JP7104574B2 - Computer asset management system and computer asset management method - Google Patents

Description

The present invention relates to a computer asset management system and a computer asset management method, and is suitable for application to, for example, a computer asset management system that manages computer asset information.

In recent years, the threat of cyber security (hereinafter referred to as security) to industrial control systems, IoT (Internet of Things) systems related to industrial control systems (hereinafter referred to as industrial related systems), etc. has become serious. In industry-related systems, there are cases where damage after a security breach has a direct impact on the real world, and security threats are one of the major threats. For example, in an IoT system, if a huge number of devices are connected to the Internet and the devices are hijacked (botted) by a cyber attack, there is a risk that the devices will be misused in a large-scale cyber attack. .. Therefore, security measures for industry-related systems have become an urgent issue.

A cyber attack is established by exploiting the specifications of the control device of an industry-related system, the IoT device constituting the industry-related system (hereinafter referred to as a device), insufficient setting information (vulnerability), and the like. Therefore, the most effective countermeasure is to understand what kind of configuration the target device is and what kind of program is installed in the target device. Therefore, in industry-related systems, it is required to monitor the setting information of programs, applications, etc. installed in the target device, and manage the applications including vulnerabilities, setting information, and system configuration information (computer asset information). Be done.

Various methods have been proposed as a means for grasping computer asset information.

The method described in Patent Document 1 is one method of collecting computer asset information. The method described in Patent Document 1 automatically discovers and collects asset information of each component connected to a computer network, and maps the asset information inside the system based on the collected information. The system described in Patent Document 1 can remotely execute asset information from an asset information collection program (asset management client) installed in various computer networks.

The method described in Patent Document 2 manages asset information by using a value generated by a cryptographic hash function (hereinafter referred to as a hash) as identification information for managing computer asset information as a computer asset management method. How to do it. The computer described in Patent Document 2 can verify whether the asset information of the computer is surely intended by verifying the hash.

Special Table 2009-510602 Japanese Unexamined Patent Publication No. 2006-344231

Computational resources are often limited in each device of industry-related systems. In addition, when the number of devices connected to the network becomes enormous, the communication band may be limited by wireless communication or the like. Therefore, it is desirable to minimize the processing related to the management of computer asset information (which is not the original processing), which is often a non-functional requirement for industry-related systems.

Since the system described in Patent Document 1 is intended for an environment in which the processing resources of a computer are large, a device having limited processing resources may require too much processing to process. Further, in the computer described in Patent Document 2, although the asset information identification process of the computer can be made more efficient by managing the asset information of the computer using the hash, there is no means for grasping the timing when the asset information is updated, and the period is regular. Inquiries about whether or not there is a specific update are required. In other words, the process of inquiring about the presence or absence of an update can also be an element that puts pressure on the communication bandwidth and processing resources, so that the originally required process may be hindered.

The present invention has been made in consideration of the above points, and an object of the present invention is to propose a computer asset management system capable of appropriately managing asset information.

In order to solve such a problem, the present invention is a computer asset management system that manages computer asset information, which includes a master and an agent, and the agent monitors a predetermined event that occurs in a computer to be monitored. Then, the identification information that can identify the asset information that may have been added or changed by the event that occurred is transmitted to the master.

In the above configuration, for example, the agent sends identification information that can identify the asset information that may have been added or changed without performing a process of confirming whether or not the asset information has been added or changed. The load on the processing resources of the agent can be reduced. In addition, for example, when an event occurs, the agent sends identification information that can identify asset information that may have been added or changed, so that the load on the network resource can be reduced.

According to the present invention, asset information can be appropriately managed.

FIG. 1 is a diagram showing an example of a configuration related to a computer asset management system according to the first embodiment. FIG. 2 is a diagram showing an example of event asset correspondence data according to the first embodiment. FIG. 3 is a diagram showing an example of managed asset data according to the first embodiment. FIG. 4 is a diagram showing an example of a flowchart relating to the asset monitoring process according to the first embodiment. FIG. 5 is a diagram showing an example of the format of the communication frame according to the first embodiment. FIG. 6 is a diagram showing an example of asset group data according to the first embodiment. FIG. 7 is a diagram showing an example of asset group identification information according to the first embodiment. FIG. 8 is a diagram showing an example of a configuration related to acquisition of updated contents according to the first embodiment. FIG. 9 is a diagram showing an example of the data structure of the data of the asset information resolution DB (Database) according to the first embodiment. FIG. 10 is a diagram showing an example of a case in which asset information corresponding to a plurality of identification information according to the first embodiment exists. FIG. 11 is a diagram showing an example of the configuration related to the master according to the first embodiment.

