JP7833352B2 - Monitoring system, monitoring method, and program - Google Patents

Description

This disclosure relates to monitoring systems, monitoring methods, and programs.

Systems are known that can determine whether a person in an image is a suspicious person. For example, Patent Document 1 describes a matching device that acquires anonymized media information, in which the distinctive features of a visitor in an image are concealed, from a monitoring device, compares the acquired anonymized media information with registered anonymized media information, and outputs the matching result to the monitoring device. According to Patent Document 1, because the anonymized information is transmitted to the matching device, it is possible to determine whether a person in an image is a suspicious person while concealing personally identifiable information.

Patent No. 6273185

Here, it is necessary to monitor not only the people in the images, but also the computers being monitored, ensuring they are functioning correctly while preventing the leakage of information they handle.

This disclosure aims to solve the aforementioned problems and provide a monitoring system, monitoring method, and program that can monitor whether a computer is operating normally while suppressing the leakage of information handled by the computer.

The monitoring system relating to this disclosure is a monitoring system including a target device, which is a computer to be monitored; a plurality of management devices; and a monitoring device. The target device includes a processing data acquisition unit that reads processing data, which is data definable as a string, output by the target device; and a concealment unit that conceals the processing data by secret sharing to generate a plurality of concealed data. The management device includes a concealed data acquisition unit that acquires one of the plurality of concealed data; a detection formula acquisition unit that acquires one of a plurality of concealed detection formulas generated by concealing a detection formula for checking whether there is an anomaly in the processing data by secret sharing; a matching unit that performs a matching process between the concealed detection formula and the concealed data; and a matching result transmission unit that transmits the matching data, which is the result of the matching process, to the monitoring device. The monitoring device includes a monitoring result generation unit that generates a monitoring result indicating whether there is an anomaly in the processing data by decrypting the matching data acquired from each of the management devices.

The monitoring method relating to this disclosure is a monitoring method for a target device, which is a computer to be monitored, and includes the steps of: reading processing data, which is data definable by a string, output by the target device; generating a plurality of confidential data by secret sharing the processing data by the target device; transmitting the confidential data to each of a plurality of management devices; obtaining a plurality of confidential detection formulas, which are generated by concealing detection formulas for checking whether there is an abnormality in the processing data, using the management devices; performing a matching process between the confidential detection formulas and the confidential data using the management devices; transmitting the matching data, which is the result of the matching process, to the monitoring devices; and generating a monitoring result indicating whether there is an abnormality in the processing data by decrypting the matching data obtained from each of the management devices using the monitoring devices.

The program relating to this disclosure is a program that causes a computer to perform a monitoring method for a target device, which is a computer to be monitored. The program causes the computer to perform the following steps: reading processing data, which is data definable as a string, output by the target device; generating multiple confidential data by secret sharing the processing data; transmitting the confidential data to each of multiple management devices; obtaining multiple confidential detection formulas, generated by concealing detection formulas for checking whether there is an anomaly in the processing data, using the management devices; performing a comparison process between the confidential detection formulas and the confidential data using the management devices; transmitting the comparison data, which is the result of the comparison process, to the monitoring devices; and generating a monitoring result indicating whether there is an anomaly in the processing data by decrypting the comparison data obtained from each of the management devices.

According to this disclosure, it is possible to monitor whether the monitored computer is functioning correctly while suppressing the leakage of information handled by the computer.

Figure 1 is a schematic block diagram of the monitoring system according to this embodiment. Figure 2 is a schematic block diagram of the target device. Figure 3 is a schematic block diagram of the control device. Figure 4 is a schematic block diagram of the monitoring device. Figure 5 is a flowchart illustrating the processing flow of the target device. Figure 6 is a flowchart illustrating the processing flow of the monitoring process.

Preferred embodiments of this disclosure will be described in detail below with reference to the attached drawings. However, this embodiment does not limit the disclosure, and where there are multiple embodiments, these may include combinations of each embodiment.

