JP2021056644A - Device and computer program and monitoring method - Google Patents

Abstract

To provide a device, a computer program, and a monitoring methods that can monitor application programs without the need for periodic external communication.SOLUTION: A device comprises an execution environment provision part that provides a normal execution environment and a trusted execution environment that is more secure than the normal execution environment and a monitoring application that runs within the trusted execution environment and monitors normal applications running within the normal execution environment, the monitoring application comprises a log acquisition part that acquires an execution log of the normal application and a monitoring part that monitors the normal application for abnormalities based on the acquired execution log.SELECTED DRAWING: Figure 1

Description

The present invention relates to devices, computer programs and monitoring methods.

In IoT (Internet of Things), a wide variety of devices are connected to the network to create new added value. Many of these devices download application programs and data via networks, and as the number of devices connected to the Internet increases, the target of attacks by attackers expands, and security problems gradually increase. It has become apparent in.

In Patent Document 1, a device (mobile phone) and a program inspection device are connected via a network, the program inspection device inspects the contents of a program provided to the device via the network, and the device sets the network. A system for determining whether or not the program received via the program can be executed is disclosed based on the inspection result.

JP-A-2007-122745

However, in a system such as Patent Document 1, the device needs to establish external communication via a network in order to determine whether or not the application program can be executed. In addition, it is difficult to detect an attack when there is an attack on the downloaded application program. Even if an attack on a device is detected by a server using a network, the operating cost is high because regular external communication from the device is required.

The present invention has been made in view of such circumstances, and an object of the present invention is to provide a device, a computer program, and a monitoring method capable of monitoring an application program without requiring periodic external communication.

The device according to the embodiment of the present invention has an execution environment providing unit that provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment, and is executed in the trusted execution environment and is executed in the normal execution environment. The monitoring application includes a monitoring application that monitors an executed normal application, and the monitoring application has an abnormality of the normal application based on a log acquisition unit that acquires an execution log of the normal application and an execution log acquired by the log acquisition unit. It is equipped with a monitoring unit that monitors the presence or absence of.

The computer program according to the embodiment of the present invention monitors a process that provides a computer with a normal execution environment and a trusted execution environment that is safer than the normal execution environment, and a normal application executed in the normal execution environment. The process of executing the monitoring application in the trusted execution environment, the process of acquiring the execution log of the normal application in the monitoring application, and the presence / absence of an abnormality in the normal application based on the execution log acquired in the monitoring application. To execute the process of monitoring.

The monitoring method according to the embodiment of the present invention provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment, and a monitoring application that monitors a normal application executed in the normal execution environment is the trusted. It is executed in the execution environment, the monitoring application is made to acquire the execution log of the normal application, and the monitoring application is made to monitor the presence or absence of an abnormality of the normal application based on the acquired execution log.

According to the present invention, an application program can be monitored without requiring periodic external communication.

It is a block diagram which shows an example of the structure of the device of this embodiment. It is a block diagram which shows an example of the function of a monitoring application. It is explanatory drawing which shows an example of the operation between a normal application and a monitoring application. It is a schematic diagram which shows the 1st example of the event log of a normal application. It is a schematic diagram which shows the 2nd example of the event log of a normal application. It is a flowchart which shows an example of the processing procedure of a monitoring application.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of the configuration of the device 50 of the present embodiment. The device 50 includes, for example, one semiconductor chip composed of a single SoC (System on a Chip), and all or part of the hardware (for example, processor, memory, etc.) necessary for the operation of the device is mounted. Has been done. The device 50 may be provided with hardware that realizes a communication circuit (not shown) or other control functions. The device 50 includes, for example, IoT devices such as routers and wearable terminals. Further, the device 50 can be incorporated into various devices such as FA (Factory Automation) devices and control devices.

