WO2022208856A1 - 通信システム、切替装置、切替方法、及びプログラム - Google Patents
通信システム、切替装置、切替方法、及びプログラム Download PDFInfo
- Publication number
- WO2022208856A1 WO2022208856A1 PCT/JP2021/014230 JP2021014230W WO2022208856A1 WO 2022208856 A1 WO2022208856 A1 WO 2022208856A1 JP 2021014230 W JP2021014230 W JP 2021014230W WO 2022208856 A1 WO2022208856 A1 WO 2022208856A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- application
- switching
- pub
- data
- communication system
- Prior art date
Links
- 238000004891 communication Methods 0.000 title claims abstract description 69
- 238000000034 method Methods 0.000 title claims description 28
- 238000001514 detection method Methods 0.000 claims description 26
- 230000006870 function Effects 0.000 description 24
- 238000007726 management method Methods 0.000 description 13
- 238000004458 analytical method Methods 0.000 description 8
- 238000000926 separation method Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 230000004044 response Effects 0.000 description 6
- 230000005540 biological transmission Effects 0.000 description 4
- 239000002131 composite material Substances 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000002123 temporal effect Effects 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 3
- 230000004048 modification Effects 0.000 description 2
- 230000004913 activation Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000010485 coping Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 238000003786 synthesis reaction Methods 0.000 description 1
- 230000002194 synthesizing effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
Definitions
- the present invention relates to a technique for switching Pubs that are preferentially handled on the Sub side in response to the occurrence of unauthorized data.
- Pub/Sub communication A Publish/Subscribe communication (hereinafter referred to as Pub/Sub communication) model has been proposed as a lightweight and flexible communication model as described above.
- Pub/Sub communication there are a Publisher that is a client that creates and transmits (distributes) a message called an event, and a Subscriber that is a client that receives (subscribes to) the message.
- Pub/Sub communication has three characteristics: “spatial separation”, “temporal separation”, and “asynchronous processing”. With “spatial separation,” Publishers and Subscribers do not need to know of each other's existence. “Temporal separation” allows data to be sent and received without the Publisher and Subscriber being on the network at the same time. Also, by “asynchronous processing", transmission and reception of events can be processed asynchronously with other processing of the Publisher or Subscriber.
- Pub/Sub communication models There are two types of Pub/Sub communication models: broker type and brokerless type.
- a broker-type configuration is a configuration in which a function called a broker, which is responsible for spatial separation, temporal separation, and asynchronous processing properties, is placed between Pub and Sub.
- a brokerless configuration is a distributed configuration in which all nodes (Pub and Sub) have spatial separation, temporal separation, and the ability to assume asynchronous processing properties.
- DDS Data Distribution Service
- the Pub/Sub communication model is also called a publication/subscription model.
- Pub In a communication system that performs Pub/Sub communication using DDS, it is possible to make Pubs redundant by means of the basic functions of DDS. It is possible to automatically switch whether to treat as Pub (hereinafter referred to as priority Pub).
- the present invention has been made in view of the above points, and it is an object of the present invention to provide a technique for switching Pub, which is preferentially handled on the Sub side, in response to occurrence of illegal data in a communication system that performs Pub/Sub communication. do.
- a communication system that communicates between a plurality of nodes according to a brokerless publish/subscribe model, One or more redundant applications on one or more of the nodes and serving as publishers, one of which is preferentially handled on the subscribing side is distributing unauthorized data.
- a fraudulent data generation detection unit that detects that a switching unit that switches an application preferentially handled by the subscribing side to another application different from the one application among the one or more applications when the distribution of the unauthorized data is detected;
- a technique in a communication system that performs Pub/Sub communication, a technique is provided that enables the Sub side to switch the Pub that is preferentially handled in response to the occurrence of unauthorized data.
- FIG. 3 is a diagram for explaining Pub/Sub communication using DDS; It is a figure which shows the system configuration example in which DDS is incorporated.
- 1 is a diagram illustrating a configuration example of a system having multiple nodes; FIG. It is a figure for demonstrating the outline
- FIG. 4 is a diagram for explaining configuration management; It is a figure which shows the structural example of the detection part in an Example. It is a figure which shows the structural example of the structure management part in an Example. It is a figure which shows the structural example of the coping part in an Example.
