Tampering monitoring system, control device, and tampering control method

A tampering monitoring system formed by an information security device and a management apparatus, the information security device including a plurality of monitoring modules that monitor for tampering, and the management apparatus managing the information security device,

• the management apparatus comprising:
• a non-transitory memory device that stores a program;
• and
• a processing device that executes the program to cause the management apparatus to operate as:
• an acquisition unit comprising logic configured to acquire a new monitoring module that has not been tampered with;
• a generation unit comprising logic configured to generate a decoy monitoring module by modifying the acquired monitoring module;
• a transmission unit comprising logic configured to transmit the decoy monitoring module to the information security device and cause the information security device to install the decoy monitoring module therein;
• a reception unit comprising logic configured to receive from the information security device, after the decoy monitoring module has been installed, monitoring results generated by the monitoring modules monitoring other monitoring modules;
• and
• a determination unit comprising logic configured to identify, by referring to the received monitoring results, a monitoring module that determines the decoy monitoring module to be valid and to determine the identified monitoring module to be invalid,
• wherein the generation unit generates the decoy monitoring module to include an invalid verification certificate,
• wherein the transmission unit transmits the decoy monitoring module that includes the invalid verification certificate to the information security device and causes the information security device to install the decoy monitoring module therein, and
• wherein each monitoring module in the information security device determines whether the decoy monitoring module has been tampered with by referring to the verification certificate included in the decoy monitoring module.

An integrated circuit for managing an information security device that includes a plurality of monitoring modules that monitor for tampering, the integrated circuit comprising:

• a non-transitory memory device that stores a program;
• and
• a processing device that executes the program to cause the integrated circuit to operate as:
• an acquisition unit comprising logic configured to acquire a new monitoring module that has not been tampered with;
• a generation unit comprising logic configured to generate a decoy monitoring module by modifying the acquired monitoring module;
• a transmission unit comprising logic configured to transmit the decoy monitoring module to the information security device and cause the information security device to install the decoy monitoring module therein;
• a reception unit comprising logic configured to receive from the information security device, after the decoy monitoring module has been installed, monitoring results generated by the monitoring modules monitoring other monitoring modules;
• and
• a determination unit comprising logic configured to identify, by referring to the received monitoring results, a monitoring module that determines the decoy monitoring module to be valid and to determine the identified monitoring module to be invalid,
• wherein the generation unit generates the decoy monitoring module to include an invalid verification certificate,
• wherein the transmission unit transmits the decoy monitoring module that includes the invalid verification certificate to the information security device and causes the information security device to install the decoy monitoring module therein, and
• wherein each monitoring module in the information security device determines whether the decoy monitoring module has been tampered with by referring to the verification certificate included in the decoy monitoring module.

A management method used in a management apparatus for managing an information security device that includes a plurality of monitoring modules that monitor for tampering, the management method comprising the steps of:

• acquiring a new monitoring module that has not been tampered with;
• generating a decoy monitoring module by modifying the acquired monitoring module;
• transmitting the decoy monitoring module to the information security device and causing the information security device to install the decoy monitoring module therein;
• receiving from the information security device, after the decoy monitoring module has been installed, monitoring results generated by the monitoring modules monitoring other monitoring modules;
• and
• identifying, by referring to the received monitoring results, a monitoring module that determines the decoy monitoring module to be valid and to determine the identified monitoring module to be invalid,
• wherein the generating generates the decoy monitoring module to include an invalid verification certificate,
• wherein the transmitting transmits the decoy monitoring module that includes the invalid verification certificate to the information security device and causes the information security device to install the decoy monitoring module therein, and
• wherein each monitoring module in the information security device determines whether the decoy monitoring module has been tampered with by referring to the verification certificate included in the decoy monitoring module.

A non-transitory computer-readable recording medium having a computer program recorded thereon, the computer program being used in a management apparatus for managing an information security device that includes a plurality of monitoring modules that monitor for tampering, and the computer program causing a computer, which is the management apparatus, to execute a method comprising the steps of:

• acquiring a new monitoring module that has not been tampered with;
• generating a decoy monitoring module by modifying the acquired monitoring module;
• transmitting the decoy monitoring module to the information security device and causing the information security device to install the decoy monitoring module therein;
• receiving from the information security device, after the decoy monitoring module has been installed, monitoring results generated by the monitoring modules monitoring other monitoring modules;
• and
• identifying, by referring to the received monitoring results, a monitoring module that determines the decoy monitoring module to be valid and to determine the identified monitoring module to be invalid,
• wherein the generating generates the decoy monitoring module to include an invalid verification certificate,
• wherein the transmitting transmits the decoy monitoring module that includes the invalid verification certificate to the information security device and causes the information security device to install the decoy monitoring module therein, and
• wherein each monitoring module in the information security device determines whether the decoy monitoring module has been tampered with by referring to the verification certificate included in the decoy monitoring module.