JP7726395B2 - Information processing device, search method, and search program - Google Patents

Description

The present invention relates to an information processing device, a search method, and a search program.

In recent years, cyber attacks targeting weaknesses in supply chains have become more prevalent and sophisticated. Risk management is becoming even more important when companies use IoT (Internet of Things) devices. Therefore, when vulnerabilities or malware infections are discovered, it is necessary to quickly check whether the devices in use contain the software or hardware that could be causing the problem, and take appropriate action.

Another known method of risk management as described above is the OEM Finder technology, which finds similar OEM products from a BOM (Bill of Materials), which is a list of components used when a product is made and is output by CAD (Computer Aided Design) software, or from images of IoT devices, and notifies the OEM (Original Equipment Manufacturer) that their products also have vulnerabilities if the original OEM's (OEM) products have vulnerabilities (see, for example, non-patent document 1).

“Hunting Vulnerable OEM IoT Devices at Scale,” Asuka Nakajima, [online], [Retrieved May 16, 2022], Internet: <https://i.blackhat.com/eu-19/Thursday/eu-19-Nakajima-OEM-Finder-Hunting-Vulnerable-OEM-IoT-Devices-At-Scale-2.pdf>

However, conventional technologies have had the problem of being unable to quickly address problems discovered with electronic components. For example, BOM technology requires information to be provided by the manufacturer, but manufacturers are reluctant to provide information due to concerns about their know-how being leaked, making it difficult to quickly address problems discovered with electronic components. Furthermore, OEM Finder technology, for example, can only grasp the configuration of a product at the external appearance level, so it is unable to grasp information about components at the chip level, making it difficult to quickly address problems discovered with electronic components.

The present invention has been made in consideration of the above, and aims to provide an information processing device, search method, and search program that can quickly deal with problems when they are discovered in electronic components.

In order to solve the above-mentioned problems and achieve the objectives, the information processing device of the present invention is characterized by having an identification unit that identifies first information regarding the characteristics of electronic components contained in an electronic board from image data of the electronic board; a storage unit that uses the first information identified by the identification unit to acquire second information from a first memory unit that stores predetermined first information regarding the characteristics of electronic components and second information regarding electronic components, and stores the acquired second information in a second memory unit in association with identification information that identifies the electronic board or electronic component; and a search unit that, when the second information is received, searches the second memory unit for the identification information corresponding to the second information.

This invention makes it possible to quickly address any problems that may be discovered with electronic components.

FIG. 1 is a block diagram illustrating an example of a configuration of a system according to an embodiment. FIG. 2 is a block diagram illustrating the configuration of the information processing apparatus according to this embodiment. FIG. 3 is a diagram illustrating an example of information stored in the feature information DB. FIG. 4 is a diagram illustrating an example of information stored in the part information DB. FIG. 5 is a diagram illustrating an example of information stored in the configuration information DB. FIG. 6 is a diagram illustrating the processing of the identification unit. FIG. 7 is a diagram illustrating the processing of the storage unit. FIG. 8 is a flowchart illustrating an example of a registration process performed by the information processing apparatus according to the embodiment. FIG. 9 is a flowchart illustrating an example of a processing procedure at the time of a search performed by the information processing apparatus according to the embodiment. FIG. 10 is a block diagram illustrating the configuration of an information processing device according to a modified example. FIG. 11 is a diagram illustrating an example of information stored in a configuration information DB according to the modification. FIG. 12 is a diagram illustrating a computer that executes a program.

The following describes in detail embodiments of the information processing device, search method, and search program according to the present application, with reference to the accompanying drawings. Furthermore, the present invention is not limited to the embodiments described below.

[System configuration]
The configuration of a system including an information processing device according to an embodiment will be described. FIG. 1 is a block diagram showing an example of the configuration of a system according to an embodiment. As shown in FIG. 1, the system includes an information processing device 10 and an image capturing device 20. The information processing device 10 and the image capturing device 20 are connected to each other via a network 30. Regarding the network configuration shown in FIG. 1, each device may communicate via any communication network, whether wired or wireless, such as the Internet, a LAN, or a VPN (Virtual Private Network). The configuration shown in FIG. 1 is merely an example, and the specific configuration and the number of devices are not particularly limited.

For example, the information processing device 10 acquires image data of an electronic circuit board (a board on which electronic components are arranged) included in an IoT device and identifies the color, shape, etc. of the electronic components. The information processing device 10 then detects the constituent electronic components by comparing it with component information DB 13b, which stores catalog information, etc., of the electronic components, and builds configuration information DB 13c. For example, if the information processing device 10 discovers that an electronic component has a vulnerability or is infected with malware, it responds to a user's search request by returning a result indicating whether the target electronic component is present on the electronic circuit board operated by the user, thereby enabling the usage status of the electronic component to be quickly searched.