(Monitoring system)
Figure 1 is a schematic block diagram of the monitoring system according to this embodiment. The monitoring system 1 according to this embodiment is a system that monitors whether there is an abnormality in the operation of the target device 10 to be monitored. As shown in Figure 1, the monitoring system 1 includes the target device 10, a plurality of management devices 12, and a monitoring device 14. In the example of Figure 1, there is one target device 10 to be monitored, but the number of target devices 10 may be multiple, and the monitoring system 1 may monitor multiple target devices 10. Also, in the example of Figure 1, there are three management devices 12A, 12B, and 12C, but the number of management devices 12 is not limited to that. The number of management devices 12 may be two or more, but it is preferable to have three or more. In addition, in this embodiment, the monitoring device 14 is installed at a location separate from the target device 10 and the management devices 12 (in a different facility), and the management entity of the monitoring device 14 is different from the management entity of the target device 10 and the management devices 12. Furthermore, the target device 10 and the management device 12 may be located in separate locations (different facilities), and the managing entity for the target device 10 and the managing entity for the management device 12 may be different. However, the managing entity for the target device 10 and the managing entity for the management device 12 may be the same.

(Target devices)
Figure 2 is a schematic block diagram of the target device. The target device 10 is a computer that performs information processing and is the device that is monitored by the monitoring system 1. As shown in Figure 2, the target device 10 has a communication unit 20, a storage unit 22, and a control unit 24. The target device 10 may be configured as a standalone device, as an integral part of other devices, or as a system combining various devices such as an arithmetic unit and a data server, and is not particularly limited. The target device 10 may also have an input unit that accepts user input and an output unit that outputs information. The input unit may be a mouse, keyboard, touch panel, etc., and the output unit may be a display that displays images, etc.

The communication unit 20 is a communication module that communicates with external devices, such as an antenna. The target device 10 communicates with external devices via wireless communication, but wired communication is also possible; the communication method is arbitrary. The storage unit 22 is a memory that stores various information, such as processing data (described later), calculation contents of the control unit 24, and programs. It includes at least one of the following: a main memory device such as RAM (Random Access Memory) or ROM (Read Only Memory), and an external memory device such as an HDD (Hard Disk Drive). The program for the control unit 24 stored in the storage unit 22 may be stored on a recording medium readable by the target device 10.

The control unit 24 is an arithmetic unit and includes arithmetic circuits such as a CPU (Central Processing Unit). The control unit 24 includes a processing unit 30, a processing data acquisition unit 32, a data concealment unit 34, and a data concealment transmission unit 36. The control unit 24 reads and executes a program (software) from the storage unit 22 to realize the processing unit 30, the processing data acquisition unit 32, the data concealment unit 34, and the data concealment transmission unit 36, and executes their processing. The control unit 24 may execute these processes using a single CPU, or it may have multiple CPUs, with the processing being executed by those multiple CPUs. Furthermore, at least a portion of the processing of the processing unit 30, the processing data acquisition unit 32, the data concealment unit 34, and the data concealment transmission unit 36 may be realized by hardware circuits.

The processing performed by the control unit 24 will be described later.

(Management device)
Figure 3 is a schematic block diagram of the management device. The management device 12 is a computer and can also be described as a server that stores the confidential processing data transmitted from the target device 10, which will be described later. As shown in Figure 3, the management device 12 has a communication unit 40, a storage unit 42, and a control unit 44. The management device 12 may be configured as a standalone device, as an integral part of other devices, or as a system combining various devices such as an arithmetic unit and a data server, and is not particularly limited. The management device 12 may also have an input unit that accepts user input and an output unit that outputs information. Here, the configuration of one management device 12 is described, but other management devices 12 have a similar configuration.

The communication unit 40 is a communication module that communicates with external devices, such as an antenna. The management device 12 communicates with external devices via wireless communication, but wired communication is also possible; the communication method is arbitrary. The storage unit 42 is a memory that stores various information, such as the confidential processing data described later, the calculation contents of the control unit 44, and programs. It includes at least one of the following: RAM, main memory such as ROM, and external storage devices such as HDDs. The program for the control unit 44 stored in the storage unit 42 may be stored on a recording medium readable by the management device 12.

The control unit 44 is an arithmetic unit and includes arithmetic circuits such as a CPU. The control unit 44 includes a confidential data acquisition unit 50, a detection-type acquisition unit 52, a verification unit 54, and a verification result transmission unit 56. The control unit 44 reads and executes a program (software) from the storage unit 42 to realize the confidential data acquisition unit 50, the detection-type acquisition unit 52, the verification unit 54, and the verification result transmission unit 56, and executes their processing. The control unit 44 may execute these processes using a single CPU, or it may have multiple CPUs, with the processing performed by those multiple CPUs. Furthermore, at least a portion of the processing of the confidential data acquisition unit 50, the detection-type acquisition unit 52, the verification unit 54, and the verification result transmission unit 56 may be realized by hardware circuits.

