WO2022180691A1

WO2022180691A1 - Communication system, communication device, fraud determination method, and program

Info

Publication number: WO2022180691A1
Application number: PCT/JP2021/006880
Authority: WO
Inventors: 弘樹長山; 将浩白石; 知暁鷲尾; 麻美宮島
Original assignee: 日本電信電話株式会社
Priority date: 2021-02-24
Filing date: 2021-02-24
Publication date: 2022-09-01

Abstract

In a communication system having a publish-side node and a subscription-side node, when detecting an abnormality in order on the basis of the sequence number of received data, the subscription-side node transmits, to the publish-side node, an inspection request including information regarding the received data, the publish-side node determines whether or not there is an abnormality on the basis of the information regarding the received data and transmits the determination result to the subscription-side node, and the subscription-side node determines whether or not fraud has been committed on the basis of a communication monitoring result and the determination result received from the publish-side node.

Description

Communication system, communication device, fraud determination method, and program

The present invention relates to technology for detecting fraud such as falsification of data sent and received on a network.

In recent years, efforts have been made to connect devices on the information NW (network) and devices on the control NW toward the realization of smart factories. In the future, it is expected that a communication model that allows interconnection of devices and one-to-many and many-to-one communication in a lightweight and flexible manner will spread.

Publish/subscribe communication (hereinafter referred to as pub/sub communication) has been proposed as a lightweight and flexible communication model as described above. In pub/sub communication, there are a publisher that is a client on the sending side that creates and sends a message called an event, and a subscriber that is a client on the receiving side of the message.

Pub/Sub communication has three characteristics: "spatial separation", "temporal separation", and "asynchronous processing". With "spatial separation," Publishers and Subscribers do not need to know of each other's existence. "Temporal separation" allows data to be sent and received without the Publisher and Subscriber being on the network at the same time. Also, by "asynchronous processing", transmission and reception of events can be processed asynchronously with other processing of the Publisher or Subscriber.

There are two types of Pub/Sub communication models: broker type and brokerless type. A broker-type configuration is a configuration in which a function called a broker, which is responsible for spatial separation, temporal separation, and asynchronous processing properties, is placed between Pub and Sub. A brokerless configuration is a distributed configuration in which all nodes (Pub and Sub) have the ability to assume spatial separation, temporal separation, and asynchronous processing properties. By deploying a function called DDS (Data Distribution Service) in each node, the above brokerless configuration can be realized.

JP 2007-129482 A

In a communication system that performs Pub/Sub communication using DDS, there is a possibility that fraud such as data falsification through spoofing will occur.

However, in conventional communication systems that perform Pub/Sub communication using DDS, there was no mechanism for detecting fraud such as data falsification.

The present invention has been made in view of the above points, and an object thereof is to provide a technique that makes it possible to detect fraud such as data falsification in a communication system that performs Pub/Sub communication.

According to the disclosed technology, a communication system comprising a distributor node and a subscriber node,
when the subscribing side node detects an order abnormality based on the sequence number of the received data, sending an audit request including information on the received data to the distributing side node;
The delivery node determines whether there is an abnormality based on the information about the received data, and transmits the determination result to the subscriber node;
A communication system is provided in which the subscribing node determines whether or not fraud has occurred based on the result of communication monitoring and the determination result received from the distributing node.

According to the disclosed technique, a technique is provided that enables detection of fraud such as data falsification in a communication system that performs Pub/Sub communication.

FIG. 3 is a diagram for explaining Pub/Sub communication using DDS; It is a figure which shows the system configuration example in which DDS is incorporated. 1 is a diagram illustrating a configuration example of a system having multiple nodes; FIG. FIG. 2 is a diagram for explaining the outline of Example 1; 1 is a diagram illustrating a system configuration example in Example 1; FIG. 4 is a diagram showing a processing flow in Example 1. FIG. 1 is a diagram illustrating a configuration example of a system having multiple nodes; FIG. System configuration example in the second embodiment FIG. 11 is a diagram showing a configuration example of an APP-DDS functional unit in Example 2; FIG. 4 is a diagram showing a configuration example of a DDS operation function unit; FIG. 4 is a diagram showing a configuration example of a DDS operation function unit; FIG. 10 is a diagram showing a processing flow in Example 2-1; It is a figure for demonstrating the inspection processing example. It is a figure for demonstrating the inspection processing example. It is a figure for demonstrating the inspection processing example. FIG. 13 is a diagram showing a processing flow in Example 2-2; It is a figure which shows the hardware configuration example of an apparatus.

An embodiment (this embodiment) of the present invention will be described below with reference to the drawings. The embodiments described below are merely examples, and embodiments to which the present invention is applied are not limited to the following embodiments.

In the embodiments described below, an example in which the present invention is applied to a communication system that performs Pub/Sub communication using DDS will be described, but the present invention is not limited to Pub/Sub communication using DDS. It is possible.

(Pub/Subs communication using DDS)
First, DDS and Pub/Sub communication using DDS, which are the premise of the present embodiment, will be described.

In this embodiment, the above-described brokerless configuration is adopted, and the brokerless type is realized by the DDS having a function corresponding to the broker.

Here, we will explain the delivery range management in DDS. DDS adds a NW for delivery to the NW I/F owned by the node. The delivery range set by the user is operated by this delivery NW and the filters inside the DDS, enabling the appropriate data transmission/reception for applications functioning as Pub or Sub.