Hereinafter, one embodiment of the present invention will be described in detail with reference to the drawings.

In the present embodiment, each device of the industry-related system has a limited use and a limited frequency of updating asset information, and the calculation processing in the device and the amount of data transferred from the device are used. The configuration for managing asset information while minimizing the above will be mainly explained.

(1) First Embodiment In FIG. 1, 100 indicates a computer asset management system according to the first embodiment as a whole. The computer asset management system 100 includes an agent 110 and a master 120.

The agent 110 is a device such as a control device for an industry-related system and an IoT device that constitutes an industry-related system. The agent 110 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), an HDD (Hard Disk Drive), a communication unit, and the like, which are not shown.

The agent 110 stores various types of information (event asset correspondence data 111, managed asset data 112, etc.) in a storage unit such as a RAM or an HDD.

The functions of the agent 110 (OS (Operating System) 113, process 114, event monitoring unit 115, hash calculation unit 116, communication processing unit 117, etc.) are executed by, for example, the CPU reading a program stored in the ROM into the RAM. It may be realized by a thing (software), it may be realized by hardware such as a dedicated circuit, or it may be realized by combining software and hardware. Further, a part of the function of the agent 110 may be realized by another computer capable of communicating with the agent 110.

The event asset correspondence data 111 includes data indicating the correspondence relationship between the event and the asset information. A specific example of the event asset correspondence data 111 will be described later with reference to FIG.

Events are events that can be processed by OS 113, events that can be processed by process 114 that receives allocation of memory area from OS 113 and executes processing, and events that do not depend on OS 113 (for example, generation of data communication of a specific input / output port). Existence, etc.) etc. The event occurs at any time. For example, an event occurs at a scheduled timing. Also, for example, an event occurs at an exceptional timing.

Assets (asset information) are various types of data to be managed (predetermined software, predetermined files, specific address data, specific area data, etc.). The asset information may be the one that is mapped in the memory (for example, the program loaded in the RAM) or the one that is on the disk (for example, the file stored in the HDD). good. Asset information is managed in data units.

For example, when the asset information is software, the software (asset information) is managed in units such as version information of the software, a file name, and data of a specific address. More specifically, when the asset information to be managed is software, the asset information is package management software that can determine the software version (version information) (for example, OS113, installation, deletion, software of various software). This includes data on dependencies between software, software that manages dependencies between software and libraries), and data on a specific binary area (a part of the object file that executes software) in the software.

When the asset information to be managed is a file, the asset information is, for example, data (binary data) of the entire file or a part of the file (header area of the file, specific area in the file).

When the asset information to be managed is a specific address, the asset information is, for example, data pointing to a specific address, data pointed to by address information (pointer) stored in the specific address, or data having the specific address as the start address. Area data, data area data that includes a specific address as part.

The managed asset data 112 includes asset information (actual data) which is various data to be managed.

The event monitoring unit 115 monitors the event specified in the event asset correspondence data 111 and detects the occurrence of the event.

When an event is detected by the event monitoring unit 115, the hash calculation unit 116 identifies the asset information corresponding to the event based on the event asset correspondence data 111. Subsequently, the hash calculation unit 116 acquires the specified asset information from the managed asset data 112. Subsequently, the hash calculation unit 116 calculates (calculates) the hash (hash value) of the acquired asset information, and notifies the communication processing unit 117 of the calculated hash. In this way, the hash calculation unit 116 calculates the hash of the asset information, so that the amount of data transmitted by the communication processing unit 117 to the master 120 can be reduced.

The communication processing unit 117 transmits the hash notified by the hash calculation unit 116 to the master 120.

As described above, the agent 110 monitors the possibility of updating the asset information to be managed through the event generated by the OS 113 or the like, and when a predetermined event occurs, the agent 110 performs a hash of the asset information that may have been updated. Send to master 120.

The master 120 centrally manages the asset information managed by the agent 110. The master 120 is a machine that manages the asset information of one or more agents 110. The master 120 may be a physical machine such as a computer, or may be a machine composed of virtualized software such as a VM (Virtual Machine). In the following, for convenience of explanation, a case where the master 120 is a computer will be described as an example.

The master 120 includes a CPU, a RAM, a ROM, an HDD, a communication unit, and the like, which are not shown. The master 120 stores various types of information (managed asset data 121, etc.) in a storage unit such as a RAM or an HDD.

