for confirming the property information of the object of the COVNotification is transmitted to the transmission source address included in the detected COV service message by the “ReadProperty Multiple” service. In response to this confirmation request, the destination equipment 121 transmits a response message to the unauthorized access detection apparatus 101 via the communication line 111. The response message includes the property (specific information) of the target object in the destination equipment 121. For this reason, the receiving unit 104 receives a response message including the property (specific information) of the target object in the destination equipment 121.

  When the response matching the specific information detected by the monitoring unit 102 is not received, the determination unit 105 determines that the specific information detected by the monitoring unit 102 is illegal and detects unauthorized access from the outside. For example, if the response matching the specific information detected by the monitoring unit 102 is not received within a predetermined time after the transmission unit 103 transmits a transmission request, the determination unit 105 illegally identifies the specific information detected by the monitoring unit 102. Judge.

  As described above, the response message received by the receiving unit 104 includes specific information targeted in the destination equipment 121. If the specific information included in this response matches the specific information detected by the monitoring unit 102, it can be determined that the specific information detected by the monitoring unit 102 is correct.

  On the other hand, when the monitoring unit 102 detects erroneous (spoofed) specific information transmitted from the unauthorized device 131 impersonating the equipment device 121, it does not match the specific information in the response message received by the receiving unit 104. Become. The request by the transmission unit 103 is transmitted to the equipment device 121 impersonated by the unauthorized device 131. Therefore, the response message received by the receiving unit 104 is transmitted from the equipment 121 impersonating the unauthorized device 131. Here, when incorrect specific information is sent from the unauthorized device 131 to the communication line 111, this specified information is different from the specified information sent from the facility device 121 pretending to be the unauthorized device 131.

  As described above, when the specific information in the response received by the receiving unit 104 does not match the specific information detected by the monitoring unit 102, the specific information detected by the monitoring unit 102 can be determined to be illegal.

  In addition, when the unauthorized device 131 performs address spoofing by ARP spoofing, there is a possibility that a transmission request for specific information by the transmission unit 103 is transmitted to the unauthorized device 131. However, in this case, the unauthorized device 131 is not a regular facility device in the air conditioning system, and is not a regular BACnet device, for example. For this reason, the unauthorized device 131 cannot return a response to the request. Therefore, even when there is no response, the determination unit 105 determines that the specific information detected by the monitoring unit 102 is illegal when a response that matches the specific information detected by the monitoring unit 102 is not received.

  By the way, when the unauthorized device 131 implements a network communication protocol used in the air conditioning system, for example, the unauthorized device 131 may have a function as a BACnet device. In this case, the "ReadProperty Multiple" service sends an information acquisition request to objects that actually exist in addition to the target object, and confirms whether or not the information of all objects has been acquired in response to this request However, if it is not acquired, it may be determined that there is a possibility of fraud.

  If the unauthorized device has misrepresented the response value of “ReadProperty” or “ReadProperty Multiple”, if the response value is a response of “ReadProperty Multiple”, the individual object is not “ReadProperty Multiple” but “ReadProperty Multiple”. All the (equipment equipment) are checked with a request message for object information, and the response values are compared to see if they are the same. If they are different, it is determined that there is a possibility of fraud. As a precaution, the request may be confirmed by including an object not included in “ReadProperty Multiple”.

  In addition, since the unauthorized device is not a BACnet device, it can respond only with “ReadProperty Multiple”. Therefore, if it is “ReadProperty” other than “ReadProperty Multiple”, it cannot be answered. it can.

  On the other hand, if the response value is a “ReadProperty” response that is not “ReadProperty Multiple”, execute the request with the “ReadProperty” object information request message for “ReadProperty Multiple” and compare the response values to see if they are the same value. If it is a value, it is determined that there is a possibility of fraud.

