JPWO2023181145A5

JPWO2023181145A5 -

Info

Publication number: JPWO2023181145A5
Application number: JP2023560133A
Authority: JP
Filing date: 2022-03-23
Publication date: 2024-03-01
Anticipated expiration: 2042-03-23

Description

図１１は、実施の形態１に係る出力情報２３０を示す図である。図１１では、シナリオＩＤ２２５と攻撃ＩＤ２１５との対応表という形で、抽出された（すなわち図１０において抽出結果２２９がＴＲＵＥとなっていた）リスク２２８のみを列挙している。なお、設計者が閲覧し易いよう、併せてシナリオ２１６と攻撃の内容２１４も示している。設計者は、この対応表を閲覧することで、リスク２２８を把握することができる。具体的には、設計者は、ＥＣＵ１２２に対して為され得る攻撃の内容２１４と、その攻撃の内容２１４により至り得る事故（すなわちシナリオ２１６）を把握することができる。特に、攻撃の内容２１４は、設計者ではなくセキュリティの専門家により列挙されていたものであるから、設計者が自身だけでは発想できなかったリスク２２８も出力情報２３０にリストアップされることが期待される。設計者は、リスク２２８を把握した際には、リスク低減策（例えば設計変更）を講じることができる。 FIG. 11 is a diagram showing output information 230 according to the first embodiment. In FIG. 11, only the extracted risks 228 (that is, the extraction result 229 was TRUE in FIG. 10) are listed in the form of a correspondence table between the scenario ID 225 and the attack ID 215. Note that a scenario 216 and attack details 214 are also shown for easy viewing by the designer. The designer can understand the risks 228 by viewing this correspondence table. Specifically, the designer can grasp the details of an attack 214 that may be made against the ECU 122 and the accident (that is, scenario 216) that may result from the attack details 214. In particular, since the details of the attack 214 were listed by a security expert rather than the designer, risks 228 that the designer could not have thought of on his own may also be listed in the output information 230 . Be expected. When the designer understands the risk 228, he or she can take risk reduction measures (eg, design changes).

図２１は、実施の形態３に係る程度情報２３１を示す図である。程度情報２３１は、設計者によって入力される情報である。図２１では、抽出されたリスク２２８を、シナリオＩＤ２２５と攻撃ＩＤ２１５との対応表で示している。また、図２１では、対応表における列項目として程度情報２３１を設けることで、各リスク２２８に対する程度情報２３１を示している。程度情報２３１は、シナリオ２１６が起こり得る状況に遭遇する頻度２３１ａ、上記状況に遭遇した際にシナリオ２１６を回避できる可能性２３１ｂ、至り得る不安全な状態の重大度２３１ｃ、の少なくともいずれか１つを備える。ここで、遭遇する頻度２３１ａは、Ｅ１が最も頻度が少なく、Ｅ４が最も頻度が高い。また、回避できる可能性２３１ｂは、Ｃ１が最も可能性が高く、Ｃ３が最も可能性が低い。また、不安全な状態の重大度２３１ｃは、Ｓ１が最も軽微であり、Ｓ３が最も重大である。なお、図２１では抽出されたリスク２２８に対してのみ程度情報２３１が示されているが、これはリスク抽出装置２００が抽出したリスク２２８を一旦設計者に向けて表示し、抽出されたリスク２２８それぞれに対して程度情報２３１を入力するよう設計者に促すことにより実現できる（具体的な手順については図２５のフローチャートを参照）。ここで、程度情報２３１は、リスク２２８単位ではなく、シナリオ２１６単位、または攻撃の内容２１４単位で入力されても良い。例えば、シナリオ２１６単位で入力された場合、優先度算出部２３３は、同じシナリオ２１６を含むリスク２２８については同じ値の優先度２３４を算出する。 FIG. 21 is a diagram showing degree information 231 according to the third embodiment. The degree information 231 is information input by the designer. In FIG. 21, extracted risks 228 are shown in a correspondence table between scenario ID 225 and attack ID 215. Further, in FIG. 21, degree information 231 for each risk 228 is shown by providing degree information 231 as a column item in the correspondence table. The degree information 231 includes at least one of the following: frequency 231a of encountering a situation in which scenario 216 may occur, possibility 231b of avoiding scenario 216 when the above situation is encountered, and severity of the potentially unsafe state 231c. Equipped with. Here, regarding the frequency of encounter 231a, E1 has the least frequency and E4 has the highest frequency. Further, regarding the possibility of avoidance 231b, C1 has the highest possibility and C3 has the lowest possibility. Furthermore, regarding the severity level 231c of the unsafe state, S1 is the least serious, and S3 is the most serious. In addition, in FIG. 21, degree information 231 is shown only for the extracted risk 228, but this is because the risk 228 extracted by the risk extraction device 200 is displayed for the designer once, and the extracted risk 228 is This can be achieved by prompting the designer to input degree information 231 for each risk 228 (see the flowchart in FIG. 25 for specific procedures). Here, the degree information 231 may be input in units of scenarios 216 or attack details 214 instead of in units of risks 228. For example, when the scenario 216 is input, the priority calculation unit 233 calculates the priority 234 having the same value for the risks 228 that include the same scenario 216.

