JP7701851B2 - Security management system and security management method - Google Patents

Description

The present invention relates to a security management system and a security management method.

Patent Document 1 describes a security countermeasure plan design device configured for the purpose of shortening the operation time from detection of an attack to response to the attack occurring on a network and realizing an early response to the attack. The security countermeasure plan design device stores countermeasure templates for creating security countermeasure plans for attacks, receives attack detection information from an attack detection device that detects the attack, extracts a countermeasure template corresponding to the detection information, creates security countermeasure plans based on the extracted countermeasure template and the detection information, refers to device information and topology information within the network, extracts implementable security countermeasure plans from the created security countermeasure plans, and outputs the extracted security countermeasure plans.

JP 2018-137500 A

As described above, the security countermeasure design device described in Patent Document 1 refers to device information and topology information within the network, and presents to the administrator feasible security countermeasures from among the security countermeasures created based on countermeasure templates and detection information.

However, the final decision on whether or not to implement the proposed security measures must be made by the administrator, taking into account the impact on business operations, which places a heavy burden on the administrator. On the other hand, for security measures where the impact on business operations is tolerable, it is preferable from a security perspective to implement them promptly.

The present invention has been made in light of this background, and aims to provide a security management system and a security management method that can quickly take necessary measures against security breaches while reducing the burden on the administrator who manages security.

One of the present inventions for achieving the above-mentioned object is an information processing system (security management system) that performs security management of a monitored system that includes a plurality of business devices connected to communicate with each other, the system being configured using an information processing device having a processor and a memory, and storing information indicating the communication paths used for communication between the business devices and business communication importance, which is information indicating the importance of each of the communication paths, monitoring communications performed in the monitored system, and upon detecting unauthorized communication performed in the monitored system, identifying the communication path used for the unauthorized communication, identifying the extent of the impact that the unauthorized communication will have on the monitored system based on the identified communication path, generating a countermeasure plan for the unauthorized communication based on the identified impact range, identifying the communication paths that may be affected if the countermeasure plan is implemented, calculating an impact value, which is an index of the degree of impact that the countermeasure plan will have on the business performed by the monitored system , based on the business communication importance of the identified communication path, and determining whether or not to automatically implement the countermeasure plan based on the impact value.

Other problems and solutions disclosed in this application will be made clear in the detailed description of the invention and the drawings.

The present invention makes it possible to quickly take necessary measures against security breaches while reducing the burden on security management administrators.

FIG. 1 is a diagram illustrating a schematic configuration of a security management system. 1 is an example of an information processing device constituting a security management system. FIG. 2 is a block diagram illustrating main functions of the communication monitoring device. FIG. 2 is a block diagram illustrating main functions of the countermeasure support device. FIG. 2 is a block diagram illustrating main functions of the countermeasure execution device. 13 is an example of a business device information table. 13 is an example of a white communication table. 13 is an example of a business information table. 13 is an example of a control information table. 13 is a flowchart illustrating an unauthorized communication monitoring process. 13 is a flowchart illustrating a business impact value calculation process. 13 is an example of a countermeasure implementation possibility designation screen.

Below, an embodiment of the present invention will be described with reference to the drawings as appropriate. The following description and drawings are examples for explaining the present invention, and some omissions and simplifications have been made as appropriate for clarity of explanation. The present invention can also be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

In the following explanation, the same or similar components may be designated with the same reference numerals, and duplicate explanations may be omitted. Also, in the following explanation, the letter "S" placed before a reference numeral indicates a processing step.

In the following explanation, various types of information may be explained using expressions such as "tables", but the various types of information may be expressed in other data structures. Furthermore, to indicate independence from the data structure, an "XX table" may be referred to as "XX information". Furthermore, when explaining identification information, expressions such as "identification information", "identifier", "name", "ID", and "number" are used, but these are interchangeable.

Figure 1 shows a schematic configuration of an information processing system (hereinafter referred to as "security management system 1") described as one embodiment. As shown in the figure, the security management system 1 includes a monitored system 5, a communication monitoring device 20, a countermeasure execution device 30, an administrator device 40, and a countermeasure support device 100. Note that the monitored system 5 does not necessarily have to be a component of the security management system 1. The communication monitoring device 20, the countermeasure execution device 30, the administrator device 40, and the countermeasure support device 100 are all configured using information processing devices (computers).

The security management system 1 has a function of generating necessary security countermeasures (hereinafter referred to as "countermeasures") for unauthorized communications (hereinafter referred to as "unauthorized communications") detected in the monitored system 5 while taking into consideration the impact on the business performed by the monitored system 5, and automatically implementing the countermeasures if the impact on the business is tolerable. The security management system 1 can reduce the burden on the person monitoring the monitored system 5 (hereinafter referred to as "administrator 2") while maintaining the continuity of business.

The monitored system 5 is a so-called industrial network system. The type of the monitored system 5 is not necessarily limited, and may be, for example, a factory IoT system (Internet of Things: IoT), a smart factory, or a social infrastructure system (railway transportation system, power receiving and transforming system, water supply and sewerage system, road system, communication and broadcasting system, etc.).

The example monitored system 5 includes one or more controllers 61, one or more actuators 71, one or more sensors 72, and a control server 50. In the following, these devices are collectively referred to as "business devices." The business devices function as information processing devices capable of two-way communication via a communication network.

The monitored system 5 includes an information system network 51 and a control system network 52, which are communication networks that communicatively connect the components of the system. If the monitored system 5 is, for example, a factory IoT system, the information system network 51 is, for example, a control network, and the control system network 52 is, for example, a field network.