The managed asset data 121 includes data indicating a correspondence relationship between the asset name of the asset information and the identification information that can identify that the asset information has been updated. A specific example of the managed asset data 112 will be described later with reference to FIG.

As for the identification information, it is clear that the asset information is changed by some processing. The identification information can identify the entire or partial hash of the asset information, the entire asset information, a part of the asset information (data pattern of a specific area in the asset information), alias information such as the name of the asset information, and the asset information. All or part of the header information that contains the information. The agent 110 can use the above-mentioned information (information that can identify that the asset information has been updated) as the identification information.

In the present embodiment, the managed asset data 121 stores in advance a hash of asset information to be managed by the agent 110. The hash of the asset information is held for each device as an asset list as shown in FIG. In addition, in FIGS. 1 to 5, the hash is mainly taken as an example as the identification information, but the identification information is not limited to the hash. As the identification information, as described above, information that can identify that the asset information has been updated can be appropriately adopted. When the hash is not calculated, the load of the processing resource required for the hash calculation is reduced.

Even if the functions of the master 120 (communication processing unit 122, hash comparison unit 123, update data acquisition unit 124, etc.) are realized by, for example, the CPU reading the program stored in the ROM into the RAM and executing it (software). It may be realized by hardware such as a dedicated circuit, or it may be realized by combining software and hardware. Further, some of the functions of the master 120 may be realized by another computer capable of communicating with the master 120.

The communication processing unit 122 receives the hash transmitted by the communication processing unit 117, and notifies the hash comparison unit 123 of the received hash.

The hash comparison unit 123 compares the hash transmitted by the communication processing unit 122 with the hash of the managed asset data 121, and detects whether or not the asset information has been updated. When the hash comparison unit 123 determines that the two do not match (when it determines that the asset information has been updated), the hash comparison unit 123 notifies the update data acquisition unit 124 that the hashes do not match. By comparing in this way, the hash comparison unit 123 detects whether or not the asset information is updated more quickly and accurately than when the user compares.

When the update data acquisition unit 124 receives the notification from the hash comparison unit 123 that the hashes do not match, the update data acquisition unit 124 acquires data for updating the managed asset data 121, and the managed asset data 121 is based on the acquired data. To update.

FIG. 2 is a diagram showing an example of event asset correspondence data 111 (event asset correspondence table 200). In the event asset correspondence table 200, information on events and assets is stored in association with each other. The event asset correspondence table 200 shows the relationship of asset information (for example, update.list) that can be updated when a specific executable file (for example, Launch update.bin) is loaded.

FIG. 3 is a diagram showing an example of managed asset data 121 (managed asset table 300). In the managed asset table 300, the asset name and the hash are stored in association with each other. The managed asset table 300 shows a list of hashes of managed asset information in "device A".

Next, the processing in the computer asset management system 100 will be described.

FIG. 4 is a diagram showing an example of a flowchart relating to the asset monitoring process executed by the agent 110.

The event monitoring unit 115 is started by scheduling processing by OS113 or the like or exception processing. After activation, the event monitoring unit 115 collects information related to the event registered in the event asset correspondence data 111, and monitors whether or not the registered event has occurred (step S400).

The event monitoring unit 115 determines whether or not the occurrence of any event (specific event) registered in the event asset correspondence data 111 has been detected (step S410). If it is determined that the event monitoring unit 115 has detected the event, the process is transferred to step S420, and if it is determined that the event monitoring unit 115 has not detected the event, the asset monitoring process is terminated.

The event monitoring method (event detection) is not limited. For example, the event monitoring unit 115 may detect the occurrence of an event by checking various logs such as a command log generated by the OS 113 and a processing result log. Further, for example, the event monitoring unit 115 may check the interrupt processing and detect the occurrence of an event. Further, for example, the event monitoring unit 115 may check the time stamp of the file to detect the occurrence of an event. Further, for example, the event monitoring unit 115 may check the communication performed by the agent 110 with the outside and detect the occurrence of an event.

Further, for example, the event monitoring unit 115 may check the change of the asset information (binary file) to detect the occurrence of the event, or describe the information indirectly related to the asset information (for example, the asset information). You may detect the occurrence of an event by checking the change of the list file). In this case, the event monitoring unit 115 checks, for example, a part or all of the header information of the file (binary file and / or list file), the hash of the file, and a part or all of the data of the file to generate an event. It may be detected.

In step S420, the event monitoring unit 115 refers to the event asset correspondence data 111 and acquires the asset information corresponding to the detected event (detection event).

