WO2025028004A1 - Detection system, detection device, response device, and detection method - Google Patents

Abstract

A detection system comprising a response device and a detection device which detects an abnormality in a network containing the response device and transmission paths, wherein: the detection device transmits response data generation information to be used in the generation of response data to the response device via a first transmission path; the response device generates response data on the basis of the response data generation information received from the detection device and transmits the generated response data to the detection device via a second transmission path; the detection device detects an abnormality in the network on the basis of the response data and reference information based on the configuration of the network; and at least one of the first transmission path and the second transmission path includes a main transmission path for transmitting a main signal in the network.

Description

DETECTION SYSTEM, DETECTION DEVICE, RESPONSE DEVICE AND DETECTION METHOD - Patent application

The present disclosure relates to detection systems, detection devices, response devices and detection methods.
This application claims priority based on Japanese Patent Application No. 2023-125266, filed on August 1, 2023, the disclosure of which is incorporated herein in its entirety.

Patent Document 1 (JP Patent Publication 2003-191804A) discloses the following vehicle communication system. That is, the vehicle communication system is a vehicle communication system in which a plurality of electrical devices mounted on a vehicle are provided with communication means for performing data communication via communication lines wired to the vehicle, enabling data to be transmitted and received between each of the electrical devices, and each of the electrical devices is provided with a plurality of communication means for communicating the same data using different communication lines, and a selection means for selecting normal received data from a plurality of received data obtained by communication using the plurality of communication means, and one of the plurality of communication means is a low-speed communication means for performing data communication at a communication speed slower than the other communication means, thereby making the reliability of data communication by the low-speed communication means higher than that of the other communication means.

JP 2003-191804 A

The detection system of the present disclosure includes a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, the detection device transmits response data generation information used to generate response data to the response device via a first transmission path, the response device generates the response data based on the response data generation information received from the detection device and transmits the generated response data to the detection device via a second transmission path, the detection device detects an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

One aspect of the present disclosure can be realized not only as a detection system equipped with such characteristic processing units, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that realizes part or all of the detection system.

FIG. 1 is a diagram illustrating a configuration of a detection system according to a first embodiment of the present disclosure. FIG. 2 is a diagram illustrating a configuration of a detection device in the detection system according to the first embodiment of the present disclosure. FIG. 3 is a diagram showing a configuration of a response device in the detection system according to the first embodiment of the present disclosure. FIG. 4 is a diagram illustrating a configuration of a detection system according to a first modification of the first embodiment of the present disclosure. FIG. 5 is a diagram illustrating a configuration of a detection system according to a second modification of the first embodiment of the present disclosure. FIG. 6 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the first embodiment of the present disclosure. FIG. 7 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the first modification of the first embodiment of the present disclosure. FIG. 8 is a diagram illustrating a configuration of a detection system according to the second embodiment of the present disclosure. FIG. 9 is a diagram illustrating a configuration of a detection device in a detection system according to the second embodiment of the present disclosure. FIG. 10 is a diagram showing a configuration of a response device in a detection system according to a second embodiment of the present disclosure. FIG. 11 is a diagram illustrating a configuration of a detection system according to a third modification of the second embodiment of the present disclosure. FIG. 12 is a diagram illustrating a configuration of a response device in a detection system according to a third modification of the second embodiment of the present disclosure. FIG. 13 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the second embodiment of the present disclosure. FIG. 14 is a diagram illustrating an example of a sequence of a detection process in a detection system according to a third modification of the second embodiment of the present disclosure.

　Technologies have been developed to improve the reliability of data communications in networks.

[Problem to be solved by the present disclosure]
There is a demand for technology that can improve security in a network beyond the technology described in Patent Document 1.

The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a detection system, detection device, response device, and detection method that can improve security in a network.

[Effects of the present disclosure]
According to the present disclosure, security in a network can be improved.

[Description of the embodiments of the present disclosure]
First, the contents of the embodiments of the present disclosure will be listed and described.

(1) A detection system according to an embodiment of the present disclosure includes a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, the detection device transmits response data generation information used to generate response data to the response device via a first transmission path, the response device generates the response data based on the response data generation information received from the detection device and transmits the generated response data to the detection device via a second transmission path, the detection device detects an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

In this way, by using a configuration that detects network anomalies based on reference information based on the network configuration and response data transmitted over a transmission path, it is possible to detect changes in the network configuration as a network anomaly, for example, based on the results of comparing the reference information with the response data. This makes it possible to improve security in the network.