- FIG. 4 is a diagram showing a configuration example of a DDS operation function unit in the embodiment; It is a figure which shows the processing flow in an Example. It is a figure which shows the hardware configuration example of an apparatus.
- the above-described brokerless configuration is adopted, and the brokerless type is realized by the DDS having a function corresponding to the broker.
- DDS adds a NW for delivery to the NW I/F owned by the node.
- the delivery range set by the user is operated by this delivery NW and the filters inside the DDS, enabling the appropriate data transmission/reception for applications functioning as Pub or Sub.
- the DDS assigns a multicast address to the NW I/F that can be used within the node and prepares the delivery NW.
- the distribution range it is also possible to set whether to distribute by unicast using the existing IP address of the node or to use a newly assigned multicast address, making it possible to determine the physical data distribution range.
- FIG. 1 An example of the delivery range is shown in Figure 1.
- domain A and domain B are set as the delivery range.
- a delivery range for topic [i] and a delivery range for topic [ro] are set.
- the delivery range of key [II] is set within the delivery range of topic [I].
- a DDS is a program that functions as middleware in a node (which may also be called a computer, communication device, etc.).
- a processing program that is the basis for communication in DDS is prepared as a library.
- a DDS program can be generated from a communication program generation data definition file that has parameters for data definitions (type, size, name, QoS, etc.) to be sent by an application (described as "APP"). can be generated.
- APP application
- FIG. 2 is a diagram showing a system configuration example in which the DDS is incorporated.
- FIG. 2 physically shows a configuration in which a plurality of nodes (computers) to which sensors and control valves are connected are connected to a logical bus-type network.
- a sensor is connected to each of nodes 1 and 2, and an APP that generates data to be published and a DDS are installed.
- Control valves are connected to nodes 2 and 3, respectively, and APP and DDS for utilizing subscribed data are installed.
- the example in FIG. 2 shows an example in which a Pub/Sub configuration with redundant QoS settings is realized using DDS.
- the DDS of the node 1 constitutes a primary Pub and a sub 1 Pub
- the DDS of the node 2 constitutes a sub 2 Pub.
- the DDS of the node 3 constitutes the first Sub and the second Sub
- the DDS of the node 4 constitutes the third Sub.
- FIG. 2 shows an example in which the APP is written in python and the DDS is written in C++, these are just examples and may be written in any programming language. Also, when changing the Pub/Sub configuration, there are those that can be partially dynamically changed such as QoS, and those that require process restart (including program modification).
- one node may belong to multiple domains.
- multiple Pub/Sub may exist in one node.
- Pub is an application that generates data to be published
- Sub is an application that utilizes subscribed data.
- the function related to Pub/Sub communication is handled by the DDS.
- one node may have both Pub/Sub, and one node may have Pub/Sub across multiple domains.
- one APP may have multiple Pubs or multiple Subs.
- each Pub and each Sub in the same APP can be identified.
- the communication is in plaintext.
- FIG. 3 shows a configuration example of a communication system that forms the basis of this embodiment. As shown in FIG. 3, this communication system has nodes 10 to 18, L2SW (Layer 2 switches) 20 and 21, L3SW (Layer 3 switch) 30, a packet analyzer 40, and a detector 50.
- L2SW Layer 2 switches
- L3SW Layer 3 switch
- nodes 10, 11, 12, 15, 16, and 17 belong to domain D1
- nodes 12, 13, 17, and 18 belong to domain D2.
- D1 of "DDS_D1" of node 10 indicates the domain to which the node belongs.
- Nodes 12 and 17 belong to both domain D1 and domain D2.
- Pub1 (APP I) is an application that publishes data on topic [I], and functions as Pub1 (Publisher1) in Pub/Sub communication.
- Pub1 (APP) Pub1
- Pub2 (APP) Pub2
- node 11 has both Pub and Sub as Pub3 and Sub4.
- Nodes 12 and 14 have multiple APPs functioning as multiple Pubs, and nodes 17 and 18 have multiple APPs functioning as multiple Subs.
- Pub1 APP I
- Pub4 Pub4
- Pub5 Pub5
- Pub6 Pub6
- the Internet 55 is connected to the end of the L3SW 30, and each node can communicate with the Internet 55.