Specifically, based on the data bus and the delivery range set by the user, the DDS assigns a multicast address to the NW I/F that can be used within the node and prepares the delivery NW. When specifying the distribution range, it is possible to set whether to distribute by unicast using the existing IP address of the node or to use a newly assigned multicast address, making it possible to determine the physical data distribution range.

An example of the delivery range is shown in Figure 1. In the example of FIG. 1, domain A and domain B are set as the delivery range. Also, within domain A, a delivery range for topic [i] and a delivery range for topic [ro] are set. Also, the delivery range of key [II] is set within the delivery range of topic [I].

(Regarding a system configuration example in which DDS is incorporated)
A DDS is a program that functions as middleware in a node (which may also be called a computer or communication device). A processing program that is the basis for communication in DDS is prepared as a library. By using this library, a DDS program can be generated from a communication program generation data definition file that has parameters for data definitions (type, size, name, QoS, etc.) to be sent by an application (described as "APP"). can be generated. DDS generation itself is an existing technology.

FIG. 2 is a diagram showing a system configuration example in which the DDS is incorporated. FIG. 2 physically shows a configuration in which a plurality of nodes (computers) to which sensors and control valves are connected are connected to a bus-type network.

A sensor is connected to each of

nodes

1 and 2, and an APP that generates data to be published and a DDS are installed. Control valves are connected to

nodes

2 and 3, respectively, and APP and DDS for utilizing subscribed data are installed.

The example in FIG. 2 shows an example in which a Pub/Sub configuration with redundant QoS settings is realized using DDS. Specifically, the DDS of node 1 constitutes a primary Pub and a sub 1 Pub, and the DDS of node 2 constitutes a sub 2 Pub. The DDS of the node 3 constitutes the first Sub and the second Sub, and the DDS of the node 4 constitutes the third Sub.

Although the example in FIG. 2 shows an example in which the APP is written in python and the DDS is written in C++, these are just examples, and any programming language may be used. Also, when changing the Pub/Sub configuration, there are those that can be partially dynamically changed such as QoS, and those that require process restart (including program modification).

Examples 1 and 2 will be described below as examples of the technology according to the present embodiment. In addition, Example 1 and Example 2 can be implemented in combination.

(Example of system configuration as a base in Embodiment 1)
Next, an example of a communication system based on the first embodiment will be described. Note that the base communication system is the same as in the second embodiment. In the communication system based on the first embodiment, one node may belong to multiple domains. Also, multiple Pub/Sub may exist in one node. Here, Pub is an application that generates data to be published, and Sub is an application that utilizes subscribed data. The function related to Pub/Sub communication is handled by the DDS.

Also, one node may have both Pub/Sub, and one node may have Pub/Sub across multiple domains. Also, one APP may have multiple Pubs or multiple Subs. Also, each Pub and each Sub in the same APP can be identified. Also, in the communication system that is the base in the first embodiment, the communication is in plain text.

FIG. 3 shows a configuration example of a communication system that serves as a base in the first embodiment. As shown in FIG. 3, this communication system has nodes 10 to 18, L2SW (Layer 2 switches) 20 and 21, L3SW (Layer 3 switch) 30, a packet analyzer 40, and a detector 50. FIG.

In the example of FIG. 3,

nodes

10, 11, 12, 15, 16, and 17 belong to domain D1, and

nodes

12, 13, 14, 17, and 18 belong to domain D2. For example, D1 of "DDS_D1" of node 10 indicates the domain to which the node belongs.

Nodes

12 and 17 belong to both domain D1 and domain D2.

For example, in node 10, "Pub1 (APP I)" is an application that publishes data on topic [I], and functions as Pub1 (Publisher1) in Pub/Sub communication. At node 10, there are two Pubs, Pub1 (APP) and Pub2 (APP). This indicates that although there is one APP, it functions as two Pubs due to the function of DDS. The same is true for Sub, as shown at node 15 .

Also, the node 11 has both Pub and Sub as Pub3 and Sub4.

Nodes

12 and 14 have multiple APPs functioning as multiple Pubs, and

nodes

17 and 18 have multiple APPs functioning as multiple Subs.

Also, the Internet 55 is connected to the end of the L3SW 30, and each node can communicate with the Internet 400. A packet analysis device 40 is connected to each L2SW, and for example, the detection unit 50 can perform anomaly detection based on packet analysis results.

(Problem in Example 1)
For example, if an attacker exists in the node 10 and distributes tampered data by spoofing, there is a problem that the Sub receives the tampered data, leading to system malfunction.

However, in the conventional technology, there is a problem that there is no mechanism for verifying whether the DDS in the node is normal or not other than that the APP side is operating. In other words, if the APP was distributing data, the DDS would have determined that the communication was normal, and could not detect falsification of the data.

(Configuration and operation example of embodiment 1)
Embodiment 1 provides a mechanism for solving the above problems. A configuration and operation example of the first embodiment will be described with reference to FIG.

FIG. 4 shows a configuration in which a node on the Pub side and a node on the Sub side are connected by a NW. A node on the Pub side is connected with a sensor that is a source of data to be published, and a node on the Sub side is connected with a control valve that is a destination of the subscribed data.

Three Pubs are configured by the DDS function of the Pub-side node, and three Subs are configured by the DDS function of the Sub-side node.