(2) In the above (1), the first transmission path may be the main transmission path and the second transmission path may be a dedicated line used to detect abnormalities in the network, or the second transmission path may be the main transmission path and the first transmission path may be a dedicated line used to detect abnormalities in the network.

This configuration makes it possible to detect network anomalies while minimizing the impact on communications using the main transmission line.

(3) In the above (2), the first transmission path may be the dedicated line, and the second transmission path may be the main transmission path.

With this configuration, for example, response data generation information can be flexibly sent to multiple response devices using a dedicated line.

(4) In any of (1) to (3) above, the response device may generate the response data further based on unique information of the response device and transmit the generated response data to the detection device via the second transmission path, and the reference information may include the unique information. The detection device may generate generated data based on the unique information included in the reference information and the response data generation information transmitted to the response device, compare the received response data with the generated data, and detect an abnormality in the network based on the comparison result.

With this configuration, for example, the presence of a fraudulent device masquerading as a response device can be detected as a network anomaly based on the results of comparing response data generated in the response device with response data generated in the detection device based on reference information.

(5) In any of (1) to (4) above, the detection device may detect an anomaly in the network based on the number of pieces of response data received.

With this configuration, for example, if the number of received response data is greater than the number of response devices in the network, it can be determined that a detour has been inserted in the network, and if the number of received response data is less than the number of response devices in the network, it can be determined that a route blockage has occurred in the network.

(6) In any of (1) to (5) above, the detection device may detect an abnormality in the network based on the timing of receiving the response data.

With this configuration, for example, if the timing of receiving the response data differs from the timing corresponding to the timing of sending the response data generation information, it can be determined that a detour has been inserted to transmit the response data generated in another network.

(7) In any of (1) to (6) above, the first logical transmission path and the second logical transmission path may be provided using a common physical transmission line, and the detection device and the response device may multiplex and transmit the response data generation information and the response data on the transmission line.

This configuration makes it possible to detect network anomalies without using a transmission line separate from the main transmission line in the network.

(8) In any of (1) to (7) above, the detection system may further include an aggregation device, and the aggregation device may generate aggregated data in which the multiple response data generated by the multiple response devices are aggregated, and transmit the generated aggregated data to the detection device.

This configuration can reduce the increase in communication traffic caused by the transmission of response data, and can also improve the efficiency of verifying response data in the detection device.

(9) A detection system according to an embodiment of the present disclosure includes a first response device, a second response device, and a detection device that detects an abnormality in a network including the first response device, the second response device, and a transmission path, wherein the detection device transmits response data generation information used to generate response data to the first response device and the second response device via a first transmission path, the first response device generates first response data, which is the response data, based on the response data generation information received from the detection device, transmits the generated first response data to the second response device via a second transmission path, and transmits the generated first response data to the second response device via a second transmission path. The device generates second response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated second response data and the first response data received from the first response device to the detection device, and the detection device detects an abnormality in the network based on reference information based on the configuration of the network, the first response data transmitted by the first response device, and the second response data transmitted by the second response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

In this way, by using a configuration that detects network anomalies based on reference information based on the network configuration and response data transmitted over a transmission path, it is possible to detect changes in the network configuration as a network anomaly, for example, based on the results of comparing the reference information with the response data. This makes it possible to improve security in the network.

(10) A detection device according to an embodiment of the present disclosure includes a transmission unit that transmits response data generation information used to generate response data to a response device in a network via a first transmission path, a reception unit that receives the response data, which is based on the response data generation information, via a second transmission path, and a detection unit that detects an abnormality in the network based on reference information based on the configuration of the network and the response data received by the reception unit, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

In this way, by transmitting response data generation information to a response device via a transmission path and detecting network abnormalities based on reference information based on the network configuration and the response data received via the transmission path, it is possible to detect changes in the network configuration as network abnormalities, for example, based on the results of comparing the reference information with the response data. This makes it possible to improve security in the network.