- a packet analysis device 40 is connected to the L2SWs 20 and 21, and the detection unit 50 can detect anomalies based on the packet analysis results.
- each Sub can switch the priority Pub to the second or third Pub if a failure occurs in the first Pub.
- DDS Basic functionality does not allow the priority Pub to switch to a secondary or a tertiary Pub.
- FIG. 4 shows an overview of this mechanism.
- the example of FIG. 4 shows how the priority Pub is switched to the third Pub when the first Pub, which is the priority Pub, is hijacked by a cyberattack and is transmitting unauthorized data. Due to this switching, data distributed from the third Pub is passed to the APP in each Sub.
- FIG. 5 shows a configuration example of a communication system according to this embodiment.
- each node is provided with a DDS operation function section, and also has a configuration management section 60 and a handling section 70, in contrast to the base communication system shown in FIG.
- the DDS operation function unit implements a function of switching the priority Pub according to an instruction from the handling unit 70 .
- FIG. 5 shows an example in which nodes 10-18 are provided with DDS operation function units 101-109, respectively. Henceforth, when the node is not distinguished, it is written as the DDS operation function unit 100 .
- the configuration management unit 60 manages the configuration information (NW configuration information) of the communication system, and the handling unit 70 executes processing for switching priority Pubs in response to detection of unauthorized data by the detection unit 50 . At this time, the handling unit 70 uses the configuration information to determine which Pub among the redundant Pubs is to be the priority Pub.
- the detection unit 50, the configuration management unit 60, and the handling unit 70 may be included in the packet analysis device 40, or may be included in a device different from the packet analysis device 40.
- FIG. In this embodiment, the packet analysis device 40 is assumed to have a detection unit 50 , a configuration management unit 60 and a handling unit 70 .
- the configuration management unit 60 must manage the configuration information of the communication system. Such configuration information may be created and managed by any method, but in this embodiment, configuration information is created and managed by combining a plurality of relationship information that can be created from communication (traffic) flowing between nodes. shall be managed.
- relationship information create three types of relationship information: "IP relationship layer”, “participant relationship layer”, and “Pub/Sub relationship layer” that represent the topology of the horizontal axis of the NW. Since the IP relationship layer and the participant relationship layer are related, and the participant relationship layer and the Pub/Sub relationship layer are related, all three layers are related after all, and by combining these three layers, the NW A "composite layer" representing the topology of the vertical axis of is obtained. Configuration information is managed by holding a plurality of generations of this synthetic layer. It should be noted that a generation refers to a division divided by, for example, a certain time division, an event division, or the like. However, it is not essential to hold multiple generations, and for example, only the latest one generation may be held.
- Fig. 6 shows an example of the IP relationship layer, the participant relationship layer, the Pub/Sub relationship layer, and the composite layer.
- the IP relationship layer is represented by a graph structure in which the IP address is the top and the IP level data transmission/reception relationship is the branch.
- the IP relationship layer if there is a branch between vertices, it indicates that there is a data transmission/reception relationship between nodes having IP addresses represented by the vertices. Note that one node may have multiple IP addresses (for example, it may have a multicast IP address in addition to a unicast IP address).
- each GUID possessed by a node is represented by one symbol (triangle or inverted triangle symbol), and each symbol represents the domain to which each GUID belongs and whether it is Pub or Sub.
- the Pub/Sub relationship layer has GUIDs possessed by nodes as vertices and relationships as to whether or not they belong to the same topic as branches, and represents the relationship of topics to which each GUID belongs.
- the participant relationship layer is also represented by a graph structure with the above symbols (triangle or inverted triangle symbols) as vertices. Although there are no branches in the graph structure representing the participant relationship layer in the example of FIG. 6, for example, vertices belonging to the same domain may be connected by branches.
- the Pub/Sub relationship layer can be created with information obtained from communication as data distribution, and the participant relationship layer can be created with information obtained from communication for DDS operation.
- the IP relationship layer can be made up of information obtained from both communications for data delivery and communications for DDS operations.
- Communication for DDS operation means communication performed when a node participates in Pub/Sub communication, communication performed when searching for other nodes, communication performed when agreeing on delivery contents, and the like.
- one vertex is associated with a 5-tuple (src/dst IP address, src/dst port number, protocol number) containing the IP address of the node.
- one symbol (triangle or inverted triangle symbol) is associated with a GUID and a port number.
