JP6447978B2 - Electromagnetic information leakage evaluation device, electromagnetic information leakage evaluation method, and electromagnetic information leakage evaluation processing program - Google Patents

Description

  Embodiments described herein relate generally to an electromagnetic information leakage evaluation apparatus, an electromagnetic information leakage evaluation method, and an electromagnetic information leakage evaluation processing program.

  The threat of electromagnetic wiretapping that obtains information from weak electromagnetic waves radiated from electronic devices has been pointed out. For example, the threat of screen snooping using leaked electromagnetic waves from display devices has been a concern. This threat of screen snooping is particularly a concern for stationary displays with relatively high electromagnetic wave strength.

  When the interface for transferring screen information to a display device is a conventional analog interface, the screen is displayed as a bit string of analog voltage values including luminance information in the device or in the wiring connecting the display device and the electronic device. Information is transmitted. When there is a color change or color shading on the screen, the above-mentioned analog voltage value changes, so that there is a possibility that an electromagnetic field is generated and is radiated to the outside as a so-called electromagnetic wave.

  In most cases, the leakage electromagnetic wave radiated to the outside (far) is a harmonic component of an electromagnetic field generated by the change in the analog voltage value. For this reason, a leaked electromagnetic wave is received by an antenna, detected, and demodulated, whereby a bit string of analog voltage values including the original screen information can be obtained. Furthermore, this bit string is input to the RGB input terminal of the monitor corresponding to the analog interface, and the vertical synchronization signal and the horizontal synchronization signal specific to the display device to be screened are simultaneously input, so that the display screen contents can be changed. Can be reproduced (see, for example, Non-Patent Document 1).

  The analog interface is an interface for a CRT display (CRT display) that performs drawing by a raster scan method. Even in the mainstream LCD displays (liquid crystal displays), many displays have an analog interface in order to maintain interface compatibility.

  In addition, even in LCD displays and tablet terminals using digital interfaces, if there is a part where data is serially processed and transmitted in the device, electromagnetic waves including screen information may be leaked from the liquid crystal drive unit. As with displays equipped with an interface, there is concern about the threat of screen snooping (see Non-Patent Document 2, for example).

Yasuo Suzuki, Kimihiro Tajima, Masao Masugi, Hiroshi Yamane, “Technology for Countermeasures against Information Leakage due to Electromagnetic Waves Eradiated from PC”, NTT Technical Journal (Aug. 2008), p.11-15, January 25, 2016 Search, Internet <URL: http://www.ntt.co.jp/journal/0808/files/jn200808011.pdf> Y. Hayashi, N. Homma, M. Miura, T. Aoki, H. Sone, "A Threat for Tablet PCs in Public Space: Remote Visualization of Screen Images Using EM Emanation," 21st ACM Conference on Computer and Communications Security (CCS '14), PP.954-965, 2014., searched on January 25, 2016, Internet <URL: http://dl.acm.org/citation.cfm?id=2660292>

  As a countermeasure against such information leakage, it is conceivable to block electromagnetic waves leaking from electronic devices. However, normally, when an electromagnetic wave radiated from an electronic device equipped with a display is received by an antenna, the received electromagnetic wave includes a signal component generated inside the electronic device and a harmonic component of this signal component. In many cases, it has a wide frequency component. That is, since a frequency component not related to the display screen on the display is also received, it is difficult to specify only the frequency component related to the display screen on the display and block it.

  Therefore, in order to implement countermeasures against the threat of screen snooping via leaked electromagnetic waves, it is necessary to take measures such as shielding to block broadband electromagnetic waves. This is difficult.

  In addition, if the frequency corresponding to the screen information is known in the leaked electromagnetic wave, it is possible to take measures against blocking the target frequency range. In the first place, there is a method for evaluating whether screen information is leaked from electronic devices, There has been no method for appropriately evaluating which frequency band should be taken against leakage when information is leaked.

  Also, in order to reduce the threat of information leakage, when taking measures to prevent electromagnetic waves including screen information from leaking outside the electronic device, it is extremely useful to identify which frequency band contains the screen information. Since it takes time, it was not possible to efficiently take measures such as shielding against electromagnetic waves.

  An object of the present invention is to provide an electromagnetic information leakage evaluation apparatus, an electromagnetic information leakage evaluation method, and an electromagnetic information leakage evaluation processing program capable of appropriately estimating the frequency band of electromagnetic waves including screen information in a short time. It is.

  In order to achieve the above object, a first aspect of an electromagnetic information leakage evaluation apparatus according to an embodiment of the present invention includes an antenna unit that inputs an electromagnetic wave radiated from a display device that is an estimation target of a drawing frequency of screen information. A bandpass filter unit that outputs a signal of a frequency component of a predetermined band for the electromagnetic wave input by the antenna unit, a detection demodulator unit that detects and demodulates the signal output by the bandpass filter unit, and the detection demodulator unit A frequency characteristic confirmation unit that obtains a frequency spectrum by performing a fast Fourier transform on the signal output from the display, and in the frequency spectrum, a horizontal resolution of screen information displayed on the display device and a refresh rate of the screen information The vicinity of the first frequency indicated by the product, or the vertical resolution and front of the screen information displayed on the display device When a frequency having a predetermined electric field strength level higher than the noise floor exists in the vicinity of the second frequency indicated by the product of the refresh rate, and in the vicinity of the first and second frequencies, and these If the electric field intensity level of the frequency other than the harmonic component of is not a predetermined level higher than the noise floor, the frequency corresponding to the peak of the electric field intensity level among the existing frequencies is estimated as the drawing frequency candidate, and the predetermined frequency And an estimation unit that estimates a band as a candidate for the frequency of an electromagnetic wave including the screen information.

