JP2020120274A - Unauthorized access monitoring device, unauthorized access monitoring method, and central monitoring system - Google Patents

Abstract

To provide an unauthorized access monitoring technology capable of monitoring unauthorized access in a communication network without affecting the information processing capability of a central monitoring device.SOLUTION: An unauthorized access monitoring device 1 includes a COV monitoring unit 10 configured to detect COV notification transmitted by a facility device 2 via a communication network NW, a calculation unit 11 configured to obtain a difference between a measurement value included in the COV notification previously detected by the COV monitoring unit 10, and a measurement value included in the COV notification detected by the COV monitoring unit 10 this time, and a determination unit 12 configured to determine that unauthorized access has occurred when the difference obtained by the calculation unit 11 exceeds a set threshold value, and the COV notification by the facility device 2 is transmitted when a change in the set value occurs in the measurement value.SELECTED DRAWING: Figure 1

Description

The present invention relates to an unauthorized access monitoring device, an unauthorized access monitoring method, and a central monitoring system, and more particularly to an unauthorized access monitoring technology in the central monitoring system.

Conventionally, a so-called BACnet system using a communication protocol standard for an intelligent building network called BACnet (Building Automation and Control Networking protocol) is used as a facility management system for managing various facilities installed in a building. Is becoming popular.

For example, in Patent Literature 1, a controller that collects data from field devices provided in equipment and a plurality of controllers are connected via a communication network such as BACnet, and information about the equipment is displayed by data from the field equipment. A central monitoring system having a monitoring device is disclosed.

JP, 2007-199798, A

Since such a BACnet system has been originally applied to a closed environment, the unauthorized access has not been given much importance so far. However, in recent years, cooperation with IoT and other systems is progressing, and the environment is changing to an open environment accessible from outside. For this reason, if a malicious person can make unauthorized access and connect to the BACnet system, various devices in the BACnet system may be manipulated in various ways.

For example, an analog input point (Analog Input (AI) point) in the BACnet protocol may be used to monitor an environmental index such as room temperature and humidity with a central monitoring device. The attacker impersonates the device to which the AI point belongs and sends a value change notification (Change Of Value: COV) to the central monitoring unit, thereby displaying the false room temperature and room humidity on the monitor screen of the central monitoring unit. It is possible to

Further, it is possible to give a false room temperature or room humidity as an input to a control program operating on the central monitoring device, for example, an air conditioning control program. By utilizing this, the room temperature in a specific area, for example, the room temperature in the data center room, etc., can be disguised as being lower than the actual temperature to stop the cooling and attack the server installed in the data center room. It will be possible.

The present invention has been made to solve the above-described problems, and provides an unauthorized access monitoring technology capable of monitoring unauthorized access in a communication network without affecting the information processing capability of the central monitoring device. With the goal.

In order to solve the above-mentioned problem, an unauthorized access monitoring device according to the present invention is configured such that a monitoring unit configured to detect a notification regarding a measurement value transmitted by a facility device via a communication network, and the monitoring unit previously configured to detect the notification. A calculation unit configured to calculate a difference between the measurement value included in the detected notification and the measurement value included in the notification detected this time by the monitoring unit, and the difference calculated by the calculation unit are set. A determination unit configured to determine that an unauthorized access has occurred when the threshold value is exceeded, and the notification of the measured value by the equipment is such that a change in the set value is the measured value. It is characterized in that it is transmitted when a value occurs.

Further, in the unauthorized access monitoring device according to the present invention, the set threshold value may be equal to or more than the set value.

The unauthorized access monitoring device according to the present invention may further include an alarm unit configured to output an alarm when the determination unit determines that an unauthorized access has occurred.

Further, in the unauthorized access monitoring device according to the present invention, the measurement value included in the notification may include an index related to the environment.

In order to solve the above-mentioned problem, the unauthorized access monitoring method according to the present invention provides a monitoring step of detecting a notification regarding a measurement value transmitted by a facility device via a communication network, and a notification detected last time in the monitoring step. And a calculation step for obtaining a difference between the measurement value included in the notification detected this time in the monitoring step, and the difference obtained in the calculation step, the set threshold value. A determination step of determining that an unauthorized access has occurred when the number exceeds the limit, and the notification of the measured value by the equipment is transmitted when a change in the set value occurs in the measured value. Characterize.

