JP7647997B2 - POLICY CONTROL DEVICE, ZERO TRUST SYSTEM, POLICY CONTROL METHOD, AND POLICY CONTROL PROGRAM - Google Patents

Description

The present invention relates to a policy control device, a zero trust system, a policy control method, and a policy control program.

Large-scale systems such as telecom networks, large-scale enterprise networks, and IoT (Internet of Things) networks are becoming widespread. It is important for security operations to implement measures (policies) to address the risk of cyber attacks on large-scale systems from entities such as external terminals. When formulating policies, it is necessary to select appropriate policy content, such as cutting off communications, for entities at high-risk policy locations, such as those located in unfriendly foreign countries.

Below are some techniques that can be useful when formulating policies.
The Zero Trust Architecture (ZTA) described in Non-Patent Documents 1 and 2 is an architecture that verifies access from each entity and executes measures against untrusted entities as the measure location. This makes it possible to deal with cyber attacks from internal terminals by not trusting not only external terminals but also internal terminals (zero trust) as verification targets.
Non-Patent Document 3 describes i-ZTA (Intelligent ZTA), which is an extension of ZTA. i-ZTA extends ZTA for large-scale networks, and performs anomaly detection using graph neural networks and reinforcement learning to dynamically evaluate risk and reliability scores. As a result, entities with high risk or low reliability scores are automatically selected as policy locations with priority over other entities.

K. John, “Build Security Into Your Network’s DNA: The Zero Trust Network Architecture,” Forrester Research Inc, pp.1-26, 2010. S.Rose, et al., “SP800-207: Zero Trust Architecture”, NIST, 2020 K. Ramezanpour and J. Jithin, “Intelligent Zero Trust Architecture for 5G/6G Tactical Networks: Principles, Challenges, and the Role of Machine Learning.”, ArXiv abs/2105.01478, 2021.

Implementing measures is expected to reduce security risks, but at the same time, it has the side effect of increasing non-security risks, such as the risk of violating the Service Level Agreement (SLA) by blocking part of the service due to the implementation of the measures.
For example, when an entity with high performance but low reliability score is eliminated by implementing a policy, the performance of the entire system will be degraded as a side effect, and the SLA that guarantees a specified standard of TPS (Transactions Per Second) will no longer be met.

The entities can be excluded by implementing the measures exemplified below.
・Blocking communication due to false positives
・Blocking communications other than false positives
・Temporarily evacuate devices with low reliability scores

The role of security operator is often only responsible for the task of reducing security risks. Therefore, the more security risks are reduced, the better the job is done, so they are proactive in implementing measures.
On the other hand, company managers have the task of continuing to provide services to customers and earning revenue, so in addition to reducing security risks, they also need to achieve two other indicators: protecting customers by adhering to SLAs, and reducing the costs of implementing measures to increase profitability.
Conventional technologies such as those described in Non-Patent Documents 1 to 3 are aimed at security operators and aim to reduce security risks, but lack the perspective of balancing with other risks. Therefore, a tool is needed to formulate measures that reflect the overall risks involved in providing services to customers.

Therefore, the main objective of this invention is to develop measures that can reduce security risks and risks when providing services in a balanced manner.

In order to solve the above problems, the policy control device of the present invention has the following features.
The present invention includes a module verification unit that verifies observation data resulting from observing an entity that accesses an asset;
a reliability evaluation unit that calculates a reliability score for each of the entities based on a damage cost caused by a cyber attack from the entity to the asset from a verification result of the module verification unit;
The system is characterized by having a policy decision unit that decides the entity at which the policy is to be applied based on the cost incurred when the policy is applied to the entity and the damage cost reduced by applying the policy, so that the total cost of both costs is reduced.

According to the present invention, it is possible to formulate measures that can reduce security risks and risks when providing services in a balanced manner.

FIG. 1 is a configuration diagram of a zero trust system according to an embodiment of the present invention. This is a configuration diagram when the zero trust system of Figure 1 according to this embodiment is applied to a 5G network. FIG. 2 is an explanatory diagram of a policy control device according to the present embodiment. FIG. 2 is a hardware configuration diagram of a policy control device according to the present embodiment.

Below, one embodiment of the present invention is described in detail with reference to the drawings.