Subsequently, the event monitoring unit 115 determines whether or not the asset information corresponding to the detected event is updated (step S430). If it is determined that there is an update, the event monitoring unit 115 shifts the process to step S440, and if it determines that there is no update, the event monitoring unit 115 ends the asset monitoring process. The event monitoring unit 115 does not confirm whether or not the asset information has actually been changed.

In step S440, the hash calculation unit 116 calculates (generates) the hash of the asset information. As described above, the hash calculation unit 116 may generate a hash of all or part of the asset information, all or part of the asset information (binary data), or the like as identification information.

The hash calculation unit 116 normalizes the data to be transmitted for the reason of collation processing on the master 120 side when generating the hash (for example, a process of arranging the hashes in the order of the assets described in the managed asset table 300). May be executed. As an additional note, the specific content does not matter as long as it is a means by which the updated asset information can be identified by a hash on both the agent 110 side and the master 120 side.

In step S450, the communication processing unit 117 transmits the generated hash to the master 120, and ends the asset monitoring process.

In such a process, the agent 110 transmits a hash of the asset information that may have been added or changed without performing a process of confirming whether or not the asset information has been added or changed. Therefore, the processing resource of the agent 110 Load can be reduced. In addition, the agent 110 transmits a hash of asset information that may have been added or changed when an event occurs, so that the load on the network resource can be reduced.

Here, when transmitting a hash to the master 120, the communication processing unit 117 assigns one or more hashes to one communication frame and transmits the hash. In the present embodiment, the communication frame used in the layer 2 communication will be described as an example, but the present embodiment is not limited to this. The format may be a communication packet used in layer 3 communication or a communication segment used in layer 4 communication. In this way, since the communication processing unit 117 can add and transmit a plurality of hashes in one communication frame, the number of transmissions can be reduced and the load of the processing resource related to the transmission can be reduced.

FIG. 5 is a diagram showing an example of a communication frame format (format 500). The format 500 includes a communication header, agent identification information that can identify the agent 110, one or more hashes, and an FCS (Frame Check Sequence). The FCS may be a MAC (Message Authentication Code).

The communication processing unit 117 stores the agent identification information of the agent 110 in the area after the header, and subsequently stores one or more hashes in the area after the agent identification information.

Examples of the hash transmission timing to the master 120 include the timing of event occurrence, a fixed cycle, and the timing when the number of hashes exceeds a predetermined number. Further, the transmission timing is selected in consideration of the system configuration, the characteristics of the device that realizes the function of the agent 110, the specifications, and the like. Regardless of which is selected, when a specific event occurs, the confirmation process of whether or not the asset information is updated is executed, and the hash sent to the master 120 is limited to the hash associated with the specific event. Will be done.

Here, most of the devices to be managed have limited uses, the asset information to be managed is also limited, and the frequency of updating the asset information is not high. Therefore, by transmitting the necessary identification information only at the timing when the event occurs, it is possible to significantly reduce the amount of processing required to confirm whether or not the asset information has been updated. As a result, it becomes possible to manage asset information effectively for the device.

The timing of acquiring the hash of the agent 110 and storing it in the managed asset data 121 may be before or after the system introduction of the managed device. For example, the hash of the asset information may be acquired in the device development process, or the hash of the asset information may be acquired by a dedicated program immediately before or immediately after the introduction of the system.

Although the management of a single asset information has been described above as an example, the management is not limited to a single asset information. The computer asset management system 100 can manage a plurality of asset information as a group. For example, the computer asset management system 100 may manage asset information using asset group data having a management group that manages a plurality of asset information, a snapshot (a list of asset information at a certain timing), and the like as one unit. It is possible.

FIG. 6 is a diagram showing an example of asset group data (asset group table 600).

In the asset group table 600, information on the asset group and the asset is stored in association with each other. For example, according to the definition of the asset group "application A setting information", the agent 110 can manage the setting files "app1.conf, app2.conf" corresponding to the application A as a whole. The agent 110 can associate the asset group defined in this way as an event for each asset group in the event asset correspondence data 111. For example, when an asset group and an event are linked in units of an asset group, when a certain event occurs, the agent 110 displays all the asset information belonging to the asset group linked to the event. It can be updated.

Further, the computer asset management system 100 may use identification information for each asset group for the asset group. In this case, the agent 110 (communication processing unit 117) transmits the identification information of the asset group to the master 120.