  According to a second aspect of the electromagnetic information leakage evaluation apparatus configured as described above, in the first aspect, the electromagnetic information leakage evaluation apparatus includes a control unit that controls a change in screen information displayed on the display device, and the estimation unit includes the changed screen. In the frequency spectrum obtained by the frequency characteristic confirmation unit based on an electromagnetic wave radiated from the display device on which information is displayed, a predetermined electric field strength higher than a noise floor when the radiated electromagnetic wave includes the screen information A frequency having a level is estimated based on a difference between the periodicity of the screen information before the change and the periodicity of the screen information after the change, and the frequency has a predetermined electric field strength level higher than a noise floor. In the frequency spectrum based on the electromagnetic wave radiated from the display device on which the screen information before the change is displayed, the high electric field strength Estimating a frequency corresponding to the peak level as a candidate of the drawing frequency, to provide a device for estimating the predetermined band as a candidate for a frequency of an electromagnetic wave including the screen information.

  In order to achieve the above object, an electromagnetic information leakage evaluation method according to an embodiment of the present invention inputs an electromagnetic wave radiated from a display device that is an estimation target of a drawing frequency of screen information. Output a frequency band signal of a predetermined band, detect and demodulate the output signal, obtain a frequency spectrum by fast Fourier transforming the detected and demodulated signal, and display the display in the frequency spectrum Near the first frequency indicated by the product of the horizontal resolution of the screen information displayed on the device and the refresh rate of the screen information, or the vertical resolution of the screen information displayed on the display device and the refresh When a frequency having a predetermined electric field strength level higher than the noise floor exists in the vicinity of the second frequency indicated by the product of the rate If the electric field intensity level of the frequency other than the frequencies near the first and second frequencies and the harmonic components thereof is not a predetermined level higher than the noise floor, the peak of the electric field intensity level among the existing frequencies Is provided as a candidate for the drawing frequency, and the predetermined band is estimated as a candidate for the frequency of the electromagnetic wave including the screen information.

  According to a second aspect of the electromagnetic information leakage evaluation method described above, in the first aspect, the screen information to be displayed on the display device is controlled to be changed, and the changed screen information is displayed from the display device. In the frequency spectrum obtained based on the electromagnetic wave to be transmitted, when the screen information is included in the radiated electromagnetic wave, a frequency having a predetermined electric field strength level higher than a noise floor, the periodicity of the screen information before the change And the display on which the screen information before the change is displayed when the frequency has a predetermined electric field strength level higher than the noise floor. In the frequency spectrum based on the electromagnetic wave radiated from the apparatus, a frequency corresponding to the peak of the high electric field strength level is set as the drawing frequency candidate. Estimation Te and provides a method for estimating a predetermined band as a candidate for a frequency of an electromagnetic wave including the screen information.

  In order to achieve the above object, an aspect of the electromagnetic information leakage evaluation processing program in the embodiment of the present invention is a program used for a computer operating as a part of the electromagnetic information leakage evaluation apparatus in the first aspect, A program for causing the computer to function as the antenna unit, the bandpass filter unit, the detection demodulation unit, the frequency characteristic confirmation unit, and the estimation unit is provided.

  According to the present invention, it is possible to appropriately estimate the frequency band of electromagnetic waves including screen information in a short time.

The figure explaining the structure of the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The figure explaining the structure of the frequency characteristic confirmation part of the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The flowchart which shows an example of the processing operation by the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The figure which shows an example of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The figure which shows an example of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The figure which shows an example of the frequency characteristic of the electromagnetic wave containing the information of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The figure which shows an example of the frequency characteristic of the electromagnetic wave containing the information of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 1st Embodiment of this invention. The figure explaining the structure of the frequency characteristic confirmation part of the electromagnetic information leakage evaluation apparatus in the 2nd Embodiment of this invention. The flowchart which shows an example of the processing operation by the electromagnetic information leakage evaluation apparatus in the 2nd Embodiment of this invention. The figure which shows an example of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 2nd Embodiment of this invention. The figure which shows an example of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 2nd Embodiment of this invention. The figure which shows an example of the frequency characteristic of the electromagnetic wave containing the information of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 2nd Embodiment of this invention. The figure which shows an example of the frequency characteristic of the electromagnetic wave containing the information of the screen displayed on the object display used as the estimation object of the drawing frequency of the screen information by the electromagnetic information leakage evaluation apparatus in the 2nd Embodiment of this invention.

Embodiments according to the present invention will be described below.
(First embodiment)
First, the first embodiment will be described.
In the first embodiment, only the frequency component of the electromagnetic wave including the screen information is specified from the frequency component of the electromagnetic wave radiated from the display device (display device).
In the first embodiment, an electromagnetic wave radiated from a display device is acquired, and the acquired electromagnetic wave is detected and demodulated to determine the presence or absence of a specific frequency component. When screen information is included in the acquired electromagnetic wave, a drawing frequency signal can be observed by detecting and demodulating the electromagnetic wave.
Data related to screen information displayed on the display device has a periodicity depending on the resolution. For this reason, in a frequency channel in which information is leaked, periodicity is observed in the demodulated data. Therefore, a frequency having this periodicity is called a drawing frequency. This drawing frequency corresponds to the horizontal synchronization signal of the analog interface.
Therefore, by analyzing the signal after detection and demodulation, and examining the frequency component near the frequency calculated from the resolution and refresh rate of the screen information in the analyzed signal, the screen information is included in the acquired electromagnetic wave. It can be estimated whether or not.

