Information processing device and malicious message detection method
An information processing device that receives, from another information processing device, a communication message generated based on recency information and control data, includes: a recency information generation unit that generates the recency information; and a recency information management unit that extracts the recency information from the received communication message.
1. A first information processing device that receives, from a second information processing device, a communication message generated based on recency information and control data, the first information processing device comprising:
a hardware processor programmed to:
generate the recency information;
extract the recency information from the received communication message; and
update the recency information according to the communication message, and, based on a synchronizing communication message containing the recency information, synchronize the recency information in the first information processing device with the recency information in the second information processing device;
wherein the recency information is a pseudo-random number sequence generated from a seed, the seed is updated each time a byte length of the pseudo-random number sequence reaches a predetermined number, the updated seed is encrypted, and the encrypted updated seed is sent to the second information processing device.
2. The first information processing device according to claim 1 , wherein:
the communication message is generated by assigning the recency information to the control data within a range of a predetermined data length.
3. The first information processing device according to claim 1 , wherein the processor:
stores a verification rule according to a type of the control data; and
verifies true/false of the control data based on the verification rule.
4. The first information processing device according to claim 3 , wherein:
a type of the control data and a data verification area are associated and stored in the processor; and
the processor verifies true/false of the control data based on data of the data verification area.
5. The first information processing device according to claim 3 , wherein:
the processor verifies true/false of the control data based on at least one among a verification using a minimum value and a maximum value of the control data, a verification using a predetermined area of the control data, or a verification using a checksum of the control data as the verification rule.
6. The first information processing device according to claim 3 , wherein:
when the processor determines that the control data is not legitimate data, the processor generates a synchronizing communication message containing the updated recency information, and sends the generated synchronizing communication message to the second information processing device.
7. The first information processing device according to claim 3 , wherein:
the processor generates a synchronizing communication message containing the updated recency information, and sends the generated synchronizing communication message to the second information processing device; and
the processor generates the generated synchronizing communication message in a predetermined cycle irrespective of a result of verification, and sends the generated synchronizing communication message to the second information processing device.
8. The first information processing device according to claim 1 , wherein:
the processor calculates an exclusive OR of the received communication message and the recency information, and extracts the recency information from the received communication message.
9. A method of detecting whether a communication message generated by a first information processing device based on recency information and control data is a malicious message, in a second information processing device, the method comprising:
generating the recency information by a processor of the first information processing device;
extracting the recency information from the communication message by a processor of the second information processing device; and
updating the recency information according to the communication message, and, based on a synchronizing communication message containing the recency information, synchronizing the recency information in the first information processing device with the recency information in the second information processing device;
wherein the recency information is a pseudorandom number sequence generated from a seed, the seed is updated each time a byte length of the pseudo-random number sequence reaches a predetermined number, the updated seed is encrypted as a plain text, and the encrypted updated seed is sent to the second information processing device.
10. The malicious message detection method according to claim 9 , wherein:
the communication message is generated by assigning the recency information to the control data within a range of a predetermined data length.