The processing performed by the control unit 44 will be described later.

(monitoring device)
Figure 4 is a schematic block diagram of the monitoring device. The monitoring device 14 is a computer and is a device that monitors the target device 10. As shown in Figure 4, the monitoring device 14 has a display unit 60, a communication unit 62, a storage unit 64, and a control unit 66. The monitoring device 14 may be configured as a standalone device, as an integral part of other devices, or as a system combining various devices such as a computing unit and a data server, and is not particularly limited. The monitoring device 14 may also have an input unit that accepts user input.

The display unit 60 is a display that shows information. The communication unit 62 is a communication module that communicates with external devices, such as an antenna. The monitoring device 14 communicates with external devices via wireless communication, but it may also use wired communication; the communication method is arbitrary. The storage unit 64 is a memory that stores various information such as the calculation contents and programs of the control unit 66, and includes at least one of the following: RAM, main memory such as ROM, and external storage device such as an HDD. The program for the control unit 66 stored in the storage unit 64 may be stored on a recording medium that the monitoring device 14 can read.

The control unit 66 is an arithmetic unit and includes arithmetic circuits such as a CPU. The control unit 66 includes a matching request unit 70, a detection-type setting unit 72, a monitoring result generation unit 74, and a monitoring result output unit 76. The control unit 66 reads a program (software) from the storage unit 64 and executes it to realize the matching request unit 70, the detection-type setting unit 72, the monitoring result generation unit 74, and the monitoring result output unit 76, and performs their respective processes. The control unit 66 may perform these processes using a single CPU, or it may have multiple CPUs, with the processes being performed by those multiple CPUs. Furthermore, at least a portion of the processing of the matching request unit 70, the detection-type setting unit 72, the monitoring result generation unit 74, and the monitoring result output unit 76 may be realized by hardware circuits.

(Processing by the monitoring system)
The following describes the processing of the monitoring system 1.

(Processed data)
The target device 10 executes predetermined information processing using the processing unit 30 and outputs processing data indicating the content of that information processing. The processing data can also be described as data indicating the history of executed information processing (data indicating the operation history of the target device 10). In other words, the processing data is data that can be defined as a string and is output from the target device 10. Examples of processing data include logs of operation data output from the target device 10 and logs of packet data used for communication with other devices. The data format of the processing data may be, for example, binary format. The processing unit 30 stores the processing data output from the target device 10, that is, the executed processing data used for information processing, in the storage unit 22. Each time the processing is executed, that is, each time processing data is output, the processing unit 30 sequentially stores that processing data in the storage unit 22.

(Reading processed data)
The processing data acquisition unit 32 of the target device 10 reads the processing data input to the storage unit 22. In other words, the processing data acquisition unit 32 reads the completed processing data used for information processing by the processing unit 30.

(Anonymization process)
The security unit 34 of the target device 10 secures the processing data read by the processing data acquisition unit 32 by secret sharing to generate multiple secure data pieces D. Secret sharing is a method of encrypting and dividing the data to be secured (in this case, processing data) into multiple secure data pieces D. For example, the method shown in ISO/IEC 19592-2 may be used. In other words, secure data pieces D are data obtained by secret sharing the processing data, and are encrypted so that the processing data cannot be decrypted from a single secure data piece D. The security unit 34 may use any method for secret sharing, but in this embodiment, the replication additive secret sharing method shown in ISO/IEC 19592-2 is used to secure the processing data and generate multiple secure data pieces D. The number of secure data pieces D generated from the processing data may be any number of two or more, but it is preferable to have three or more. The number of secure data pieces D is preferably less than or equal to the number of management devices 12, for example.