(11) A response device according to an embodiment of the present disclosure is a response device attached to a communication device in a network, and includes a receiver that receives response data generation information used to generate response data from a detection device that detects an abnormality in the network via a first transmission path, a generator that generates the response data based on the response data generation information received by the receiver, and a transmitter that transmits the response data generated by the generator to another device via a second transmission path, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

In this way, in a response device attached to a communication device in a network, response data based on response data generation information received via a transmission line is transmitted to another device via the transmission line, so that, for example, the other device can detect a change in the network configuration as a network anomaly based on the results of a comparison between information based on the network configuration and the response data received from the response device. This can improve security in the network.

(12) A response device according to an embodiment of the present disclosure includes a receiving unit that receives response data generation information used to generate response data from a detection device that detects network abnormalities via a first transmission path, a generating unit that generates the response data based on the response data generation information received by the receiving unit, and a transmitting unit that transmits the response data generated by the generating unit to another device via a second transmission path, wherein the first transmission path is a main transmission path that transmits a main signal in the network and the second transmission path is a dedicated line used to detect abnormalities in the network, or the second transmission path is the main transmission path and the first transmission path is a dedicated line used to detect abnormalities in the network.

In this way, by using the main transmission path that transmits the main signal in the network and the dedicated line to receive response data generation information and transmit the response data to another device, it is possible to suppress the impact on communications using the main transmission path, while, for example, in the other device, based on the comparison result between information based on the network configuration and the response data received from the response device, detect a change in the network configuration as a network abnormality. Therefore, security in the network can be improved.

(13) A detection method according to an embodiment of the present disclosure is a detection method in a detection system including a response device and a detection device that detects an abnormality in a network including the response device and a transmission path, the detection device transmitting response data generation information used to generate response data to the response device via a first transmission path, the response device generating the response data based on the response data generation information received from the detection device and transmitting the generated response data to the detection device via a second transmission path, and the detection device detecting an abnormality in the network based on reference information based on the configuration of the network and the response data transmitted by the response device, and at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

In this way, by using a method for detecting network anomalies based on reference information based on the network configuration and response data transmitted over a transmission path, it is possible to detect a change in the network configuration as a network anomaly, for example, based on the results of comparing the reference information with the response data. This makes it possible to improve security in the network.

Below, embodiments of the present disclosure will be described with reference to the drawings. Note that the same or equivalent parts in the drawings will be given the same reference numerals and their description will not be repeated. In addition, at least some of the embodiments described below may be combined in any manner.

First Embodiment
[Configuration and basic operation]
Fig. 1 is a diagram showing a configuration of a detection system according to a first embodiment of the present disclosure. Referring to Fig. 1, the detection system 401 includes response devices 101A and 101B that are response devices 101, communication devices 111A and 111B that are communication devices 111, a gateway device 121, and detection devices 301A and 301B that are detection devices 301. For example, the detection system 401 includes M response devices 101A, M communication devices 111A, N response devices 101B, and N communication devices 111B. M and N are integers equal to or greater than 2. The detection system 401 may include one response device 101A and one communication device 111A, or one response device 101B and one communication device 111B.

For example, the detection system 401 is used in a network in an industrial control system such as a factory or plant. In this case, the communication device 111 is, for example, a power supply control unit, a robot, a sensor, or a PLC (Programmable Logic Controller) for controlling an actuator.

The detection system 401 may be used in a home network or an in-vehicle network. When the detection system 401 is used in an in-vehicle network, the communication device 111 and the detection device 301 are an in-vehicle ECU (Electronic Control Unit).

For example, the answering device 101 is a connector that can be attached to the communication device 111. In the example shown in FIG. 1, the answering device 101A is attached to each of the communication devices 111A, and the answering device 101B is attached to each of the communication devices 111B.

The gateway device 121 and the response device 101A are connected in a one-to-many relationship. More specifically, the gateway device 121, the response device 101A, and the detection device 301A are connected to each other via transmission line 2A, which is transmission line 2. Furthermore, the detection device 301A and the response device 101A are connected to each other via transmission line 1A, which is transmission line 1. Transmission lines 1 and 2 are physical transmission paths.