FIG. 1 is a configuration diagram of a zero trust system 80.
The zero trust system 80 is configured by connecting an entity 81, an enterprise resource 82, a policy control unit 83, and a policy execution unit 84 via a network.
The enterprise resource 82 corresponds to a resource and is also called an asset in Non-Patent Document 2. The enterprise resource 82 is an object to be protected, such as an in-house device that stores confidential information.
The entity 81 corresponds to an entity in Non-Patent Document 2. The entity 81 is a terminal attempting to access the enterprise resource 82, or a network to which a set of terminals attempting to access the enterprise resource 82 belongs, and is an object to be inspected by the policy control device.
The policy control device may not only inspect the entity 81 on a device basis, but also inspect the entity 81 on a network basis, such as the target network 73 in Fig. 2. If a contaminated network is found in the inspection, the policy control device may apply a measure to disconnect (disconnect and disable communication) the network from the carrier network.

For ease of understanding, the present specification will be described assuming that each device is classified as either an entity 81 or an enterprise resource 82. However, the same device may be both an entity 81 and an enterprise resource 82.
For example, device A storing secret information A1 and device B storing secret information B1 belong to the enterprise resource 82 when their secret information is accessed from outside. On the other hand, when device A obtains secret information B1 from device B, device A becomes entity 81.
In this way, in the zero trust system 80, the only truly trustworthy device is the policy control device that performs the verification, and all other devices, whether internal or external, correspond to entities 81 that are subject to inspection without trust (zero trust).

The policy control unit 83 corresponds to a PDP (policy decision point) in Non-Patent Document 2. The policy control unit 83 has an access permission unit 83A and a policy setting unit 83B.
The access permission unit 83A authenticates whether or not to permit access to each entity 81 accessed via the policy enforcement unit 84, by referring to an in-house database (not shown) or the like. The policy setting unit 83B sets the authentication result of the access permission unit 83A in the policy enforcement unit 84 as a policy (measure).

The policy enforcement unit 84 corresponds to a PEP (policy enforcement point) in Non-Patent Document 2. The policy enforcement unit 84 allows or denies access to the entity 81 according to the policy. An entity 81 that passes authentication can access the enterprise resources 82. An entity 81 that fails authentication cannot access the enterprise resources 82.

FIG. 2 is a configuration diagram of the zero trust system 80 of FIG. 1 applied to a 5G network.
The target network 73 includes enterprise resources 82. The enterprise resources 82 in Fig. 1 are embodied as a group of carrier networks including the following devices in Fig. 2:
・NEF82A: Network Exposure Function.
・PCF82B: Policy Control function.
・AMF82C: Access and Mobility management Function.
UPF 82D: User Plane Function. This UPF 82D is connected to a DN (Data Network) 82E.

The entity 81 in Fig. 1 is embodied as a UE (User Entity) such as the in-vehicle terminal 81A, the smartphone 81B, or the tablet terminal 81C in Fig. 2. The target network 73 itself may also be one entity 81.

The policy control device is one or more housings having a module verification unit 10, a reliability evaluation unit 20, a policy decision unit 30, and a scheduler unit 40. In Fig. 2, the four processing units are distributed in separate housings (four housings), but the four processing units may be accommodated in one housing.
The policy control unit 83 in FIG. 1 is embodied in FIG. 2 as a reliability evaluation unit 20 and a scheduler unit 40 in the core network 71 .
2, the policy execution unit 84 in Fig. 1 is embodied as a module verification unit 10 and a policy decision unit 30 in the access network 72. Furthermore, the policy execution unit 84 in Fig. 1 may include a gNB (next generation NodeB) 84A, which is a base station of the communication standard 5G in Fig. 2.

The module verification unit 10 has an observation data DB 12 that stores the results of observing the entity 81 (observation data 73D in FIG. 3), and a verification module 11 that verifies the entity 81 on a module-by-module basis based on the data stored in the observation data DB 12. The verification module 11 executes one or more of the verifications exemplified below.
- Verify the communication performed by the modules.
- Verify the system calls used by the module.
-Verify any tampering with the memory area that the module rewrites.

The reliability evaluation unit 20 includes a reliability calculation unit 21 and a network DB 22 .
The reliability calculation unit 21 applies a quantitative risk management method to the verification results of the module verification unit 10 to calculate a reliability score for each entity 81. This reliability score is an index based on the cost of damage caused by a cyber attack from the entity 81 to the enterprise resources 82. Note that the cyber attack is, for example, unauthorized access from the entity 81 or a denial of service attack such as a DoS (Denial of Services).
The network DB 22 stores inventory information of the target network 73 and asset information of the enterprise resources 82 .