- one vertex is associated with a GUID and a topic name.
- a GUID is an identifier used in DDS, and is generated from an IP address, port number, or the like. Note that one node may have multiple GUIDs (for example, when one node functions as both Pub and Sub, when one node belongs to multiple domains or multiple topics, etc.).
- a synthetic layer can be obtained as NW configuration information of a communication system that performs Pub/Sub communication. This synthetic layer is held for a plurality of generations, for example.
- one or more vertices (5 tuples including IP address) of the IP relation layer correspond to this node, and for each of these one or more vertices Associated with one or more vertices (port number and GUID) of the participant relationship layer.
- zero or more vertices (GUID and topic name) of the Pub/Sub relationship layer are associated with each of the one or more vertices of the participant relationship layer. That is, in the composite layer, for each node, a tree structure with the node at the top (the highest hierarchy is the IP address, the next hierarchy is the port number, the next hierarchy is the GUID, and the last hierarchy is the topic name). ) is obtained, which represents the vertical axis topology.
- FIG. 7 shows a configuration example of the detection unit 50.
- the detection unit 50 has an invalid data generation detection unit 510 .
- the operation of the invalid data generation detection unit 510 will be described in the sequence described later.
- FIG. 8 shows a configuration example of the configuration management unit 60.
- the configuration management unit 60 has a relationship recording unit 610 in which at least one generation of configuration information (IP relationship layer, participant relationship layer, Pub/Sub relationship layer, composite layer) is recorded. It is assumed that the configuration information is created in advance and recorded in the relationship recording unit 610 .
- FIG. 9 shows a configuration example of the handling unit 70.
- the handling unit 70 has a switching candidate selection unit 710 , a switching instruction output unit 720 , and a switching candidate selection condition recording unit 730 . The operations of these units will be described in the sequence to be described later.
- FIG. 10 shows a configuration example of the DDS operation function unit 100.
- the DDS operation function section 100 has a switching section 110 .
- the operation of the switching unit 110 will be explained in the sequence described later.
- each of the above units detects the occurrence of unauthorized data, and switches the Pub that is preferentially handled on the Sub side in response to this detection.
- the fraudulent data occurrence detection unit 510 detects the occurrence of fraudulent data in the communication system and the location of the occurrence (that is, the pub that transmitted the fraudulent data) (S101).
- the illegal data is data with illegal contents (that is, data with unintended contents). Examples of unauthorized data include data sent by a Pub hijacked by a malicious third party for the purpose of attacking the Sub, numeric data in a range that cannot be originally sent by the Pub-side APP, and data received by the Sub-side APP. data that cannot be recognized normally even if the The occurrence of such illegal data and the detection of its occurrence location are performed by existing techniques.
- the invalid data occurrence detection unit 510 notifies the switching candidate selection unit 710 of the location where the invalid data is generated (that is, the Pub that transmitted the invalid data) (S102).
- the switching candidate selection unit 710 searches for a switching condition from the switching candidate selection condition recording unit 730 based on this occurrence location, and obtains the corresponding switching condition as the search result (S103-S104).
- a switching condition for switching a pub that is transmitting illegal data to another pub in the redundant configuration is recorded.
- Such a switching condition may be recorded for each Pub, for each domain or topic, or for each other information (for example, GUID).
- the switching candidate selection unit 710 searches for a switching candidate Pub using the configuration information recorded in the relationship recording unit 610, and displays the search results (S105-S106).
- the switching candidate pub is to search for a pub that satisfies the above switching condition among pubs that distribute data of the same topic as the pub that is transmitting the incorrect data (that is, other redundant pubs). Just do it.
- the switching candidate selection unit 710 determines a switching destination Pub from among the one or more Pubs searched above (S107). This may be determined randomly from one or more Pubs searched above, or determined using some criteria (for example, a predetermined order among Pubs in a redundant configuration). You may
- the switching candidate selection unit 710 transmits to the switching instruction output unit 720 a command generation instruction for setting the switching destination Pub determined above as the priority Pub (S108).
- the switching instruction output unit 720 Upon receiving the command generation instruction, the switching instruction output unit 720 generates a command (hereinafter referred to as a switching command) for setting the switching destination pub determined in S107 as a priority pub, and transmits the command to the switching unit 110. (S109).