FIG. 7 is a diagram showing an example of the identification information of the asset group. FIG. 7 shows an example in which the agent 110 generates identification information of an asset group using a hash of all or part of the asset information, the whole asset information, and a part of the asset information, but the present invention is not limited to this. .. For example, the agent 110 may generate the asset group identification information by using alias information such as the name of the asset information, all or part of the header information including the information that can identify the asset information.

FIG. 7 shows an example of identification information of an asset group that uniquely identifies a plurality of asset groups. For example, as shown in FIG. 7A, the hash calculation unit 116 uses the hash 720 of the asset information 710 (all asset information or a combination of some asset information) belonging to the predetermined asset group 700 as the identification information 730. You may calculate.

Further, for example, as shown in FIG. 7B, the hash calculation unit 116 identifies a part of the combination 750 of the asset information (all asset information or some asset information) belonging to the predetermined asset group 740. It may be used as 760.

In this way, the computer asset management system 100 can manage the asset information in the asset group unit by generating the identification information in the asset group unit.

Here, the software assets that make up the device are less diverse than the information system, and many are treated as common in the internal configuration (for example, OS113 and common in the standard application configuration). Use to change and handle sensing and actuation parameter information, etc.). Therefore, the computer asset management system 100 can realize efficient asset information management by collectively managing a plurality of asset information as one unit.

By the method shown above, the master 120 compares the identification information received from the agent 110 with the identification information shared in advance, and if there is a change, detects that the asset information has been updated. Further, the master 120 acquires the update content (for example, difference information) of the managed asset data 121 by the update data acquisition unit 124, and updates the managed asset data 121.

The method of acquiring the updated contents will be described below.

The method of acquiring the updated contents is roughly classified into the following three.
(Method 1) A method in which the master 120 acquires the updated contents from the device (agent 110) via the network (Method 2) A method in which the user directly accesses the updated device, verifies the contents, and acquires the updated contents. (Method 3) A method in which the master 120 utilizes the mapping information between the identification information and the asset information managed in advance by the computer asset management system 100 to acquire the updated contents.

(Method 1)
(Method 1) is a method applicable when the network resources and the computer resources of the device are available. This is a method of updating the updated identification information directly via the network. This method is a method that enables management without the need to share the updated identification information in advance. Note that this method is often inadequate in an environment where network resources and computer resources of equipment are limited. In particular, this method causes a remarkable problem when the amount of data of the asset information to be managed becomes large, and there are cases where it is insufficient under limited resources.

(Method 2)
(Method 2) is a method in which a user directly accesses a device and acquires updated contents from the device without going through a network. This method is one method that can be selected according to the needs for managing asset information. For example, when the update frequency of the asset information is limited, there are cases where it is sufficient to detect whether or not the asset information is updated. In this case, the user can select this method. In addition, when the asset information that can be transmitted via the network is restricted by the limitation of the specifications of the device, the user can select this method.

(Method 3)
(Method 3) is a method in which the master 120 receives the identification information, but identifies the asset information without directly accessing the device, and acquires the updated contents of the identified asset information. In this method, it is required to solve (identify) which asset information corresponds (corresponds) on the master 120 side by using the identification information.

FIG. 8 shows an example of a configuration for realizing the above (method 3). In (method 3), the master 120 has a mechanism for exchanging information with a database (for example, asset information resolution DB 800) that stores data indicating a correspondence relationship between identification information and asset information via an internal network or a network. The asset information resolution DB 800 may be provided in the master 120, or may be provided in a computer different from the master 120.

The asset information resolution DB 800 has information necessary for resolving which asset information the identification information corresponds to. The master 120 identifies the asset name by reverse lookup of the asset name from the identification information using the asset information resolution DB 800.

The asset information resolution DB 800 is generated (updated) by the DB generation unit 810. The DB generation unit 810 may be provided in the master 120, or may be provided in a computer different from the master 120.

FIG. 9 is a diagram showing an example (data structure 900) of the data structure of the asset information resolution DB 800. The data structure 900 is in a format in which a plurality of identification information (identification information A920, identification information B930, identification information C930, etc.) is added to one asset name 910, and the asset name can be uniquely identified from the certain identification information. It has such a structure. For example, if the identification information received by the master 120 from the agent 110 is equivalent to the identification information B930, it is concluded that the master 120 has the asset information of the asset name 910 corresponding to the identification information B930.

The number of identification information corresponding to an asset is determined by how the identification information is calculated or obtained. For example, when a hash is used for the identification information, the identification information corresponding to one asset information is single except when a hash collision occurs. On the other hand, when the binary information of the area limited to the identification information is used, the identification information per asset information tends to be larger than that of the hash, although it depends on the size of the area. In this case, when a certain identification information corresponds to a plurality of asset information, there arises a problem that the corresponding asset information cannot be solved.