The information system network 51 and the control system network 52 are wired or wireless communication networks, such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, various public wireless communication networks, dedicated lines, etc. All of these communication networks are appropriately provided with a certain level of security management, such as the use of encrypted communication or a VPN (Virtual Private Network), or the installation of a firewall or a DMZ (DeMilitarized Zone).

As shown in the figure, one or more controllers 61 and a control server 50 are connected to the information system network 51. In addition, each of the controllers 61, one or more actuators 71, and one or more sensors 72 are communicatively connected to the control system network 52.

The control server 50 and the controllers 61 are connected to each other via an information network 51 in a state where two-way communication is possible. The control server 50 monitors and controls the operating states of the controllers 61, the actuators 71, and the sensors 72 via the information network 51. The control server 50 transmits control instructions to the controllers 61 via the information network 51, for example. The control server 50 receives information (such as sensor measurement values) sent from the controllers 61 via the information network 51, and monitors the states of the controllers 61 based on the received information. The control server 50 functions as, for example, an EWS (Engineering WorkStation), and performs, for example, change/update (upgrade) the logic of a control program (firmware) executed in the controllers 61.

The controller 61 is connected to the actuator 71 and the sensor 72 in a state where two-way communication is possible via the control system network 52. The controller 61 is, for example, a programmable logic controller (PLC), and performs, for example, control of the rotation speed and operation settings of the motor constituting the actuator 71, collection of information output by the sensor 72, and the like via the control system network 52 in accordance with instructions sent from the control server 50 via the information system network 51.

The actuator 71 causes a valve, a motor, an electric motor, etc. to function in accordance with a set value that is set based on, for example, a command from the controller 61. The sensor 72 measures physical quantities such as temperature, flow rate, pressure, etc., and transmits the measured values to the controller 61 via the control system network 52.

The communication monitoring device 20 acquires communications (packets, communication messages) flowing through the information network 51 via the mirror port 41, and monitors communications in the information network 51 (detecting unauthorized communications, etc.) by analyzing the acquired information. The communication monitoring device 20 acquires the contents of communications (packets, communication messages) flowing through the control network 52 via the mirror port 42, and monitors communications in the control network 52 (detecting unauthorized communications, etc.) by analyzing the acquired contents.

As shown in the figure, the communication monitoring device 20, the countermeasure execution device 30, the administrator device 40, and the countermeasure support device 100 are all connected to each actuator 71 and each sensor 72 via the countermeasure network 43 in a state where two-way communication is possible.

The countermeasure execution device 30 is communicatively connected to the monitored system 5 and the countermeasure support device 100 via the countermeasure network 43. The countermeasure network 43 is a wired or wireless communication network, such as a LAN, a WAN, the Internet, various public wireless communication networks, or a dedicated line.

The countermeasure execution device 30 has processing authority (control authority) for each business device of the monitored system 5. The countermeasure execution device 30 receives countermeasure commands sent from the countermeasure support device 100 via the countermeasure network 43. The countermeasure execution device 30 converts the received countermeasure commands, for example, into control commands or control logic programs that the countermeasure execution device 30 can execute or process, and transmits the converted control commands or control logic programs (hereinafter referred to as "control commands") to the business device to which the countermeasure plan is to be applied (hereinafter referred to as "countermeasure work device"), thereby causing the countermeasure work device to execute processing corresponding to the countermeasure plan (implementation of security countermeasures).

The countermeasure support device 100 uses information about the unauthorized communication received from the communication monitoring device 20 (hereinafter referred to as "detection information") to analyze the business affected by the unauthorized communication, and generates a countermeasure plan based on the analysis results. It also calculates the impact of the countermeasure on the business (hereinafter referred to as "business impact value"), and determines whether the countermeasure plan can be automatically implemented based on the calculated business impact value. If the countermeasure support device 100 determines that the countermeasure plan can be automatically implemented, it generates a countermeasure command based on the countermeasure plan, and transmits the generated countermeasure command to the countermeasure execution device 30.

The administrator device 40 presents the countermeasure plan received from the countermeasure support device 100 to the administrator 2 and accepts input of an indication of intent as to whether or not to implement the countermeasure plan. When the administrator device 40 accepts the input of the indication of intent, it transmits the accepted content to the countermeasure support device 100.

FIG. 2 is a block diagram showing an example of the hardware configuration of an information processing device used to realize the components of the security management system 1 (communication monitoring device 20, countermeasure execution device 30, administrator device 40, control server 50, and countermeasure support device 100). The illustrated information processing device 10 includes a processor 11, a main storage device 12 (memory), an auxiliary storage device 13, an input device 14, an output device 15, and a communication device 16. Examples of the information processing device 10 include a personal computer, an office computer, a server device, a smartphone, a tablet, and a general-purpose machine (mainframe). Note that two or more of the components of the security management system 1 (communication monitoring device 20, countermeasure execution device 30, administrator device 40, control server 50, and countermeasure support device 100) may be realized by a common information processing device 10.

The information processing device 10 may be realized, in whole or in part, by using virtual information processing resources provided by using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a cloud system via an API (Application Programming Interface) or the like. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a cloud system via an API (Application Programming Interface), or the like. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a service provider such as SaaS (Software as a Service), PaaS (Platform as a Service), IaaS (Infrastructure
This may be realized by using the Service as a Service, etc.