The gateway device 121 and the response device 101B are connected in a one-to-many relationship. More specifically, the gateway device 121, the response device 101B, and the detection device 301B are connected to each other via transmission line 2B, which is transmission line 2. Also, the detection device 301B and the response device 101B are connected to each other via transmission line 1B, which is transmission line 1.

The detection system 401 includes networks NWa and NWb. Network NWa is composed of a gateway device 121, a response device 101A, a communication device 111A, and a transmission line 2A. Network NWb is composed of a gateway device 121, a response device 101B, a communication device 111B, and a transmission line 2B. Hereinafter, each of networks NWa and NWb will also be referred to as network NW.

Transmission line 2A includes a main transmission path that transmits a main signal in network NWa. Transmission line 2B includes a main transmission path that transmits a main signal in network NWb. Transmission line 1A is a dedicated line used to detect abnormalities in network NWa. Transmission line 1B is a dedicated line used to detect abnormalities in network NWb. Transmission line 1 is an example of a first transmission path, and transmission line 2 is an example of a second transmission path.

Transmission lines 1 and 2 are, for example, transmission lines for serial communication conforming to standards such as RS (Recommended Standard)-232C, RS-422A, and RS-485. Note that transmission lines 1 and 2 may also be transmission lines conforming to other standards such as CAN (Controller Area Network) (registered trademark) and LIN (Local Interconnect Network).

Communication device 111A communicates with gateway device 121 and other communication devices 111A via corresponding response device 101A and transmission line 2A. Communication device 111B communicates with gateway device 121 and other communication devices 111B via corresponding response device 101B and transmission line 2B. As an example, communication device 111 transmits a message conforming to Modbus (registered trademark) addressed to other communication devices 111 to gateway device 121 and other communication devices 111 via corresponding response device 101 and transmission line 2.

The gateway device 121 performs relay processing to relay, for example, messages exchanged between communication devices 111 connected to different transmission lines 2 via the response device 101, and messages exchanged between communication devices 111 and an external network (not shown) outside the detection system 401. For example, communication device 111A sends and receives low-confidentiality messages, and is communicatively connected to the external network via the gateway device 121. On the other hand, communication device 111B sends and receives highly confidential messages, and its communicative connection to the external network is restricted.

Detection device 301A periodically or irregularly transmits response data generation information Ga used to generate response data Ra to response device 101A via transmission line 1A. Detection device 301B also periodically or irregularly transmits response data generation information Gb used to generate response data Rb to response device 101B via transmission line 1B. Hereinafter, each of response data Ra and Rb will also be referred to as response data R, and each of response data generation information Ga and Gb will also be referred to as response data generation information G.

Each response device 101A generates response data Ra based on the response data generation information Ga received from the detection device 301A, and transmits the generated response data Ra to the detection device 301A via the transmission line 2A. For example, the response device 101A transmits the response data Ra to the detection device 301A by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Ra onto the transmission line 2A over which the main signal in the network NWa is transmitted.

Furthermore, each response device 101B generates response data Rb based on the response data generation information Gb received from the detection device 301B, and transmits the generated response data Rb to the detection device 301B via the transmission line 2B. For example, the response device 101B transmits the response data Rb to the detection device 301B by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Rb to the transmission line 2B over which the main signal in the network NWb is transmitted.

The detection device 301A detects an abnormality in the network NWa based on reference information RFa based on the configuration of the network NWa and response data Ra transmitted by the response device 101A. The detection device 301B detects an abnormality in the network NWb based on reference information RFb based on the configuration of the network NWb and response data Rb transmitted by the response device 101B. More specifically, the detection device 301 detects a change in the network configuration of the corresponding network NW as an abnormality in that network NW. In other words, the detection device 301 detects a change in the network topology of the network NW as an abnormality in that network NW. Hereinafter, each of the reference information RFa and RFb will also be referred to as reference information RF.

For example, the detection device 301 detects a route blockage in the network NW as an abnormality in the corresponding network NW. The route blockage includes a physical route blockage caused by cutting the transmission line 1, and a logical route blockage caused by adding an unauthorized filter device to the transmission line 1 that discards some or all messages.