(Transmission of confidential data)
The confidential data transmission unit 36 of the target device 10 transmits each generated confidential data D to the management device 12. The confidential data transmission unit 36 transmits separate confidential data D to each management device 12. That is, for example, as shown in the example in Figure 1, if three confidential data DA, DB, and DC are generated from one processing data, the confidential data transmission unit 36 transmits confidential data DA to the management device 12A, confidential data DB to the management device 12B, and confidential data DC to the management device 12C. The confidential data transmission unit 36 may also store each generated confidential data D in the storage unit 22.

The target device 10 may perform the processes described above (processing data reading, processing data anonymization, and anonymized data transmission) sequentially, or it may perform these processes triggered, for example, by a command input from the user to perform the processing.

The processing flow of the target device 10 described above will now be explained. Figure 5 is a flowchart illustrating the processing flow of the target device. As shown in Figure 5, the target device 10 reads processing data using the processing data acquisition unit 32 (step S10), encrypts the read processing data using the encryption unit 34 to generate multiple encrypted data D (step S12), and transmits each encrypted data D to the management device 12 using the encrypted data transmission unit 36 (step S14).

In this way, the target device 10 transmits the confidential data, which has already been concealed, to the management device 12 without transmitting the processing data itself to the management device 12 or the monitoring device 14. Therefore, the leakage of the contents of the processing data (information handled by the target device 10) can be suppressed.

(Acquisition of confidential data)
The confidential data acquisition unit 50 of the management device 12 acquires (receives) confidential data D from the target device 10 and stores it in the storage unit 42. The confidential data acquisition unit 50 acquires one confidential data D from among multiple confidential data D generated from one processing data by the target device 10. In this embodiment, the confidential data transmission unit 36 of management device 12A receives confidential data DA, the confidential data transmission unit 36 of management device 12B receives confidential data DB, and the confidential data transmission unit 36 of management device 12C receives confidential data DC. It is preferable that each management device 12 does not acquire confidential data D transmitted to another management device 12. That is, for example, it is preferable that management device 12A does not acquire confidential data DB and DC. As a result, even if data in one management device 12 is leaked, multiple confidential data D will not be leaked, and the risk of processing data leakage can be reduced.

(Monitoring of target devices)
As described above, the monitoring device 14 monitors whether the target device 10 is malfunctioning. Specifically, the monitoring device 14 monitors whether there are abnormalities in the processing data. That is, for example, if the operation of the target device 10 is abnormal, the processing data indicating that operation is often also abnormal. Therefore, by determining whether there are abnormalities in the processing data, the malfunction of the target device 10 can be monitored.

Whether there is an anomaly in the processing data can be confirmed by comparing (matching) the processing data with a detection formula used to check for anomalies. However, in order for the monitoring device 14 to compare the processing data with the detection formula, the monitoring device 14 needs to acquire the processing data, which creates a risk of data leakage. Therefore, in this embodiment, the monitoring device 14 determines whether there is an anomaly in the processing data without directly using the processing data. This process will be described in detail below.

(Acquisition of trigger information and detection formula)
The matching request unit 70 of the monitoring device 14 acquires trigger information, which is information that triggers the start of matching the processing data with the detection formula, and information about the detection formula to be used for matching. The matching request unit 70 may acquire the trigger information and the detection formula information using any event as a trigger. For example, the matching request unit 70 may acquire the trigger information and the detection formula information at predetermined intervals, or it may acquire the trigger information and the detection formula information when a command to request matching and the detection formula information are input by the user.

The detection expression acquired by the matching request unit 70 is a logical expression for checking whether there is an abnormality in the processing data. In this embodiment, the detection expression is an expression for checking whether a predetermined string is included in the processing data. An example of a detection expression is "curl.exe AND \\-F\\". In this example, the detection expression checks whether the processing data contains the string "curl.exe" AND the string "-F". However, the content of the detection expression may be arbitrary and can be set appropriately according to the type of abnormality to be detected. Furthermore, the data format of the detection expression may be, for example, binary format.