The processor 11 may be, for example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), or the like.
It is composed of a gate array, an application specific integrated circuit (ASIC), an artificial intelligence (AI) chip, etc.

The main memory device 12 is a device for storing programs and data, and is, for example, a ROM (Read Only Memory).
The main memory 12 may include a random access memory (RAM), a random access memory (RAM), a non-volatile memory (NVRAM), etc. The functions realized in each component of the security management system 1 are realized by the processor 11 reading and executing a program stored in the main memory 12.

The auxiliary storage device 13 is, for example, a solid state drive (SSD), a hard disk drive, an optical storage device (CD (Compact Disc), DVD (Digital Versatile Disc), etc.), a storage system, an IC card, a read/write device for a non-transient recording medium such as an SD card or an optical recording medium, a non-transient storage area of a cloud server, etc. Programs and data can be read into the auxiliary storage device 13 from other information processing devices equipped with non-transient recording media or non-transient storage devices via a recording medium reader or a communication device 16. The programs and data stored (stored) in the auxiliary storage device 13 are read into the main storage device 12 as needed.

The input device 14 is an interface that accepts information input from the outside, and is, for example, a keyboard, a mouse, a touch panel, a card reader, a pen-input tablet, a voice input device, etc.

The output device 15 is an interface that outputs various information such as the progress of processing and the results of processing to the outside. The output device 15 is, for example, a display device (liquid crystal monitor, LCD (Liquid Crystal Display), graphic card, etc.) that visualizes the various information described above, a device that converts the various information described above into audio (audio output device (speaker, etc.)), or a device that converts the various information described above into text (printer, etc.). Note that, for example, the information processing device 10 may be configured to input and output information to and from other devices via the communication device 16.

The input device 14 and the output device 15 constitute a user interface that realizes interactive processing with the user (accepting information, providing information, etc.).

The communication device 16 is a device that realizes communication with other devices. The communication device 16 is a wired or wireless communication interface that realizes communication with other devices that conform to a specific communication protocol via various communication networks (information system network 51, control system network 52, response system network 53), and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, etc.

The information processing device 10 includes, for example, an operating system, a file system, a database,
A DataBase Management System (MS) (relational database, NoSQL, etc.), a Key-Value Store (KVS), etc. may also be introduced.

Figure 3 is a block diagram showing the main functions of the communication monitoring device 20. When the communication monitoring device 20 detects unauthorized communication by monitoring the communication in the monitored system 5, it generates detection information of the detected unauthorized communication and transmits the generated detection information to the countermeasure support device 100.

As shown in the figure, the communication monitoring device 20 has the functions of a memory unit 210, a system information management unit 220, an unauthorized communication detection unit 230, and a detection information transmission unit 240.

Of the above functions, the memory unit 210 stores a business device information table 211, a white communication table 212, a business information table 213, and a control information table 214.

In the business device information table 211, information about business devices (hereinafter referred to as "business device information") is managed. The contents of the business device information table 211 are set by, for example, the administrator 2.

Figure 6 shows an example of the business device information table 211. As shown in the figure, the business device information table 211 is composed of one or more records having the following fields: business device ID 611, device name 612, IP address 613, alternative device ID 614, autonomous control possible/not possible 615, and business ID 616. One record in the business device information table 211 corresponds to one business device.

Of the above items, the business device ID 611 stores the business device ID, which is an identifier for the business device. The device name 612 stores the name of the business device (device name).

IP address 613 stores the network address (in this example, the IP address) of the business device in the control network 52. Note that, although the illustrated business device information table 211 only shows the IP address in the control network 52, the business device information table 211 also manages the IP addresses of the communication networks to which each of the business devices is connected.

The alternative device ID 614 stores the business device ID (hereinafter referred to as the "alternative device ID") of another device (hereinafter referred to as the "alternative device") that can substitute (act as a proxy) for the business device. Note that if the business device's business cannot be substituted by another device or if no alternative device is available, "none" is stored in the alternative device ID 614.

In autonomous control possible or not 615, information indicating whether the business device is capable of autonomous operation (autonomous control possible) is stored. In this example, if autonomous operation is possible, "yes" is stored in autonomous control possible or not 615, and if autonomous operation is not possible, "no" is stored in autonomous control possible or not 615. Note that "if autonomous control is possible" also includes cases where business can be continued safely, although there will be effects such as a decrease in business efficiency.

The business ID 616 stores an identifier of the business performed by the business device (hereinafter referred to as the "business ID"). Note that "none" is stored in the business ID 616 of the business device with the business device ID 611 of "D03" in the illustrated business device information table 211, which indicates that the business device has been prepared as an alternative device and is currently in a standby state (not performing any business). Note that when the alternative device subsequently starts operating as an alternative, the business ID of the business performed by the original business device that took over the alternative device is stored in the business ID 616 of the record.

Returning to FIG. 3, the white communication table 212 manages information indicating the correspondence between the node that is the source of information and the node that is the destination of information (hereinafter referred to as the "communication path") for regular communication (communication between business devices when performing business) carried out in the business of the monitored system 5. The above communication path is identified (specified) by a combination of the protocol, IP address, and port used in the communication. The white communication table 212 manages information indicating the importance of each of the above communication paths (hereinafter referred to as the "business communication importance"). The contents of the white communication table 212 are set, for example, by the administrator 2.