  As described above, when the signal after detection and demodulation does not include a frequency component having a predetermined or higher electric field strength level near the calculated frequency, screen information is not included in the acquired electromagnetic wave, that is, screen information is leaked. It can be determined that it is not.

  On the other hand, when the signal after detection and demodulation includes a frequency component having a predetermined or higher electric field intensity level near the calculated frequency, it is appropriate to immediately determine that the acquired electromagnetic wave includes screen information. In addition, screen information may not be included in the acquired electromagnetic wave.

  Specifically, the screen information may not be included in the acquired electromagnetic wave because the screen information is crushed due to noise or the like. The fact that the screen information has been crushed indicates that the screen information cannot be reproduced normally due to noise generated from electronic components in the display device, for example.

  Therefore, in the first embodiment, the presence or absence of screen information in the acquired electromagnetic wave is determined based on the electric field strength level of the frequency component other than the vicinity of the calculated frequency and its harmonic component.

Specifically, in the first embodiment, when the signal after detection and demodulation includes a frequency component having a predetermined electric field intensity level near the calculated frequency, the signal in the signal after detection and demodulation is described above. If the electric field strength level of the frequency component other than the calculated frequency and its harmonic components is below a predetermined level, screen information is included in the acquired electromagnetic wave, and there is a high possibility that the screen information is leaked. Is determined.
On the other hand, in the first embodiment, the signal after detection or demodulation is detected and demodulated when the signal after detection and demodulation includes a frequency component having a predetermined electric field strength level near the calculated frequency. If the electric field strength level of the frequency component other than the calculated frequency in the later signal and other than its harmonics exceeds the predetermined level, the screen information is crushed by noise, etc. It is determined that the screen information is not included (cannot be reproduced normally) and the screen information is not leaked.

Next, a specific example of the first embodiment will be described.
FIG. 1 is a diagram for explaining the configuration of an electromagnetic information leakage evaluation apparatus according to the first embodiment of the present invention.
As shown in FIG. 1, the electromagnetic information leakage evaluation apparatus according to the first embodiment determines whether or not screen information is included in an electromagnetic wave radiated from a target display terminal 10 that is an estimation target of a screen information drawing frequency. The antenna unit 11, the amplifier unit 12, the band pass filter unit (BPF) 13, the detection demodulation unit 14, the frequency characteristic confirmation unit (spectrum monitor) 15, the control unit 16, and the storage device 17 are evaluated.

The antenna unit 11 receives as wide an electromagnetic wave as possible radiated from the target display terminal 10. The amplifier unit 12 amplifies the radio wave signal received by the antenna unit 11 to a level sufficient for subsequent processing. The band pass filter unit 13 passes only a signal having a specific frequency component among the radio wave signals amplified by the amplifier unit 12.
The detection demodulation unit 14 detects and demodulates the signal that has passed through the band pass filter unit 13.
The frequency characteristic confirmation unit 15 obtains a frequency spectrum which is a signal in the frequency domain by performing FFT (Fast Fourier Transform) analysis on the signal input from the detection demodulation unit 14, and displays the frequency spectrum on a built-in monitor. .
FIG. 2 is a diagram illustrating the configuration of the frequency characteristic confirmation unit of the electromagnetic information leakage evaluation apparatus according to the first embodiment of the present invention.
The frequency characteristic confirmation unit 15 includes an input unit 15a, an FFT analysis unit 15b, a drawing frequency candidate determination unit 15c, a high frequency component outside level determination unit 15d, a storage unit 15e, and an output unit 15f. The storage unit 15e is a storage medium such as a nonvolatile memory.

The control unit 16 controls the frequency band of the signal passing through the bandpass filter unit 13 and the frequency confirmed by the frequency characteristic confirmation unit 15, and records the measurement result and the measurement progress status in the storage device 17. The storage device 17 is a storage medium such as a nonvolatile memory.
The above-described configuration may be configured by either hardware or software, and may be configured by using functions of devices such as a spectrum analyzer and a personal computer.

Next, a procedure for specifying a candidate for an electromagnetic wave frequency including screen information and a candidate for a drawing frequency in the electromagnetic wave radiated from the target display terminal 10 will be described. FIG. 3 is a flowchart showing an example of processing operations performed by the electromagnetic information leakage evaluation apparatus according to the first embodiment of the present invention.
First, the control unit 16 knows that the horizontal resolution of the screen of the target display terminal 10 is X (dpi), the vertical resolution is Y (dpi), and the screen refresh rate is Z (Hz). , The provisional candidate values of the drawing frequency of the screen information, the frequencies f1 and f2 that are so-called rough candidate values are calculated, and the calculated f1 and f2 are set in the frequency characteristic confirmation unit 15, and Recording is performed in the storage device 17 (S1).
f1 is obtained by X × Z, and f2 is obtained by Y × Z. Regarding f1 and f2, separately calculated values may be recorded in advance in the storage device 17 without depending on the control unit 16.