At the Pub side node, an APP-DDS function unit 100 is provided between the APP and the DSS. In the Sub-side node, an APP-DDS functional unit 200 is provided between APP and DSS.

The APP-DDS function unit 100 in the Pub side node has a route control unit 110, a route condition recording unit 120, and a route condition arbitration unit 130. The APP-DDS functional unit 200 in the Sub-side node has a route control unit 210, a route condition recording unit 220, and a route condition arbitration unit 230. FIG. The operation of each unit will be explained in the sequence to be described later.

In Example 1, when distributing data from nodes on the Pub side, the same data (sensor values, etc.) is distributed as multiple different topics.

For example, a node on the Pub side stores and distributes the same data to topic A, topic B, and topic C. Specifically, the data (payload) of a topic has the identification information of the topic (eg topic A) and a value. Topic A, Value_1", "Topic B, Value_1", and "Topic C, Value_1".

The path control unit 210 in the Sub-side node that subscribes to the data compares the received data of the three topics to determine whether or not there is fraud, and determines which topic data is actually processed (that is, the APP pass).

In the example of using the three routes of Topic A, Topic B, and Topic C as described above, in the configuration example of FIG. Pub1 is set as the Pub for Topic B, Pub2 is set as the Pub for Topic B, and Pub3 is set as the Pub for Topic C. However, two of the three Pubs are set as dummies.

At the node on the Sub side, the routing control unit 210 sets Sub1 as the Sub for Topic A, Sub2 as the Sub for Topic B, and Sub3 as the Sub for Topic C by controlling the DDS. do. However, two of the three Subs are set as dummies.

In the configuration example of FIG. 4, Pub1 distributes topic A data, and Sub1 receives (subscribes to) topic A data. Pub2 distributes topic B data and Sub2 receives topic B data. Pub3 distributes topic C data, and Sub3 receives topic C data. A Pub-Sub pair that publishes/subscribes to the same topic may be called a "path". In the configuration example of FIG. 4, there are three paths that distribute the same data. Note that the use of three paths for the same data is an example. Three or more routes may be used for the same data.

That is, in the first embodiment, three (or more) multiple routes are prepared for distribution of the same data, and the node on the Sub side (specifically, the route control unit 210) compares the distribution data between the routes. By doing so, it is possible to detect and defend against attacks other than when the multiple routes are hijacked at the same time. For example, if at least one data among the plurality of data is different from other data, it may be determined that fraud has been committed.

As an example, an example of determination by the route control unit 210 on the Sub side when three routes corresponding to topic A, topic B, and topic C are used as multiple routes will be described. When the path control unit 210 detects that the three data values of Topic A, Topic B, and Topic C are the same, the data is determined to be normal and passed to the APP.

When the path control unit 210 detects that any two of topic A, topic B, and topic C have the same value and the remaining one is different from the other two, the two data having the same value are It judges it to be normal and passes the data to the APP. Also, it is determined that an abnormality (illegal) has occurred in one different data path.

When the path control unit 210 detects that the value of any of the data of Topic A, Topic B, and Topic C is different from the value of the other data, all of the three data are determined to be abnormal. does not pass any data to the APP. Also, it is determined that an abnormality has occurred in three routes.

As described above, by distributing the same data as, for example, three topics, if one of the three topics is tampered with, the risk of utilizing the tampered value on the Sub side is reduced. be. Also, by confirming on the Sub side that there is a difference in the values of the three subscribed topics, it is possible to detect the possibility of fraud.

(Specific configuration example of embodiment 1)
FIG. 5 shows a configuration example of a communication system according to the first embodiment. As shown in FIG. 5, each node is provided with an APP-to-DDS function for the base communication system shown in FIG. The internal configuration of each APP-DDS functional unit is as shown in FIG.

(Sequence example of embodiment 1)
Next, an operation example of the communication system according to the first embodiment will be described with reference to the sequence diagram shown in FIG. In the example of FIG. 6, the APP 150, the route control unit 110, the route condition recording unit 120, and the route condition arbitration unit 130 in the node on the Pub side are shown. APP 250, route control section 210, route condition recording section 220, and route condition arbitration section 230 in the node on the Sub side are also shown. The DDS exists in each of the node on the Pub side and the node on the Sub side, but in FIG. 6, it is shown as one DDS 270 as a function of performing Pub/Sub communication through multiple paths.

As a premise of FIG. 6, route conditions are stored in each of the route condition recording unit 120 and the route condition recording unit 220. FIG. The route condition is, for example, "use N routes from time X to time Y", "use M routes when the value of the data output from the APP is K or more", and the like. is a condition for using

In S101 and S103, the route condition arbitration unit 130 of the Pub-side node searches the route condition recording unit 120 and acquires the current route conditions as search results. Similarly, in S102 and S104, the route condition arbitration unit 230 of the Sub-side node searches the route condition recording unit 220 and acquires the current route conditions as search results.

On the Pub side and Sub side respectively, the route

condition arbitration units

130 and 230 hash the current route conditions obtained by searching (S105, S106). In S107, arbitration is performed by transmitting and receiving hashed route conditions between the route condition arbitration unit 130 and the route condition arbitration unit 230. FIG. Specifically, each of the route condition arbitration unit 130 and the route condition arbitration unit 230 compares the route condition on its own side with the route condition on the other party's side and checks whether they match. If they match, it decides to use that route condition, and registers it in the route condition recording unit 120/220 as an arbitration result (S108/S109).