The device 50 includes an execution environment providing unit 30 that is executed on the CPU 40. The execution environment providing unit 30 to be executed uses, for example, a technology called CPU virtualization support technology (for example, TrustZone (registered trademark)) to provide an execution environment for software (OS: Operating System, application, etc.). It is divided into a normal execution environment 10 (normal world, also referred to as REE: Rich Execution Environment) and a trusted execution environment 20 (secure world, also referred to as TEE: Trusted Execution Environment). A memory space, an input / output device, and the like are separated between the normal execution environment 10 and the trusted execution environment 20.

The normal execution environment 10 is an execution environment of an OS that is widely and generally used, and access to the trusted execution environment 20 is restricted.

The trusted execution environment 20 is an independent execution environment provided separately from the normal execution environment 10 on the same SoC for the purpose of isolating the security function. Access to the trusted execution environment 20 from the normal execution environment 10 is restricted. The trusted execution environment 20 may be an execution environment of any name as long as it is separated from the normal execution environment 10 and is a safer execution environment in terms of security.

The security of the device 50 can be ensured by arranging the software and data to be protected in terms of security in the trusted execution environment 20 and restricting access from the outside of the normal execution environment 10 and the device 50.

As described above, since the trusted execution environment 20 is restricted from being accessible from the normal execution environment 10, the existence of the trusted execution environment 20 cannot be recognized from the normal execution environment 10. In order to call the process to be executed in the trusted execution environment 20 from the normal execution environment 10, it is necessary to go through the execution environment providing unit 30. The execution environment providing unit 30 is referred to as, for example, a trusted family, a secure monitor, or the like.

In the normal execution environment 10, the normal application 11, the control application 12, and the like can be executed. Normally, the application 11 can be downloaded from the outside of the device 50 via a communication network, installed (introduced), or updated according to the use of the device 50. In the present embodiment, the normal application 11 is a monitoring target application program that monitors the presence or absence of an abnormality. The control application 12 is a program for controlling the normal application 11, and corresponds to a library, a subroutine, or the like when the normal application 11 is executed. The control application 12 may be replaced by a general-purpose OS. The control application 12 usually has an interface function between the application 11 and the execution environment providing unit 30.

In the trusted execution environment 20, the monitoring application 21, the trusted OS 22, and the like can be executed.

The trusted OS 22 is software that functions as an OS in the trusted execution environment 20. The trusted OS 22 has an interface function between the monitoring application 21 and the execution environment providing unit 30. The monitoring application 21 is an application that runs on the trusted OS 22. The monitoring application 21 normally monitors the presence or absence of an abnormality in the application 11. Although only one normal application 11 and one monitoring application 21 are shown in FIG. 1, a plurality of normal application 11 and monitoring application 21 may be executed.

Although not shown, the device 50 includes a network communication unit. Specifically, the network communication unit is provided separately in the normal execution environment 10 and the trusted execution environment 20. That is, the device 50 has a path capable of transmitting and receiving information to and from a server (not shown) on the network via the network communication unit for the normal execution environment 10, and network communication for the trusted execution environment 20. It has two paths that can establish a secret communication path and send / receive information to / from a server (not shown) on the network via the unit.

FIG. 2 is a block diagram showing an example of the function of the monitoring application 21. The monitoring application 21 has functions such as a log acquisition unit 211, a monitoring target information acquisition unit 212, a monitoring frequency acquisition unit 213, a log analysis unit 214, an authentication unit 215, and a notification unit 216.

The log acquisition unit 211 acquires the execution log of the normal application 11. The execution log is also referred to as an event log, and includes commands, parameters, data, command execution times, and the like that are normally executed by the application 11.

The monitoring target information acquisition unit 212 acquires the monitoring target information from the normal application 11 at a required time. The monitoring target information is information that is desired to be monitored by the monitoring application 21, and specifies which information is to be monitored in the execution log. The monitoring target information includes required information among commands, parameters, data, command execution times, and the like that are normally executed by the application 11. The required time point may be, for example, a preset timing, each time a certain time elapses, or a timing at which the normal application 11 or the control application 12 is started.