- the switching candidate selection unit 710 transmits the switching command to both the switching units 110 of the switching destination Pub and the Sub that receives data from the switching destination Pub.
- the content of the switching command may be different between the switching destination Pub and the Sub that receives data from the switching destination Pub.
- the switching unit 110 executes the switching command to the DDS (S110). At this time, the process is restarted as necessary. As a result, the priority pub is switched from the pub that is transmitting the illegal data to the above switching destination pub.
- the above method (1) is capable of responding quickly to detection of occurrence of illegal data, if the OWNERSHIP_STRENGTH value of the pub transmitting the illegal data is set to a higher value, There is a risk that the Sub will receive incorrect data again.
- the above methods (2) and (3) are inferior to the above method (1) in speed, there is no possibility that the Sub will receive incorrect data again after the countermeasure is taken. Therefore, which of the above methods (1) to (3) should be adopted should be appropriately determined in consideration of the speediness of handling. Alternatively, for example, after the method (1) is provisionally handled, the method (2) or (3) may be taken.
- the node having the DDS operation function unit 100 and the packet analysis device 40 having the detection unit 50, the configuration management unit 60, and the handling unit 70 according to the present embodiment are configured, for example, by a computer to perform processing described in the present embodiment. It can be realized by executing the described program.
- the above program can be recorded on a computer-readable recording medium (portable memory, etc.), saved, or distributed. It is also possible to provide the above program through a network such as the Internet or e-mail.
- FIG. 12 is a diagram showing a hardware configuration example of the computer.
- the computer of FIG. 12 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are interconnected by a bus B, respectively.
- a program that implements the processing in the computer is provided by a recording medium 1001 such as a CD-ROM or memory card, for example.
- a recording medium 1001 such as a CD-ROM or memory card
- the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000 .
- the program does not necessarily need to be installed from the recording medium 1001, and may be downloaded from another computer via the network.
- the auxiliary storage device 1002 stores installed programs, as well as necessary files and data.
- the memory device 1003 reads and stores the program from the auxiliary storage device 1002 when a program activation instruction is received.
- the CPU 1004 implements functions related to the above units according to programs stored in the memory device 1003 .
- the interface device 1005 is used as an interface for connecting to the network.
- a display device 1006 displays a GUI (Graphical User Interface) or the like by a program.
- An input device 1007 is composed of a keyboard, a mouse, buttons, a touch panel, or the like, and is used to input various operational instructions.
- the output device 1008 outputs the calculation result. Note that either or both of the display device 1006 and the input device 1007 may not be provided in the node or packet analysis device 40 .
- This specification discloses a communication system, a switching device, a switching method, and a program according to at least the following items.
- (Section 1) A communication system that communicates between multiple nodes according to a brokerless publish/subscribe model, One or more redundant applications on one or more of the nodes and serving as publishers, one of which is preferentially handled on the subscribing side is distributing unauthorized data.
- a fraudulent data generation detection unit that detects that a switching unit that switches an application preferentially handled by the subscribing side to another application different from the one application among the one or more applications when the distribution of the unauthorized data is detected;
- a communication system having (Section 2) a determination unit that determines the other application to be preferentially handled by the subscriber based on a predetermined switching condition and configuration information representing a network configuration of the communication system;
- the switching unit is 2.
- the switching condition is a condition indicating that, among the one or more applications, an application on a node different from the one application is treated preferentially by the subscriber; 3.
- a fraudulent data generation detection unit that detects that When the distribution of the unauthorized data is detected, an instruction is sent to switch the application preferentially handled by the subscribing side to another application, out of the one or more applications, which is different from the one application.
- a switching instruction unit A switching device having a (Section 5) a determination unit that determines the other application to be preferentially handled by the subscribing side based on a predetermined switching condition and configuration information representing a network configuration of the communication system configured by the plurality of nodes;
- the switching instruction unit 5 The method according to claim 4, wherein when the unauthorized data distribution is detected, an instruction is sent to switch the application preferentially handled by the subscriber to the other application determined by the determining unit. switching device.
- the switching condition is a condition indicating that, among the one or more applications, an application on a node different from the one application is treated preferentially by the subscriber; 6.