In this embodiment, the detection expression consists of a string to be matched and a logical AND or logical OR. String matching is performed using exclusive OR (XOR). Because strings are matched using exclusive OR, the detection expression in this embodiment results in the expression having the most exclusive ORs among logical AND (AND), logical OR (OR), and exclusive OR (i.e., strings). Note that the detection expression may include both logical AND and logical OR, or only one of them. For example, in the above detection expression, the logical expression determining whether the processing data contains the string "curl.exe" and the logical expression determining whether the processing data contains the string "F" are both exclusive ORs, and AND is a logical AND. Therefore, in the above detection expression, there are two exclusive ORs and one logical AND, resulting in the most exclusive ORs. In this embodiment, for detection expressions with the largest number of exclusive OR operations, a replication-type additive secret sharing method is used, which can perform exclusive OR operations quickly and reduce communication load. This allows for high-precision verification of whether there are anomalies in the processed data while minimizing computational load. In other words, the replication-type additive secret sharing method is particularly suitable for detection expressions like those in this embodiment.

(Disguising the detection method)
The detection formula setting unit 72 of the monitoring device 14 conceals an arbitrarily set detection formula by secret sharing to generate multiple concealed detection formulas F. The detection formula setting unit 72 conceals the detection formula by secret sharing using the same method as the secret sharing performed by the concealment unit 34 of the target device 10 to generate multiple concealed detection formulas F. In other words, in this embodiment, the detection formula setting unit 72 conceals the detection formula using a replication-type additive secret sharing method.

(Sending a matching request)
The matching request unit 70 acquires trigger information and detection formula information, and when a confidential detection formula F is generated, it sends a matching request, which is a command requesting a matching process between the confidential data and the confidential detection formula F, and the generated confidential detection formula F to the management device 12. The detection formula setting unit 72 sends separate confidential detection formulas F to each management device 12. That is, for example, as shown in the example in Figure 1, the matching request unit 70 sends a matching request and a confidential detection formula FA, which has been made confidential using the same method as the confidential data DA, to the management device 12A. The matching request unit 70 also sends a matching request and a confidential detection formula FB, which has been made confidential using the same method as the confidential data DB, to the management device 12B. The matching request unit 70 also sends a matching request and a confidential detection formula FC, which has been made confidential using the same method as the confidential data DC, to the management device 12C. The matching request unit 70 may also store each of the generated confidential detection formulas F in the storage unit 64.

Furthermore, when a matching process using a previously used detection formula is requested, the management device 12 and monitoring device 14 may already have a confidential detection formula F stored for that formula. Therefore, the monitoring device 14 checks whether a confidential detection formula F generated from the same detection formula as the one acquired this time is stored in the storage unit 64. If it is stored, it may transmit the matching request and information indicating the confidential detection formula F to be used for matching to the respective management devices 12 without setting a new confidential detection formula F.

(Retrieving a matching request)
The management device 12 receives a verification request from the monitoring device 14. Once a verification request is received, the management device 12 reads the confidential data D to be verified from the storage unit 42 using the confidential data acquisition unit 50, and obtains one confidential detection formula F to be used for verification using the detection formula acquisition unit 52. Furthermore, if a verification process using a detection formula that has not been used in the past is requested, the management device 12 receives the verification request and the confidential detection formula F from the monitoring device 14, and once it has received the verification request and the confidential detection formula F, it reads the confidential data D to be verified from the storage unit 42. Also, if a verification process using a detection formula that has been used in the past is requested, the management device 12 receives the verification request and information indicating the confidential detection formula F to be used for verification from the monitoring device 14. Once the management device 12 has received the verification request and information indicating the confidential detection formula F to be used for verification, it reads the confidential data D to be verified and the confidential detection formula F to be used for the current verification from the storage unit 42.

(Verification process)
When a matching request is received and the confidential data D and confidential detection formula F are read out, the matching unit 54 of the management device 12 matches the confidential data D and confidential detection formula F and generates matching data E that shows the result of the matching. Since the matching data E is data that shows the result of matching the confidential data DA and confidential detection formula FA, it is not possible to decode the content of the processing data or the monitoring result indicating whether there is an abnormality in the processing data from a single matching data E.

In this embodiment, the matching unit 54 of the management device 12A compares the confidential data DA with the confidential detection type FA and generates matching data EA showing the matching result between confidential data DA and confidential detection type FA. The matching unit 54 of the management device 12B compares the confidential data DB with the confidential detection type FB and generates matching data EB showing the matching result between confidential data DB and confidential detection type FB. The matching unit 54 of the management device 12C compares the confidential data DC with the confidential detection type FC and generates matching data EC showing the matching result between confidential data DC and confidential detection type FC.