The monitoring frequency acquisition unit 213 normally acquires information on the monitoring frequency from the application 11. The monitoring frequency can be, for example, a specific cycle, and the cycle can be changed as appropriate.

The log analysis unit 214 includes a function as a monitoring unit, analyzes the execution log of the normal application 11, and monitors the presence or absence of an abnormality in the normal application 11.

The authentication unit 215 authenticates the normal application 11 when acquiring the monitoring target information from the normal application 11. For the authentication, for example, confirmation by ID and password, confirmation by the presence or absence of duplicate registration ID, message authentication, signature authentication and the like can be used. Confirmation based on the presence or absence of a registration ID is such that authentication is not possible (with fraud) when the registration IDs are duplicated. In message authentication, for example, a MAC value (message authentication code value) is calculated from a message received from a communication partner, and the calculated MAC value is compared with a MAC value received from the communication partner to falsify the message or spoof the communication partner. Can be prevented. Signature authentication sends a message and a signature in which the message or its hash value is encrypted with a private key to the recipient, and the recipient decrypts the hash value of the received message and the received signature with the sender's public key. It is possible to prevent tampering and spoofing by comparing with the hash value obtained in this way. As a result, it is possible to confirm that the normal application 11 is a correct application, and spoofing can be prevented.

The notification unit 216 has a function as an output unit, and outputs the monitoring result by the monitoring application 21 to, for example, an external server (for example, a server that manages the state of each device on the cloud). As for the output to the external server, the abnormality detection may be output only when the abnormality of the application 11 is usually detected. Since an abnormality is detected, it is notified to the outside, so that regular external communication is not required and the operating cost can be reduced. Further, since the amount of data indicating that the normal application 11 is normal or abnormal is considered to be smaller than the amount of data when the external communication is established by the external server and the monitoring process is executed, the monitoring application 21 The monitoring result may be output to an external server each time it is monitored by. Security can be ensured by outputting the monitoring result using a secret communication path that can be directly connected to the external server via the network communication unit for the trusted execution environment 20. Security is ensured, for example, that independent result notification can be performed regardless of the operation of the monitoring application 21, communication can be established and the monitoring result can be notified to an external server even if an abnormality occurs in the monitoring application 21. Can be mentioned. In addition, the operating cost required for external communication can be reduced. The notification unit 216 may display the notification on an external monitor.

Next, the operation between the normal application 11 and the monitoring application 21 will be described.

FIG. 3 is an explanatory diagram showing an example of operation between the normal application 11 and the monitoring application 21. For convenience, the subject of processing will be described as the normal application 11 and the monitoring application 21. Hereinafter, the processes from P1 to P15 will be described.

P1: The normal application 11 determines whether or not it is a required time point. The required time point may be, for example, a preset timing, each time a certain time elapses, or a timing at which the normal application 11 or the control application 12 is started.

P2: Normally, the application 11 outputs the authentication information.

P3: The monitoring application 21 authenticates the normal application 11 that outputs the authentication information. For the authentication, for example, confirmation by ID and password, confirmation by the presence or absence of duplicate registration ID, message authentication, signature authentication and the like can be used.

P4: The monitoring application 21 notifies the normal application 11 of the authentication result.

P5: Normally, the application 11 outputs the monitoring target information. The monitoring target information is information that is desired to be monitored by the monitoring application 21, and is information that identifies which information is to be monitored in the execution log.

P6: When the monitoring application 21 acquires the monitoring target information, the monitoring application 21 outputs the receipt result to the normal application 11.

P7: Normally, the application 11 outputs monitoring frequency information. The monitoring frequency can be, for example, a specific cycle (for example, 1 second, 10 seconds, 1 minute, etc.). The monitoring frequency can usually be set to a desired cycle on the application 11 side.

P8: Normally, the application 11 outputs an execution log. The execution log (event log) includes commands, parameters, data, command execution times, etc. that are normally executed by the application.