図２２は、実施の形態３に係る優先度算出テーブル２３２を示す図である。優先度算出テーブル２３２は、設計者によって予め入力される。ここで、ＱＭが最も優先度が低く、Ｄが最も優先度が高い（ＱＭ、Ａ、Ｂ、Ｃ、Ｄの順番である）。優先度算出部２３３は、程度情報２３１を用いて優先度算出テーブル２３２を索引することで優先度２３４を算出する。なお、優先度算出部２３３は、優先度算出テーブル２３２を用いる代わりに、例えば予め定められた数式に対して程度情報２３１の値を代入することで優先度２３４を算出しても良い。 FIG. 22 is a diagram showing a priority calculation table 232 according to the third embodiment. The priority calculation table 232 is input in advance by the designer. Here, QM has the lowest priority and D has the highest priority (in the order of QM, A, B, C, and D). The priority calculation unit 233 calculates the priority 234 by indexing the priority calculation table 232 using the degree information 231. Note that instead of using the priority calculation table 232, the priority calculation unit 233 may calculate the priority 234 by substituting the value of the degree information 231 into a predetermined formula, for example.

Claims

an input unit that receives input of a scenario including the state of the controlled object;
a storage unit that stores in advance an attack list that is information listing details of attacks;
a first type assigning unit that receives the scenario from the input unit and assigns a scenario type to the scenario according to a keyword included in the scenario;
a second type assigning unit that assigns an attack type to the attack content according to a keyword included in the attack content;
an extraction unit that extracts a combination of the scenario type and the attack type that follows a predetermined causal relationship as a risk;
an output unit that outputs output information that is information listing the risks extracted by the extraction unit;
A risk extraction device equipped with

The type of scenario indicates either a first sign that a control that should be started cannot be started, or a second sign that a control that should not be started is started,
The type of attack indicates either one or both of a third code in which an existing detection target is not detected, or a fourth code in which a non-existent detection target is detected,
The extraction unit is configured such that the type of scenario indicates the first code and the type of attack indicates the third code, or the type of scenario indicates the second code and the type of attack indicates Determining that a combination that satisfies one of the following, indicating the fourth code, is a combination that follows the predetermined causal relationship;
The risk extraction device according to claim 1, characterized in that:

The scenario type and the attack type each indicate a sensor type,
The extraction unit determines that a combination in which the scenario type and the attack type have the same value is a combination that follows the predetermined causal relationship;
The risk extraction device according to claim 1, characterized in that:

Receiving degree information from the input unit including at least one of the frequency with which a situation in which the scenario can occur, the possibility of avoiding the scenario when the situation is encountered, and the severity of the situation; comprising a priority calculation unit that calculates the priority of the risk from the degree information,
The input unit receives input of the degree information,
The output unit receives the priority from the priority calculation unit, and outputs the priority in association with each of the risks.
The risk extraction device according to any one of claims 1 to 3, characterized in that:

Receive target system configuration information, which is information indicating the configuration of a target system, which is a system including the control target, from the input unit, and determine input/output relationships between components of the target system from among the target system configuration information. or a search unit that searches for the relationship information related to the risk among relationship information that is information indicating an operational relationship;
The input unit receives input of the target system configuration information,
The output unit receives the relationship information from the search unit, and outputs the relationship information in association with each of the risks.
The risk extraction device according to any one of claims 1 to 4, characterized in that:

A risk extraction method using a risk extraction device comprising an input section, a storage section, a first classification section, a second classification section, an extraction section, and an output section,
the input unit receives input of a scenario including a state of a controlled object;
The storage unit stores in advance an attack list that is information listing details of attacks,
the first type assigning unit assigns a scenario type to the scenario according to a keyword included in the scenario;
the second type assigning unit assigns an attack type to the attack content according to a keyword included in the attack content;
The extraction unit extracts, as a risk, a combination of the scenario type and the attack type that follows a predetermined causal relationship;
the output unit outputs output information that is information listing the extracted risks;
Risk extraction method.

Input processing that accepts input of a scenario including the state of the controlled object;
memory processing that stores in advance an attack list that is information listing the details of the attack;
a first type assignment process that assigns a scenario type to the scenario according to a keyword included in the scenario to provide first factor information;
a second type assigning process that assigns an attack type corresponding to a keyword included in the attack content to the attack content as second factor information;
an extraction process of extracting, as a risk, a combination of the first factor information and the second factor information that follows a predetermined causal relationship between the scenario type and the attack type;
an output process that outputs output information that is information listing the risks extracted by the extraction process;
A risk extraction program that allows a computer to execute