Also, for example, the detection device 301 detects the insertion of a detour, which is a transmission path that does not go through the gateway device 121, between the response device 101A and the response device 101B as an abnormality in the network NW. The insertion of a detour includes the insertion of a physical detour by changing the wiring of the transmission lines 1A and 1B, and the insertion of a logical detour by inserting an unauthorized repeater that relays a message transmitted on one of the transmission lines 1A and 1B to the other of the transmission lines 1A and 1B.

As described above, communication device 111A is communicatively connected to an external network via gateway device 121, while communication device 111B has a restricted communication connection to the external network. If a detour is inserted between response device 101A and response device 101B, communication device 111B will be communicatively connected to the external network via gateway device 121 and the detour. Therefore, detection device 301 detects the insertion of the detour as an abnormality in network NW.

(Transmission of response data generation information G)
Fig. 2 is a diagram showing a configuration of a detection device in a detection system according to a first embodiment of the present disclosure. Referring to Fig. 2, the detection device 301 includes a transmission unit 31, a reception unit 32, a detection unit 33, and a storage unit 34. A part or all of the transmission unit 31, the reception unit 32, and the detection unit 33 are realized, for example, by a processing circuit including one or more processors. The storage unit 34 is, for example, a non-volatile memory included in the processing circuit.

The detection unit 33 generates response data generation information G and a verification start command periodically or irregularly, and outputs the generated response data generation information G and verification start command to the transmission unit 31. The response data generation information G may be a random number value of a predetermined length, or may be a predetermined value. For example, when generating response data generation information G of a predetermined value, the detection unit 33 generates response data generation information G of a different value from response data generation information G generated in the past, and outputs it to the transmission unit 31. This makes it possible to more reliably detect the presence of an unauthorized device even if the unauthorized device impersonates the response device 101 and performs a retransmission attack.

For example, the detection unit 33 in the detection device 301A generates response data generation information Ga and a verification start command at a specific transmission timing ta and outputs them to the transmission unit 31, and the detection unit 33 in the detection device 301B generates response data generation information Gb and a verification start command at a specific transmission timing tb that is different from the transmission timing ta and outputs them to the transmission unit 31.

The transmitting unit 31 transmits response data generation information G to each response device 101 via transmission line 1. More specifically, the transmitting unit 31 in the detection device 301A receives response data generation information Ga from the detection unit 33, and transmits the received response data generation information Ga and the verification start command in a message to each response device 101A via transmission line 1A. The transmitting unit 31 in the detection device 301B receives response data generation information Gb from the detection unit 33, and transmits the received response data generation information Gb and the verification start command in a message to each response device 101B via transmission line 1B.

(Transmission of response data R)
The following describes the transmission of response data R by the response device 101. Unless otherwise specified, the following content regarding the transmission of response data R is common to the response devices 101A and 101B.

FIG. 3 is a diagram showing the configuration of a response device in a detection system according to a first embodiment of the present disclosure. Referring to FIG. 3, the response device 101 includes a connection unit 10 and a response unit 20. The response unit 20 includes a receiving unit 21, a transmitting unit 22, a processing unit 23, and a storage unit 24. The processing unit 23 is an example of a generation unit. The receiving unit 21, the transmitting unit 22, and a part or all of the processing unit 23 are realized, for example, by a processing circuit including one or more processors. The storage unit 24 is, for example, a non-volatile memory included in the processing circuit.

The connection unit 10 electrically connects the transmission line 2 and the communication device 111. The communication device 111 receives messages sent by other communication devices 111 via the transmission line 2 and the connection unit 10, and transmits messages addressed to other communication devices 111 via the connection unit 10 and the transmission line 2.

The memory unit 24 in the response unit 20 of the response device 101 stores key information K that is unique to the response device 101. The key information K is an example of unique information.

The receiving unit 21 in the response unit 20 receives the response data generation information G from the detection device 301 via the transmission line 1. More specifically, the receiving unit 21 receives a message from the detection device 301 via the transmission line 1, and acquires the response data generation information G from the received message. The receiving unit 21 outputs the acquired response data generation information G to the processing unit 23.

The processing unit 23 generates response data R based on the response data generation information G. For example, the processing unit 23 generates the response data R further based on the key information K in the storage unit 24. More specifically, the processing unit 23 receives the response data generation information G from the receiving unit 21, and generates the response data R using the received response data generation information G and the key information K in the storage unit 24. The response data R may be a digital signature or a message authenticator. The processing unit 23 outputs the generated response data R to the transmitting unit 22.