P9: The monitoring application 21 acquires an execution log.

P10: The monitoring application 21 analyzes the execution log. The processing of P7 to P9 is performed each time a specific cycle is performed.

P11: Normally, the application 11 outputs an execution log. After that, the same processing as the processing of P7 to P9 is performed each time in a specific cycle.

P12: Normally, the application 11 outputs an execution log.

P13: The monitoring application 21 acquires an execution log.

P14: The monitoring application 21 analyzes the execution log.

P15: When the monitoring application 21 analyzes the execution log and detects an abnormality in the normal application 11, it notifies the outside (server or the like) that the normal application 11 is abnormal.

The notification to the external server may be performed, for example, via the network communication unit for the normal execution environment 10 (for example, the normal application 11 receives the monitoring result of the monitoring application 21 via the control application 12 and receives the monitoring result. The received monitoring result may be notified to the server), or a secret communication path may be established via the network communication unit for the trusted execution environment 20 (for example, the monitoring application 21 directly notifies the server). ..

FIG. 4 is a schematic diagram showing a first example of the event log of the normal application 11. In the example of FIG. 4, the event log includes the operation date and time, the temperature measurement result of the target device acquired by the normal application 11, the set temperature, the reference value, the temperature state determined by the normal application 11, and the like. The item of the event log is an example, and is not limited to the example of FIG. When some kind of attack is applied to the normal application 11, the normal application 11 determines that the temperature state is normal even though the measured temperature and the set temperature deviate from the reference value. By analyzing the event log by the monitoring application 21, it is possible to detect that the normal application 11 is abnormal.

FIG. 5 is a schematic diagram showing a second example of the event log of the normal application 11. In the example of FIG. 5, the event log includes the detection time, the detection content of the target device acquired by the normal application 11, the detection start time, the detection end time, the staying time of a person, the state determined by the normal application 11, and the like. .. The item of the event log is an example, and is not limited to the example of FIG. By analyzing the event log by the monitoring application 21, there is no abnormality such as deviation or inconsistency between the detection time, the detection content, the detection start time, the detection end time, and the staying time of the person, so that the normal application 11 can be used. It can be detected that it is normal.

As described above, the monitoring application 21 executed in the more secure trusted execution environment 20 on the same device 50 monitors the presence or absence of an abnormality in the normal application 11 executed on the device 50 from the device 50. The application 11 can be normally monitored without performing periodic external communication (for example, communication with an external monitoring server). Further, even if an attack is applied from the outside, the monitoring application 21 is executed in the more secure trusted execution environment 20, so that it is possible to continue monitoring the presence or absence of an abnormality in the normal application 11 without being affected by the attack. ..

Further, even if there is an attack on the normal application 11 installed on the device 50, the attack can be detected at a required time point (for example, when the normal application 11 is introduced, started, or updated).

Further, since the normal application 11 is monitored at a specific cycle, when there is an attack on the normal application 11, the attack can be detected quickly.

FIG. 6 is a flowchart showing an example of the processing procedure of the monitoring application 21. The monitoring application 21 determines whether or not it is a required time point (S11), and if it is not a required time point (NO in S11), continues the process of step S11. When it is a required time point (YES in S11), the monitoring application 21 authenticates the normal application 11 (S12).

The monitoring application 21 determines whether or not it is the correct normal application 11, that is, whether or not the authentication is successful (S13). When the normal application 11 is correct (YES in S13), the monitoring application 21 acquires the monitoring target information from the normal application 11 (S14), and determines whether or not the execution log of the normal application 11 has been acquired (S15). ..

If the execution log has not been acquired (NO in S15), the monitoring application 21 continues the process of step S15. When the execution log is acquired (YES in S15), the monitoring application 21 analyzes the execution log (S16) and determines whether or not there is an abnormality in the normal application 11 (S17).