The imaging device 20 acquires image data and spatial data of the electronic board and transmits them to the information processing device 10. For example, the imaging device 20 captures image data of the electronic board using a camera and measures the spatial data using a laser. The imaging device 20 may also acquire only image data. The imaging device 20 may be installed in a factory, for example, and automatically capture images of the electronic board, or it may be configured to manually capture images of the electronic board at any location.

[Configuration of information processing device]
2 is a block diagram illustrating the configuration of an information processing apparatus according to this embodiment. As illustrated in FIG. 2, the information processing apparatus 10 according to this embodiment includes a communication processing unit 11, a control unit 12, and a storage unit 13.

The communication processing unit 11 is realized using a NIC (Network Interface Card) or the like, and controls communication via telecommunications lines such as a LAN (Local Area Network) or the Internet.

The memory unit 13 stores data and programs necessary for various processes performed by the control unit 12, and includes a feature information DB 13a, a component information DB 13b, and a configuration information DB 13c. For example, the memory unit 13 is a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk.

Feature information DB13a stores information related to the features of electronic components included in electronic boards. For example, as illustrated in Figure 3, feature information DB13a stores identification information (color, shape, logo, printed string, etc.) of electronic components identified from image data and spatial data, as well as the registration date and time, in association with a "device ID" that uniquely identifies an electronic board and a "component ID" that uniquely identifies an electronic component. Note that "SIP" in Figure 3 is an abbreviation for Single in-line Package, and "QFP" is an abbreviation for Quad Flat Package.

Component information DB13b stores pre-set identification information (first information) and configuration information (second information) related to electronic components. For example, as illustrated in Figure 4, component information DB13b stores "identification information" of electronic components manually set from a web page or catalog, and "configuration information," which is detailed information about the electronic components, in association with an "ID" that uniquely identifies the electronic component. Here, configuration information includes the manufacturer of the electronic component, the function of the electronic component, the start and end of production of the electronic component, the model number of the electronic component, etc.

Configuration information DB13c stores configuration information in association with device IDs and component IDs. For example, as illustrated in FIG. 5, configuration information DB13c stores the "registration date and time" and "configuration information," which is detailed information about electronic components, in association with the "device ID" and "component ID." Note that configuration information DB13c is not limited to storing the "registration date and time" and "configuration information" in association with the "device ID" and "component ID," and may store the "registration date and time" and "configuration information" in association with either the "device ID" or the "component ID."

The control unit 12 has an internal memory for storing programs that define various processing procedures and required data, and uses these to perform various processes. For example, the control unit 12 has an identification unit 12a, a storage unit 12b, and a search unit 12c. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

The identification unit 12a identifies identification information related to the characteristics of the electronic components included in the electronic board from the image data of the electronic board. For example, the identification unit 12a identifies one or more of the following as identification information: the color of the electronic component, the shape of the electronic component, the number of terminals of the electronic component, a logo mark written on the electronic component, and text written on the electronic component.

As illustrated in FIG. 6, for example, the identification unit 12a acquires image data of an electronic board from the imaging device 20, identifies the area of an electronic component included in the electronic board from the image data, and identifies identification information from the identified area. Note that the identification unit 12a may utilize image processing techniques such as edge detection to identify the area of the electronic component. The identification unit 12a may also acquire spatial data in addition to image data. The identification unit 12a then stores the identified identification information in the feature information DB 13a, correlating it with the device ID and component ID.

The storage unit 12b uses the identification information identified by the identification unit 12a to acquire configuration information from the component information DB 13b, which stores identification information regarding the characteristics of pre-set electronic components and configuration information regarding the electronic components, and stores the acquired configuration information in the configuration information DB 13c in association with the equipment ID and component ID.

For example, the storage unit 12b acquires one or more of the following configuration information from the component information DB 13b: the manufacturer of the electronic component, the model number of the electronic component, the function of the electronic component, the start date and end date of production of the electronic component, and stores the acquired configuration information in the configuration information DB 13c in association with the equipment ID and component ID.

As illustrated in FIG. 7, for example, the storage unit 12b compares the data in the part information DB 13b with the data in the feature information DB 13a and creates data for the configuration information DB 13c. For example, the storage unit 12b calculates the similarity between the identification information identified by the identification unit 12a and the identification information stored in the part information DB 13b, and if the similarity is equal to or greater than a predetermined threshold, acquires the configuration information corresponding to the identification information stored in the part information DB 13b and stores the acquired configuration information in the configuration information DB 13c in association with the device ID and part ID.

When the search unit 12c receives configuration information, it searches the configuration information DB 13c for the device ID or component ID corresponding to the configuration information. For example, if a user discovers a vulnerability in an IoT device that includes an electronic board or discovers that malware has been introduced, the user inputs configuration information such as the manufacturer and model number of the electronic component in question. The search unit 12c receives the input of configuration information and outputs whether the electronic board (IoT device) uses that component.

