WO2024116251A1

WO2024116251A1 - Inspection system, inspection method, and inspection program

Info

Publication number: WO2024116251A1
Application number: PCT/JP2022/043826
Authority: WO
Inventors: 楊鐘本; 浩義瀧口
Original assignee: 日本電信電話株式会社
Priority date: 2022-11-28
Filing date: 2022-11-28
Publication date: 2024-06-06

Abstract

An inspection system (10) includes an equipment information transmission device (20) and an inspection processing device (30). The equipment information transmission device (20) includes a first ID assignment unit (22a) and a transmission unit (22b). The inspection processing device (30) includes a second ID assignment unit (32a), a computation unit (32b), and a display unit (32c). The first ID assignment unit (22a) assigns respective IDs to equipment to be inspected and configuration information thereof. The transmission unit (22b) encrypts and transmits the assigned IDs to the inspection processing device (30). The second ID assignment unit (32a) assigns an ID for security risk information to be used in an inspection. The computation unit (32b) finds a feature shared by the ID for the encrypted configuration information and the ID for the security risk information. The display unit (32c) displays an inspection result corresponding to an inputted equipment ID.

Description

Inspection system, inspection method, and inspection program

The present invention relates to an inspection system, an inspection method, and an inspection program.

Today, as cyber attacks targeting weaknesses in the supply chain become more prevalent and sophisticated, risk management becomes even more important when companies use IoT devices. For this reason, companies need to check the IoT devices they use for software and hardware vulnerabilities and malware infections.

Conventional technologies related to the inspection of IoT devices include a technology that lists software dependencies and components to detect vulnerabilities, bugs, and other problems at an early stage (see, for example, Non-Patent Document 1), and a technology that prepares data that serves as an indicator of malware infection and checks for its presence or absence (see, for example, Non-Patent Document 2).

However, with the above conventional technology, when sending user information to an external party and conducting an inspection remotely, there was a risk that information could be unintentionally leaked to the outside due to a security breach by an attacker or internal fraud.

In order to solve the above problems and achieve the objective, the inspection system of the present invention is an inspection system having a device information transmission device and an inspection processing device, the device information transmission device having a first ID assignment unit that assigns an ID to each of the device to be inspected and its configuration information, and a transmission unit that encrypts the assigned ID and transmits it to the inspection processing device, and the inspection processing device has a second ID assignment unit that assigns an ID to security risk information used in the inspection, a calculation unit that finds common denominators between the ID for the encrypted configuration information and the ID for the security risk information, and a display unit that displays the inspection results corresponding to the input device ID.

The present invention has the advantage that it is possible to carry out security inspections while avoiding the risk of information leaks, even when user information is sent externally and inspections are carried out remotely.

FIG. 1 is a diagram showing an overview of an inspection process including an inspection system according to an embodiment. FIG. 2 is a block diagram showing the configuration of an inspection system according to the embodiment. FIG. 3 is a diagram showing a specific example of configuration information of a device according to the embodiment. FIG. 4 is a diagram showing a specific example of security risk information according to the embodiment. FIG. 5 is a diagram showing an overview of a process of dividing a set of IDs for security risk information by a calculation unit according to the embodiment. FIG. 6 is a diagram showing a specific example of the inspection process according to the embodiment. FIG. 7 is a flowchart showing a flow of information processing by the device information transmission device in the inspection system according to the embodiment. FIG. 8 is a flowchart showing a flow of information processing by the inspection processing device in the inspection system according to the embodiment. FIG. 9 is a diagram illustrating an example of a computer that executes a test program.

Below, embodiments of the inspection system, inspection method, and inspection program according to the present application will be described in detail with reference to the drawings. Note that the inspection system, inspection method, and inspection program according to the present application are not limited to these embodiments.

[1. System configuration example]
Fig. 1 is a diagram showing an overview of an inspection process including an inspection system according to the present embodiment. In the system shown in Fig. 1, there are an inspection user who manufactures IoT devices, an inspector who inspects the devices, and an inspection result checker who is the delivery destination of the IoT devices, and the inspection system 10 is composed of a device information transmission device 20 to which the inspection user inputs information about the IoT devices and an inspection processing device 30 to which the inspector inputs security risk information.