(Sending matching data)
The matching result transmission unit 56 of the management device 12 transmits the matching data E generated by the matching unit 54 to the monitoring device 14. In the example in Figure 1, the matching result transmission unit 56 of management device 12A transmits the matching data EA to the monitoring device 14, the matching result transmission unit 56 of management device 12B transmits the matching data EB to the monitoring device 14, and the matching result transmission unit 56 of management device 12C transmits the matching data EC to the monitoring device 14. The matching result transmission unit 56 may also transmit time information indicating the time when the confidential data D, which is the source of the matching data E, was acquired to the monitoring device 14. The matching result transmission unit 56 may also transmit identification information (for example, an identifier such as the name or ID of the target device) that identifies the target device 10 that acquired the confidential data D to the monitoring device 14.

(Generating monitoring results)
The monitoring result generation unit 74 of the monitoring device 14 acquires (receives) the matching data E from each management device 12. The monitoring result generation unit 74 may also receive time information indicating the time when the confidential data D was acquired. The monitoring result generation unit 74 generates a monitoring result, which is information indicating whether the processed data is abnormal, by performing a decryption process using the matching data E received from each management device 12. In other words, the monitoring result is data decrypted using each matching data E, and is information indicating the matching result between the detection formula and the processed data. The monitoring result does not include the content of the processed data, and can be said to be information that only indicates the matching result between the detection formula and the processed data. Here, since the confidential data D and the confidential detection formula F, which are the sources of the matching data E, are data encrypted using the same secret sharing method, by collecting matching data E obtained by matching confidential data D and confidential detection formula F in a number equal to the number of confidential data D (number of secret sharings), the matching data E can be decrypted, and information indicating the matching result between the detection formula and the processed data can be obtained.

The monitoring result output unit 76 of the monitoring device 14 outputs the monitoring result information generated by the monitoring result generation unit 74. For example, the monitoring result output unit 76 may display the monitoring result information on the display unit 60, or it may transmit the monitoring result information to another device. Furthermore, along with the monitoring result information, the monitoring result output unit 76 may also output time information indicating the time when the verification data E was acquired, and identification information of the target device 10, which is the source of the confidential data D. By outputting the time information and identification information, it becomes possible, for example, to identify the time period and device where the anomaly occurred.

In this embodiment, when monitoring abnormalities in processing data, the monitoring device 14 obtains verification data E from each management device 12 and decodes the verification data E to obtain a monitoring result indicating an abnormality in the processing data. Therefore, according to this embodiment, it is possible to monitor for abnormalities without transmitting processing data to the monitoring device 14, thereby suppressing the leakage of information about the target device 10 while monitoring whether it is operating normally. The management device 12 and the monitoring device 14 may perform the processes described above sequentially, or they may perform these processes triggered, for example, by a command input from the user to perform the processes.

Furthermore, it is preferable that the monitoring device 14 does not receive any data based on processing data other than the matching data E. For example, it is preferable that the monitoring device 14 does not receive processing data or confidential data D from the target device 10, and that processing data or confidential data D is not stored in the storage unit 64. Also, for example, it is preferable that the monitoring device 14 does not receive confidential data D from the management device 12, and that confidential data D is not stored in the storage unit 64. By preventing the monitoring device 14 from receiving processing data or confidential data D in this way, the leakage of information from the target device 10 can be effectively suppressed.

(Processing flow)
The processing flow of the monitoring process will be explained. Figure 6 is a flowchart illustrating the processing flow of the monitoring process. As shown in Figure 6, once the monitoring device 14 acquires trigger information and detection formula information, it sends a matching request to each management device 12 to perform a matching process (step S20). Once each management device 12 receives the matching request, it acquires confidential data D (step S22) and confidential detection formula F (step S24). The order in which steps S22 and S24 are performed is arbitrary. Each management device 12 performs a matching process between the acquired confidential data D and confidential detection formula F to generate matching data E (step S26), and sends the generated matching data E to the monitoring device 14 (step S28). Once the monitoring device 14 has acquired the matching data E from each management device 12, it generates a monitoring result by combining the respective matching data E (step S30), and outputs the monitoring result (step S32). This completes the process, but for example, once trigger information is acquired again, the same process may be repeated to continue monitoring the target device 10.