The policy decision unit 30 has a policy control unit 31 as the policy control unit 83 in FIG.
The policy control unit 31 determines a policy based on the cost incurred when the policy is applied to the entity 81 (hereinafter referred to as "application cost") and the damage cost to be reduced by applying the policy, so that the total cost of both costs is reduced. In other words, the policy control unit 31 determines a policy by evaluating the security risk (reliability score) calculated by the reliability evaluation unit 20 and the risk when providing a service (such as the risk of not complying with the SLA) using a unified index.

The policy determined by the policy control unit 31 is at least one of the "policy content" indicating what policy to execute and the "policy location" indicating which entity 81 the policy will be executed on. When there are multiple pairs of policy content and policy location, the policy control unit 31 determines the optimal combination from among the pairs. "Optimal" here refers to the ability to reduce not only security risks (reliability scores) but also risks when providing services in a balanced manner, as described later in Figure 3.

The policy control unit 31 applies the determined policy to the target network 73 (the policy enforcement unit 84 in FIG. 1).
The policy determination unit 30 applies the policy to access from the entity 81 to the enterprise resource 82 by setting the determined policy in the policy execution unit 84. Alternatively, the policy determination unit 30 may present the determined policy to the operator on a display screen to allow the operator to understand the policy.

The scheduler unit 40 has an operation unit 41 that operates each processing unit (the module verification unit 10, the reliability evaluation unit 20, and the policy decision unit 30) of the policy control device.
In the operation phase, the operation unit 41 schedules processing by each processing unit of the policy control device according to the security risk indicated by the reliability score for each entity 81. The operation unit 41 may periodically execute the scheduling based on this operation phase, or may execute it one-off at an irregular timing.

Furthermore, the operation unit 41 may receive the reliability score evaluated by the reliability evaluation unit 20 and increase or decrease the verification load when the verification module 11 verifies the entity 81. For example, the operation unit 41 assigns fewer types of verification functions to an entity 81 having a higher reliability score in order to reduce the load of verifying the observation data 73D.
As a result, finite system resources (verification capacity) are concentrated and allocated in large quantities to the entities 81 with low reliability scores, so that valid verification with low latency is possible even in a system with a large number of entities 81. Alternatively, the operation unit 41 may perform verification processing for a specific entity 81 that requires low latency later than the other entities 81. The operation unit 41 may assign a provisional verification result (communication permission or communication blocking) to the specific entity 81 for the period of time that elapses until the verification processing for the specific entity 81 is performed.

FIG. 3 is an explanatory diagram of the policy control device.
First, each variable used in the explanation of FIG. 3 will be explained.
The entity 81 is represented by a variable e. The first entity 81 is represented by e[1], and the m-th entity 81 is represented by e[m]. The risk manifestation probability 21B is represented by the probability P(e[m]=malicious | I) that the risk of e[m] manifests. The manifestation of a risk means, for example, that an entity 81 actually attacks corporate resources 82 with a cyber attack.
The network settings 21F in the network DB 22 are information on the target network 73, and are referenced to identify the impact on the surrounding area when the risk of e[m] becomes apparent.

The assets of the enterprise resource 82 are represented by the variable a. The first asset is represented by a[1], and the nth asset is represented by a[n]. The value of the asset a[n] is represented by v(a[n]). The intrusion probability 21D is represented by the probability p(a[i]) that the asset a[i] is intruded into.
The resource information 21G in the network DB 22 is represented by a set of asset values V={v(a[1]), v(a[2]), . . . v(a[n])}.

Each component in FIG. 3 will now be described.
The observation data DB 12 registers observation data 73D obtained by observing an entity 81 (e[m]) in the target network 73. Therefore, each entity 81 has a log output function, and the module verification unit 10 (observation data DB 12) has a log collection function for collecting logs from the log output function.
The verification module 11 receives the observation data 73D, performs verification, and outputs the verification result to the reliability calculation unit 21 as an event I={i[1], i[2], . . . i[k]}.

The reliability calculation unit 21 includes a risk manifestation evaluation unit 21A, an influence extent evaluation unit 21C, and a reliability calculation unit 21E.
The risk manifestation evaluation unit 21A calculates a risk manifestation probability 21B (P(e[m])) from the event I output by the verification module 11 using algorithms such as machine learning and mathematical statistical processing.
The influence range evaluation unit 21C evaluates the intrusion probability 21D (p(a[i])) based on the event I output by the verification module 11, the risk manifestation probability 21B, and the network setting 21F. Then, the influence range evaluation unit 21C calculates the impact cost Im(e[m]) of the manifested risk on the surroundings from the intrusion probability 21D and the asset value v(a[i]).
The reliability calculation unit 21E calculates a reliability score 21H based on the intrusion probability 21D and the resource information 21G. The reliability score 21H is a scale for uniformly measuring risks such as security risk and SLA violation risk. In the following, the cost expectation value Ex(e[m])=P(e[m]×Im(e[m]) is used as an example of the reliability score 21H, but it is not limited to the cost expectation value and any unified scale may be used.