Here, the agent 110 can also solve the duplication problem by generating, for example, a plurality of identification information and transmitting it to the master 120. However, in such a configuration, the processing load on the agent 110 increases, so a method for solving the problem is required on the master 120 side.

In this regard, as one method for solving the problem of duplication of identification information, there is a method of determining which of a plurality of asset information corresponding to the identification information is correct based on the presence or absence of other asset information. .. For example, when a plurality of asset information always exists in the same environment, the master 120 identifies the asset information existing in the same environment from the asset information corresponding to the plurality of identification information.

FIG. 10 is a diagram showing an example (case 1000) of a case in which asset information corresponding to a plurality of identification information exists. In case 1000, when the identification information X1010 corresponds to both the asset A1020 and the asset B1030, the master 120 determines that the asset Y is the asset A1020 when the asset Y exists in the same environment as the asset A1020, and determines that the asset B1030. When the asset Y does not exist in the same environment as, it is determined to be the asset B1030. This method can improve the accuracy of identifying the asset information even when one identification information corresponds to a plurality of asset information. In addition, the master 120 has asset-related information indicating which asset information is related to which asset information, and configuration information indicating which agent 110 monitors which asset information. There is. That is, when there are a plurality of identified asset information, the master 120 determines the existence or nonexistence of other related asset information using the asset-related information and the configuration information, and identifies the asset information based on the determination result. ..

If the received identification information does not correspond to (exist) in the asset information resolution DB 800, the master 120 detects it as an unknown asset. When the master 120 detects an unknown asset, it considers that there is a security problem and outputs the problem to the outside. In this case, in order to update or expand the contents of the asset information resolution DB 800, the user directly accesses the device to acquire (verify) information such as whether an asset corresponding to the unknown asset exists or which asset has been updated. )do.

The update (generation) of the asset information resolution DB 800 does not necessarily have to be acquired via the agent 110 and the asset information to be managed. For example, the DB generation unit 810 generates asset information (identification information) based on software information provided by the vendor, the Web, etc., device specifications, device manuals, etc., and uses the generated information to generate the asset information resolution DB 800. You may update it.

Further, in the case of asset information having many patterns that are manually changed, the DB generation unit 810 may store (cover) the assumed change patterns and generate asset information and identification information from each change pattern. .. Due to the limited use of the equipment, the patterns allowed are often limited. In that case, the DB generation unit 810 grasps the permissible pattern in advance, generates the corresponding identification information, and links it with the asset information to obtain the permissible (identifiable) asset information or not. May be determined.

Further, depending on the method of defining the identification information, the computer asset management system 100 can detect falsification of the asset information, contamination of malware, etc. (threat by a malicious program) by using the identification information.

FIG. 11 is a diagram showing an example of a configuration related to the master 1100 including the threat detection unit 1101 for detecting a threat caused by a malicious program. Since the master 1100 has the same configuration as the master 120, a configuration different from that of the master 120 will be mainly described.

Here, the identification information of the asset information is defined based on, for example, the trace (in this example, IOC (Indicator of Compromise)) indicating that a threat by a malicious program exists. When the user defines the identification information 1102, the master 1100 can compare the identification information 1102 with the IOC file 1111 by matching the items with the items of the IOC file 1111.

For example, the agent 110 transmits the information of the item of the IOC file 1111 to the master 120 as the identification information of the asset information. The threat detection unit 1101 collates the IOC file 1111 stored in the IOCDB1110 with the identification information 1102 acquired from the agent 110, and whether the information of the condition item defined in the IOC file 1111 matches the identification information 1102. Verify whether. Note that the IOC file 1111 is configured to include one or more items subdivided regarding the presence or absence of malware infection and their establishment conditions (logical operators such as AND and OR).

According to such a configuration, the master 1100 can detect and verify the presence or absence of infection with malware or the like without accessing the device.

(2) Other Embodiments In the above-described embodiment, the case where the present invention is applied to the computer asset management system 100 has been described, but the present invention is not limited to this, and various other computers. It can be widely applied to asset management systems, computer asset management methods, computer asset management devices, and the like.

Further, in the above-described embodiment, an example is shown in which one agent 110 is provided in FIG. 1, but the present invention is not limited to this, and a plurality of agents 110 may be provided.