Further, the unauthorized access monitoring method according to the present invention may further include an alarm step of outputting an alarm when it is determined in the determination step that an unauthorized access has occurred.

In order to solve the above-mentioned problems, a central monitoring system according to the present invention provides a facility device, a central monitoring device connected to the facility device via a communication network to control and monitor the facility device, and the communication network. An unauthorized access monitoring device that is connected and monitors unauthorized access to the equipment, and the unauthorized access monitoring device is configured to detect a notification regarding a measurement value transmitted by the equipment via the communication network. A monitoring unit; an arithmetic unit configured to obtain a difference between the measurement value included in the notification previously detected by the monitoring unit and the measurement value included in the notification detected this time by the monitoring unit; The difference obtained by the unit, comprising a determination unit configured to determine that an unauthorized access has occurred when it exceeds a set threshold value, the notification regarding the measured value by the equipment, It is transmitted when a change in the set value occurs in the measured value.

According to the present invention, an unauthorized access occurs when the difference between the previous measurement value and the current measurement value in the notification of the measurement value transmitted by the equipment device via the communication network exceeds the set threshold value. The unauthorized access monitoring device installed on the communication network determines that it has done so. Therefore, it is possible to monitor unauthorized access in the communication network without affecting the information processing capability of the central monitoring device.

FIG. 1 is a block diagram showing the configuration of an unauthorized access monitoring device according to an embodiment of the present invention. FIG. 2 is a block diagram showing the hardware configuration of the unauthorized access monitoring device according to this embodiment. FIG. 3 is a flowchart for explaining the operation of the unauthorized access monitoring device according to this embodiment. FIG. 4 is a sequence diagram for explaining the operation of the central monitoring system according to this embodiment.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. 1 to 4.
The unauthorized access monitoring device 1 according to the embodiment of the present invention is provided in, for example, a central monitoring system such as a building automation (BA) system. The BA system centrally manages and controls various equipment such as air conditioners, lighting equipment, and security equipment installed in buildings such as office buildings.

The central monitoring system according to the present embodiment is an unauthorized access to the central monitoring device 3 that centrally manages information to be managed, the facility device 2 that the central monitoring device 3 manages and controls, and the facility device 2 in the communication network NW. An unauthorized access monitoring device 1 for monitoring access is provided. The central monitoring device 3, the equipment 2, and the unauthorized access monitoring device 1 are connected to each other via a communication network NW using a communication protocol such as BACnet.

The facility device 2 includes various devices such as field devices, and measures an environmental index represented by, for example, room temperature and humidity. Specific examples of field devices include air conditioners, fans, and temperature sensors.

The equipment device 2 continuously measures analog values such as indoor temperature and humidity, and when the measured values change in a preset value, the central monitoring device 3 measures them via the communication network NW. A value change notification (hereinafter referred to as a COV notification) is transmitted as a value notification.

Specifically, for the room temperature and humidity that the equipment 2 measures as time-series data, the values required to send the COV notification set in the COV Increment property specified in the BACnet communication specifications. Each time a change in temperature or humidity that exceeds the change occurs, the facility device 2 transmits a COV notification.

Environmental indexes such as temperature and humidity measured by the equipment 2 generally do not change rapidly in a short period of time. If the temperature or humidity suddenly changes due to a special cause such as a fire, it is usually detected by means other than a temperature sensor for air conditioning such as a fire alarm.

From this, the measured value of the COV notification transmitted by the facility device 2 to the central monitoring apparatus 3 does not normally have a sudden change from the measured value of the COV notification transmitted by the facility device 2 last time. .. That is, the measured value of the COV notification transmitted last time by the equipment 2 and the measured value of the COV notification transmitted this time are normally the values required for the equipment 2 to transmit the COV notification as described above. It is assumed that the difference is about the amount of change.

In the present embodiment, when the measured value of the COV notification is rewritten due to an unauthorized access to the equipment 2, the difference between the measured value of the COV notification transmitted last time and the measured value of the COV notification transmitted this time is generally. Pay attention to the fact that it can be a large difference that does not normally occur and exceeds the change in the environmental index.