The inspection system 10 has a device information transmission device 20 and an inspection processing device 30. The device information transmission device 20 assigns an ID to each of the input devices to be inspected and their configuration information, encrypts the assigned IDs, and transmits them to the inspection processing device 30. The inspection processing device 30 also assigns an ID to the input security risk information, and finds common denominators between the ID assigned to the security risk information and the ID for the received configuration information of the device to be inspected. Furthermore, the inspection processing device 30 displays the inspection results corresponding to the input device ID.

The device information transmission device 20 assigns an ID to each of the input devices to be inspected and their configuration information. For example, the device information transmission device 20 assigns an ID that can uniquely identify each piece of information to each of the IoT devices to be inspected and their configuration information input by the inspection user. The device information transmission device 20 then encrypts the assigned ID and transmits it to the inspection processing device 30. For example, the device information transmission device 20 encrypts the ID assigned to the configuration information of the device to be inspected and transmits it to the inspection processing device 30.

The inspection processing device 30 assigns an ID to the input security risk information. For example, the inspection processing device 30 assigns an ID that can uniquely identify each piece of security risk information, such as vulnerability information and malware information, input by an inspector.

Then, the inspection processing device 30 seeks commonalities between the ID assigned to the security risk information and the ID for the received configuration information of the device to be inspected. For example, the inspection processing device 30 seeks commonalities between the set of IDs for the encrypted configuration information and the set of IDs for the security risk information while still encrypted. Furthermore, upon input of a device ID, the inspection processing device 30 displays the corresponding inspection results. For example, upon input of a device ID by the inspection user or inspection result checker, the inspection processing device 30 displays the inspection results for the corresponding device.

2. Configuration of Inspection System 10
Next, the configuration of the inspection system 10 shown in Fig. 1 will be described with reference to Fig. 2. Fig. 2 is a diagram showing a configuration example of the inspection system according to the embodiment. As shown in Fig. 2, the inspection system 10 according to the embodiment has a device information transmission device 20 and an inspection processing device 30.

The device information transmission device 20 has a communication unit 21, a control unit 22, and a storage unit 23, and the inspection processing device 30 has a communication unit 31, a control unit 32, and a storage unit 33. The device information transmission device 20 and the inspection processing device 30 are connected to each other so that they can communicate with each other via wire or wirelessly.

The

communication units

21 and 31 are realized, for example, by a NIC (Network Interface Card) or the like. The

communication units

21 and 31 are connected to the device information transmission device 20 or the inspection processing device 30 by wired or wireless connection, and transmit and receive information between the device information transmission device 20 or the inspection processing device 30.

The storage unit 23 and the storage unit 33 are realized by a storage device such as a RAM (Random Access Memory) or a hard disk. The storage unit 23 and the storage unit 33 store data and programs necessary for various processes by the control unit 22 or the control unit 32. The storage unit 23 of the device information transmission device 20 has a device information storage unit 23a, which is closely related to the present invention.

The device information storage unit 23a stores the ID assigned to the device to be inspected and its configuration information by the first ID assignment unit 22a described below. For example, the device information storage unit 13a stores the ID assigned to the information of the IoT device to be inspected that is input from outside so that the device and its configuration information can be uniquely identified.

The storage unit 33 of the inspection processing device 30 has a received information storage unit 33a, a security risk information storage unit 33b, and an inspection result information storage unit 33c, which are closely related to the present invention. The received information storage unit 33a stores information that is transmitted by the transmission unit 22b (described below) and received by the inspection processing device 30. For example, the received information storage unit 33a stores encrypted IDs that are received by the inspection processing device 30, such as IDs assigned to devices to be inspected and IDs assigned to their configuration information.

The security risk information storage unit 33b stores information about vulnerabilities, scores indicating their severity, and information about malware, which are used in the inspection process. For example, the security risk information storage unit 33b stores information about vulnerabilities, scores indicating their severity, and information about malware, which are stored in a security risk information database owned by the inspector, by external storage.

The inspection result information storage unit 33c stores the inspection results calculated by the calculation unit 32b described below. For example, the inspection result information storage unit 33c stores the inspection results, such as the common items and the number of common items between the ID of the configuration information and the ID of the security risk information, calculated by the calculation unit 32b described below, in association with the ID of the device to be inspected.