If they do not match, for example, it is decided to use a predetermined route condition. For example, if it is decided to use the Pub-side route conditions, the Pub-side route condition arbitration unit 130 registers its own route conditions in the route condition recording unit 120 as the arbitration result (S108). The route condition arbitration unit 230 on the side acquires the route condition on the Pub side from the Pub side and registers it in the route condition recording unit 220 as the arbitration result (S109).

On each of the Pub side and the Sub side, the route control units 110/210 acquire the latest arbitrated route conditions from the route condition recording units 120/220 (S110 to S113). Further, the route control units 110/220 construct routes according to the route conditions. Specifically, for example, as shown in FIG. 4, when the route condition is to use three routes, the route control unit 110 controls the DDS 270 so that three routes are available. For example, add two dummy Pubs. Also, the path control unit 210 on the Sub side adds, for example, two dummy Subs so as to create three paths by controlling the DDS 270 . Note that this process is unnecessary if there are already three routes (three Pubs and three Subs).

At S114, the route control unit 110 receives data from the APP150. In S115, the route control unit 110 duplicates the data received from the APP 150 by the number of routes. In S116, the route control unit 110 notifies the DDS 270 of the duplicated data. For example, when using 3 paths, the same 3 data are posted to the DDS 270 .

In S117, the DDS 270 notifies the route control unit 210 on the Sub side of each data received through a plurality of routes. In S118, the route control unit 210 compares the data between the routes as described above, determines whether or not the data is illegal, and determines whether or not to send the data to the APP 250 and which data to send to the APP 250. . If it is determined to send certain data to APP 250, the routing control unit 210 sends the data to APP 250 in S119.

(Communication system that is the basis of the second embodiment, problems)
Next, Example 2 will be described. Example 2 can also be implemented independently and can also be implemented in combination with Example 1. FIG. FIG. 7 shows a communication system on which the second embodiment is based. As shown in FIG. 7, the communication system on which the second embodiment is based has the same configuration as the communication system on which the first embodiment is based shown in FIG.

For example, if an attacker exists on the Pub/Sub communication path and distributes tampered data through spoofing, there is a problem that the Sub receives the tampered data, leading to system malfunction.

For example, an attacker analyzes data of a certain topic on a communication channel, and transmits malicious data generated by rewriting QoS guarantee information (sequence No. related to Reliability in this embodiment). It is conceivable that the malfunction of the assurance function (in this case, Reliability QoS Policy) is pushed. Specifically, attacking sequence No. >Normal Sequence No. By creating and transmitting illegal data such as the attack sequence No. and normal sequence no. There is a possibility that an attack may be made to mislead that there was data loss during Sequence no. is a number indicating the order of data, hereinafter referred to as SN.

However, as described above, in the conventional technology, there is a problem that there is no mechanism for verifying whether the DDS in the node is normal or not other than that the APP side is operating. In other words, if the APP was distributing data, the DDS would have determined that the communication was normal, and could not detect falsification of the data.

Also, an attack with the following procedure that does not cause order anomalies is also conceivable. First, an attacker intercepts topic data distributed by multicast on the network and confirms the current latest SN of Pub. Then, based on the confirmed SN, incorrect data is inserted so as not to cause sequence anomaly.

For example, when an attacker confirms that the latest transmitted sequence number of good Pub is SN=1, he attacks by inserting (SN=2, data X) before good Pub. . In this case, no sequence abnormality occurs in the DDS on the Sub side, and the correct data (SN=2, data B) arrives at the DDS after the incorrect data X is processed without any problem.

However, the DDS on the Sub side only discards the data corresponding to the SN that has been received once, and does not cause an order abnormality, so it is impossible to detect that there has been unauthorized data insertion.

(Configuration example of embodiment 2)
The second embodiment provides a mechanism for solving the above problems. A configuration example of the second embodiment will be described with reference to FIG.

As shown in FIG. 8, in the second embodiment, each node is provided with an APP-DDS function unit 100/200 and a DDS operation function unit 300/400. Note that the Pub-side APP-DDS functional unit 100 may not be provided.

FIG. 9 shows a configuration example of the APP-DDS function unit 200 on the Sub side. As shown in FIG. 9, the APP-DDS functional unit 200 has a notification control unit 240. FIG. FIG. 10 shows a configuration example of the DDS operation function unit 300 on the Pub side. As shown in FIG. 10 , the DDS operation function unit 300 has a pub-side audit unit 310 . FIG. 11 shows a configuration example of the DDS operation function unit 400 on the Sub side. As shown in FIG. 11, the DDS operation function section 400 has a monitoring management section 410 and a Sub-side auditing section 420 . The operation of each unit will be explained in the sequence to be described later.

In the following, an example of an anomaly determination method for attacks that cause sequence anomalies will be described as Example 2-1, and an example of an anomaly determination method for attacks that will not cause sequence anomalies will be described as Example 2-2. Although Example 2-1 and Example 2-2 will be described separately below, in actual operation, both Example 2-1 and Example 2-2 are performed. However, only the operation of Example 2-1 or only the operation of Example 2-2 may be executed.