Next, the control unit 16 records these values in the storage device 17 with the lower limit value of the frequency range measured by the frequency characteristic confirmation unit 15 as fl and the upper limit value as fh. fl and fh are set within a range supported by an electromagnetic information leakage evaluation apparatus as a measurement component to be used.
Further, the control unit 16 sets the initial value of the center frequency fm in the frequency band of the electromagnetic wave radiated from the target display terminal 10 to pass through the band-pass filter unit 13 as the above lower limit value fl, and sets this value as the band. It is set in the pass filter unit 13 and the frequency characteristic confirmation unit 15 and recorded in the storage device 17 (S2). The frequency fm is a center frequency of a frequency band having a predetermined width such as 10 MHz or 20 MHz and passing through the band pass filter unit 13.

  Next, the control unit 16 controls the image display by the target display terminal 10 to display an arbitrary image on the target display terminal 10 (S3). Note that the image displayed on the target display terminal 10 is not a white noise screen, but an image that can be determined to be significant by human vision, such as characters and figures.

  Next, the antenna unit 11 receives the electromagnetic waves radiated from the target display terminal 10. The received radio wave is amplified by the amplifier unit 12 and then passes through the bandpass filter unit 13 so that only the signal of the frequency component belonging to the band of the predetermined width from the center frequency fm set as described above. Is transmitted to the detection demodulator 14 (S4). The detection demodulator 14 detects and demodulates the signal input from the bandpass filter 13 (S5).

  Next, the input unit 15a of the frequency characteristic confirmation unit 15 inputs the signal obtained in S5. The FFT analysis unit 15b performs FFT analysis on the input signal to obtain a frequency domain signal (S6), and the signal falls within the range from the lower limit value fl to the upper limit value fh set as described above. To display on the built-in monitor.

  Then, the drawing frequency candidate determination unit 15c of the frequency characteristic confirmation unit 15 has a predetermined value higher than the noise floor in the vicinity of the frequency f1 or the frequency f2 set in S1 in the signal in the frequency domain. It is determined whether or not there is a frequency component having an electric field intensity level (S7). The level of the noise floor is the electric field intensity level of the other frequency band in which the frequency component of the high electric field intensity level is not observed, or the electric field intensity level observed when the display of the target display terminal 10 is turned off. Points to either. The electric field strength level in the other frequency band refers to a value obtained by averaging the electric field strength levels in a predetermined frequency range from this frequency, centered on a frequency separated from the frequency f1 or f2 by a predetermined frequency.

  If a frequency component having an electric field strength level higher than Adb compared to the noise floor exists in the vicinity of the frequency f1 or f2 (Yes in S7), the high-frequency component outside level determination unit 15d of the frequency characteristic confirmation unit 15 The electric field intensity level of the frequency component in all frequency bands other than the harmonic components of the frequency components in the vicinity of the frequencies f1 and f2 within the range from the lower limit value fl to the upper limit value fh in the signal in the frequency domain is a noise floor. It is determined whether it is below a predetermined level which is higher than (S8). A and C are detection threshold values, for example, set to values that can be clearly distinguished from the noise floor.

  If the electric field strength level of the frequency component in all frequency bands other than the above harmonic components is a level equal to or lower than the level higher by Cdb than the noise floor (Yes in S8), the level outside the high frequency component of the frequency characteristic confirmation unit 15 The determination unit 15d assumes that the screen information is included in the acquired electromagnetic wave, and the center frequency fm set from the control unit 16 is the frequency of the electromagnetic wave including the screen information radiated from the target display terminal 10. It is estimated as a candidate and recorded in the storage unit 15e. The output unit 15 f records the recorded frequency value in the storage device 17.

  Further, in addition to the recording of the center frequency fm, if there is a frequency component having an electric field strength level higher than Adb in the vicinity of the frequency f1 in S7, the level outside the high frequency component of the frequency characteristic confirmation unit 15 is present. The determination unit 15d estimates the frequency having the peak electric field intensity level in the existing frequency component as a candidate for the drawing frequency of the screen information included in the electromagnetic wave radiated from the target display terminal 10, and records it in the storage unit 15e. . The output unit 15 f records the recorded frequency value in the storage device 17. The same applies when there is a frequency component having an electric field strength level higher than Adb in the vicinity of the frequency f2 in S7 (S9).

When the electric field intensity level of the frequency near the frequencies f1 and f2 is not higher than Adb compared to the noise floor (No in S7), the drawing frequency candidate determination unit 15c of the frequency characteristic confirmation unit 15 does not pass through S9. Considers that the acquired electromagnetic wave does not contain screen information, and records information indicating this in the storage unit 15e. The output unit 15f notifies the control unit 16 of the recorded information.
In addition, when a frequency component having an electric field intensity level that exceeds a level higher by Cdb than the noise floor in a frequency band other than the above harmonic component (No in S8), the frequency characteristics are not passed through S9. Since the screen information originally displayed on the target display terminal 10 may be crushed by noise, the high-frequency component outside level determination unit 15d of the confirmation unit 15 includes the screen information in a correct state in the acquired electromagnetic wave. Information indicating this is recorded in the storage unit 15e. The output unit 15f notifies the control unit 16 of the recorded information.
Also after S9, the output unit 15f notifies the control unit 16 of the information recorded in the storage unit 15e in S9.

  Receiving the above notification, the control unit 16 changes the center frequency fm of the pass band by the bandpass filter unit 13 to fm + α (S10). α is a measurement step and may be arbitrarily determined. The control unit 16 sets the changed center frequency fm in the band pass filter unit 13 and the frequency characteristic confirmation unit 15 and records it in the storage device 17.