The

control units

22 and 32 are realized by a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) or the like executing various programs stored in the storage device within each device using the RAM as a working area. The

control units

22 and 32 are also realized by integrated circuits such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

The control unit 22 of the device information transmission device 20 has a first ID assignment unit 22a and a transmission unit 22b. The first ID assignment unit 22a assigns an ID to each of the devices to be inspected and their configuration information. For example, the first ID assignment unit 22a assigns an ID that can uniquely identify a device to an externally input device to be inspected by assigning a serial number or an ID that can be physically identified to the device.

The first ID assignment unit 22a also assigns an ID that can uniquely identify each piece of information, for example, depending on the type of configuration information of the device to be inspected that is input from outside. If the first ID assignment unit 22a finds a duplicate when assigning an ID, it excludes that ID.

Now, referring to FIG. 3, the process in which the first ID assignment unit 22a assigns an ID to configuration information will be described. FIG. 3 is a diagram showing a specific example of configuration information of a device according to an embodiment. In FIG. 3, three types of configuration information of the device to be inspected are shown: "app" indicating an application, "file/hash" indicating a file hash, and "file/name" indicating a file name.

When the configuration information is "app", the first ID assignment unit 22a assigns an ID that is a hashed value of the combined value of the app name and version. In other words, "id1" in FIG. 3 is a hashed value of the combined value of the app name "A" and the version "1.0".

Next, if the configuration information is "file/hash", the first ID assignment unit 22a assigns the file hash value as is as the ID. That is, "id4" in FIG. 3 becomes the file hash value "1111aaaa". Then, if the configuration information is "file/name", the first ID assignment unit 22a assigns the hashed value of the file name as the ID. That is, "id6" in FIG. 3 becomes the hashed value of the file name "Malware.exe".

The transmission unit 22b encrypts the assigned ID and transmits it to the inspection processing device. For example, the transmission unit 22b encrypts the ID for the configuration information of the device assigned by the first ID assignment unit 22a described above, and transmits the ID for the device and the ID for the encrypted configuration information to the inspection processing device 30.

The control unit 32 of the inspection processing device 30 has a second ID assignment unit 32a, a calculation unit 32b, and a display unit 32c. The second ID assignment unit 32a assigns an ID to the security risk information used in the inspection. The second ID assignment unit 32a then notifies the calculation unit 32b, which will be described later, of the assigned ID.

For example, the second ID assignment unit 32a assigns an ID that can uniquely identify security risk information, such as information about vulnerabilities and IOC (Indicator of Compromise) information about malware, that is used in testing input from outside, and notifies the calculation unit 32b.

Now, referring to FIG. 4, the process in which the second ID assignment unit 32a assigns an ID to security risk information will be described. FIG. 4 is a diagram showing a specific example of security risk information according to an embodiment. In FIG. 4, three types of security risk information are shown: "app" indicating an application, "file/hash" indicating a file hash, and "file/name" indicating a file name.

If the risk type related to the vulnerability information is "app", the second ID assignment unit 32a assigns an ID that is a hashed value obtained by combining the app name and version. In other words, "id1" in FIG. 4 is a hashed value obtained by combining the app name "A" and the version "1.0".

Next, if the type of risk related to the malware information is "file/hash", the second ID assignment unit 32a assigns the file hash value as is as the ID. That is, "id4" in FIG. 4 becomes the file hash value "1111aaaa". Then, if the type of risk related to the malware information is "file/name", the second ID assignment unit 32a assigns the hashed value of the file name as the ID. That is, "id6" in FIG. 4 becomes the hashed value of the file name "Malware.exe".

The calculation unit 32b finds commonalities between the IDs for the encrypted configuration information and the IDs for the security risk information. For example, the calculation unit 32b finds commonalities between a set of IDs for the encrypted configuration information transmitted from the device information transmitting device 20 and stored in the received information storage unit 33a, and a set of IDs for the security risk information notified from the second ID assignment unit 32a, while still encrypted.

The calculation unit 32b may also determine the number of common terms between the ID for the encrypted configuration information and the ID for the security risk information. For example, the calculation unit 32b determines the number of common terms between a set of IDs for the encrypted configuration information and a set of IDs for the security risk information.