(Overview of Example 2-1)

In the embodiment 2-1, when data loss is detected based on the SN of data (packets), the DDS internal data and traffic of Pub and Sub are detected by the sequence assurance function that the DDS has as its basic function. to determine whether the data loss that occurred was an attack by a malicious Pub. In addition, data is not passed to the APP when it is determined to be an attack.

In other words, audit processing is run simultaneously on the Pub side and Sub side, and fraud is confirmed from two degrees of accuracy. If fraud is confirmed, the Sub side is protected by not passing data to the APP.

(Sequence example of Example 2-1)
Next, an operation example of the communication system according to the embodiment 2-1 will be described with reference to the sequence diagram shown in FIG. In the example of FIG. 12, the DDS 330 and the Pub-side auditing unit 310 are shown in the Pub-side node. A DDS 340, an audit management unit 410, a Sub-side audit unit 420, a notification control unit 240, and an APP 350 are shown in the node on the Sub side.

Each DDS is equipped with a queue that records the transmitted/received data and its sequence (SN), which makes it possible to determine whether or not there is a sequence abnormality.

　In FIG. 12, when the DDS 340 on the Sub side detects the occurrence of a sequence abnormality, it transmits a sequence abnormality notification to the audit management unit 410 in S201. The audit management unit 410 that has received the sequence abnormality notification transmits an audit request to each of the pub-side audit unit 310 and the sub-side audit unit 420 (S202, S203). The audit request contains information about the data received on the Sub side. The information about the received data is, for example, the SN of the latest data received by the Sub and the data.

Upon receiving the audit request, the pub-side auditing unit 310 confirms the presence of the latest SN data received from the sub-side with respect to the DDS 330 (S204), and based on the confirmation result, determines whether or not there is an abnormality (S205). ). In S207, the pub-side auditing unit 310 transmits the determination result to the sub-side audit management unit 410. FIG.

On the Sub side, on the Sub side, the Sub side auditing unit 420 performs communication monitoring based on the latest SN received in S203 to determine whether there is an abnormality (S206). Notify 410.

The audit management unit 410 that has received the determination results from the pub-side audit unit 310 and the sub-side audit unit 420 makes a final determination of the presence or absence of an abnormality (unfairness), and transmits the audit result to the notification control unit 240 in S209.

At S210, the communication control unit 240 determines whether or not to transmit data to the APP 350 based on the inspection result. When it is determined to transmit data to APP 350, the data is transmitted to APP 350 in S211.

(Specific example of audit processing in Example 2-1)
An example of inspection processing will be described with reference to FIGS. 13, 14, and 15. FIG. In the examples of FIGS. 13, 14, and 15, it is assumed that there are Pub (publisher) and Sub (subscriber) that transmit and receive data, and there is an attacker (attacker). However, in the case of FIG. 13, it is assumed that the attacker has not attacked.

Also, queues in which SNs and data are recorded (publisher queue on the pub side, subscriber queue on the sub side) are provided as functions of the DDS 330/340 on the pub side and the sub side, respectively.

As shown in the upper left of FIG. 13, the publisher queue stores data A to D of SN1 to 4, and the Pub-side DDS 330 puts a check mark on the data for which Ack or NACK has been received after transmission. Also, the DDS 340 on the Sub side records the received data and puts a checkmark in the subscriber queue.

In S301, Sub receives data A with SN=1 from Pub, and returns ACK for data A to Pub in S202. As a result, normal transmission and reception of data A is recorded in the respective queues on the Pub side and the Sub side.

After that, data B, C, and D with SN=2, 3, and 4 are transmitted from Pub, but data B and C with SN=2 and 3 do not reach Sub, and only data D with SN=4 is sent to Sub. reach. Therefore, the DDS 340 on the Sub side records only data D with SN=4 in the subscriber queue.

Since the data D with SN=4 arrived before the data B and C with SN=2 and 3 arrived, the DDS 340 on the Sub side detects that an order abnormality has occurred, and notifies the audit management unit 410 of the order Notify anomalies.

The audit management unit 410 notifies each of the pub-side audit unit 310 and the sub-side audit unit 420 of an audit request (SN=4, data D). As a result, both the Pub side and the Sub side are in a monitoring state.

　As shown in S306 of FIG. 13, ACK/NACK for each of the data with SN=2 to 4 is returned from Sub to Pub. Having received NACK, Pub retransmits data B with SN=2 and data C with SN=3 in S307 and S308.

Pub-side auditing unit 310, which is currently auditing based on SN=4, confirms that data D with SN=4 exists (recorded in the queue) on the Pub side, determines that there is no abnormality, and confirms that there is no abnormality. is notified to the audit management unit 410 on the Sub side.

On the other hand, since the Sub side receives the data B with SN=2 and the data C with SN=3, the Sub side monitoring unit 420 determines that there is no abnormality, and sends the result of the determination that there is no abnormality to the audit management unit 410 on the Sub side. to notify.

The audit management unit 410 notifies the notification control unit 240 that there is no abnormality (no fraud) as the audit result. to the APP 350.

Next, the case of FIG. 14 will be explained. In S401, Sub receives data A with SN=1 from Pub, and returns ACK for data A to Pub in S402. As a result, normal transmission and reception of data A is recorded in the respective queues on the Pub side and the Sub side.

After that, in S403, data X with SN=4, which is illegal data, is transmitted from an attacker (attacker) and reaches Sub. Therefore, the DDS 340 on the Sub side records data X with SN=4 in the subscriber queue.