Next, the control unit 16 compares fm changed in S10 with fh recorded in the storage device 17. If fm> fh is not satisfied (No in S11), the process proceeds to S4 and subsequent operations based on the center frequency fm changed in S10. If the currently set center frequency fm> fh (Yes in S11), the control unit 16 ends the process.
At this time, if the frequency candidate of the electromagnetic wave including the screen information and the candidate of the drawing frequency are not recorded at S9, the frequency characteristic confirmation unit 15 does not confirm the leaked electromagnetic wave including the screen information. May be displayed on a built-in monitor.

FIG. 4 and FIG. 5 are diagrams illustrating an example of a screen displayed on a target display that is an estimation target of a drawing frequency of screen information by the electromagnetic information leakage evaluation apparatus according to the first embodiment of the present invention. 6 and 7 are examples of frequency characteristics of electromagnetic waves including screen information displayed on a target display that is an estimation target of a drawing frequency of screen information by the electromagnetic information leakage evaluation apparatus according to the first embodiment of the present invention. FIG.
FIG. 6 shows frequency characteristics when an image as shown in FIG. 4 is obtained on the target display terminal 10. FIG. 7 shows frequency characteristics when an image as shown in FIG. 5 is obtained on the target display terminal 10.
The images shown in FIGS. 4 and 5 are reproduced images of the same target display terminal 10 but have different center frequencies fm. 4 shows an image in which the screen information is correctly displayed, and FIG. 5 shows an image in which the screen information is crushed by noise or the like and is not correctly displayed.

  In FIG. 6, a frequency (fa in FIG. 6) corresponding to a frequency component of a level higher than the noise floor (hereinafter simply referred to as a high level) observed at the frequency on the left end side in the figure. As a drawing frequency candidate, a high level frequency component is observed at a frequency corresponding to a harmonic of this frequency, while a high level frequency component is not observed at the above drawing frequency candidate and a frequency that is not its harmonic. . That is, it indicates that the screen information is included in the correct state in the radiated electromagnetic wave.

Further, in FIG. 7, a frequency (fa in FIG. 7) corresponding to a high level frequency component observed at the frequency on the left end side in the figure is set as a drawing frequency candidate, and the frequency corresponding to the harmonic of this frequency is high. A level is observed, and a high-level frequency component is also observed at the drawing frequency candidate and a frequency that is not its harmonic. This frequency component is a noise frequency component f _n .

  In this way, when high frequency components are observed at frequencies other than the drawing frequency candidate and its harmonics, if this level is above a certain level, the screen information is crushed by noise, so radiation It can be determined that the screen information is not included in the correct state in the electromagnetic wave to be transmitted.

Through the above procedure, it is possible to estimate the candidate for the frequency of the electromagnetic wave including the screen information and the candidate for the drawing frequency of the screen information.
In S <b> 1, based on the specifications of the target display terminal 10, the frequencies f <b> 1 and f <b> 2, which are provisional candidate values of the drawing frequency, as approximate estimates of the drawing frequency are the operations of the clock IC used by the target display terminal 10. There is a high possibility that the screen cannot be reconstructed based on the leaked electromagnetic wave of this frequency without considering the frequency variation. Therefore, in order to reconstruct the screen based on the leaked electromagnetic wave, it is necessary to specify the drawing frequency of the target display terminal 10 that is the leak source with high accuracy.
On the other hand, if the method described in the first embodiment is used, a frequency having a high electric field strength level in the vicinity of the frequencies f1 and f2 is calculated based on electromagnetic waves leaked from the target display terminal 10 that is actually operating. Since it can be estimated as a drawing frequency candidate, the drawing frequency candidate can be estimated with sufficient accuracy for reconstructing the screen based on the leaked electromagnetic wave.

  By implementing the first embodiment of the present invention, it is possible to estimate the frequency of an electromagnetic wave including screen information and the estimation of a drawing frequency in a short time, and it is possible to evaluate a risk and take measures against a threat of snooping. Can be easily considered.

(Second Embodiment)
Next, a second embodiment will be described. In addition, in this embodiment, the description similar to 1st Embodiment is abbreviate | omitted.
As described in the first embodiment, the signal obtained after detection and demodulation is acquired in the case where the signal includes a frequency component having a predetermined or higher electric field strength level near the frequency calculated from the resolution of the screen information and the refresh rate. It is not appropriate to immediately determine that screen information is included in the electromagnetic wave, and there is a possibility that the screen information is not included in the acquired electromagnetic wave. Further, in the first embodiment, it has been described that the screen information may be crushed due to noise.

However, the present invention is not limited to this. For example, since only a control signal for drawing is leaked, there is a possibility that screen information is not included in the acquired electromagnetic wave.
The fact that only the control signal for drawing is leaked means that a control signal different from the image signal for controlling drawing is output in the target display terminal 10 in synchronization with the timing of image display. It means that only this control signal is leaked to the outside as an electromagnetic wave due to the influence of the configuration of the target display terminal 10 or the like. In this case, screen information is not included in the acquired electromagnetic wave.

  Therefore, in the second embodiment, the screen has periodicity (for example, different colors are displayed alternately at predetermined intervals along the horizontal direction and the vertical direction) as described in the first embodiment. The target display terminal 10 displays an image in which the electric field strength level of the frequency component in the vicinity of the provisional candidate value of the drawing frequency calculated based on the resolution of the information and the refresh rate is higher than the noise floor. Make sure the level is higher than the noise floor.