- (Section 7) A switching device connected to a plurality of nodes communicating according to a brokerless publish/subscribe model, One or more redundant applications on one or more of the nodes and serving as publishers, one of which is preferentially handled on the subscribing side is distributing unauthorized data.
- a fraudulent data occurrence detection procedure for detecting that When the distribution of the unauthorized data is detected, an instruction is sent to switch the application preferentially handled by the subscribing side to another application, out of the one or more applications, which is different from the one application.
- a switching instruction procedure; Switching method to perform (Section 8) A program that causes a computer to function as the switching device according to any one of items 4 to 6.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知部と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替える切替部と、
を有する通信システムが提供される。
まず、本実施の形態の前提となるDDS、及びDDSを用いたPub/Sub通信について説明する。
DDSは、ノード(コンピュータ、通信装置などと呼んでもよい)においてミドルウェアとして機能するプログラムである。DDSにおける通信に必要な大元となる処理プログラムはライブラリとして用意されている。アプリケーション(「APP」と記述する)が送信するデータの定義(型、サイズ、名称、QoS、など)をパラメータとして有する通信プログラム生成用データ定義ファイルから、このライブラリを利用することで、DDSのプログラムを生成することができる。DDSの生成自体は既存技術である。
次に、本実施例においてベースとなる通信システムの例について説明する。本実施例においてベースとなる通信システムでは、1つのノードは複数のドメインに所属してよい。また、1つのノードに複数のPub/Subが存在してよい。なお、ここでのPubとはPublishするデータを生成するアプリケーションであり、SubとはSubscribeしたデータを活用するアプリケーションである。Pub/Sub通信に係る機能はDDSが担う。
例えば、或るトピックに関して、第1Pub、第2Pub、第3Pubの3つで冗長化されており、第1Sub~第3Subの各Subが第1Pubを優先Pubと扱っている場合を考える。この場合、各Subには第1Pub~第3Pubの各々からデータが配信されるが、第1Pubから配信されたデータのみがSub側のAPPに渡される。
図5に、本実施例における通信システムの構成例を示す。図5に示すように、図3に示したベースとなる通信システムに対して、各ノードにDDS操作機能部が備えられ、また、構成管理部60、対処部70を有する。DDS操作機能部は対処部70からの指示に応じて優先Pubを切り替える機能を実現する。図5では、ノード10~18がそれぞれDDS操作機能部101~109を備えている例を示している。以降、ノードを区別しない場合は、DDS操作機能部100と表記する。
構成管理部60では通信システムの構成情報が管理されている必要がある。このような構成情報な任意の方法で作成及び管理されればよいが、本実施例では、ノード間を流れる通信(トラヒック)から作成できる複数の関係性情報を組み合わせることで、構成情報を作成及び管理するものとする。
本実施例では、上記の構成情報を利用して、優先Pubが不正データを送信しているような場合に、優先Pubを切り替えることができる仕組みが提供される。
次に、図11のシーケンス図を参照して、本実施例における通信システムの動作例について説明する。
本実施の形態におけるDDS操作機能部100を有するノードと、検知部50、構成管理部60及び対処部70を有するパケット分析装置40は、例えば、コンピュータに、本実施の形態で説明する処理内容を記述したプログラムを実行させることにより実現することができる。
本実施の形態に係る技術によれば、不正データの発生に応じてSub側で優先的に扱うPubを切り替えることが可能となる。
本明細書には、少なくとも下記各項の通信システム、切替装置、切替方法、及びプログラムが開示されている。
(第1項)
ブローカレス型の出版/購読型モデルにより複数のノード間で通信を行う通信システムであって、
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知部と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替える切替部と、
を有する通信システム。
(第2項)
所定の切替条件と、前記通信システムのネットワーク構成を表す構成情報とに基づいて、前記購読側で優先的に扱われる前記他のアプリケーションを決定する決定部を有し、
前記切替部は、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記決定部で決定された前記他のアプリケーションに切り替える、第1項に記載の通信システム。
(第3項)
前記切替条件は、
前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、又は、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上かつ最も配信データが少ないノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、である、第2項に記載の通信システム。
(第4項)
ブローカレス型の出版/購読型モデルにより通信を行う複数のノードと接続される切替装置であって、
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知部と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替えるための指示を送信する切替指示部と、
を有する切替装置。
(第5項)
所定の切替条件と、前記複数のノードで構成される通信システムのネットワーク構成を表す構成情報とに基づいて、前記購読側で優先的に扱われる前記他のアプリケーションを決定する決定部を有し、