Figure 7 shows an example of the white communication table 212. As shown in the figure, the illustrated white communication table 212 is composed of one or more records having each of the following items: communication path ID 711, communication protocol 712, source address 713, destination address 714, source port 715, destination port 716, and business communication importance 717. One record in the white communication table 212 corresponds to one of the communication paths that are performed via the information system network 51 or the control system network 52.

In the communication path ID 711, an identifier of the communication path (hereinafter referred to as the "communication path ID") is stored. In the communication protocol 712, information indicating the communication protocol used in the communication path is stored.

The source address 713 stores the network address (in this example, an IP address) of the source node of the communication path. The destination address 714 stores the network address (in this example, an IP address) of the destination node of the communication path.

The source port 715 stores the port number of the source node of the communication path. The destination port 716 stores the port number of the destination node of the communication path. For communication paths that do not specify a source port or destination port (communication paths with an arbitrary port number), "*" is stored in the source port 715 or destination port 716.

In the business communication importance level 717, information indicating the business communication importance level is stored. In this embodiment, the business communication importance level takes a value ranging from "0" to "1" ("1" being the most important and "0" being the least important). For example, if the interruption of the communication path will result in the stop of the business using the communication path, "1" is stored in the business communication importance level 717. Also, for example, if the communication path is for maintenance or is a communication path used by one of the redundantly configured sensors 72, "0" is stored in the business communication importance level 717. The business communication importance level 717 is set in advance by the administrator 2.

Returning to FIG. 3, the business information table 213 manages information related to the business operations performed in the monitored system 5 (hereinafter referred to as "business information"). For example, the business information table 213 manages information such as the operating period of each business operation, the priority of each business operation, the communications performed in each business operation, and whether or not degraded operation is possible for each business operation.

Figure 8 shows an example of the business information table 213. As shown in the figure, the business information table 213 is composed of one or more records having the following items: business ID 811, business name 812, operating period 813, business priority 814, usage path 815, and degraded operation availability 816. One record in the business information table 213 corresponds to one of the business operations performed by the monitored system 5.

The task ID of the task is stored in the task ID 811. The task name 812 stores the name of the task (hereinafter, referred to as the "task name").

Operating period 813 stores information indicating the period during which the business is performed.

In the task priority 814, information indicating the priority of the task (hereinafter referred to as the "task priority"). In this example, the smaller the task priority value, the higher the priority.

The communication path ID of the communication path used when executing the task is stored in the usage path 815.

In the degraded operation availability 816, information indicating whether the relevant task can be operated in a degraded state is stored. If degraded operation is possible, "yes" is stored in the degraded operation availability 816, and if degraded operation is not possible, "no" is stored in the degraded operation availability 816.

Returning to FIG. 3, the control information table 214 manages information related to the control performed between business devices using the communication path (control protocol, control command, control parameters, communication cycle, impact value, etc., hereafter referred to as "control information").

Figure 9 shows an example of the control information table 214. As shown in the figure, the control information table 214 is composed of one or more records having each of the following items: communication path ID 911, control protocol 912, control command 913, control parameter 914, communication cycle 915, and impact degree 916. One record in the control information table 214 corresponds to one communication path.

The communication path ID of the communication path in question is stored in communication path ID 911.

Control protocol 912 stores information indicating the control protocol used when controlling the business device via the communication path.

Control command 913 stores information indicating the control command used when controlling the business device via the communication path.

Control parameters 914 stores information indicating the control parameters used when controlling the business device via the communication path.

In the communication cycle 915, information indicating the communication cycle (which may be the average communication cycle) of the communication when the business device is controlled via the communication path is stored. If the communication is not periodic, "*" is stored in the communication cycle 915.

In the impact level 916, a value (hereinafter referred to as "impact level") indicating the magnitude of the impact on business continuity and safety when an abnormality occurs in the communication path (when control commands are no longer transmitted or increase sharply, when an incorrect control parameter is set, etc.) is stored. The contents of the impact level 916 are used, for example, as a basis for setting the business communication importance level 717. In this example, for example, one of "high", "medium", or "low" is set in the impact level 916. For example, when the impact on business is large, such as when business is stopped for several days or there is a possibility that human life is threatened, "high" is stored in the impact level 916. Also, for example, when the impact is minor or limited, "low" is stored in the impact level 916.

Returning to Figure 3, among the functions shown in the figure, the system information management unit 220 manages a business device information table 211, a white communication table 212, a business information table 213, and a control information table 214 (hereinafter, these pieces of information are collectively referred to as "system information").

The unauthorized communication detection unit 230 acquires the contents of the communication (packets, communication messages) flowing through the information network 51 and the control network 52 of the monitored system 5 via the mirror port 41 and the mirror port 42. The unauthorized communication detection unit 230 analyzes the acquired communication contents and acquires, for example, packet header information (such as the IP addresses of the data source device and the data destination device, the communication protocol, and the port number), and information on the control commands and parameters included in the packet payload (hereinafter referred to as "communication information"). The unauthorized communication detection unit 230 also generates information based on the acquired communication information (such as the change in the number of communications per unit time and the number of control commands per unit time; hereinafter referred to as "statistical information"). The unauthorized communication detection unit 230 determines whether unauthorized communication is occurring in the monitored system 5, for example, by comparing the communication information and statistical information (hereinafter referred to as "analysis information") with the information of each table stored in the storage unit 210.

The detection information transmission unit 240 generates detection information when the unauthorized communication detection unit 230 determines that unauthorized communication is occurring in the monitored system 5, and transmits the generated detection information to the response support device 100 via the response system network 43.