Since the data X with SN=4 arrived before the data with SN=2 and 3 arrived, the DDS 340 on the Sub side detects that an order abnormality has occurred and notifies the audit management unit 410 of the order abnormality. do.

The audit management unit 410 notifies each of the pub-side audit unit 310 and the sub-side audit unit 420 of an audit request (SN=4, data X). As a result, both the Pub side and the Sub side are in a monitoring state.

　As shown in S404 of Fig. 14, ACK/NACK for each of the data with SN = 2 to 4 is returned from Sub to Pub. Since the data with SN=2 to 4 have not been transmitted in Pub, Pub ignores ACK/NACK and transmits data B with SN=2 and data C with SN=3 in S405 and S406. . Here, it is assumed that the data of SN=4 has not yet been transmitted. As a result, as shown in the lower left of FIG. 14, the transmission of each data is recorded in the queue. On the other hand, the pub-side auditing unit 310 performs abnormality determination as follows.

Here, it is assumed that when Pub receives an ACK for data with SN=4, there is no record of sending data with SN=4 in the queue on the Pub side.

In this case, the pub-side auditing unit 310, which is in the process of auditing based on SN=4, judges that there is an abnormality when it detects that there is no record in the pub-side queue for sending data with SN=4. , and notifies the inspection management unit 410 on the Sub side of the determination result of the existence of an abnormality (data of SN=4 has not been transmitted). In this case, an abnormality is detected earlier than the timing at which the data with SN=4 is stored in the DDS queue on the pub side due to the normal operation of the pub side APP. Therefore, it is not necessary to compare the data values (normal data D and incorrect data X) at SN=4 for abnormality determination.

On the Sub side, data B with N=2 and data C with SN=3 are received, so the receipt of these is recorded in the subscriber queue. The Sub-side auditing unit 420 monitoring the communication detects that data X has been received as data with SN=4 based on the subscriber queue, and notifies the Sub-side audit management unit 410 of that fact.

Based on the judgment result from the pub-side auditing unit 310 and the judgment result from the sub-side auditing unit 420, the audit management unit 410 determines that the data X with SN=4 is not data transmitted from the pub side and is abnormal. I judge. That is, it determines that an illegal act has been performed, and instructs the notification control unit 240 not to transmit the data X with SN=4 to the APP 350 . Thereby, the notification control unit 240 transmits the data B and C among the data B, C and X received by the Sub to the APP 350 .

Next, the case of FIG. 15 will be explained. In S501, Sub receives data A with SN=1 from Pub, and returns ACK for data A to Pub in S502. As a result, normal transmission and reception of data A is recorded in the respective queues on the Pub side and the Sub side.

After that, in S503, data X with SN=4, which is unauthorized data, is transmitted from an attacker (attacker) and reaches Sub. Therefore, the DDS 340 on the Sub side records data X with SN=4 in the subscriber queue.

　As shown in S504 of FIG. 15, ACK/NACK for each of the data with SN=2 to 4 is returned from Sub to Pub. Since data with SN=2 to 4 are data that have not been transmitted in Pub, Pub ignores ACK/NACK, and in S505, S506, and S507, data B with SN=2, data C with SN=3, Data D with SN=4 is transmitted. As a result, as shown in the lower left of FIG. 15, the transmission of each data is recorded in the queue. On the other hand, the pub-side auditing unit 310 performs abnormality determination as follows.

Here, it is assumed that there is a record of sending data D with SN=4 in the queue on the Pub side. Pub-side auditing unit 310, which is auditing based on SN=4 and data X, compares data X with data D with SN=4 recorded in the queue, and detects that they do not match. It determines that there is an abnormality, and notifies the inspection management unit 410 on the Sub side of the determination result that there is an abnormality (data X with SN=4 has not been transmitted).

Since the Sub side receives data B with SN = 2, data C with SN = 3, and data D with SN = 4, the receipt of these is recorded in the subscriber queue. The Sub-side auditing unit 420, which monitors communication, detects that data X and data D have been received as data with SN=4 based on the subscriber queue. The audit management unit 410 on the Sub side is notified that data X and data D have been received with SN=4.

The audit management unit 410 determines that the data X with SN=4 is abnormal based on the judgment result from the pub-side audit unit 310 and the judgment result from the sub-side audit unit 420. That is, it determines that an illegal act has been performed, and instructs the notification control unit 240 not to transmit the data X with SN=4 to the APP 350 . Thereby, the notification control unit 240 transmits the data B, C, and D among the data B, C, D, and X received by the Sub to the APP 350 .

(Example 2-2)
Next, Example 2-2 will be described. Embodiment 2-2 will explain a mechanism capable of detecting fraud even when fraudulent data is inserted so as not to cause sequence anomaly.

The system configuration in Example 2-2 is the same as in Example 2-1. The operation on the Sub side in embodiment 2-2 will be described with reference to the sequence diagram of FIG. In the example of FIG. 16, the DDS 340, the audit management unit 410, the Sub-side audit unit 420, the notification control unit 240, and the APP 350 in the Sub-side node are shown. Also, the DDS 340 is shown connected to the network.

At S601, the DDS 340 receives data with SNs. In S602, the DDS 340 causes the Sub-side audit section 420 to store the set of the received data and its SN.