Further, in the above-described embodiment, the case where the agent 110 is a device (hardware) of an industry-related system has been described, but the present invention is not limited to this, and the agent 110 includes an event monitoring unit 115 and a hash calculation unit. It may be a program (software) for realizing 116, the communication processing unit 117, and the like. In this case, one agent 110 may be provided in the equipment of the industry-related system, or a plurality of agents 110 may be provided.

Further, in the above-described embodiment, the case where the agent 110 is provided for each device of the industry-related system has been described, but the present invention is not limited to this, and the agent 110 is used for a plurality of devices of the industry-related system. It may be provided (multiple devices may be monitored).

Further, in the above-described embodiment, the case where the agent 110 executes step S430 has been described, but the present invention is not limited to this, and the agent 110 performs the process of step S440 without executing step S430. You may. Such a configuration is suitable, for example, in a system in which the computer resources of the device are not sufficient and the network resources are sufficient.

Further, in the above-described embodiment, various data have been described using the XX table and the XX file for convenience of explanation, but the data structure is not limited and may be expressed as XX information or the like.

In addition, the information such as programs, tables, and files that realize each function in the above description is a memory, a hard disk, a storage device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD. Can be placed in.

Further, the above-described configuration may be appropriately changed, rearranged, combined, or omitted as long as it does not exceed the gist of the present invention.

As described above, the computer asset management system (for example, the computer asset management system 100) of the above-described embodiment is the asset of the computer (for example, the control device of the industry-related system, the device such as the IoT device constituting the industry-related system). A computer asset management system that manages information, including a master (for example, master 120) and an agent (for example, agent 110), and the agent is a predetermined event (for example, an event) that occurs in a computer to be monitored. Monitors the event shown in the asset correspondence data 111 and the event registered in the event asset correspondence table 200, and identifies the asset information (for example, managed asset data 112) that may have been added or changed by the event that occurred. Possible identification information (for example, information that can identify that the asset information has been updated, hash of all or part of the asset information, whole asset information, part of the asset information, alias information such as the name of the asset information, etc. It is characterized in that all or part of the header information including the information that can identify the asset information) is transmitted to the master.

Further, the agent generates an event shown in the event asset correspondence data based on the event asset correspondence data (for example, event asset correspondence data 111, event asset correspondence table 200) in which the event and the asset information are associated with each other. When is detected, the asset information corresponding to the detected event is acquired, the identification information of the asset information is generated based on the acquired asset information, and the generated identification information is transmitted to the master (for example, steps S410 to S410 to It is desirable to perform the process of step S450).

Further, it is desirable that the agent (for example, the hash calculation unit 116) calculates the hash based on the asset information as the identification information of the asset information.

In addition, the agent may use the entire asset information, a part of the asset information, the whole header information of the file defining the asset information, or a part of the header information of the file as the identification information of the asset information. It is desirable to use it.

In addition, the agent uses one unit of identification information of asset information that may have been added or changed due to an event that has occurred in one communication (for example, one communication frame, one communication packet, one communication segment). It is desirable to transmit the above (for example, one or more hashes).

Further, a storage unit (for example, HDD) for storing identification information (for example, managed asset data 121) of the asset information of the computer is provided, and the master (for example, hash comparison unit 123) is transmitted from the agent. It is desirable to compare the identification information of the asset information with the identification information stored in the storage unit to detect whether or not the asset information has been updated.

Further, the agent is added or added by an event that occurs based on the asset group data (for example, asset group data, asset group table 600) in which the plurality of asset information is associated with the group to which the plurality of asset information belongs. It is desirable to identify the group to which the asset information that may have been changed is associated, and to determine that all the asset information belonging to the specified group may have been added or changed by the above event.

Further, it is desirable that the agent (for example, the communication processing unit 117) transmits the identification information that can identify the group (for example, the identification information of the asset group) to the master.

Further, it is desirable that the agent (for example, the hash calculation unit 116) calculates the hash by combining some of the asset information among all the asset information as the identification information of the group.

Further, it is desirable that the agent (for example, the hash calculation unit 116) calculates the hash by combining all the asset information described above as the identification information of the group.

Further, it is desirable that the agent (for example, the hash calculation unit 116) uses the whole of all the asset information or a part of all the asset information as the identification information of the group.

Further, when the master (update data acquisition unit 124) detects the update of the asset information of the computer, the master (update data acquisition unit 124) identifies the asset information corresponding to the identification information by using the identification information of the asset information transmitted from the agent. , It is desirable to update the identification information of the identified asset information stored in the storage unit.