Figure 4 is a block diagram illustrating the main functions of the countermeasure support device 100. When the countermeasure support device 100 receives detection information from the communication monitoring device 20, it identifies business that may be affected by the unauthorized communication of the detection information, and generates a countermeasure against the unauthorized communication. The countermeasure support device 100 also calculates a business impact value, which is an index showing the impact on the business if the generated countermeasure is implemented, and determines whether or not to automatically implement the generated countermeasure based on the calculated business impact value.

As shown in the figure, the countermeasure support device 100 has the functions of a memory unit 110, a system information management unit 120, a detection information receiving unit 130, a countermeasure plan generating unit 140, an automatic implementation feasibility determining unit 150, a countermeasure command transmitting unit 160, and a countermeasure information transmitting unit 170.

Of the above functions, the storage unit 110 stores a business device information table 211, a white communication table 212, and a business information table 213. This information is similar to the system information (business device information table 211, white communication table 212, and business information table 213) shown in FIG. 3, so a description thereof will be omitted. The countermeasure support device 100 refers to this information when generating countermeasure plans and calculating the business impact value for the generated countermeasure plans.

The system information management unit 120 manages the business device information table 211, the white communication table 212, and the business information table 213. Note that system information may be shared and managed between the communication monitoring device 20 and the response support device 100.

The detection information receiving unit 130 receives the detection information sent from the communication monitoring device 20.

The countermeasure plan generating unit 140 identifies a business that may be affected by the unauthorized communication of the detection information based on the detection information, and generates one or more countermeasure plans for the unauthorized communication. Specifically, the countermeasure plan generating unit 140 identifies a business device related to the unauthorized communication and a business that may be affected by the unauthorized communication based on the detection information and the system information (business device information table 211, white communication table 212, and business information table 213) stored in the storage unit 110. In addition, the countermeasure plan generating unit 140 calculates a business impact value when the generated countermeasure plan is implemented. When some countermeasure is currently being implemented for a certain business, the countermeasure plan generating unit 140 calculates a business impact value by adding an impact value when the newly generated countermeasure plan is implemented to the total impact value of all the countermeasures being implemented. The details of the calculation method of the business impact value will be described later. Furthermore, the countermeasure plan generation unit 140 may assign a recommendation rank to each generated countermeasure plan taking into consideration the operating status of the business equipment and the implementation status of the business, present each countermeasure plan and its respective recommended rank to the administrator 2, and allow the administrator 2 to select the recommended rank he or she wishes to implement via a user interface.

The automatic implementation feasibility determination unit 150 determines whether the countermeasure plan can be implemented automatically by comparing the business impact value of the countermeasure plan with a preset threshold value. If it is determined that the countermeasure plan can be implemented automatically, the automatic implementation feasibility determination unit 150 sends a countermeasure command to the countermeasure execution device 30. On the other hand, if it is determined that the countermeasure plan cannot be implemented automatically, the automatic implementation feasibility determination unit 150 generates countermeasure information that includes the contents of the countermeasure plan, information indicating the business that will be affected by implementing the countermeasure plan, the business impact value of the countermeasure plan, etc., transmits the generated countermeasure information to the administrator device 40, and accepts an indication of intent as to whether or not to implement the countermeasure plan.

The countermeasure command transmission unit 160 transmits a countermeasure command to the countermeasure execution device 30 when implementing a countermeasure plan.

The countermeasure information transmission unit 170 transmits countermeasure information to the administrator device 40 if the countermeasure is not to be automatically implemented.

Figure 5 is a block diagram explaining the main functions of the countermeasure execution device 30. The countermeasure execution device 30 receives a countermeasure command from the countermeasure support device 100, and transmits a control command and control logic (a control sequence of the controller 61 that is realized by executing a specified process or calculation) to the countermeasure work device based on the received countermeasure command.

As shown in the figure, the countermeasure execution device 30 has the functions of a memory unit 310, a countermeasure information receiving unit 320, a control logic configuration unit 330, and a control command transmitting unit 340.

Of the above functions, the memory unit 310 stores a control logic table 311 that manages information regarding the control commands and control logic corresponding to each of the business devices of the monitored system 5.

The handling information receiving unit 320 receives handling commands sent from the handling support device 100 via the communication device 16, and inputs the received handling commands to the control logic configuration unit 330.

The control logic configuration unit 330 obtains from the control logic table 311 the control command or control logic to be sent to the response operation device that corresponds to the response command input from the response information receiving unit 320, and inputs the obtained control command or control logic to the control command transmitting unit 340 as a response command.

The control command transmission unit 340 transmits the countermeasure command input from the control logic configuration unit 330 to the countermeasure work device, and causes the countermeasure work device to execute processing for the countermeasure. The control command transmission unit 340 may receive information indicating the results of the above processing from the countermeasure work device, and transfer the received information to the countermeasure support device 100. This allows the countermeasure support device 100 to grasp the implementation status of the countermeasure in the countermeasure work device. In this case, the countermeasure support device 100 may transmit information indicating the grasped implementation status to the administrator device 40, and the administrator device 40 may receive the above information and present the contents to the administrator 2. This allows the administrator 2 to efficiently grasp the implementation status of the countermeasure plan.

Next, we will explain the processing performed in the security management system 1.

Figure 10 is a sequence diagram explaining the process (hereinafter referred to as "unauthorized communication monitoring process S1000") performed by the security management system 1 when monitoring unauthorized communication in the monitored system 5. The unauthorized communication monitoring process S1000 will be explained below with reference to the same figure.