　S601 and S602 are executed each time data is received, and the Sub-side auditing unit 420 stores a set of data and its SN for all received data. However, data and SN pairs received earlier than a certain time may be deleted.

In S603, the Sub-side auditing unit 420 compares the SN of the newly received data with the SN of the stored received data, and determines whether data with the same SN as the already received data has been newly received. to judge whether

When the Sub-side auditing unit 420 determines that it has received data with the same SN as the received SN (for example, SN=2), it notifies the auditing management unit 410 of this along with the SN in S604.

In S605, the audit management unit 410 requests the Sub-side audit unit 420 to audit. Specifically, it confirms whether or not the data value corresponding to the received SN and the data value of the same SN received again match, and if they do not match, it is requested to determine that there is an abnormality.

In S606, the Sub-side auditing unit 420 executes the above determination. For example, when the received data value of SN=2 is "X" and the newly received data value of SN=2 is "B", the Sub-side auditing unit 420 determines that there is an abnormality. Note that the Sub-side auditing unit 420 may perform the abnormality determination process without receiving the notification of S604 and the request of S605.

In S607, the Sub-side auditing unit 420 notifies the audit management unit 410 of the judgment result (for example, the judgment result indicating that unauthorized data has been inserted into SN=2). The notification control unit 240 is notified.

For example, when the notification control unit 240 receives from the audit management unit 410 an audit result indicating that unauthorized data has been inserted into SN=2, the notification control unit 240 detects that unauthorized data has been inserted into SN=2. can be notified to APP 350 (S609). As a result, in the APP 350, for example, the already received data X with SN=2 can be handled as incorrect data.

(Hardware configuration example)
Each node (communication device) according to the present embodiment can be realized, for example, by causing a computer to execute a program describing the processing content described in the present embodiment.

The above program can be recorded on a computer-readable recording medium (portable memory, etc.), saved, or distributed. It is also possible to provide the above program through a network such as the Internet or e-mail.

FIG. 17 is a diagram showing a hardware configuration example of the computer. The computer of FIG. 17 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are interconnected by a bus BS.

A program that implements the processing in the computer is provided by a recording medium 1001 such as a CD-ROM or memory card, for example. When the recording medium 1001 storing the program is set in the drive device 1000 , the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000 . However, the program does not necessarily need to be installed from the recording medium 1001, and may be downloaded from another computer via the network. The auxiliary storage device 1002 stores installed programs, as well as necessary files and data.

The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when a program activation instruction is received. The CPU 1004 implements functions related to nodes according to programs stored in the memory device 1003 . The interface device 1005 is used as an interface for connecting to the network. A display device 1006 displays a GUI (Graphical User Interface) or the like by a program. An input device 1007 is composed of a keyboard, a mouse, buttons, a touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the calculation result. Note that at the node Either or both of the display device 1006 and the input device 1007 may be omitted.

(Effect of Embodiment)
According to the technology according to the present embodiment, it is possible to detect fraud such as falsification of data in a communication system that performs Pub/Sub communication using DDS.

(Summary of embodiment)
<Summary of Example 1>
This specification discloses at least a communication system, a communication device, a data distribution method, and a program according to the following items.
(Section 1)
A communication system comprising a distributor node and a subscriber node,
said delivery side node transmits a plurality of data obtained by duplicating one piece of data to said subscriber node through a plurality of routes;
The subscribing node determines whether fraud has occurred by comparing the plurality of data received from the plurality of paths.
(Section 2)
The plurality of routes are three or more routes, and the subscribing side node is deemed to be fraudulent when at least one data among the plurality of data received from the plurality of routes is different from other data. The communication system according to item 1.
(Section 3)
3. The communication system according to

claim

1 or 2, wherein the subscribing node passes the data received from the plurality of paths to an application in the subscribing node when it is determined that fraud has not occurred.
(Section 4)
4. The method according to any one of claims 1 to 3, wherein route conditions are arbitrated between the distributor node and the subscriber node, and the plurality of routes are determined based on the arbitration result. Communications system.
(Section 5)
A communication device used as the distributor node in a communication system comprising a distributor node and a subscriber node,
a route condition arbitration unit that arbitrates route conditions with the subscribing node;
a route control unit that transmits a plurality of data obtained by duplicating one piece of data to the subscribing node through a plurality of routes based on the route conditions arbitrated by the route condition arbitration unit;
A communication device comprising:
(Section 6)
A communication device used as the subscriber node in a communication system comprising a distributor node and a subscriber node,
Route control for determining whether or not fraudulent activity has occurred by receiving a plurality of data obtained by duplicating one piece of data at the delivery side node from a plurality of routes and comparing the plurality of data. A communication device comprising:
(Section 7)
A data distribution method in a communication system comprising a distributor node and a subscriber node,
a step in which the delivery side node transmits a plurality of data obtained by duplicating one piece of data to the subscribing side node through a plurality of routes;
and determining, by said subscribing node, whether or not fraud has occurred by comparing the plurality of data received from said plurality of paths.
(Section 8)
A program for causing a computer to function as each unit in the communication device according to item 5 or 6.