  Then, after this confirmation, an image whose periodicity is changed with respect to this image (for example, the predetermined interval is set to ½) is newly displayed on the target display terminal 10. Based on the change in periodicity at the time of the display, a predetermined frequency component expected to change (increase) the electric field strength level in the leakage electromagnetic wave (for example, the frequency of the high electric field strength level in the image before the change). Whether or not screen information is included in the electromagnetic wave is determined based on the electric field intensity level in the vicinity of twice the frequency.

  When electromagnetic waves including screen information are not leaked, even if the image displayed on the target display terminal 10 is changed as described above, the frequency spectrum of the acquired electromagnetic waves does not change. That is, the electric field strength level of the expected predetermined frequency component does not change between the image before the change and the image after the change.

  On the other hand, when an electromagnetic wave including screen information is leaked, if the image displayed on the target display terminal 10 is changed, the frequency spectrum of the electromagnetic wave acquired as described above changes in the image after the change. That is, when the image before the change and the image after the change are compared, the electric field strength level of the expected frequency component is different.

  As described above, in the second embodiment, the image displayed on the target display terminal 10 is changed during the leakage evaluation of electromagnetic information in order to confirm the presence or absence of leakage of electromagnetic waves correlated with the screen information. When this occurs, the presence or absence of a change in the frequency spectrum of this image is measured.

Next, a specific example of the second embodiment will be described.
FIG. 9 is a diagram illustrating the configuration of the frequency characteristic confirmation unit of the electromagnetic information leakage evaluation apparatus according to the second embodiment of the present invention.
The frequency characteristic confirmation unit 15 includes an input unit 15a, an FFT analysis unit 15b, a drawing frequency candidate determination unit 15c, a high frequency component outside level determination unit 15d, a storage unit 15e, an output unit 15f, and an image frequency component comparison unit 15g.

Next, a procedure for specifying a candidate for an electromagnetic wave frequency including screen information and a candidate for a drawing frequency in the electromagnetic wave radiated from the target display terminal 10 will be described. FIG. 10 is a flowchart showing an example of the processing operation performed by the electromagnetic information leakage evaluation apparatus according to the second embodiment of the present invention.
First, after S1 (calculation of the frequencies f1, f2, etc.) and S2 (setting of the lower limit value fl of the frequency range, the upper limit value fh, the initial value of the center frequency fm, etc.) described in the first embodiment, the control is performed. The unit 16 displays an arbitrary image on the target display terminal 10 by transmitting an image display signal to the target display terminal 10 and controlling the image display (S21). Hereinafter, the image displayed in S21 may be referred to as a pre-change image.

  FIG. 10 is a diagram illustrating an example of a screen displayed on a target display that is an estimation target of a drawing frequency of screen information by the electromagnetic information leakage evaluation apparatus according to the second embodiment of the present invention. The pre-change image shown in FIG. 10 has periodicity as described above, and the color C1 and the color C2 are alternately displayed at predetermined intervals along the horizontal direction and the vertical direction.

  Next, after S4 (measurement of radiated electromagnetic wave, etc.), S5 (detection, demodulation, etc.), S6 (FFT analysis, etc.) described in the first embodiment, the drawing frequency candidate determination unit 15c of the frequency characteristic confirmation unit 15 Stores the frequency domain signal corresponding to the pre-change image in the storage unit 15e, and then in the vicinity of the frequency f1 or the frequency f2 set in S1 in the frequency domain signal obtained by the FFT analysis described above. Then, it is determined whether or not there is a frequency component having a higher electric field strength level than the noise floor (S7A).

  If a frequency component having an electric field strength level higher than Adb in comparison with the noise floor exists in the vicinity of the frequency f1 or f2 (Yes in S7A), the high frequency component outside level determination unit 15d of the frequency characteristic confirmation unit 15 The electric field intensity level of the frequency component in all frequency bands other than the harmonic components of the frequency components in the vicinity of the frequencies f1 and f2 within the range from the lower limit value fl to the upper limit value fh in the signal in the frequency domain is a noise floor. It is determined whether or not the level is equal to or lower than the level higher by Cdb than (S8).

If the electric field intensity level of the frequency component in all frequency bands other than the above harmonic components is a level equal to or lower than the level higher by Cdb than the noise floor (Yes in S8), the image characteristic component comparison of the frequency characteristic confirmation unit 15 is performed. The unit 15g considers that the screen information of the pre-change image is included in the acquired electromagnetic wave, and instructs the control unit 16 to change the image displayed on the target display terminal 10 in S3 via the output unit 15f. .
In accordance with this instruction, the control unit 16 outputs an image switching signal from the target display terminal 10, so that a new image with a different periodicity is displayed instead of the pre-change image displayed on the target display terminal 10 in S 3. (S22). Hereinafter, the image displayed in S22 may be referred to as a post-change image.

  FIG. 11 is a diagram illustrating an example of a screen displayed on a target display that is an estimation target of a drawing frequency of screen information by the electromagnetic information leakage evaluation apparatus according to the second embodiment of the present invention. The post-change image shown in FIG. 11 has twice the image period of the pre-change image shown in FIG. 10, and the colors C1 and C2 are compared with the pre-change image along the horizontal and vertical directions. Thus, the images are alternately displayed at half intervals.