  In addition, since an unauthorized device can reply only to messages that are not “ReadProperty Multiple”, it cannot be answered in the case of “ReadProperty Multiple”, so it can be determined that there is a possibility of fraud even if no response is made. In the unlikely event that an unauthorized device has a BACnet function, the “ReadProperty Multiple” service sends an information acquisition request to an object that actually exists in addition to the target object. , It is confirmed whether the information of all objects has been acquired. If not, it is determined that there is a possibility of fraud.

  Next, an operation example (unauthorized access detection method) of the unauthorized access detection apparatus in the first embodiment will be described with reference to FIG.

  First, in step S <b> 101, the monitoring unit 102 monitors the communication line 111 to monitor whether specific information has been sent to the communication line 111. A plurality of equipment devices 121 and unauthorized devices 131 are connected to the communication line 111. In this monitoring, when the specific information targeted by any of the equipment devices 121 sent to the communication line 111 is detected (yes in step S101) (first step), in step S102, the transmission unit 103 specifies the specific information. Is sent (second step). The transmission unit 103 transmits a transmission request to the transmission source specified by the transmission source information of the specific information detected by the monitoring unit 102 together with the specific information.

  Next, in step S103, the receiving unit 104 monitors whether a response to the transmission request has been received. When the receiving unit 104 receives a response to the transmission request (yes in step S103) (third step), in step S104, the determining unit 105 determines that the specific information included in the received response is displayed by the monitoring unit 102. It is determined whether or not it matches the detected specific information. If the specific information included in the received response matches the specific information detected by the monitoring unit 102 (yes in step S104), the process ends.

  On the other hand, when the specific information included in the received response does not match the specific information detected by the monitoring unit 102 (no in step S104), the determination unit 105 determines that the specific information detected by the monitoring unit 102 in step S105. Is determined to be illegal (fourth step). If the response is not received within the predetermined time in Step S103 (Yes in Step S106), the determination unit 105 determines that the specific information detected by the monitoring unit 102 is illegal (Step S105). 4 steps).

  By the way, the determination unit 105 determines that the specific information detected by the monitoring unit 102 is not illegal when the response to the transmission request matches within the allowable range set in the specific information detected by the monitoring unit 102. May be. For example, when the specific information by the COV service message is frequently changed, the specific information may be changed when a transmission request is issued after the monitoring unit 102 detects the specific information. For example, when the equipment 121 is an analog point or the like, the state value of the output object property frequently fluctuates within a predetermined range. In such a case, if a decision is made based on a perfect match, frequent misjudgment of fraud often occurs. On the other hand, if the permissible width is set and it is determined that it is not illegal if they match within the permissible width range, the above-described erroneous determination can be suppressed.

[Embodiment 2]
Next, the unauthorized access detection apparatus 101 according to the second embodiment of the present invention will be described with reference to FIG. This unauthorized access detection apparatus 101 is connected to the communication line 111 as in the first embodiment. A plurality of facility devices 121 are connected to the communication line 111.

  The unauthorized access detection apparatus 101 includes a monitoring unit 102, a transmission unit 103, a reception unit 104, and a determination unit 105, as in the first embodiment.

  In the second embodiment, the unauthorized access detection apparatus 101 further includes a re-determination unit 106. After the determination unit 105 determines that the detected specific information is illegal, the re-determination unit 106 specifies the specific information from the same transmission source specified by the transmission source information newly detected by the monitoring unit 102, and the reception unit It is determined whether or not the response received by 104 matches. If the determinations match, the re-determination unit 106 cancels the determination that the unauthorized access from the outside by the determination unit 105 has been detected (fifth step).

  For example, when the specific information by the COV service message is frequently changed, the specific information may be changed when a transmission request is issued after the monitoring unit 102 detects the specific information. For example, when the equipment 121 is an analog point or the like, the state value of the output object property frequently fluctuates within a predetermined range. In such a case, misjudgment of fraud frequently occurs. On the other hand, when the specific information newly detected by the monitoring unit 102 matches the response received by the receiving unit 104, the determination by the determining unit 105 is canceled to suppress the above-described erroneous determination. it can.