(effect)
As described above, the monitoring system 1 according to the first aspect of this disclosure includes a target device 10 which is a computer to be monitored, a plurality of management devices 12, and a monitoring device 14. The target device 10 includes a processing data acquisition unit 32 which reads processing data which is data that can be defined by a string output from the target device 10, and a concealment unit 34 which conceals the processing data by secret sharing and generates a plurality of concealed data D. The management device 12 includes a concealed data acquisition unit 50 which acquires one of the plurality of concealed data D, a detection formula acquisition unit 52 which acquires one of a plurality of concealed detection formulas F which are generated by concealing a detection formula for checking whether there is an abnormality in the processing data by secret sharing, a matching unit 54 which performs a matching process between the concealed detection formula F and the concealed data D, and a matching result transmission unit 56 which transmits the matching data E, which is the result of the matching process, to the monitoring device 14. The monitoring device 14 includes a monitoring result generation unit 74 which generates a monitoring result indicating whether there is an abnormality in the processing data by decrypting the matching data E acquired from each management device 12. According to this disclosure, it is possible to generate monitoring results without transmitting processing data to the monitoring device 14, thereby enabling monitoring of whether the target device 10 is operating normally while suppressing information leakage. Furthermore, by sending the matching data E, which is the result of matching the confidential data D, to the monitoring device 14 without sending each confidential data D to the monitoring device 14, information leakage of the target device 10 can be suitably suppressed. In addition, by distributing the processing data into multiple confidential data D and having them held by multiple management devices 12, information leakage of the target device 10 can be suitably suppressed.

The monitoring system 1 according to the second aspect of this disclosure is the monitoring system 1 according to the first aspect, wherein the detection formula acquisition unit 52 of the management device 12 acquires a confidential detection formula F, which has been concealed by secret sharing using the same method as the secret sharing performed by the concealment unit 34. Since the confidential data D and the confidential detection formula F are created using the same secret sharing method, multiple matching data E can be decoded to obtain information indicating the matching result between the detection formula and the processing data.

The monitoring system 1 according to the third aspect of this disclosure is the monitoring system 1 according to the second aspect, wherein the concealment unit 34 of the target device 10 conceals the processing data using a replication-type additive secret sharing method. By using a replication-type additive secret sharing method, it becomes possible to monitor whether the target device 10 is operating normally while suppressing the communication burden. In particular, using a replication-type additive secret sharing method that can suppress the communication burden is especially effective when the target device 10, the management device 12, and the monitoring device 14 are located in separate locations.

The monitoring system 1 according to the fourth aspect of this disclosure is the monitoring system 1 according to any of the first to third aspects, wherein the monitoring device 14 does not receive data based on processing data other than the matching data E. According to this disclosure, since data related to processing data other than the matching data E is not received, information leakage can be more effectively suppressed.

The monitoring system 1 according to the fifth aspect of this disclosure is a monitoring system 1 according to any of the first to fourth aspects, wherein the detection expression has the highest number of exclusive OR operations among logical AND, logical OR, and exclusive OR operations. By using such a detection expression, it becomes possible to appropriately monitor whether the target device 10 is operating normally.

The monitoring method described in this disclosure is a monitoring method for a target device 10, which is a computer to be monitored, and includes the steps of: reading processing data, which is string-definable data, output by the target device 10 to operate the target device 10; generating a plurality of confidential data D by secret sharing by the target device 10; transmitting the confidential data D to each of the plurality of management devices 12; obtaining a plurality of confidential detection formulas F, which are generated by concealing detection formulas for checking whether there is an abnormality in the processing data, using the management devices 12; performing a comparison process between the confidential detection formulas F and the confidential data D using the management devices 12; transmitting the comparison data E, which is the result of the comparison process, to the monitoring device 14; and generating a monitoring result indicating whether there is an abnormality in the processing data by decrypting the comparison data obtained from each management device 12 using the monitoring device 14. According to this disclosure, it is possible to monitor whether the target device 10 is operating normally while suppressing the leakage of information from the target device 10.