The transmitting unit 22 transmits the response data R to the detection device 301 via the transmission line 2. More specifically, the transmitting unit 22 receives the response data R from the processing unit 23, generates a message including the received response data R, and transmits the generated message to the detection device 301 via the connection unit 10 and the transmission line 2.

(Detection process)
2 again, the receiving unit 32 in the detection device 301 receives the response data R transmitted by the response device 101 via the transmission line 2. The detection unit 33 performs a detection process to detect an abnormality in the network NW based on the reference information RF based on the configuration of the network NW and the response data R received by the receiving unit 32. The detection process in the detection device 301A will be representatively described below.

For example, the memory unit 34 in the detection device 301A stores reference information RFa indicating the number of response devices 101A connected to the transmission line 1A, the key information K of each response device 101A connected to the transmission line 1A, and the required time TM, which is the time required from when response data generation information Ga is transmitted to the response device 101A until the response device 101A completes transmission of the response data Ra.

The receiving unit 32 in the detection device 301A receives a message from the response device 101 via the transmission line 2A. The receiving unit 32 acquires response data R from the received message, and outputs the acquired response data R and the ID of the response device 101 that sent the response data R to the detection unit 33.

The detection unit 33 receives response data R from the receiving unit 32 and compares the received response data R with information based on the reference information RFa. For example, the detection unit 33 generates generated data Ma based on the key information K included in the reference information RFa and the response data generation information Ga sent to the response device 101A, and compares the response data R received from the receiving unit 32 with the generated data Ma. The detection unit 33 detects an abnormality in the network NWa based on the result of comparing the response data R, the number of response data R received by the receiving unit 32, and the reception timing of the response data R.

More specifically, the detection unit 33 uses the response data generation information Ga transmitted to the response device 101A via the transmission unit 31 and each piece of key information K in the storage unit 34 to generate multiple pieces of generated data Ma corresponding to multiple pieces of response data Ra respectively corresponding to the multiple response devices 101A connected to the transmission line 2A. For example, the generated data Ma is a hash value.

The detection unit 33 compares the response data Ra with the generated data Ma for each response device 101A based on the response data Ra and ID received from the receiving unit 32. For example, the detection unit 33 determines that the detection condition C1 is met when at least one of the multiple response data Ra received by the receiving unit 32 does not match the generated data Ma corresponding to the response device 101A that sent the response data Ra. On the other hand, the detection unit 33 determines that the detection condition C1 is not met when the multiple response data Ra received by the receiving unit 32 match each of the multiple generated data Ma that it generated.

The detection unit 33 also refers to the reference information RFa and compares the number of response data R received by the receiving unit 32 in a predetermined reception period TRa with the number of response devices 101A connected to the transmission line 1A. For example, the reception period TRa is set in advance according to the transmission timing of the response data generation information G in the detection system 401 and the required time TM indicated by the reference information RFa. As an example, the reception period TRa is the period from the transmission timing ta of the response data generation information Ga by the detection device 301A to the transmission timing tb of the response data generation information Gb by the detection device 301B. For example, if the number of response data R received by the receiving unit 32 in the reception period TRa does not match the number of response devices 101A connected to the transmission line 1A, that is, N, the detection unit 33 determines that the detection condition C2 is satisfied. On the other hand, if the number of response data R received by the receiving unit 32 in the reception period TRa is N, the detection unit 33 determines that the detection condition C2 is not satisfied.

The detection unit 33 also checks whether or not response data R has been received by the receiving unit 32 in a period other than the reception period TRa. For example, if there is response data R received by the receiving unit 32 in a period other than the reception period TRa, the detection unit 33 determines that the detection condition C3 is met. On the other hand, if there is no response data R received by the receiving unit 32 in a period other than the reception period TRa, the detection unit 33 determines that the detection condition C3 is not met.

In the detection process, the detection unit 33 detects an abnormality in the network NWa based on the result of the determination as to whether or not the detection conditions C1, C2, and C3 are satisfied. More specifically, when the detection unit 33 determines that at least one of the detection conditions C1, C2, and C3 is satisfied, it determines that an abnormality has occurred in the network NWa.