前記切替指示部は、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記決定部で決定された前記他のアプリケーションに切り替えるための指示を送信する、第4項に記載の切替装置。
(第6項)
前記切替条件は、
前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、又は、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上かつ最も配信データが少ないノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、である、第5項に記載の切替装置。
(第7項)
ブローカレス型の出版/購読型モデルにより通信を行う複数のノードと接続される切替装置が、
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知手順と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替えるための指示を送信する切替指示手順と、
を実行する切替方法。
(第8項)
コンピュータを、第4項乃至第6項の何れか一項に記載の切替装置として機能させるプログラム。
20、21 L2SW
30 L3SW
40 パケット分析装置
50 検知部
55 インターネット
60 構成管理部
70 対処部
100 DDS操作機能部
110 切替部
510 不正データ発生検知部
610 関係性記録部
710 切替候補選定部
720 切替指示出力部
730 切替候補選定条件記録部
1000 ドライブ装置
1001 記録媒体
1002 補助記憶装置
1003 メモリ装置
1004 CPU
1005 インタフェース装置
1006 表示装置
1007 入力装置
1008 出力装置
Claims (8)
- ブローカレス型の出版/購読型モデルにより複数のノード間で通信を行う通信システムであって、
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知部と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替える切替部と、
を有する通信システム。 - 所定の切替条件と、前記通信システムのネットワーク構成を表す構成情報とに基づいて、前記購読側で優先的に扱われる前記他のアプリケーションを決定する決定部を有し、
前記切替部は、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記決定部で決定された前記他のアプリケーションに切り替える、請求項1に記載の通信システム。 - 前記切替条件は、
前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、又は、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上かつ最も配信データが少ないノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、である、請求項2に記載の通信システム。 - ブローカレス型の出版/購読型モデルにより通信を行う複数のノードと接続される切替装置であって、
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知部と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替えるための指示を送信する切替指示部と、
を有する切替装置。 - 所定の切替条件と、前記複数のノードで構成される通信システムのネットワーク構成を表す構成情報とに基づいて、前記購読側で優先的に扱われる前記他のアプリケーションを決定する決定部を有し、
前記切替指示部は、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記決定部で決定された前記他のアプリケーションに切り替えるための指示を送信する、請求項4に記載の切替装置。 - 前記切替条件は、
前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、又は、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なるノード上かつ最も配信データが少ないノード上のアプリケーションを、前記購読側で優先的に扱われるアプリケーションとすることを示す条件、である、請求項5に記載の切替装置。 - ブローカレス型の出版/購読型モデルにより通信を行う複数のノードと接続される切替装置が、
1以上の前記ノード上で冗長化された1以上のアプリケーションであって、出版側として機能する1以上のアプリケーションのうち、購読側で優先的に扱われる一のアプリケーションから不正なデータが配信されていることを検知する不正データ発生検知手順と、
前記不正なデータの配信が検知された場合、前記購読側で優先的に扱われるアプリケーションを、前記1以上のアプリケーションのうち、前記一のアプリケーションとは異なる他のアプリケーションに切り替えるための指示を送信する切替指示手順と、
を実行する切替方法。 - コンピュータを、請求項4乃至6の何れか一項に記載の切替装置として機能させるプログラム。
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2021/014230 WO2022208856A1 (ja) | 2021-04-01 | 2021-04-01 | 通信システム、切替装置、切替方法、及びプログラム |
US18/552,052 US20240187428A1 (en) | 2021-04-01 | 2021-04-01 | Communication system, switching apparatus, switching method, and program |
JP2023510123A JPWO2022208856A1 (ja) | 2021-04-01 | 2021-04-01 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/JP2021/014230 WO2022208856A1 (ja) | 2021-04-01 | 2021-04-01 | 通信システム、切替装置、切替方法、及びプログラム |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022208856A1 true WO2022208856A1 (ja) | 2022-10-06 |
Family
ID=83458302
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2021/014230 WO2022208856A1 (ja) | 2021-04-01 | 2021-04-01 | 通信システム、切替装置、切替方法、及びプログラム |
Country Status (3)
Country | Link |
---|---|
US (1) | US20240187428A1 (ja) |
JP (1) | JPWO2022208856A1 (ja) |
WO (1) | WO2022208856A1 (ja) |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2017196965A (ja) * | 2016-04-26 | 2017-11-02 | 三菱電機株式会社 | 自動運転制御装置および自動運転制御方法 |