If there is an abnormality (YES in S17), the monitoring application 21 notifies the outside that there is an abnormality (S18), and ends the process. When there is no abnormality in the normal application 11 (NO in S17), the monitoring application 21 determines whether or not to end the process (S19). If the process is not completed (NO in S19), the monitoring application 21 continues the process after step S15. When the process is terminated (YES in S19), or when the normal application 11 is not correct (NO in S13), the monitoring application 21 terminates the process.

The device of the present embodiment has an execution environment providing unit that provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment, and is executed in the trusted execution environment and is executed in the normal execution environment. The monitoring application includes a monitoring application that monitors a normal application, and the monitoring application determines the presence or absence of an abnormality in the normal application based on a log acquisition unit that acquires an execution log of the normal application and an execution log acquired by the log acquisition unit. It is equipped with a monitoring unit for monitoring.

The computer program of the present embodiment provides a computer with a normal execution environment and a trusted execution environment that is safer than the normal execution environment, and a monitoring application that monitors the normal application executed in the normal execution environment. The process to be executed in the trusted execution environment, the process of acquiring the execution log of the normal application from the monitoring application, and the monitoring application monitoring the presence or absence of an abnormality of the normal application based on the acquired execution log. Process and execute.

The monitoring method of the present embodiment provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment, and a monitoring application that monitors a normal application executed in the normal execution environment is provided in the trusted execution environment. To have the monitoring application acquire the execution log of the normal application, and cause the monitoring application to monitor the presence or absence of an abnormality in the normal application based on the acquired execution log.

The execution environment providing unit provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment. The execution environment providing unit provides the CPU virtualization support technology on a device equipped with a processor, for example, to make the software execution environment safer than the normal execution environment (also called the normal world) and the normal execution environment. It can be physically separated into two execution environments, a trusted execution environment (also called secure world). The memory space, input / output device, etc. can be separated between the normal execution environment and the trusted execution environment.

The monitoring application runs within the trusted execution environment. The monitoring application monitors the normal application executed in the normal execution environment. Specifically, the monitoring application (log acquisition unit) acquires the execution log of the normal application, and the monitoring unit monitors the presence or absence of an abnormality in the normal application based on the acquired execution log. The execution log (also referred to as an event log) includes commands, parameters, data, command execution times, etc. that are normally executed by an application.

Periodic external communication from the device (regular external communication from the device) by monitoring the presence or absence of abnormalities in the normal application (application program) executed on the device by the monitoring application executed in the more secure trusted execution environment on the same device. For example, the application can be normally monitored without performing communication with an external monitoring server. In addition, even if an attack is applied from the outside, the monitoring application is executed in a more secure trusted execution environment, so that it is possible to continue monitoring the presence or absence of abnormalities in the normal application without being affected by the attack.

In the device of the present embodiment, the monitoring application includes a monitoring target information acquisition unit that acquires monitoring target information from the normal application at a required time, and the monitoring unit is an execution log acquired by the log acquisition unit. The presence or absence of an abnormality in the normal application is monitored based on the monitoring target information of the above.

The monitoring application (monitoring target information acquisition unit) acquires the monitoring target information from the normal application at a required time. The monitoring target information is information that the monitoring application wants to monitor, and specifies which information is to be monitored in the execution log. The monitored information includes required information such as commands, parameters, data, and command execution times normally executed by the application. The required time may be, for example, a preset timing, each time a certain time elapses, or a timing at which the OS (control program) in the normal application or the normal execution environment is started.

The monitoring application (monitoring unit) monitors the presence or absence of abnormalities in the normal application based on the acquired monitoring target information in the execution log. This makes it possible to detect an attack at a required point even if there is an attack on a normal application installed on the device.

In the device of the present embodiment, the required time point includes the time when the normal application is introduced, the time when the application is started, or the time when the application is updated.

The required time points usually include the time when the application is introduced, started, or updated. This makes it possible to detect an attack when a normal application is introduced, started, or updated.