  Next, the image frequency component comparison unit 15g of the frequency characteristic confirmation unit 15 has an electric field strength level higher than the noise floor in the post-change image based on the difference between the image cycle of the pre-change image and the image cycle of the post-change image. Estimate the expected predetermined frequency. For example, as described above, when the image period of the post-change image is twice that of the pre-change image, the frequency expected to have a high electric field strength level in the post-change image is a high electric field in the pre-change image. Double the frequency expected to have an intensity level.

  Then, the image frequency component comparison unit 15g acquires a frequency domain signal corresponding to the pre-change image from the storage unit 15e. Further, by changing the image, acquisition, detection, demodulation, and FFT analysis of electromagnetic waves radiated from the target display terminal 10 on which the screen information of the changed image is displayed are performed, and the image frequency component comparison unit 15g A signal in the frequency domain corresponding to the post-image is acquired from the FFT analysis unit 15b, and the electric field strength level at the estimated frequency is compared between the pre-change image and the post-change image, and the electric field strength level difference based on this comparison It is determined whether or not the change in the electric field intensity level is equal to or higher than the predetermined threshold value EdB (S23).

  When the change in the electric field intensity level is equal to or greater than EdB (Yes in S23), the image frequency component comparison unit 15g of the frequency characteristic confirmation unit 15 includes the screen information in the electromagnetic wave acquired as described above for the pre-change image. The center frequency fm set by the control unit 16 is estimated as a candidate for the frequency of the electromagnetic wave including the screen information emitted from the target display terminal 10 and recorded in the storage unit 15e. The output unit 15 f records the recorded frequency value in the storage device 17.

  Further, in addition to the recording of the center frequency fm, if there is a frequency component having an electric field intensity level higher than Adb in the vicinity of the frequency f1 in S7A in the vicinity of the frequency f1, the image frequency component comparison of the frequency characteristic confirmation unit 15 The unit 15g estimates the frequency having the peak electric field intensity level in the existing frequency component as a candidate for the drawing frequency of the screen information included in the electromagnetic wave radiated from the target display terminal 10, and records it in the storage unit 15e. The output unit 15 f records the recorded frequency value in the storage device 17. The same applies when there is a frequency component having an electric field strength level higher than Adb in the vicinity of the frequency f2 in S7A (S9A).

If the change in the electric field strength level is not equal to or greater than EdB (No in S23), the image frequency component comparison unit 15g of the frequency characteristic confirmation unit 15 does not include screen information in the acquired electromagnetic wave without passing through S9A. Therefore, it is considered that there is a high possibility that only the control signal for drawing is leaked, and information indicating this is recorded in the storage unit 15e. The output unit 15f notifies the control unit 16 of the recorded information.
Also after S9A, the output unit 15f notifies the control unit 16 of the information recorded in the storage unit 15e in S9A.

  In the case of S7A No and S8 No, the control unit 16 is notified in the same manner as in the case of S7 No in the first embodiment and the case of S8 No.

  Upon receiving the notification, the control unit 16 changes the center frequency fm of the passband by the bandpass filter unit 13 to fm + α (S10). α is a measurement step and may be arbitrarily determined. The control unit 16 sets the changed center frequency fm in the band pass filter unit 13 and the frequency characteristic confirmation unit 15 and records it in the storage device 17.

Next, the control unit 16 compares fm changed in S10 with fh recorded in the storage device 17. If fm> fh is not satisfied (No in S11), the process proceeds to S4 and subsequent operations based on the center frequency fm changed in S10. If the currently set center frequency fm> fh (Yes in S11), the control unit 16 ends the process.
At the end of this time, if the electromagnetic wave frequency candidate including the screen information and the drawing frequency candidate in S9A have never been recorded, the frequency characteristic confirmation unit 15 confirms that the leaked electromagnetic wave including the screen information is not confirmed. A message or the like may be displayed on a built-in monitor.

12 and 13 are examples of frequency characteristics of electromagnetic waves including screen information displayed on a target display that is an estimation target of a drawing frequency of screen information by the electromagnetic information leakage evaluation apparatus according to the first embodiment of the present invention. FIG.
FIG. 12 shows frequency characteristics when the pre-change image as shown in FIG. 10 is obtained by the target display terminal 10. FIG. 13 shows frequency characteristics when an after-change image as shown in FIG. 11 is obtained on the target display terminal 10.
When the pre-change image shown in FIG. 10 is displayed, as shown in FIG. 12, it has the strongest peak P1 in the vicinity of the drawing frequency candidate frequency, and when the post-change image shown in FIG. As shown in FIG. 13, it can be seen that the strongest peak P2 is generated in the frequency component in the frequency band twice as high as the drawing frequency candidate. In this way, when the frequency characteristics change greatly with the image change, it is estimated that the electromagnetic wave having a correlation with the display image is leaked, and the above change in the frequency characteristics is not seen even when the image is changed It can be estimated that electromagnetic waves having a correlation with the display image are not leaked.

  As described above, in the second embodiment of the present invention, it is possible to estimate the electromagnetic wave frequency candidate including the screen information and the drawing frequency candidate for the display terminal in a short time and with high accuracy. Therefore, it is possible to easily evaluate the risk and examine countermeasures against the threat of eavesdropping.