WO2019208442A1 (ja) * | 2018-04-25 | 2019-10-31 | 株式会社デンソー | 車両制御装置 |
WO2021002013A1 (ja) * | 2019-07-04 | 2021-01-07 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ | 異常検知装置および異常検知方法 |
-
2021
- 2021-04-01 US US18/552,052 patent/US20240187428A1/en active Pending
- 2021-04-01 JP JP2023510123A patent/JPWO2022208856A1/ja active Pending
- 2021-04-01 WO PCT/JP2021/014230 patent/WO2022208856A1/ja active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2017196965A (ja) * | 2016-04-26 | 2017-11-02 | 三菱電機株式会社 | 自動運転制御装置および自動運転制御方法 |
WO2019208442A1 (ja) * | 2018-04-25 | 2019-10-31 | 株式会社デンソー | 車両制御装置 |
WO2021002013A1 (ja) * | 2019-07-04 | 2021-01-07 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ | 異常検知装置および異常検知方法 |
Non-Patent Citations (1)
Title |
---|
MATSUURA, MASANAO : "Data Guarantee Mechanism for Distributed Publish/Subscribe System", IEICE TECHNICAL REPORT, vol. 113, no. 424, 23 January 2014 (2014-01-23), JP , pages 49 - 54, XP009540192, ISSN: 0913-5685 * |
Also Published As
Publication number | Publication date |
---|---|
US20240187428A1 (en) | 2024-06-06 |
JPWO2022208856A1 (ja) | 2022-10-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN111865642B (zh) | 用于软件定义网络的多集群配置控制器 | |
US9705800B2 (en) | Load distribution in data networks | |
EP2030414B1 (en) | Self-managed distributed mediation networks | |
EP2835938B1 (en) | Message publishing and subscribing method and apparatus | |
US10601702B1 (en) | Flexible packet replication and filtering for multicast/broadcast | |
US20110307603A1 (en) | Broker node and event topic control method in distributed event distribution system | |
CN108063813B (zh) | 一种集群环境下密码服务网络并行化的方法与系统 | |
JP2014135721A (ja) | データセンタネットワークのトラフィックを分配するための装置および方法 | |
JP2003208365A (ja) | 適応ディスパッチャを有する仮想ネットワーク | |
US9311123B2 (en) | Distributed virtual security appliance and flow-based forwarding system using virtual machines | |
US11968080B2 (en) | Synchronizing communication channel state information for high flow availability | |
US11133947B2 (en) | Multicast routing | |
US20170244783A1 (en) | Federating geographically distributed networks of message brokers into a scalable content delivery network | |
CN104065553B (zh) | 虚拟网络迁移方法和相关设备 | |
JP2005295124A (ja) | 経路テーブル同期方法、ネットワーク機器および経路テーブル同期プログラム | |
US9218356B2 (en) | Systems and methods for accelerating networking functionality | |
CN105656786A (zh) | 一种基于快、慢表的路由器查表方法 | |
US11165750B1 (en) | Flexible services-based pipeline for firewall filter processing | |
CN114726774A (zh) | 用于云平台的服务链实现的方法、装置及基于云平台的系统 | |
CN101534255A (zh) | 一种实现特定请求定向处理的方法及装置 | |
WO2022208856A1 (ja) | 通信システム、切替装置、切替方法、及びプログラム | |
WO2022208855A1 (ja) | 通信システム、異常検知装置、異常検知方法、及びプログラム | |
WO2022208857A1 (ja) | 通信システム、検査装置、検査方法、及びプログラム | |
JPWO2007086129A1 (ja) | ネットワーク管理プログラムおよびネットワーク管理装置 | |
WO2022208854A1 (ja) | 通信システム、構成管理装置、構成管理方法、及びプログラム |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21935018 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 18552052 Country of ref document: US Ref document number: 2023510123 Country of ref document: JP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 21935018 Country of ref document: EP Kind code of ref document: A1 |