<Summary of Example 2>
This specification discloses at least a communication system, a communication device, a fraud determination method, and a program according to the following items.
(Section 1)
A communication system comprising a distributor node and a subscriber node,
when the subscribing side node detects an order abnormality based on the sequence number of the received data, sending an audit request including information on the received data to the distributing side node;
The delivery node determines whether there is an abnormality based on the information about the received data, and transmits the determination result to the subscriber node;
The communication system, wherein the subscribing side node determines whether or not fraudulent activity has occurred, based on a communication monitoring result and the determination result received from the delivery side node.
(Section 2)
The distributing node determines that there is an abnormality when detecting that the subscribing node has received data that has not been transmitted by the distributing node based on the information about the received data. The communication system according to item 1.
(Section 3)
If the subscribing node detects that data not transmitted by the distributing node is received based on the communication monitoring result and the judgment result received from the distributing node, the subscribing node commits fraud. The communication system according to

Clause

1 or 2.
(Section 4)
wherein the subscribing side node passes the data received from the distributing side node to an application in the subscribing side node if it is determined that no fraud has been committed; Communication system as described.
(Section 5)
Each time the subscribing node receives data, it stores the received data and its sequence number, and determines that there is an abnormality when newly receiving data having the same sequence number as the sequence number of already received data. The communication system according to any one of items 1 to 4.
(Section 6)
A communication device used as the distributor node in a communication system comprising a distributor node and a subscriber node,
When the subscribing node detects a sequence abnormality based on the sequence number of the received data, the subscribing node receives an audit request including information on the received data from the subscribing node, and A communication device comprising: an auditing unit that determines the presence or absence of an abnormality based on information and transmits a determination result to the subscriber node.
(Section 7)
A communication device used as the subscriber node in a communication system comprising a distributor node and a subscriber node,
an audit management unit that transmits an audit request including information about the received data to the delivery side node when an order abnormality is detected based on the sequence number of the received data;
receiving, from the delivery side node, a determination result as to whether or not there is an abnormality based on information relating to the received data at the delivery side node, and based on the determination result and the result of communication monitoring, whether fraud has been committed; an audit department that determines whether
A communication device comprising:
(Section 8)
A fraud determination method in a communication system comprising a distributor node and a subscriber node,
a step of sending an audit request including information on the received data to the delivery node when the subscriber node detects an order abnormality based on the sequence number of the received data;
a step in which the delivery node determines whether there is an abnormality based on the information about the received data, and transmits the determination result to the subscriber node;
A fraud determination method comprising the step of determining whether or not fraud has been committed by the subscribing node based on the communication monitoring result and the determination result received from the distribution node.
(Section 9)
A program for causing a computer to function as each unit in the communication device according to item 5 or 6.

Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

10 to 18

nodes

20, 21 L2SW
30 L3 SW
40 packet analysis device 50 detection unit 55

Internet

100, 200 APP-

DDS function units

110, 210

route control units

120, 220 route

condition recording units

130, 230 route condition mediation unit 240

notification control units

300, 400 DDS operation function unit 310 Pub-side audit unit 410 Audit management unit 420 Sub-side audit unit 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 interface device 1006 display device 1007 input device 1008 output device

Claims

A communication system comprising a distributor node and a subscriber node,
when the subscribing side node detects an order abnormality based on the sequence number of the received data, sending an audit request including information on the received data to the distributing side node;
The delivery node determines whether there is an abnormality based on the information about the received data, and transmits the determination result to the subscriber node;
The communication system, wherein the subscribing side node determines whether or not fraudulent activity has occurred, based on a communication monitoring result and the determination result received from the delivery side node.
Based on the information about the received data, the distribution node determines that there is an abnormality when it detects that the subscriber node has received data that the distribution node has not transmitted. Item 1. The communication system according to item 1.
If the subscribing node detects that data not transmitted by the distributing node is received based on the communication monitoring result and the judgment result received from the distributing node, the subscribing node commits fraud. 3. The communication system according to claim 1 or 2, wherein the communication system determines that the
Each time the subscribing node receives data, it stores the received data and its sequence number, and determines that there is an abnormality when newly receiving data having the same sequence number as the sequence number of already received data. The communication system according to any one of claims 1 to 3.
A communication device used as the distributor node in a communication system comprising a distributor node and a subscriber node,
When the subscribing node detects a sequence abnormality based on the sequence number of the received data, the subscribing node receives an audit request including information on the received data from the subscribing node, and A communication device comprising: an auditing unit that determines the presence or absence of an abnormality based on information and transmits a determination result to the subscriber node.
A communication device used as the subscriber node in a communication system comprising a distributor node and a subscriber node,
an audit management unit that transmits an audit request including information about the received data to the delivery side node when an order abnormality is detected based on the sequence number of the received data;
receiving, from the delivery side node, a determination result as to whether or not there is an abnormality based on information relating to the received data at the delivery side node, and based on the determination result and the result of communication monitoring, whether fraud has been committed; an audit department that determines whether
A communication device comprising:
A fraud determination method in a communication system comprising a distributor node and a subscriber node,
a step of sending an audit request including information on the received data to the delivery node when the subscriber node detects an order abnormality based on the sequence number of the received data;
a step in which the delivery node determines whether there is an abnormality based on the information about the received data, and transmits the determination result to the subscriber node;
A fraud determination method comprising the step of determining whether or not fraud has been committed by the subscribing node based on the communication monitoring result and the determination result received from the distribution node.
A program for causing a computer to function as each unit in the communication device according to claim 5 or 6.