Further, the unauthorized access is, for example, a direct or indirect access to the equipment 2 on the communication network NW from the outside or the like to disguise the measurement value of the equipment 2 and notify the COV based on the measurement value different from the actual value. Is transmitted to the central monitoring device 3.

Next, the configuration of the unauthorized access monitoring device 1 will be described. The unauthorized access monitoring device 1 monitors unauthorized access to the equipment 2 on the communication network NW.
As illustrated in FIG. 1, the unauthorized access monitoring device 1 includes a COV monitoring unit (monitoring unit) 10, a calculation unit 11, a determination unit 12, an alarm unit 13, and a storage unit 14.

The COV monitoring unit 10 continuously detects the COV notification transmitted by the equipment 2 via the communication network NW. The COV monitoring unit 10 may continuously detect the COV notification over a certain period.

For example, the COV monitoring unit 10 can detect all the packets flowing on the communication network NW, analyze the captured packets, and detect the COV notification transmitted by the facility device 2.

Alternatively, the COV monitoring unit 10 uses a predetermined flow protocol to acquire only the packets that match the flow conditions such as the destination IP address and the source IP address specified in advance, and the header necessary for the analysis is required. The configuration may be such that only information is acquired.

The COV monitoring unit 10 records the COV notification in the storage unit 14 together with the time information when the COV notification is detected. The time when the COV notification is detected can be acquired by referring to the built-in clock 107 and a time server (not shown) included in the unauthorized access monitoring device 1.

The calculation unit 11 obtains the difference between the measured value of the COV notification previously detected by the COV monitoring unit 10 and the measured value of the COV notification currently detected by the COV monitoring unit 10. For example, when the equipment 2 is a temperature sensor, the calculation unit 11 obtains the difference between the indoor temperatures included in the previous and current COV notifications. As described above, the difference between the measured values obtained by the calculation unit 11 is normally a value corresponding to the change amount with respect to the measured value set by the COV Increment property defined by the BACnet communication specifications. ..

The determination unit 12 is the one in which the unauthorized access has occurred when the difference between the measured value of the previous COV notification obtained by the calculation unit 11 and the measured value of the current COV notification exceeds the set threshold value. To judge. For example, as the threshold value, the same value as the value change amount necessary for transmitting the COV notification set in the COV Increment property can be set. Alternatively, a value that is larger than the value change amount required for COV notification by a certain ratio, for example, 1.1 times the value change amount required, or the like can be set as the threshold value. The threshold value can be appropriately set in accordance with the type and characteristic of the environmental index measured by the facility device 2 and the amount of change in the value specified by the COV Increment property.

The alarm unit 13 outputs an alarm when the determination unit 12 determines that an unauthorized access has occurred. Specifically, the alarm unit 13 generates a signal indicating an alarm based on the determination by the determination unit 12 that an unauthorized access has occurred. The alarm unit 13 can also transmit information indicating an alarm to the central monitoring device 3 via the communication network NW by BACnet communication or the like. Alternatively, the alarm may be output by displaying text data on a display screen (not shown) provided in the unauthorized access monitoring device 1, blinking an LED, or outputting voice from a speaker (not shown). Further, a configuration may be adopted in which an alarm is transmitted to a specific communication terminal (not shown) on the communication network NW.

The storage unit 14 stores the threshold value used by the determination unit 12. In addition, the storage unit 14 stores the COV notification detected by the COV monitoring unit 10 and the identification information of the transmission source equipment 2 and the detected time in association with each other.

[Hardware configuration of unauthorized access monitoring device]
Next, an example of the hardware configuration of the unauthorized access monitoring device 1 having the above configuration will be described with reference to FIG.

As shown in FIG. 2, the unauthorized access monitoring device 1 is, for example, a computer including a CPU 102, a main storage device 103, a communication interface 104, an auxiliary storage device 105, an input/output interface 106, which are connected via a bus 101, and these. Can be realized by a program that controls the hardware resources of

Programs for the CPU 102 to perform various controls and calculations are stored in the main storage device 103 in advance. The CPU 102 and the main storage device 103 realize each function of the unauthorized access monitoring device 1, such as the determination unit 12 shown in FIG.