  As shown in FIG. 4, the unauthorized access detection device in the above-described embodiment includes a CPU (Central Processing Unit) 201, a main storage device 202, an external storage device 203, a network connection device 204, and the like. The above-described functions are realized by the CPU operating by a program developed in the main storage device. The network connection device 204 is connected to the network 205. Each function may be distributed among a plurality of computer devices.

  As described above, according to the present invention, when specific information targeted by any of the equipment transmitted to the communication line is detected, the specific information is identified by the source information of the detected specific information together with the specific information. Since a transmission request for specific information is transmitted to the transmission source, unauthorized access from outside can be detected.

  The present invention is not limited to the embodiment described above, and many modifications and combinations can be implemented by those having ordinary knowledge in the art within the technical idea of the present invention. It is obvious.

  DESCRIPTION OF SYMBOLS 101 ... Unauthorized access detection apparatus, 102 ... Monitoring part, 103 ... Transmission part, 104 ... Reception part, 105 ... Judgment part, 111 ... Communication line, 121 ... Equipment, 131 ... Unauthorized equipment.

Claims (8)

A monitoring unit configured to monitor a communication line to which a plurality of facility devices are connected and detect transmission of specific information targeted by any of the facility devices to the communication line;
In response to detection of specific information by the monitoring unit, a transmission unit that transmits a transmission request for specific information to a transmission source specified by the transmission source information of the specific information detected by the monitoring unit together with the specific information;
A receiver configured to receive a response to the transmission request;
An unauthorized access detection apparatus comprising: a determination unit configured to determine that the specific information detected by the monitoring unit is illegal when a response that matches the specific information detected by the monitoring unit is not received. The unauthorized access detection device according to claim 1,
When the determination unit does not receive a response that matches the specific information detected by the monitoring unit within a predetermined time after the transmission unit transmits the transmission request, the determination unit determines that the specific information detected by the monitoring unit is illegal. An unauthorized access detection device characterized by judging. The unauthorized access detection device according to claim 1 or 2,
The determination unit determines that the specific information detected by the monitoring unit is illegal when a response that matches the specific information detected by the monitoring unit within a set allowable range is not received. Unauthorized access detection device. The unauthorized access detection device according to any one of claims 1 to 3,
After the determination unit determines that the detected specific information is illegal, specific information from the same transmission source specified by the transmission source information newly detected by the monitoring unit, and the response received by the reception unit However, when there is a match, the unauthorized access detection apparatus further includes a re-determination unit that cancels the determination that the unauthorized access from the outside is detected by the determination unit. A first step of monitoring a communication line connected to a plurality of equipment and detecting specific information targeted by any of the equipment sent to the communication line;
A second step of transmitting a specific information transmission request to a transmission source specified by the transmission source information of the specific information detected together with the specific information in the first step in response to detection of the specific information by the first step;
A third step of receiving a response to the transmission request;
An unauthorized access detection method comprising: a fourth step of determining that the specific information detected in the first step is illegal when a response matching the specific information detected in the first step is not received. The unauthorized access detection method according to claim 5.
In the fourth step, if the response matching the specific information detected in the first step is not received within a predetermined time after the transmission request is transmitted in the second step, the specific detected in the first step An unauthorized access detection method characterized in that information is judged to be unauthorized. The unauthorized access detection method according to claim 5 or 6,
In the fourth step, if a response that matches the specific information detected in the first step within the set allowable range is not received, the specific information detected in the first step is determined to be illegal. A feature of the method of detecting unauthorized access. In the unauthorized access detection method according to any one of claims 5 to 7,
After determining that the detected specific information is illegal in the fourth step, the newly detected specific information from the same transmission source specified by the transmission source information and the response received in the third step are: An unauthorized access detection method, further comprising a fifth step of canceling the determination that unauthorized access from the outside in the fourth step is detected when they match.

Images