In the device of the present embodiment, the monitoring application includes an authentication unit that authenticates the normal application when the monitoring target information acquisition unit acquires the monitoring target information.

The monitoring application (authentication unit) authenticates the normal application when acquiring the monitoring target information from the normal application. For the authentication, for example, confirmation by ID and password, confirmation by the presence or absence of duplicate registration ID, message authentication, signature authentication and the like can be used. As a result, it is possible to confirm that the normal application is the correct application and prevent spoofing.

In the device of the present embodiment, the monitoring application includes a monitoring frequency information acquisition unit that acquires information on the monitoring frequency from the normal application, and the monitoring unit monitors the presence or absence of an abnormality in the normal application at the monitoring frequency. To do.

The monitoring application (monitoring frequency information acquisition unit) acquires information on the monitoring frequency from the normal application. The monitoring frequency can be, for example, a specific cycle, and the cycle can be changed as appropriate. The monitoring application (monitoring unit) monitors the presence or absence of abnormalities in the normal application at the monitoring frequency. As a result, since the normal application is monitored at a specific cycle, when there is an attack on the normal application, the attack can be detected quickly.

In the device of the present embodiment, the monitoring application includes an output unit that outputs the monitoring result of the monitoring unit to the outside.

The monitoring application (output unit) outputs the monitoring result (for example, abnormality detection) to the outside. The outside includes, for example, a server connected to the device via a network. Since an abnormality is detected, it is notified to the outside, so that regular external communication is not required and the operating cost can be reduced.

10 Normal execution environment 11 Normal application 12 Control application 20 Trusted execution environment 21 Monitoring application 211 Log acquisition unit 212 Monitoring target information acquisition unit 213 Monitoring frequency acquisition unit 214 Log analysis unit 215 Authentication unit 216 Notification unit

Claims (8)

An execution environment provider that provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment,
It includes a monitoring application that is executed in the trusted execution environment and monitors a normal application that is executed in the normal execution environment.
The monitoring application
A log acquisition unit that acquires the execution log of the normal application, and
A device including a monitoring unit that monitors the presence or absence of an abnormality in the normal application based on the execution log acquired by the log acquisition unit. The monitoring application
A monitoring target information acquisition unit that acquires monitoring target information from the normal application at a required time is provided.
The monitoring unit
The device according to claim 1, which monitors the presence or absence of an abnormality in the normal application based on the monitoring target information of the execution log acquired by the log acquisition unit. The device according to claim 2, wherein the required time point includes the time when the normal application is introduced, the time when the application is started, or the time when the application is updated. The monitoring application
The device according to claim 2 or 3, further comprising an authentication unit that authenticates the normal application when the monitoring target information acquisition unit acquires the monitoring target information. The monitoring application
It is provided with a monitoring frequency information acquisition unit that acquires information on the monitoring frequency from the normal application.
The monitoring unit
The device according to any one of claims 1 to 4, wherein the presence or absence of an abnormality in the normal application is monitored at the monitoring frequency. The monitoring application
The device according to any one of claims 1 to 5, further comprising an output unit that outputs the monitoring result of the monitoring unit to the outside. On the computer
Processing that provides a normal execution environment and a trusted execution environment that is safer than the normal execution environment,
A process of executing a monitoring application that monitors a normal application executed in the normal execution environment in the trusted execution environment, and a process of executing the monitoring application in the trusted execution environment.
The process of acquiring the execution log of the normal application in the monitoring application, and
A computer program that causes the monitoring application to execute a process of monitoring the presence or absence of an abnormality in the normal application based on the acquired execution log. To provide a normal execution environment and a trusted execution environment that is safer than the normal execution environment,
A monitoring application that monitors a normal application executed in the normal execution environment is executed in the trusted execution environment, and the monitoring application is executed.
Have the monitoring application acquire the execution log of the normal application,
A method for monitoring a normal application that causes the monitoring application to monitor the presence or absence of an abnormality in the normal application based on an acquired execution log.

Images