Further, it is desirable to provide a database (for example, asset information resolution DB 800) that stores data in which the identification information of the asset information of the computer and the asset information are associated with each other.

In addition, when there are a plurality of identified asset information, the master determines the existence or nonexistence of other related asset information using information that defines the relationship between the asset information (for example, asset relationship information, configuration information). , It is desirable to identify the asset information based on the judgment result.

In addition, a database generator that generates the database based on information acquired by processing that does not generate communication processing with the agent (for example, software information provided by a vendor, the Web, etc., device specifications, device manuals). (For example, it is desirable to include a DB generation unit 810).

Further, the agent transmits information of an item (for example, an item of IOC file 1111) indicating that a threat due to a malicious program exists to the master as identification information of asset information, and the master (for example, a threat detection unit). 1101) compares the trace information indicating the existence of a threat by a malicious program (for example, the information of the condition item defined in the IOC file 1111) with the identification information of the asset information transmitted from the agent. , It is desirable to detect threats caused by malicious programs.

According to the above-described configuration, asset information can be appropriately managed.

100 ... Computer asset management system, 110 ... Agent, 120 ... Master.

Claims (16)

A computer asset management system that manages computer asset information.
Equipped with a master and an agent
The agent
It monitors a predetermined event that occurs on the computer to be monitored, and sends identification information that can identify asset information that may have been added or changed by the event to the master.
Based on the asset group data that associates a plurality of asset information with the group to which the plurality of asset information belongs, a group to which the asset information that may have been added or changed by the event that occurred is associated is identified. Judge that all asset information belonging to the specified group may have been added or changed by the event.
A computer asset management system that features. When the agent detects the occurrence of the event shown in the event asset correspondence data based on the event asset correspondence data in which the event and the asset information are associated with each other, the agent acquires the asset information corresponding to the detected event. The identification information of the asset information is generated based on the acquired asset information, and the generated identification information is transmitted to the master.
The computer asset management system according to claim 1. The agent calculates a hash based on the asset information as identification information of the asset information.
The computer asset management system according to claim 2. The agent uses the entire asset information, a part of the asset information, the whole header information of the file defining the asset information, or a part of the header information of the file as the identification information of the asset information.
The computer asset management system according to claim 2. The agent transmits one or more units of identification information of asset information that may have been added or changed due to an event that has occurred in one communication.
The computer asset management system according to claim 1. A storage unit for storing identification information of the asset information of the computer is provided.
The master compares the identification information of the asset information transmitted from the agent with the identification information stored in the storage unit, and detects whether or not the asset information is updated.
The computer asset management system according to claim 1. The agent sends identification information that can identify the group to the master.
The computer asset management system according to claim 1 . The agent calculates a hash by combining a part of the asset information among all the asset information as the identification information of the group.
The computer asset management system according to claim 7 . The agent calculates a hash by combining all the asset information as the identification information of the group.
The computer asset management system according to claim 7 , wherein the computer asset management system is characterized in that. The agent uses the whole of all the asset information or a part of all the asset information as the identification information of the group.
The computer asset management system according to claim 7 . When the master detects an update of the asset information of the computer, the master identifies the asset information corresponding to the identification information by using the identification information of the asset information transmitted from the agent, and the identification stored in the storage unit. Update the identification information of the asset information
The computer asset management system according to claim 6. A database for storing data in which the identification information of the asset information of the computer and the asset information are associated with each other is provided.
The computer asset management system according to claim 11 . When the identified asset information is plural, the master determines the existence or nonexistence of other related asset information using the information defining the relationship between the asset information, and identifies the asset information based on the determination result. ,
The computer asset management system according to claim 12 . It is provided with a database generation unit that generates the database based on the information acquired by the process that does not generate the communication process with the agent.
The computer asset management system according to claim 12 . The agent sends information on an item indicating that a threat due to a malicious program exists to the master as identification information of asset information.
The master detects the threat by the malicious program by comparing the trace information indicating the existence of the threat by the malicious program with the identification information of the asset information transmitted from the agent.
The computer asset management system according to claim 1. A computer asset management method that manages computer asset information.
The first step in which the agent monitors a predetermined event that occurs on the computer to be monitored, and
A second step in which the agent sends identifiable identification information to the master that can identify asset information that may have been added or modified by the event that occurred.
A group to which asset information that may have been added or changed by an event that has occurred is associated with the agent based on the asset group data that associates the plurality of asset information with the group to which the plurality of asset information belongs. And the third step to determine that all asset information belonging to the identified group may have been added or changed by the event.
A computer asset management method characterized by providing.

Images