Mitsubishi Electric Corporation

Mitsubishi Electric R&d Centre Europe B.v.

Teruyoshi Yamaguchi

Nobuhiro Kobayashi

Koichi Shimizu

Tsunato Nakai

Tsuneo Sato

Takeshi Ueda

Masaki Higuchi

Makoto Itoi

Yoshinori Nakajima

Jin Kawasaki

Masamichi Tanji

Benoit Boyer

Hiroyasu Tabata

Takehisa Miwa

When a hash expected value, which is an expected value of a hash value of activation software, is stored in a storing unit (), a security calculation unit () compares the hash value of the activation software with the hash expected value. A main calculation unit () activates the activation software when the hash value and the hash expected value match, and stops a process when both do not match. The main calculation unit () performs signature verification for the activation software when the hash expected value is not stored in the storing unit (), and stores in the storing unit () as the hash value expected value, the hash value of the activation software as well as activates the activation software when the signature verification is successful. The main calculation unit () stops a process when the signature verification is not successful.

Software verification device

An object of this invention is to obtain a whitelist generator with which the accuracy of data relating to the specifications of normal communication serving as an automatic generation source can be guaranteed, whereby the accuracy of a generated whitelist can be guaranteed over an entire whitelist generation flow. The whitelist generator is applied to a system formed from a plurality of devices, the plurality of devices being configured to exchange data with each other, in order to generate a whitelist used for whitelisting intrusion detection, and includes a model verification unit that verifies, on the basis of an input model, at least one of whether or not normal communication in the system has been modeled correctly and whether or not the model is logically consistent, and a model conversion unit that converts the verified model into a whitelist.

Whitelist generator, whitelist evaluator, whitelist generator/evaluator, whitelist generation method, whitelist evaluation method, and whitelist generation/evaluation method

A key management apparatus receives a key request including a first device identification information and a second device identification information, encrypts a common key using the first device identification information to generate a first encrypted common key, encrypts the common key using the second device identification information to generate a second encrypted common key, and transmits a key response including the first encrypted common key and the second encrypted common key. A first device receives the key response, decrypts the first encrypted common key using the first device identification information to obtain the common key, and transmits the second encrypted common key. A second device receives the second encrypted common key and decrypts the second encrypted common key using the second device identification information to obtain the common key.

Key management system, communication device and key sharing method

A state detection section () detects states of a plurality of controllers () included in a communication system (). An attack determination section () selects, from among a plurality of whitelists () each of which is associated with a combination of states, a whitelist () associated with the combination of the states of the plurality of controllers () detected by the state detection section (). The attack determination section () detects an attack on the communication system () by using the selected whitelist ().

Intrusion detection device, intrusion detection method, and computer readable medium

An allowed communication list conversion unit () assigns one or more flags to request communication and response communication, between which a correspondence relationship is described in a detection rule, and describes, in an allowed communication list, details of a flag operation specifying a value to be set to the flag and a flag condition for determining whether the value to be set is set in the flag, in association with each other. A determination unit () sets the value after determining that communication data on the request communication is normal, determines whether the value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal, and determines that the communication data on the response communication is normal when the value is set, to thereby reset the flag.

Data determination device, data determination method, and data determination program

In the present invention, unauthorized access from outside a facility to a device disposed inside the facility is detected by effectively using the output from a mirror port of a network switch. A gateway device has: a monitored data acquisition unit for saving in a monitored data storage unit, as monitored data, packet data that is outputted from a mirror port of a switch, the packet data being outputted from a device being monitored; an unauthorized access detection unit for detecting unauthorized access by determining whether the monitored data is abnormal on the basis of a comparison between the monitored data and assessment rules; and an unauthorized access notification unit for notifying a server of a monitoring center, which is connected to an external network via an external communication unit, that unauthorized access has been detected.

Relay apparatus, network monitoring system, and program

A data determination apparatus of the present invention includes a state transition model storage unit to store a state transition model representing a state transition, a state management unit to hold an operating state of an own apparatus based on the state transition model, a communication permission list storage unit to store, as a communication permission list, communication permitted data whose communications are permitted in respective operating states, a communication unit to obtain communication determination data, and a determination unit to determine whether or not the communication determination data is communication permitted data whose communication has been permitted in a current operating state, using the current operating state and the communication permission list.

Data determination apparatus, data determination method, and computer readable medium

The present invention relates to: a packet filtering apparatus that represents a rule set for packet filtering being a technique for preventing a cyber-attack, using a tree structure suitable for calculation of a logical expression, thereby improving processing efficiency; and a packet filtering method thereof. The packet filtering apparatus includes: a rule set containing a rule in which a condition and an action are associated with each other, and a Zero-Suppressed Binary Decision Diagram (ZDD) that represents a logical expression in which the condition of the rule is described using a logical variable; a packet analyzing unit to analyze a packet received from a network and extract collation information being a character string to be collated; and a filtering unit to collate the collation information extracted by the packet analyzing unit with the ZDD, execute the action associated with the condition that the collation information matches, and permit or deny communication of the packet.

Packet filtering apparatus and packet filtering method

A certificate management apparatus retains an important certificate, while deleting the oldest referenced certificate. An update determination information output unit outputs update determination information being information for determining whether or not to update a certificate. A certificate cache stores the certificate on a volatile memory. An operation unit stores the update determination information output by the update determination information output unit in the certificate cache by relating to the certificate, and based on the update determination information stored in the certificate cache, updates the certificate related to the update determination information.

Certificate management apparatus and certificate management method

A delay element delays an output signal Dt from an arithmetic circuit and outputs a delayed signal Dd. An XOR element compares the output signal Dt with the delayed signal Dd, and outputs an XORout signal with the signal value '0' when the signals match each other, and outputs an XORout signal with the signal value '1' when the signals do not match each other. In a flip-flop, when the signal value of the XORout signal at the rise of a clock of a clock signal CK is &#x201c;0&#x201d;, the output signal Dt is output from a flip-flop, and when the signal value of the XORout signal at the rise of the clock becomes &#x201c;1&#x201d; even once, a fixed value of the signal value &#x201c;0&#x201d; continues to be output.

Growing community of inventors

Tokyo, Japan

Teruyoshi Yamaguchi