The communication monitoring device 20 acquires packets flowing through the information network 51 via mirror port 41 and the control network 52 via mirror port 42, and monitors in real time whether unauthorized communication is occurring in the monitored system 5 (S1010: NO). When the communication monitoring device 20 detects unauthorized communication (S1010: YES), it transmits detection information of the unauthorized communication to the countermeasure support device 100.

Unauthorized communication refers to, for example, communication on a communication path present in the white communication table 212, whose contents do not conform to the contents of the control information table 214. Examples of such communications that do not conform include the following:

(1) Communication using a control protocol other than the control protocol stored in the control protocol 912 of the control information table 214 (communication deviating from the available control protocols)
(2) Communication using a control command other than the control command stored in the control command 913 of the control information table 214 (communication deviating from the available control commands)
(3) Communication using control parameters other than those stored in the control parameters 914 of the control information table 214 (communication deviating from the available control parameters)
(4) A communication whose communication cycle significantly deviates from the communication cycle stored in the communication cycle 915 of the control information table 214 (a communication performed with a communication cycle that exceeds a preset allowable range)

In this embodiment, any communication that occurs via a communication path that does not exist in the white communication table 212 is blocked by other security mechanisms, such as routing settings, a firewall, or security software.

The detection information includes, for example, the communication path ID of the communication path of the unauthorized communication, and information indicating the specific details of the unauthorized communication (the deviating control protocol, the deviating control command, the deviating control parameters, and the deviating communication cycle).

When the countermeasure support device 100 receives detection information from the communication monitoring device 20, it executes a process for calculating a business impact value (hereinafter referred to as "business impact value calculation process S1011"), generates countermeasures against unauthorized communication in the received detection information, and calculates a business impact value when the countermeasures are implemented. Details of the business impact value calculation process S1011 will be described later.

Next, the countermeasure support device 100 judges whether or not to automatically implement the generated countermeasure (S1012). Specifically, the countermeasure support device 100 judges to automatically implement the countermeasure if the business impact value calculated in the business impact value calculation process S1011 is less than a preset threshold (business impact value<threshold) (S1012: YES), and judges not to automatically implement the countermeasure if the business impact value calculated in the business impact value calculation process S1011 is equal to or greater than a preset threshold (business impact value≧threshold) (S1012: NO ).

When it is determined that automatic implementation is to be performed (S1012: YES), the countermeasure support device 100 generates a countermeasure command corresponding to the countermeasure plan and transmits the generated countermeasure command to the countermeasure execution device 30 (S1017). When the countermeasure execution device 30 receives a countermeasure command from the countermeasure support device 100, it generates a control command and transmits the generated control command to the countermeasure work device (S1018). When the countermeasure work device receives the control command, it executes control according to the control command (S1019).

On the other hand, if it is determined that automatic implementation is not to be performed (S1012: NO), the countermeasure support device 100 generates countermeasure information and transmits the generated countermeasure information to the administrator device 40. Upon receiving the countermeasure information, the administrator device 40 presents the contents of the received countermeasure information to the administrator 2 and accepts input of an indication of intent as to whether or not to implement the countermeasure (S1013). The administrator 2 checks the contents of the presented countermeasure information and inputs the result of the judgment as to whether or not to implement the countermeasure to the administrator device 40 (S1014). The administrator device 40 transmits the input contents (hereinafter referred to as the "judgment result") to the countermeasure support device 100 (S1015).

12 shows an example of a screen (hereinafter referred to as "countermeasure implementation suitability designation screen 1200") that the countermeasure support device 100 displays when accepting an indication of intent from the administrator 2 as to whether or not to implement the countermeasures in S1013 (S1013). In the illustrated countermeasure implementation suitability designation screen 1200, two countermeasures are presented, and the administrator 2 is prompted to operate the buttons indicated by the reference numerals 1211 and 1212 ("Implement" and "Not Implement") to accept an indication of intent as to whether or not to implement each countermeasure from the administrator 2. Note that the countermeasure implementation suitability designation screen 1200 may display, together with the countermeasures, the name of the business that will be affected by implementing the countermeasures and the magnitude of the impact on the business (business impact value). By displaying this information, the administrator 2 can be supported in selecting a countermeasure and deciding whether to implement it.

Returning to FIG. 10, when the countermeasure support device 100 receives a judgment result from the administrator device 40, it judges whether or not to implement the countermeasure plan based on the content of the received judgment result (S1016). If it is judged that the countermeasure plan is to be implemented, the countermeasure support device 100 generates a countermeasure command corresponding to the countermeasure plan and transmits the generated countermeasure command to the countermeasure execution device 30 (S1017). As described above, when the countermeasure execution device 30 receives a countermeasure command, it generates a control command and transmits the generated control command to the business device (S1018). Furthermore, when the business device receives the control command, it executes control according to the control command (S1019).

Figure 11 is a flowchart explaining the details of the business impact value calculation process S1011 in Figure 10. Below, the business impact value calculation process S1011 will be explained with reference to this figure.

First, the response support device 100 receives detection information from the communication monitoring device 20 (S1111).

Then, the response support device 100 identifies the extent of the impact of the unauthorized communication described in the received detection information on the monitored system 5 (business devices that may be affected by the unauthorized communication) (S1112). Specifically, first, the response support device 100 identifies the communication path of the unauthorized communication by comparing information on the communication path of the unauthorized communication included in the detection information (source address, destination address, source port, destination port) with the white communication table 212. Next, the response support device 100 identifies the business that uses the identified communication path from the business information table 213. Next, the response support device 100 identifies the business device that performs the identified business by comparing the identified business with the business device information table 211.