For example, using the example in Figure 5, if it is discovered that a malicious circuit has been mixed into a CPU manufactured from 2020 for product B, the search unit 12c will specify conditions and search the configuration information DB 13c, and since "chip 2" is found, it will output that the electronic board (IoT device) with device ID "device 1" uses the corresponding component "chip 2."

[Processing Procedure of Information Processing Device 10]
Next, an example of a processing procedure of processing executed by the information processing device 10 will be described with reference to Fig. 8 and Fig. 9. Fig. 8 is a flowchart showing an example of a processing procedure at the time of registration by the information processing device of the embodiment. Fig. 9 is a flowchart showing an example of a processing procedure at the time of search by the information processing device of the embodiment.

As illustrated in Figure 8, when the identification unit 12a of the information processing device 10 acquires image data of an electronic board (step S101: Yes), it identifies the identification information of the electronic components contained in the electronic board from the image data of the electronic board (step S102).

Then, the storage unit 12b uses the identified identification information to obtain configuration information from the component information DB 13b (step S103), and stores the obtained configuration information in the configuration information DB 13c in association with the equipment ID and component ID (step S104).

Also, as illustrated in FIG. 9, when the search unit 12c of the information processing device 10 receives a specification of a model number, manufacturer, etc. (Yes in step S201), it searches the configuration information DB 13c for a device ID and a component ID corresponding to the specified information (step S202). The search unit 12c then outputs the searched device ID and component ID as the search result (step S203). For example, the search unit 12c searches the configuration information DB 13c by specifying conditions, and since "chip 2" is found, it outputs that the electronic board (IoT device) with device ID "device 1" uses the corresponding component "chip 2."

[Effects of the embodiment]
In this way, the information processing device 10 according to the embodiment identifies identification information related to the characteristics of electronic components included in the electronic board from image data of the electronic board. The information processing device 10 then uses the identified identification information to acquire configuration information from a component information DB 13b, which stores preset identification information and configuration information related to the electronic components, and stores the acquired configuration information in the configuration information DB 13c in association with a device ID and a component ID. Next, when the information processing device 10 receives the configuration information, it searches the configuration information DB 13c for a device ID or component ID corresponding to the configuration information. This allows the information processing device 10 to quickly address any problems discovered with the electronic components.

For example, the information processing device 10 identifies the color and shape of electronic components included in an electronic board (a board on which electronic components are arranged) included in an IoT device, and detects the constituent electronic components by comparing them with a component information DB 13b that stores catalog information for the electronic components. If the information processing device 10 discovers that an electronic component has a vulnerability or is infected with malware, it can quickly search the electronic boards included in the IoT device to determine whether that electronic component is used.

As a result, with the information processing device 10, users can understand the IoT devices they use at the electronic component level, allowing them to respond more quickly when vulnerabilities in electronic components or malware intrusion are discovered, thereby improving the user's security level.

[Modification]
As a variant, the information processing device may store the combinations and number of electronic components used in electronic devices, share them among users, and perform anomaly detection to estimate counterfeit or inferior electronic components, in order to eliminate counterfeit or inferior electronic components.

As a modified example, for example, the information processing device 10A may further include an estimation unit 12d, as illustrated in FIG. 10. When electronic components of the same type are used on different electronic boards, if the proportion of unknown manufacturing information included in each piece of configuration information for the electronic components of the same type stored in the configuration information DB 13c is equal to or greater than a predetermined number, the estimation unit 12d estimates that the electronic components are inferior products.

For example, the configuration information DB 13c in this modified example may manage data for each user, as illustrated in Figure 11. In the example of Figure 11, the configuration information DB 13c stores data tables for users A, B, and C, in which "equipment ID," "component ID," "registration date and time," and "configuration information" are associated with each other.

The processing of the estimation unit 12d will be explained using the example of Figure 11. For example, as illustrated in Figure 11, assume that users A, B, and C are using the same type of electronic devices 1, 2, and 3. However, when looking at the configuration information of the electronic devices, it is found that the serial number, etc., identified from the image of chip 1 for user C alone is not a valid number or is a random number, and therefore the start date of manufacture is unknown. The estimation unit 12d detects the possibility that the product is an inferior or counterfeit product by calculating the proportion of the same electronic device for which configuration information is unknown. Note that, for example, the estimation unit 12d can determine whether the number is random by searching the serial number via a website to find information on whether the product is genuine.

For example, in the above example, the estimation unit 12d determines that although the manufacturer of each chip in the configuration information DB 13c is the same across users, the proportion of the start date of production for "chip 1" is {2021/1/1: 2/3, unknown: 1/3}, and since the proportion that is unknown is greater than or equal to the threshold T = 1/3, it is possible to detect that there is an abnormality in the start date of production of chip 1 of device 3, and that it is a counterfeit or inferior product.

