Intrusion prevention device, intrusion prevention method, and intrusion prevention program

1. An intrusion prevention device comprising:

a processor; and

a memory wherein the processor is configured to

receive, from a control target device connected to an industrial device, a notification indicating a current state of the control target device;

receive, from the industrial device, a notification about a place of the industrial device,

receive, from a scheduler that managers current date and time, a notification indicating time,

receive a control command transmitted from a control device to the control target device, and

specify a current state of the control target device, a current time zone, and a place of the industrial device based on the notification received, and specify a state after transition that is made in a case in which the control target device receives the control command,

wherein the memory stores therein a table in which processing content indicating whether to permit or block passage of the control command is specified in advance for each combination of a current state of the control target device, a state after transition made by receiving the control command, a time zone, and a place of the industrial device, and

wherein the processor is further configured to

acquire, from the table stored in the storage unit, the processing content corresponding to the combination of the current state of the control target device, the state after transition, the current time zone, and the place of the industrial device that are specified, and

determine whether to permit or block passage of the received control command received in accordance with the acquired processing content.

2. The intrusion prevention device according to claim 1 , wherein

in the table, whether to notify an external device of an anomaly is specified as the processing content, and

the processor configured to

acquire, from the table stored in the memory, the processing content corresponding to the combination of the current state of the control target device, the state after transition, the current time zone, and the place of the industrial device specified, and

in accordance with the acquired processing content, determine whether to permit or block passage of the control command received and notifies the external device of an anomaly.

3. The intrusion prevention device according to claim 1 , wherein the processor configured to

determine whether to permit or block passage of the received control command received in accordance with the combination of the current state of the control target device, the state after transition of the control target device, the current time zone, and the place of the industrial device,

transmit the control command to the control target device when determining to permit the passage, and

discard the control command when determining to block the passage.

4. The intrusion prevention device according to claim 1 , wherein

the processor is configured to

receive, from a network device, the control command transmitted from the control device to the control target device, and

determine whether to permit or block passage of the control command received in accordance with the combination of the current state, the state after transition of the control target device, the current, time zone and the place of the industrial device,

instruct the network device to transmit the control command to the control target device when determining to permit the passage, and

instruct the network device to discard the control command when determining to block the passage.

5. An intrusion prevention method executed by an intrusion prevention device, the method comprising:

receiving, from a control target device connected to an industrial device, a notification indicating a current state of the control target device;

receiving, from the industrial device a notification about a place of the industrial device;

receiving, from a scheduler that managers current date and time, a notification indicating time;

receiving a control command transmitted from a control device to the control tar e device;

specifying a current state of the control target device, a current time zone, and a place of the industrial device based on the notification received, and specifying a state after transition that is made in a case in which the control target device receives the control command;

storing, in a memory, a table in which processing content indicating whether to permit or block passage of the control command is specified in advance for each combination of a current state of the control target device, a state after transition made by receiving the control command, a time zone, and a place of the industrial device;

acquiring, from the table stored in the memory, the processing content corresponding to the combination of the current state of the control target device, the state after transition, the current time zone, and the place of the industrial device that are specified; and

determining whether to permit or block passage of the received control command in accordance with the acquired processing content.

6. A non-transitory computer-readable recording medium containing an intrusion prevention program for causing a computer to execute:

receiving, from a control target device connected to an industrial device, a notification indicating a current state of the control target device;

receiving from the industrial device, a notification about a place of the industrial device;

receiving, from a scheduler that manages current date and time, a notification indicating time;

receiving a control command transmitted from a control device to the control target device;

specifying a current state of the control target device, a current time zone, and a place of the industrial device based on the notification received, and specifying a state after transition that is made in a case in which the control target device receives the control command;

storing, in a memory, a table in which processing content indicating whether to permit or block passage of the control command is specified in advance for each combination of a current state of the control target device, a state after transition made by receiving the control command, a time zone, and a place of the industrial device;

acquiring, from the table stored in the memory, the processing content corresponding to the combination of the current state of the control target device, the state after transition, the current time zone, and the place of the industrial device that are specified; and

determining whether to permit or block passage of the received control command in accordance with the acquired processing content.