Next, the response support device 100 generates one or more actionable countermeasures for the business device identified in S1112 (S1113). For example, the response support device 100 refers to the business device information table 211 and determines whether or not the identified business device has an alternative device. If the identified business device has an alternative device, the response support device 100 generates a countermeasure of "having the alternative device take over the business performed by the identified business device." Also, for example, the response support device 100 refers to the business device information table 211 and determines whether or not the identified business device is capable of autonomous control. If the identified business device is capable of autonomous control, the response support device 100 generates a countermeasure of "switching the identified business device to autonomous control and disconnecting the business device from the communication path currently in use." For example, the response support device 100 refers to the business device information table 211 and determines whether or not the identified business device is capable of autonomous control. If the identified business device is capable of autonomous control, the response support device 100 generates a countermeasure of "switching the identified business device to autonomous control and disconnecting the business device from the communication path currently in use."
The countermeasure support device 100 may generate a countermeasure plan according to the content of the unauthorized communication. In addition, for example, the countermeasure support device 100 may accumulate and manage information including a history of past unauthorized communications and a history of countermeasures taken against the unauthorized communications, and generate a countermeasure plan based on the information (for example, by using a machine learning model that has learned the history).

Next, the countermeasure support apparatus 100 calculates a task impact value for the generated countermeasure plan (S1114). First, the countermeasure support apparatus 100 calculates the impact value based on the following formula.
[Number 1]
Impact value = Impact standard × Business communication importance × Business operation status (Formula 1)

The impact criterion in the above formula is a base value of the impact of the countermeasure plan on the business, and is a value that the administrator 2 has set in advance for each business performed in the monitored system 5. In this example, the impact criterion takes a value from "0" to "1" (the larger the value, the greater the impact on the business). For example, in cases where communication required for the business becomes impossible, such as when control communication is cut off or the device is stopped, the impact criterion is set to "1". In addition, for example, when the countermeasure plan is degraded operation or autonomous control, the impact on the business is limited, so an intermediate value such as "0.5" is set to the impact criterion. In addition, when the alternative plan is switching to an alternative device, the business can be continued, so the impact criterion is set to "0". The value of the impact criterion may be adjusted according to the value of the business priority 814 in the business information table 213 (see FIG. 8) (for example, the higher the priority of the business, the larger the impact criterion value).

The business communication importance in the above formula is the value of the business communication importance 717 in the white communication table 212 of the communication path identified in S1112 that may be affected by implementing the countermeasure plan, and is set to a value between "0" and "1" ("1" being the most important and "0" being the least important) as described above.

In the above formula, the business operation status is set to either "1" or "0". If the business (business that uses a communication path that may be affected if the countermeasure plan is implemented) is currently operating, the business operation status is set to "1", and if the business is not currently operating, the business operation status is set to "0". In this way, if the business is currently operating, there is a possibility that the business will be affected, so the impact value calculated from formula 1 will be a value other than "0". The countermeasure support device 100 obtains the business operation status of the business by, for example, comparing the operation period 312 in the business information table 213 with the current time.

Next, the countermeasure support device 100 acquires a business impact value _n of a countermeasure currently being implemented for the business affected by the fraudulent communication identified in S1112. Note that if there is no countermeasure currently being implemented for the business, the business impact value _n is "0", and in this case the impact value becomes the business impact value _n+1 as it is.

Next, the countermeasure support device 100 calculates a business impact value n+1 by adding the impact value of the countermeasure plan generated in S1113 to the business impact value _n , which is the sum of the impact values of the countermeasure plans that have already been implemented (currently being applied) for the business in question, as shown in _the following formula.
[Number 2]
Business impact value _n+1 = Business impact value _n + Impact value (Formula 2)

This completes the business impact value calculation process S1011, and the business impact value _n+1 calculated from the above formula is used as the return value (business impact value), and the process returns to FIG. 10 and proceeds to the process of S1012.

When a countermeasure command is generated in S1017 of FIG. 10 (that is, when a new countermeasure is taken), the countermeasure support apparatus 100 updates the stored business impact value _n with the newly calculated business impact value _n+1 .

As described above in detail, the security management system 1 of this embodiment evaluates the impact of a countermeasure plan on business operations, and if it is determined that the impact is small, it automatically implements the countermeasure plan, so that countermeasure plans that have a small impact on business operations can be implemented quickly, improving security performance. Furthermore, since the administrator 2 does not need to express an intention, in this case the burden on the administrator 2 can be reduced. Furthermore, if it is determined that the impact on business operations is large, a decision is made as to whether or not to implement the countermeasure plan based on the content (judgment) of the administrator 2's expression of intention, so that appropriate measures can be taken against unauthorized communications while taking into account the impact on business operations.