[System configuration, etc.]
The components of each device shown in the drawings according to the above embodiments are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the drawings, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information, including the processing procedures, control procedures, specific names, various data, and parameters shown in the above documents and drawings, can be changed as desired unless otherwise specified.

〔program〕
It is also possible to create a program written in a computer-executable language that executes the processes executed by the information processing device described in the above embodiments. In this case, the same effects as those of the above embodiments can be achieved by having a computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to achieve the same processes as those of the above embodiments.

Figure 12 is a diagram showing a computer that executes a program. As illustrated in Figure 12, the computer 1000 has, for example, memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and each of these components is connected by a bus 1080.

As illustrated in FIG. 12, the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031 as illustrated in FIG. 12. The disk drive interface 1040 is connected to a disk drive 1041 as illustrated in FIG. 12. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052 as illustrated in FIG. 12. The video adapter 1060 is connected to a display 1061 as illustrated in FIG. 12.

Here, as illustrated in FIG. 12, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. In other words, the above programs are stored, for example, on the hard disk drive 1031 as program modules that describe instructions to be executed by the computer 1000.

In addition, the various data described in the above embodiment are stored as program data, for example, in memory 1010 or hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1031 into RAM 1012 as needed, and executes various processing procedures.

The program module 1093 and program data 1094 related to the program do not necessarily have to be stored on the hard disk drive 1031, but may be stored, for example, on a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 related to the program may be stored in another computer connected via a network (such as a LAN (Local Area Network), WAN (Wide Area Network)), and read by the CPU 1020 via the network interface 1070.

The above describes an embodiment of the invention made by the inventor, but the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention according to this embodiment. In other words, all other embodiments, examples, operational techniques, etc. made by those skilled in the art based on this embodiment are included in the scope of the present invention.

10, 10A Information processing device 11 Communication processing unit 12 Control unit 12a Identification unit 12b Storage unit 12c Search unit 12d Estimation unit 13 Memory unit 13a Feature information DB
13b Parts information DB
13c Configuration information DB

Claims (8)

an identification unit that identifies first information related to characteristics of electronic components included in an electronic board from image data of the electronic board;
a storage unit that uses the first information identified by the identification unit to acquire second information from a first storage unit that stores first information on predetermined characteristics of electronic components and second information on electronic components, and stores the acquired second information in the second storage unit in association with identification information that identifies the electronic board or the electronic component;
a search unit that, when receiving the second information, searches the second storage unit for the identification information corresponding to the second information. The information processing device described in claim 1, characterized in that the identification unit identifies as the first information one or more of the color of the electronic component, the shape of the electronic component, the number of terminals of the electronic component, a logo mark written on the electronic component, and text written on the electronic component. The information processing device described in claim 1, characterized in that the identification unit acquires image data of the electronic board, identifies an area of an electronic component contained in the electronic board from the image data, and identifies the first information from the identified area. The information processing device described in claim 1, characterized in that the storage unit acquires from the first memory unit one or more of the following as the second information: the manufacturer of the electronic component, the model number of the electronic component, the function of the electronic component, the start date and end date of production of the electronic component, and stores the acquired second information in the second memory unit in association with the identification information. The information processing device described in claim 1, characterized in that the storage unit calculates the similarity between the first information identified by the identification unit and the first information stored in the first memory unit, and if the similarity is equal to or greater than a predetermined threshold, acquires second information corresponding to the first information stored in the first memory unit, and stores the acquired second information in the second memory unit in association with the identification information. The information processing device described in claim 1 further comprises an estimation unit that, when electronic components of the same type are used on different electronic boards, estimates that the electronic components are inferior products if the proportion of unknown manufacturing information contained in each second information of the electronic components of the same type stored in the second memory unit is equal to or greater than a predetermined number of the total. A search method executed by an information processing device, comprising:
an identification step of identifying first information relating to characteristics of electronic components included in the electronic board from image data of the electronic board;
a storage step of acquiring second information from a first storage unit that stores first information related to predetermined characteristics of electronic components and second information related to electronic components, using the first information identified by the identification step, and storing the acquired second information in a second storage unit in association with identification information that identifies the electronic board or the electronic component;
a search step of searching the second storage unit for the identification information corresponding to the second information when the second information is received. an identification step of identifying first information relating to characteristics of electronic components included in the electronic board from image data of the electronic board;
a storage step of acquiring second information from a first storage unit that stores first information related to predetermined characteristics of electronic components and second information related to electronic components, using the first information identified by the identification step, and storing the acquired second information in a second storage unit in association with identification information that identifies the electronic board or the electronic component;
a search step of searching, when the second information is received, for the identification information corresponding to the second information from the second storage unit.