Furthermore, the calculation unit 32b may divide the set of IDs for the encrypted configuration information or the set of IDs for the security risk information into any number of sets, and for each of the divided sets, find common denominators between the IDs for the encrypted configuration information and the IDs for the security risk information.

For example, if the set of IDs for encrypted configuration information or the set of IDs for security risk information has an extremely large number of elements, the calculation unit 32b divides the set of IDs into an arbitrary number of sets and performs the above-mentioned common denominator calculation process for each of the divided sets.

Now, referring to FIG. 5, the process of dividing a set of IDs for device configuration information or a set of IDs for security risk information by the calculation unit 32b will be described. FIG. 5 is a diagram showing an overview of the process of dividing a set of IDs for security risk information by the calculation unit according to the embodiment.

In the example of FIG. 5, the set of IDs of the encrypted configuration information is designated as X, and the set of IDs of the security risk information is designated as Y, and the calculation unit 32b finds common terms between X and Y. Here, if the number of elements in set X or Y is extremely large, finding the common terms takes a significant amount of processing time and consumes resources. Therefore, in such cases, a division process of X or Y is performed to find the common terms efficiently in a relatively short time with minimal resource consumption.

In the example of FIG. 5, set Y has an extremely large number of types of elements, and first, the calculation unit 32b divides set Y into an arbitrary number of N sets, "Y1, Y2, ...". Then, the calculation unit 32b finds the number of common terms with set X for each of the divided subsets "Y1, Y2, ..." and extracts the subsets with the number of common terms of 1 or more. In the example of FIG. 5, set Y is divided into two sets, and both of the divided subsets "Y1" and "Y2" have the number of common terms of 1 or more.

Then, for example, the calculation unit 32b repeats the above-mentioned series of processes on the extracted subsets until the number of types of elements in the subset falls below a preset threshold. In the example of FIG. 5, the extracted subsets "Y1" and "Y2" are similarly divided into two sets, resulting in subsets "Y11", "Y12", "Y21", and "Y22", of which "Y11" and "Y22" are selected because they have 1 or more common terms, but because the number of types of elements in subsets "Y11" and "Y22" falls below a preset threshold, the calculation unit 32b ends the division process.

The calculation unit 32b may also find common denominators between the ID of the security risk information narrowed down by information related to the severity of the vulnerability and the ID of the encrypted configuration information.

For example, in order to reduce the processing time and resource consumption of the process of finding common denominators, the calculation unit 32b refers to the Common Vulnerability Scoring System (CVSS), which is a score that indicates the severity of vulnerabilities and is stored in the security risk information storage unit 33b, narrows down the IDs for the security risk information to be matched, and finds common denominators with the IDs for the encrypted configuration information.

The display unit 32c displays the test results corresponding to the input device ID. For example, for a device ID input from outside, the display unit 32c displays the test results associated with that ID stored in the test result information storage unit 33c.

3. Specific Examples of Inspection Processing
Here, the inspection process of the configuration information of the device by the inspection system 10 will be described using the example of Fig. 6. Fig. 6 is a diagram showing a specific example of the inspection process according to the embodiment. The upper part of Fig. 6 shows the configuration information of the device to be inspected and the ID assigned thereto, and the lower part of Fig. 6 shows the security risk information and the ID assigned thereto.

The calculation unit 32b finds common denominators between the set X of IDs for the encrypted configuration information and the set Y of IDs for security risk information. For example, when inspecting information related to vulnerabilities, the calculation unit 32b extracts IDs whose type of configuration information and type of risk information are "app" and finds common denominators.

In other words, in the example in Figure 6, X = {id1, id2, id3}, Y = {id1, id3}, and the common term X ∩ Y = {id1, id3}. Therefore, the inspection results reveal that the device being inspected has vulnerabilities related to "CVE-2022-XXXX" and "CVE-2022-YYYY".

Furthermore, when inspecting information related to malware infection, the calculation unit extracts IDs whose configuration information type and risk information type are "file/*" and finds common terms. That is, in the example of FIG. 6, X = {id4, id5, id6, id7}, Y = {id4, id6, id9}, and the common term X ∩ Y = {id4, id6}. Therefore, the inspection result reveals that the device being inspected is suspected of being infected with malware.