Although the embodiments have been described above, the present invention is not limited to the above-described embodiments, and includes various modified examples, and is not necessarily limited to those having all of the configurations described. It is also possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

REFERENCE SIGNS LIST 1 security management system, 2 administrator, 5 monitored system, 10 information processing device, 20 communication monitoring device, 100 response support device, 110 storage unit, 120 system information management unit, 130 detection information receiving unit, 140 response plan generating unit, 150 automatic implementation feasibility determining unit, 160 response command transmitting unit, 170 response information transmitting unit, 210 storage unit, 211 business device information table, 212 white communication table, 213 business information table, 214
Control information table, 220 System information management unit, 230 Unauthorized communication detection unit, 240 Detection information transmission unit, 30 Countermeasure execution device, 310 Storage unit, 311 Control logic table, 320 Countermeasure information reception unit, 330 Control logic configuration unit, 340 Control command transmission unit, 40 Administrator device, 43 Countermeasure network, 50 Control server, 51 Information network, 52 Control network, 61 Controller, 71 Actuator, 72 Sensor, S1000 Unauthorized communication monitoring process, S1011 Business impact value calculation process, 1200 Countermeasure implementation possibility designation screen

Claims (15)

A security management system that performs security management of a monitored system including a plurality of business devices connected in a communicable manner,
The information processing device includes a processor and a memory.
storing information indicating a communication path used for communication between the business devices and a business communication importance level which is information indicating the importance of each of the communication paths;
Monitor communications taking place in the monitored system;
When unauthorized communication is detected in the monitored system,
Identifying a communication path used for the unauthorized communication, and identifying the extent of the impact of the unauthorized communication on the monitored system based on the identified communication path;
generating a countermeasure against the unauthorized communication based on the identified extent of the impact;
Identifying the communication path that may be affected when the countermeasure plan is implemented;
calculating an impact value, which is an index showing the degree of impact that the countermeasure plan has on the business performed by the monitored system , based on the business communication importance of the identified communication path;
determining whether to automatically implement the countermeasure plan based on the impact value;
Security management systems. 2. The security management system according to claim 1,
When it is determined that the countermeasure is to be automatically implemented, the countermeasure is automatically implemented.
Security management systems. 2. The security management system according to claim 1,
If the impact value is less than a preset threshold value, it is determined that the countermeasure plan is to be automatically implemented, and if the impact value is equal to or greater than the threshold value, it is determined that the countermeasure plan is not to be automatically implemented.
Security management systems. 2. The security management system according to claim 1,
managing a business operation status, which is information indicating whether the business using the communication path that may be affected when the countermeasure plan is implemented is currently in operation;
determining the impact value based on the business communication importance and the business operation state;
Security management systems. 2. The security management system according to claim 1,
When one or more countermeasures are currently being applied to the business, the impact value is calculated by adding an impact value calculated for the countermeasure for the newly detected unauthorized communication to a total value of the impact values of the countermeasures currently being applied.
Security management systems. 2. The security management system according to claim 1,
adjusting the influence value based on an influence criterion, which is a value preset for each of the tasks;
Security management systems. 2. The security management system according to claim 1,
The unauthorized communication is at least one of a communication that deviates from a control protocol that can be used in communication between the business devices, a communication that uses a control command other than a control command that can be used in communication between the business devices, a communication that uses a control parameter other than a control parameter that can be used in communication between the business devices, and a communication that is performed in a communication cycle that exceeds a preset allowable range for communication between the business devices.
Security management systems. 2. The security management system according to claim 1,
If it is determined that the countermeasure is not to be automatically implemented,
Presenting the content of the countermeasure plan via a user interface;
Accepting an input of an indication of intent as to whether or not to implement the countermeasure plan;
If an indication of intent to implement the countermeasure plan is received, the countermeasure plan is implemented.
Security management systems. 2. The security management system according to claim 1,
The countermeasure plan is to substitute a business performed by the business device that communicates using the identified communication path with another business device.
Security management systems. 2. The security management system according to claim 1,
The countermeasure plan is to switch the identified business device to autonomous control and to disconnect the business device from the communication path.
Security management systems. An information processing device having a processor and a memory,
A step of storing information indicating a communication path used for communication between business devices of a monitored system including a plurality of business devices communicatively connected to each other, and business communication importance, which is information indicating the importance of each of the communication paths;
monitoring communications taking place in the monitored system;
When unauthorized communication is detected in the monitored system,
Identifying a communication path used for the unauthorized communication, and identifying the extent of the impact of the unauthorized communication on the monitored system based on the identified communication path;
generating a countermeasure against the unauthorized communication based on the identified extent of the impact;
Identifying the communication path that may be affected when the countermeasure plan is implemented;
calculating an impact value, which is an index showing the degree of impact that the countermeasure plan has on the business performed by the monitored system , based on the business communication importance of the identified communication path;
determining whether to automatically implement the countermeasure plan based on the impact value; and
When it is determined that the countermeasure is to be automatically implemented, automatically implementing the countermeasure;
A security management methodology. 12. A security management method according to claim 11, comprising:
a step of determining, by the information processing device, to automatically implement the countermeasure plan if the impact value is less than a preset threshold value, and determining, by the information processing device, not to automatically implement the countermeasure plan if the impact value is equal to or greater than the threshold value;
The security management method further comprises: 12. A security management method according to claim 11, comprising:
The information processing device,
managing a business operation status, which is information indicating whether the business using the communication path that may be affected when the countermeasure plan is implemented is currently in operation; and
determining the impact value based on the business communication importance and the business operation state;
The security management method further comprises: 12. A security management method according to claim 11, comprising:
a step of calculating the impact value by adding an impact value calculated for the countermeasure plan for the newly detected unauthorized communication to a total value of impact values of the countermeasure plans currently being applied when the information processing device is currently applying one or more countermeasure plans for the business;
The security management method further comprises: 12. A security management method according to claim 11, comprising:
the information processing device adjusts the influence value based on an influence criterion which is a value preset for each of the tasks;
The security management method further comprises:

Images