  According to each of the embodiments described above, it is possible to estimate a candidate for an electromagnetic wave frequency including screen information and a candidate for a drawing frequency in a short time, and various display terminals and displays exposed to the threat of screen snooping. With regard to the interface, it becomes possible to easily evaluate the risk and examine countermeasures against the threat of eavesdropping.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

  In addition, the method described in each embodiment is, for example, a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), optical disk (CD-ROM, etc.) as a program (software means) that can be executed by a computer (computer). It can be stored in a recording medium such as a DVD, MO, etc., semiconductor memory (ROM, RAM, flash memory, etc.), or transmitted and distributed by a communication medium. The program stored on the medium side includes a setting program that configures software means (including not only the execution program but also a table and data structure) in the computer. A computer that implements this apparatus reads a program recorded on a recording medium, constructs software means by a setting program as the case may be, and executes the above-described processing by controlling the operation by this software means. The recording medium referred to in this specification is not limited to distribution, but includes a storage medium such as a magnetic disk or a semiconductor memory provided in a computer or a device connected via a network.

  DESCRIPTION OF SYMBOLS 10 ... Target display terminal, 11 ... Antenna part, 12 ... Amplifier part, 13 ... Band pass filter part, 14 ... Detection demodulation part, 15 ... Frequency characteristic confirmation part, 16 ... Control part, 17 ... Memory | storage device.

Claims (5)

An antenna unit that inputs electromagnetic waves radiated from a display device that is an estimation target of a drawing frequency of screen information;
A band pass filter unit that outputs a signal of a frequency component of a predetermined band for the electromagnetic wave input by the antenna unit;
A detection and demodulation unit for detecting and demodulating the signal output by the bandpass filter unit;
A frequency characteristic confirmation unit that obtains a frequency spectrum by performing a fast Fourier transform on the signal output from the detection demodulation unit;
In the frequency spectrum, the vicinity of the first frequency indicated by the product of the horizontal resolution of the screen information displayed on the display device and the refresh rate of the screen information, or the screen information displayed on the display device When there is a frequency having a predetermined electric field strength level higher than the noise floor in the vicinity of the second frequency indicated by the product of the vertical resolution and the refresh rate, and the first and second frequencies If the electric field strength level of the frequencies other than the harmonic components and the frequencies other than these harmonic components is not a predetermined level higher than the noise floor, the frequency corresponding to the peak of the electric field strength level among the existing frequencies is set as the drawing frequency candidate. An estimation unit that estimates and estimates the predetermined band as a frequency candidate of an electromagnetic wave including the screen information. Electromagnetic information leakage evaluation apparatus characterized and. Control means for controlling change of screen information to be displayed on the display device;
The estimation unit includes
In the frequency spectrum obtained by the frequency characteristic confirmation unit based on electromagnetic waves radiated from the display device on which the changed screen information is displayed, when the screen information is included in the radiated electromagnetic waves from a noise floor A frequency having a high predetermined electric field strength level is estimated based on a difference between the periodicity of the screen information before the change and the periodicity of the screen information after the change, and the frequency is higher than the noise floor. In the frequency spectrum based on the electromagnetic wave radiated from the display device on which the screen information before the change is displayed when having the electric field strength level, the frequency corresponding to the peak of the high electric field strength level is set to the drawing frequency. Estimating as a candidate, and estimating the predetermined band as a candidate for a frequency of an electromagnetic wave including the screen information Electromagnetic information leakage evaluation apparatus according to claim 1. A method applied to an electromagnetic information leakage evaluation device,
Input the electromagnetic wave radiated from the display device for which the drawing frequency of screen information is estimated,
Output a signal of a frequency component of a predetermined band for the input electromagnetic wave,
Detecting and demodulating the output signal,
A frequency spectrum is obtained by fast Fourier transforming the detected and demodulated signal,
In the frequency spectrum, the vicinity of the first frequency indicated by the product of the horizontal resolution of the screen information displayed on the display device and the refresh rate of the screen information, or the screen information displayed on the display device When there is a frequency having a predetermined electric field strength level higher than the noise floor in the vicinity of the second frequency indicated by the product of the vertical resolution and the refresh rate, and the first and second frequencies If the electric field strength level of the frequencies other than the harmonic components and the frequencies other than these harmonic components is not a predetermined level higher than the noise floor, the frequency corresponding to the peak of the electric field strength level among the existing frequencies is set as the drawing frequency candidate. Estimating, and estimating the predetermined band as a candidate of the frequency of the electromagnetic wave including the screen information Magnetostatic information leakage evaluation method. Controlling the change of screen information to be displayed on the display device;
In the frequency spectrum obtained based on the electromagnetic wave radiated from the display device on which the changed screen information is displayed, a predetermined electric field strength level higher than a noise floor when the radiated electromagnetic wave includes the screen information. Is estimated based on the difference between the periodicity of the screen information before the change and the periodicity of the screen information after the change, and the frequency has a predetermined electric field strength level higher than the noise floor. In the frequency spectrum based on the electromagnetic wave radiated from the display device on which the screen information before the change is displayed, the frequency corresponding to the peak of the high electric field strength level is estimated as the drawing frequency candidate, The predetermined band is estimated as a candidate for the frequency of the electromagnetic wave including the screen information. Magnetostatic information leakage evaluation method. A program used for a computer operating as a part of the electromagnetic information leakage evaluation apparatus according to claim 1,
The computer,
The electromagnetic information leakage evaluation processing program for functioning as said antenna part, said band pass filter part, said detection demodulation part, said frequency characteristic confirmation part, and said estimation part.