The calculation unit 32b uses, for example, a mechanism called a secret intersection calculation to find the common denominator, and the transmission unit 22b transmits the ID of the configuration information of the device to be inspected to the inspection processing device 30 in an encrypted form using the function "F(x) = (x-id1) (x-id2) ...".

Then, when the calculation unit 32b substitutes the ID for the security risk information into the above-mentioned F(x), if there is a match, the return value will be "0", making it possible to find only the common ID. On the other hand, because F(x) is encrypted, the configuration information of the mismatched parts will not be revealed.

4. An example of inspection processing by the inspection system
Next, the inspection process of the inspection system 10 will be described with reference to Fig. 7 and Fig. 8. Fig. 7 is a flowchart showing the flow of information processing by the device information transmission device in the inspection system according to the embodiment, and Fig. 8 is a flowchart showing the flow of information processing by the inspection processing device in the inspection system according to the embodiment.

First, the process of the device information transmission device 20 will be described with reference to FIG. 7. The device information transmission device 20 receives the device to be inspected and its configuration information (step S101). When the device information transmission device 20 receives the device to be inspected and its configuration information (step S101; Yes), the first ID assignment unit 22a assigns an ID to the device to be inspected and its configuration information, respectively (step S102).

On the other hand, if the device information transmission device 20 has not received the device to be inspected and its configuration information (step S101; No), the device information transmission device 20 waits until it receives the device to be inspected and its configuration information. Then, the transmission unit 22b encrypts the assigned ID and transmits it to the inspection processing device 30 (step S103).

Next, the processing of the inspection processing device 30 will be described with reference to FIG. 8. The inspection processing device 30 receives security risk information (step S201). If the inspection processing device 30 receives security risk information (step S201; Yes), the second ID assignment unit 32a assigns an ID to the security risk information (step S202).

On the other hand, if the inspection processing device 30 has not received security risk information (step S201; No), the inspection processing device 30 waits until it receives security risk information. Then, the inspection processing device 30 receives the encrypted ID from the device information transmission device 20 (step S203). If the inspection processing device 30 receives the encrypted ID from the device information transmission device 20 (step S203; Yes), the calculation unit 32b finds a common denominator between the ID for the configuration information and the ID for the security risk information (step S204).

On the other hand, if the inspection processing device 30 has not received the encrypted ID from the device information transmission device 20 (step S203; No), the inspection processing device 30 waits until it receives the encrypted ID from the device information transmission device 20. After that, the display unit 32c displays the inspection results corresponding to the input device ID (step S205).

5. Effects of the embodiment
As described above, the inspection system 10 according to this embodiment includes the equipment information transmission device 20 and the inspection processing device 30. The equipment information transmission device 20 includes a first ID assignment unit 22a that assigns an ID to each of the equipment to be inspected and its configuration information, and a transmission unit 22b that encrypts the assigned ID and transmits it to the inspection processing device 30.

The inspection processing device 30 also has a second ID assignment unit 32a that assigns an ID to the security risk information used in the inspection, a calculation unit 32b that determines the common denominator between the ID for the encrypted configuration information and the ID for the security risk information, and a display unit 32c that displays the inspection results corresponding to the input device ID.

As a result, the inspection system 10 encrypts the configuration information of the device to be inspected and transmits it to the inspection processing device 30, and the inspection is performed while still encrypted. This has the effect of making it possible to perform security inspections while avoiding the risk of information leaks, even when user information is transmitted externally and inspections are performed remotely.

The calculation unit 32b of the inspection system 10 also determines the number of common terms between the ID for the encrypted configuration information and the ID for the security risk information. As a result, by determining the number of common terms, the inspection system 10 has the effect of preventing the inspector from learning the configuration information from the ID of the common term determined by the inspection process, and enabling security inspection to be performed.

Furthermore, the calculation unit 32b of the inspection system 10 divides the set of IDs for the encrypted configuration information or the set of IDs for the security risk information into any number of sets, and for each divided set, finds common denominators between the IDs for the encrypted configuration information and the IDs for the security risk information.

As a result, the inspection system 10 has the advantage of being able to perform security inspections in a relatively short time and with minimal resource consumption in the process of finding common denominators, even when the set has a significantly large number of elements.