The communication interface 104 is an interface circuit for receiving the COV notification transmitted by the facility device 2 via the communication network NW and communicating with the central monitoring device 3.

The auxiliary storage device 105 includes a readable/writable storage medium and a drive device for reading/writing various information such as programs and data from/to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or a flash memory as a storage medium.

The auxiliary storage device 105 has a program storage area for storing a program for the unauthorized access monitoring device 1 to monitor unauthorized access. The auxiliary storage device 105 implements the storage unit 14 described in FIG. 1. Further, for example, it may have a backup area for backing up the above-mentioned data and programs.

The input/output interface 106 is composed of an I/O terminal that inputs a signal from an external device and outputs a signal to the external device.

The built-in clock 107 measures the time and supplies a signal indicating the current time. Instead of the built-in clock 107, the current time may be acquired from an external time server via the communication interface 104.

[Operation of unauthorized access monitoring device]
Next, the operation of the unauthorized access monitoring device 1 having the above configuration will be described with reference to the flowchart of FIG. In the following, it is assumed that the threshold value used when the determination unit 12 determines whether or not an unauthorized access has occurred is stored in the storage unit 14 in advance.

First, the COV monitoring unit 10 starts capturing packets flowing on the communication network NW (step S1). Next, the COV monitoring unit 10 analyzes the captured packet and detects the COV notification transmitted by the equipment 2 (step S2). The COV monitoring unit 10 continuously detects the COV notification for at least a certain period. The COV notification detected by the COV monitoring unit 10 is stored in the storage unit 14 together with the detected time information.

Then, the calculating part 11 calculates|requires the difference of the measured value of the COV notification detected last time, and the measured value of the COV notification detected this time (step S3). More specifically, the calculation unit 11 reads the measured value of the previously detected COV notification from the storage unit 14 and obtains the difference from the measured value of the COV notification detected this time.

Next, the determination unit 12 determines that the difference between the measurement value included in the previous COV notification and the measurement value included in the current COV notification calculated by the calculation unit 11 in step S3 exceeds the set threshold value. (Step S4: YES), it is determined that an unauthorized access has occurred, and the alarm unit 13 outputs an alarm (step S5). Specifically, the determination unit 12 reads the threshold value stored in the storage unit 14 and executes threshold value processing on the difference obtained in step S3. Further, the alarm generated by the alarm unit 13 is transmitted to the central monitoring device 3 by BACnet communication or the like via the communication network NW, for example.

[Central monitoring system sequence]
Next, the operation of the central monitoring system including the unauthorized access monitoring device 1 having the above-described configuration will be described with reference to the sequence diagram of FIG.

As shown in FIG. 4, when a change in the set value occurs in the measured value, the equipment 2 transmits a COV notification to the central monitoring device 3 via the communication network NW (step S100). The change in the set value is a permissible value for increasing or decreasing the measured value set in advance in the COV Increment property. The unauthorized access monitoring device 1 detects the COV notification transmitted by the equipment 2 by capturing a packet flowing on the communication network NW, for example (step S101). On the other hand, the central monitoring device 3 receives the COV notification transmitted by the equipment 2 (step S102).

After that, when the change in the set value occurs in the measured value again, the equipment device 2 transmits the COV notification to the central monitoring device 3 via the communication network NW (step S103). The unauthorized access monitoring device 1 detects the COV notification transmitted by the equipment 2 (step S104). On the other hand, the central monitoring device 3 receives the COV notification transmitted by the equipment 2 (step S105).

Next, the unauthorized access monitoring device 1 determines whether or not unauthorized access has occurred, based on the difference between the measured values indicated by the previous and current COV notifications detected in steps S101 and S104, respectively (step S106). More specifically, the calculation unit 11 calculates the difference between the previous and current measurement values. Then, the determination unit 12 reads the threshold value stored in advance in the storage unit 14, and when the difference between the measured values exceeds the threshold value, determines that an unauthorized access has occurred.