In addition, the policy control device can also improve the accuracy of the reliability score 21H by calculating the impact on the surroundings when the risk of e[m] becomes apparent.
Therefore, the impact range evaluation unit 21C first lists all assets A={a[1], a[2], ...a[n]} that can be reached from e[m] when the risk of e[m] becomes apparent, and the value set V of the assets={v(a[1]),v(a[2]), ...v(a[n])}. Based on the listed assets, the impact range evaluation unit 21C calculates the impact cost Im(e[m]) of the risk of e[m] on the surroundings as shown in (Formula 1). Here, the intrusion probability 21D (p(a[i])) is the sum of the products of the impact cost and the probability of intrusion (the sum of the expected cost values of all assets).

Next, the reliability calculation unit 21E calculates the final damage cost expectation value Ex(e[m]) according to (Equation 2).
Ex(e[m])=P(e[m]=malicious | I)×Im(e[m]) … (Formula 2)
The process in which the reliability calculation unit 21 outputs the reliability score 21H has been described above with reference to FIG.

The policy determination unit 30 determines an optimal policy based on the reliability score 21H. The process of the policy determination unit 30 will be described below.
First, we will explain each variable used to explain the policy. A policy is indicated by the variable m. The first entity 81 is m[1], and the l-th entity 81 is m[l]. In other words, we define a policy set M={m[1], m[2], ...m[l]}.

Each policy is defined as m[i] = {e(m[i]), d(m[i]), c(m[i]), i(m[i])}.
e(m[i]) denotes the entity 81 at which the policy m[i] is applied.
d(m[i]) indicates the content of the policy m[i]. Examples of the content of the policy include filtering communications, shutting down the entity 81, and the like, to stop an attack.
・c(m[i]) indicates the application cost when the measure m[i] is applied. This application cost includes the cost of executing the measure content, the cost when executing the measure content affects the SLA, etc.
i(m[i]) is the measure effect, which is the expected value of the damage cost that indicates the security risk mitigated by implementing m[i]. This measure effect i(m[i]) is related to the impact cost Im(e[m]) calculated by (Equation 1).
Then, the set of measures M(e[m]) to be taken for e[m] is expressed as (Equation 3).

The measure decision unit 30 evaluates both the measure effect and the applied cost obtained by executing each measure m[i] using (Formula 3), and decides on a measure that will reduce the overall cost as much as possible. In other words, when measure content d(m[i]) is executed, even if a risk is actualized, the damage cost is reduced, so the cost expectation value Ex(e[m]) can be reduced by the measure effect i(m[i]). On the other hand, the execution of measure content d(m[i]) increases the cost by the applied cost c(m[i]).
The policy decision unit 30 uses (Equation 3) to offset the reduction in damage cost and the increase in applied cost, thereby selecting whether to execute each policy m[i] so that the overall cost is lower when the policy is executed or not executed.
This enables total risk management, including security and SLAs, to be achieved.

FIG. 4 is a hardware configuration diagram of the policy control device.
The policy control device is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I/F 905 , an input/output I/F 906 , and a media I/F 907 .
The communication I/F 905 is connected to an external communication device 915. The input/output I/F 906 is connected to an input/output device 916. The media I/F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (also called an application or its abbreviation, "app") loaded into the RAM 902. This program can be distributed via a communication line, or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

Furthermore, the policy control device may have a container board 920 having a H/W (Hardware) accelerator 921 and a TPM (Trusted Platform Module) 922. Furthermore, each component of the container board 920 may be implemented in the CPU 901.
It is desirable to apply the functions of the H/W accelerator 921 and the container runtime of the container base 920 to each processing unit of the policy control device (the module verification unit 10, the reliability evaluation unit 20, the policy decision unit 30, and the scheduler unit 40). This enables each processing unit to be accelerated and scaled out, and makes it possible to support a system equipped with a large-scale entity 81.
It is desirable to apply the TPM 922 to each processing unit of the policy control device (the module verification unit 10, the reliability evaluation unit 20, the policy decision unit 30, and the scheduler unit 40). This makes it possible to prevent tampering with the reliability score 21H and the policy m[i].