Furthermore, the calculation unit 32b of the inspection system 10 finds common denominators between the ID of the security risk information narrowed down by information related to the severity of the vulnerability and the ID of the encrypted configuration information.

As a result, in the process of finding common denominators, the inspection system 10 has the advantage of being able to perform security inspections in a relatively short time and with minimal resource consumption by narrowing down the IDs for the security risk information to be compared, even if the set of IDs for the security risk information has an extremely large number of elements.

[6. System configuration, etc.]
Of the processes described in the above embodiments, some of the processes described as being performed automatically can be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified. For example, the various information shown in each drawing is not limited to the illustrated information.

Furthermore, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed and integrated in any unit depending on various loads and usage conditions. Furthermore, each processing function performed by each device can be realized in whole or in part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

For example, a part or all of the memory unit 23 or memory unit 33 shown in FIG. 2 may be stored in a storage server or the like, rather than being stored in the device information transmission device 20 or the inspection processing device 30 of the inspection system 10. In this case, the device information transmission device 20 or the inspection processing device 30 obtains various information by accessing the storage server.

7. Hardware Configuration
Fig. 9 is a diagram showing an example of a hardware configuration. The device information transmission device 20 and the inspection processing device 30 included in the inspection system 10 according to the embodiment described above are realized by a computer 1000 having a configuration as shown in Fig. 9, for example.

FIG. 9 is a diagram showing an example of a computer that executes a test program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that defines each process of the device information transmission device 20 or the inspection processing device 30 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing a process similar to the functional configuration of the device information transmission device 20 or the inspection processing device 30 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Furthermore, the setting data used in the processing of the above-mentioned embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes it.

The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

REFERENCE SIGNS LIST 10 Inspection system 20 Device

information transmission device

21, 31

Communication unit

22, 32 Control unit 22a First ID assignment unit

22b Transmission unit

23, 33 Storage unit 23a Device information storage unit 32a Second ID assignment unit 32b Calculation unit 32c Display unit 33a Received information storage unit 33b Security risk information storage unit 33c Inspection result information storage unit

Claims

An inspection system having an equipment information transmission device and an inspection processing device,
The device information transmission device includes:
a first ID assignment unit that assigns an ID to each of a test target device and its configuration information;
a transmission unit that encrypts the assigned ID and transmits it to the inspection processing device;
The inspection processing device includes:
a second ID assigning unit that assigns an ID to the security risk information used in the inspection;
a calculation unit for determining a common denominator between an ID for the encrypted configuration information and an ID for the security risk information;
An inspection system comprising: a display unit that displays an inspection result corresponding to an input device ID.
The inspection system according to claim 1 , wherein the calculation unit calculates the number of common terms between an ID for the encrypted configuration information and an ID for the security risk information.
The inspection system described in claim 1, characterized in that the calculation unit divides a set of IDs for the encrypted configuration information or a set of IDs for the security risk information into any number of sets, and for each of the divided sets, finds common denominators between the IDs for the encrypted configuration information and the IDs for the security risk information.
The inspection system according to claim 1 , wherein the calculation unit finds common denominators between an ID of the security risk information narrowed down based on information about a severity of vulnerability and an ID of encrypted configuration information.
An inspection method performed in an inspection system having an equipment information transmission device and an inspection processing device,
The device information transmission device includes:
a first ID assignment step of assigning an ID to each of the devices to be inspected and their configuration information;
a transmission step of encrypting the assigned ID and transmitting it to the inspection processing device;
The inspection processing device includes:
a second ID assignment step of assigning an ID to the security risk information used in the inspection;
A calculation step of determining a common denominator between an ID for the encrypted configuration information and an ID for the security risk information;
An inspection method comprising the steps of: displaying an inspection result corresponding to an input device ID.
An inspection program for causing a computer to execute the method,
The computer as the device information transmission device includes:
a first ID assignment step of assigning an ID to each of the inspection target devices and their configuration information;
a transmission step of encrypting the assigned ID and transmitting it to the computer serving as the inspection processing device;
The computer as the inspection processing device includes:
a second ID assignment step of assigning an ID to the security risk information used for the inspection;
A calculation step of determining a common denominator between an ID for the encrypted configuration information and an ID for the security risk information;
and a display step of displaying the inspection result corresponding to the input device ID.