After that, the unauthorized access monitoring device 1 generates an alarm indicating that an unauthorized access has occurred and sends it to the central monitoring device 3 via the communication network NW (step S107). For example, a warning message indicating that unauthorized access has occurred to the equipment 2 is displayed on a display screen (not shown) of the central monitoring device 3.

As described above, according to the unauthorized access monitoring device 1 according to the present embodiment, in the measurement values of the plurality of COV notifications transmitted by the equipment device 2 via the communication network NW, the measurement of the previously detected COV notification is performed. If the difference between the value and the measured value of the COV notification detected this time exceeds the set threshold value, it is determined that an unauthorized access has occurred. In this way, since the unauthorized access monitoring device 1 provided on the communication network NW makes a determination as to whether or not an unauthorized access has occurred, the information processing capability of the central monitoring device 3 is not affected, and the unauthorized access monitoring device 1 in the communication network NW Unauthorized access can be monitored.

In the above-described embodiment, the case where the number of the facility devices 2 connected via the communication network NW is one has been described as an example, but the number of the facility devices 2 may be plural. .. In this case, the threshold value used by the determination unit 12 is set for each facility device 2 and stored in the storage unit 14 in advance.

The embodiments of the unauthorized access monitoring device, the unauthorized access monitoring method, and the central monitoring system according to the present invention have been described above, but the present invention is not limited to the described embodiments, and the invention described in the claims. Various modifications that can be envisioned by those skilled in the art can be made within the range.

DESCRIPTION OF SYMBOLS 1... Unauthorized access monitoring device, 2... Equipment device, 3... Central monitoring device, 10... COV monitoring part, 11... Arithmetic part, 12... Judgment part, 13... Alarm part, 14... Storage part, 101... Bus, 102... CPU, 103... Main storage device, 104... Communication interface, 105... Auxiliary storage device, 106... Input/output interface, 107... Built-in clock, NW... Communication network.

Claims (7)

A monitoring unit configured to detect a notification regarding measurement values transmitted by the equipment device via the communication network;
The operation unit configured to obtain a difference between the measurement value included in the notification detected by the monitoring unit last time and the measurement value included in the notification detected by the monitoring unit this time,
A determination unit configured to determine that an unauthorized access has occurred when the difference calculated by the calculation unit exceeds a set threshold value,
The unauthorized access monitoring device, wherein the notification about the measured value by the equipment is transmitted when a change in a set value occurs in the measured value. In the unauthorized access monitoring device according to claim 1,
The unauthorized access monitoring device, wherein the set threshold value is equal to or more than the set value. In the unauthorized access monitoring device according to claim 1 or 2,
The unauthorized access monitoring device, further comprising an alarm unit configured to output an alarm when the determination unit determines that an unauthorized access has occurred. The unauthorized access monitoring device according to any one of claims 1 to 3,
The unauthorized access monitoring device, wherein the measurement value included in the notification includes an index relating to the environment. A monitoring step of detecting a notification regarding measurement values transmitted by the facility device via the communication network;
In the monitoring step, a calculation step of obtaining a difference between the measurement value included in the notification detected last time and the measurement value included in the notification detected this time in the monitoring step,
A determination step of determining that an unauthorized access has occurred when the difference obtained in the calculation step exceeds a set threshold value,
The unauthorized access monitoring method, wherein the notification about the measured value by the equipment is transmitted when a change in a set value occurs in the measured value. The unauthorized access monitoring method according to claim 5,
The unauthorized access monitoring method, further comprising an alarm step of outputting an alarm when it is determined in the determination step that an unauthorized access has occurred. An equipment device, a central monitoring device connected to the equipment device via a communication network to control and monitor the equipment device, and an unauthorized access monitoring device connected to the communication network to monitor unauthorized access to the equipment device ,
The unauthorized access monitoring device,
A monitoring unit configured to detect a notification regarding a measurement value transmitted by the equipment device via the communication network,
An operation unit configured to obtain a difference between the measurement value included in the notification previously detected by the monitoring unit and the measurement value included in the notification currently detected by the monitoring unit,
And a determination unit configured to determine that an unauthorized access has occurred when the difference obtained by the calculation unit exceeds a set threshold value,
The central monitoring system, wherein the notification regarding the measured value by the equipment is transmitted when a change in a set value occurs in the measured value.

Images