The program disclosed herein is a program that causes a computer to perform a monitoring method for a target device 10, which is a computer to be monitored. The program causes the computer to perform the following steps: reading processing data, which is string-definable data, output by the target device 10 to operate the target device 10; generating multiple confidential data D by secret sharing the processing data; transmitting the confidential data D to each of the multiple management devices 12; obtaining multiple confidential detection formulas F, generated by concealing detection formulas for checking for abnormalities in the processing data, via the management devices 12; performing a comparison process between the confidential detection formulas F and the confidential data D via the management devices 12; transmitting the comparison data E, which is the result of the comparison process, to the monitoring device 14; and generating a monitoring result indicating whether there are abnormalities in the processing data by decrypting the comparison data obtained from each management device 12 via the monitoring device 14. According to this disclosure, it becomes possible to monitor whether the target device 10 is operating normally while suppressing information leakage.

The embodiments described above are not limited to those described herein. Furthermore, the aforementioned components include those easily conceivable by those skilled in the art, those substantially identical, and those within the so-called equivalent range. Moreover, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the spirit of the aforementioned embodiments.

1 Monitoring system 10 Target device 12 Management device 14 Monitoring device 32 Processing data acquisition unit 34 Confidentiality unit 50 Confidential data acquisition unit 52 Detection type acquisition unit 54 Verification unit 56 Verification result transmission unit 72 Detection type setting unit 74 Monitoring result generation unit D Confidential data E Verification data F Confidential detection type

Claims (7)

A monitoring system including a target device which is a computer to be monitored, multiple management devices, and a monitoring device,
The aforementioned target device is
A processing data acquisition unit reads processing data, which is data that can be defined as a string, output by the aforementioned target device.
A security unit that secures the aforementioned processed data by secret sharing to generate multiple secure data sets,
Includes,
The aforementioned control device is
A confidential data acquisition unit that acquires one of the multiple confidential data,
A detection formula acquisition unit acquires one of several confidential detection formulas generated by concealing a detection formula used to check for abnormalities in the aforementioned processed data using secret sharing,
A matching unit that performs a matching process between the confidentiality detection formula and the confidentiality data,
A matching result transmission unit that transmits matching data, which is the result of the matching process, to the monitoring device,
Includes,
The aforementioned monitoring device is
The system includes a monitoring result generation unit that generates a monitoring result indicating whether there is an abnormality in the processing data by decoding the matching data acquired from each of the management devices,
A monitoring system. The monitoring system according to claim 1, wherein the detection formula acquisition unit of the management device acquires the confidential detection formula, which has been concealed by secret sharing using the same method as the secret sharing performed by the confidentiality unit. The monitoring system according to claim 2, wherein the concealment unit of the target device conceals the processing data using a replication-type additive secret sharing method. The monitoring device does not receive data based on the processing data other than the matching data, as described in claim 1 or 2. The monitoring system according to claim 1 or 2, wherein the detection formula has the largest number of exclusive OR operations among logical AND, logical OR, and exclusive OR operations. A method for monitoring a target device, which is a computer that is the subject of monitoring,
The aforementioned target device reads the processing data, which is data that can be defined as a string, output by the aforementioned target device.
The target device performs the steps of: concealing the processing data by secret sharing to generate multiple confidential data;
The steps include transmitting the confidential data to each of the multiple management devices,
The steps include: acquiring multiple confidential detection formulas, which are generated by concealing the detection formula used to check for abnormalities in the processing data, using the management device;
The management device performs a step of matching the confidentiality detection formula with the confidentiality data,
The steps include: transmitting the matching data, which is the result of the matching process, to a monitoring device;
The monitoring device decodes the matching data acquired from each of the management devices to generate a monitoring result indicating whether there is an abnormality in the processing data.
including,
Monitoring method. A program that causes a target device , which is a computer to be monitored, multiple management devices, and a monitoring device to execute a monitoring method for the target device ,
The aforementioned target device reads the processing data, which is data that can be defined as a string, output by the aforementioned target device.
The target device performs the steps of: concealing the processing data by secret sharing to generate multiple confidential data;
The target device transmits the confidential data to each of the multiple management devices,
The steps include: acquiring multiple confidential detection formulas, which are generated by concealing the detection formula used to check for abnormalities in the processing data, using the management device;
The management device performs a step of matching the confidentiality detection formula with the confidentiality data,
The management device transmits the matching data, which is the result of the matching process, to the monitoring device.
The monitoring device decodes the matching data acquired from each of the management devices to generate a monitoring result indicating whether there is an abnormality in the processing data.
To execute
program.