[effect]
The policy control device of the present invention includes a module verification unit 10 that verifies observation data 73D obtained by observing an entity 81 that accesses a corporate resource 82;
a reliability evaluation unit that calculates a reliability score for each entity based on a damage cost of a cyber attack from the entity to a corporate resource from a verification result of the module verification unit;
The system is characterized by having a policy decision unit 30 that decides the entity 81 at which the policy is to be applied, based on the application cost incurred when the policy is applied to the entity 81 and the damage cost to be reduced by applying the policy, so that the total cost of both costs is reduced.

In this way, the policy control device evaluates the security risk of allowing an entity 81 with a low reliability score to remain, and the service risk of not meeting the SLA when the policy is applied to the entity 81, using the same measure of cost. This makes it possible to develop measures that can reduce security risks and risks when providing services in a balanced manner.

In the present invention, the policy control device further includes a scheduler unit 40.
The scheduler unit 40 is characterized in that the higher the reliability score of an entity 81 , the lower the load imposed on the module verification unit 10 when verifying the observation data 73D observed from that entity 81 .

This reduces the total verification load by focusing on verifying only a small portion of entities 81 that pose a high security risk. Therefore, even in a large-scale system in which the number of target entities 81 is in the hundreds of millions, the verification load imposed on the policy control device is reduced, making it possible to comply with the strict delay requirements imposed on the policy control device.

The present invention is characterized in that the scheduler unit 40 performs verification processing of a specified entity 81 later than other entities 81, and assigns a provisional verification result to the specified entity 81 for the elapsed period until the verification processing of the specified entity 81 is performed.

This allows the verification process for entity 81 to be temporarily skipped, instead being assigned a provisional verification result, thereby complying with the strict delay requirements imposed on the policy control device.

The present invention is characterized in that the processing of the module verification unit 10, the processing of the reliability evaluation unit 20, and the processing of the strategy determination unit 30 are performed by the TPM 922.

This prevents tampering with the calculation contents by each processing unit of the policy control device.

10 Module verification unit 11 Verification module 12 Observation data DB
20 Reliability evaluation unit 21 Reliability calculation unit 21A Risk manifestation evaluation unit 21B Risk manifestation probability 21C Impact range evaluation unit 21D Intrusion probability 21E Reliability calculation unit 21F Network setting 21G Resource information 21H Reliability score 22 Network DB
30 Policy decision unit 31 Policy control unit 40 Scheduler unit 41 Operation unit 71 Core network 72 Access network 73 Target network 73D Observation data 80 Zero trust system 81 Entity 82 Enterprise resource (asset)
83 Policy control unit 83A Access permission unit 83B Policy setting unit 84 Policy execution unit

Claims (7)

a module verification unit that verifies observed data resulting from observing an entity that accesses the asset;
a reliability evaluation unit that calculates a reliability score for each of the entities based on a damage cost caused by a cyber attack from the entity to the asset from a verification result of the module verification unit;
A policy control device comprising: a policy decision unit that decides the entity to which the policy is to be applied, based on the cost incurred when the policy is applied to the entity and the damage cost reduced by the application of the policy, so that the total cost of both costs is reduced. The policy control device further includes a scheduler unit,
2 . The policy control device according to claim 1 , wherein the scheduler unit reduces a load imposed on the module verification unit for verifying the observed data observed from an entity having a higher reliability score. The policy control device according to claim 2, characterized in that the scheduler unit performs verification processing of a specified entity later than the other entities, and assigns a provisional verification result to the specified entity for the elapsed period until the verification processing of the specified entity is performed. 2. The policy control device according to claim 1, wherein the processing of the module verification unit, the processing of the reliability evaluation unit, and the processing of the policy determination unit are executed by a TPM (Trusted Platform Module). The policy control device according to any one of claims 1 to 4, the entity, and the asset are connected via a network,
A zero trust system, characterized in that a policy determined by the policy determination unit is applied to access from the entity to the asset. The policy control device includes a module verification unit, a reliability evaluation unit, and a policy decision unit.
The module verification unit verifies observation data resulting from observing an entity accessing an asset;
The reliability evaluation unit calculates a reliability score for each of the entities based on a damage cost caused by a cyber attack from the entity to the asset from the verification result of the module verification unit,
The policy control method is characterized in that the policy decision unit decides the entity at which the policy is to be applied based on the cost incurred when the policy is applied to the entity and the damage cost reduced by applying the policy, so that the total cost of both costs is reduced. A policy control program for causing a computer to function as a policy control device as described in any one of claims 1 to 4.

Images