For example, if detection condition C1 is satisfied, the detection unit 33 determines that there is an unauthorized device masquerading as the response device 101A. Also, for example, if detection condition C2 is satisfied and the number of response data R received by the receiving unit 32 during the reception period TRa is less than N, the detection unit 33 determines that a route blockage has occurred in the network NWa. Also, for example, if detection condition C2 is satisfied and the number of response data R received by the receiving unit 32 during the reception period TRa is greater than N, or if detection condition C3 is satisfied, the detection unit 33 determines that a detour has been inserted in the network NWa.

When the detection unit 33 determines that an abnormality has occurred in the network NWa, it transmits abnormality information indicating that an abnormality has occurred in a message to the response device 101A via the transmission line 1A. The detection unit 33 also notifies the user of the detection system 401 that an abnormality has occurred in the network NWa by voice or display. Note that the processing unit 23 may be configured not to transmit the abnormality information to the response device 101A and/or notify the user.

Referring again to FIG. 3, for example, when the processing unit 23 in the response device 101A receives abnormality information from the detection device 301A via the transmission line 1A and the receiving unit 21, it notifies the user of the detection system 401 by voice or display that an abnormality has occurred in the network NWa. Also, for example, when the processing unit 23 receives abnormality information from the detection device 301A via the transmission line 1A and the receiving unit 21, it cuts off the electrical connection between the transmission line 2A and the communication device 111A at the connection unit 10. Note that the processing unit 23 may be configured not to notify the user or not to cut off the electrical connection between the transmission line 2A and the communication device 111A, or both.

(Variation 1)
FIG. 4 is a diagram showing a configuration of a detection system according to a first modified example of the first embodiment of the present disclosure. Referring to FIG. 4, the detection system 402 includes a detection device 302 instead of the detection device 301A, and includes a response device 102A that is a response device 102 instead of the response device 101A, compared to the detection system 401. Also, the detection system 402 further includes a communication device 111C that is a communication device 111, a response device 102C that is a response device 102, and aggregation devices 201A and 201C, compared to the detection system 401. For example, the detection system 402 includes L response devices 102C and L communication devices 111C. In the example shown in FIG. 4, the communication device 111C is connected to each of the response devices 102C. L is an integer equal to or greater than 2. The detection system 402 may include one response device 102C and one communication device 111C. Hereinafter, each of the aggregation devices 201A and 201C will also be referred to as an aggregation device 201.

Gateway device 121, response device 102A, aggregation device 201A, and detection device 302 are connected to each other via transmission line 2A. Also, response devices 102A and 102C, aggregation devices 201A and 201C, and detection device 302 are connected to each other via transmission line 1A.

The gateway device 121, the response device 102C, and the aggregation device 201C are connected to each other via the transmission line 2C, which is the transmission line 2.

Compared to detection system 401, detection system 402 includes network NW1a instead of network NWa, and further includes network NWc. Network NW1a is composed of gateway device 121, response device 102A, communication device 111A, and transmission line 2A. Network NWc is composed of gateway device 121, response device 102C, communication device 111C, and transmission line 2C.

The detection device 302 transmits the response data generation information Ga to the response devices 102A and 102C and the aggregation devices 201A and 201C via the transmission line 1A.

The response device 102A transmits the response data Ra based on the response data generation information Ga received from the detection device 302 to the aggregation device 201A via the transmission line 2A, including the response data Ra in a message. For example, the response device 102A transmits the response data Ra to the aggregation device 201A by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Ra to the transmission line 2A over which the main signal in the network NWa is transmitted.

The response device 102C also transmits response data Rc based on the response data generation information Ga received from the detection device 302 to the aggregation device 201C via the transmission line 2C, including the response data Rc in a message. For example, the response device 102C transmits the response data Rc to the aggregation device 201C by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Rc to the transmission line 2C over which the main signal in the network NWc is transmitted.

The aggregation device 201A generates aggregated data RxA by aggregating multiple pieces of response data Ra generated by multiple response devices 102A, and transmits the generated aggregated data RxA to the detection device 302.

More specifically, the aggregation device 201A receives a message from the response device 102A via the transmission line 2A. The aggregation device 201A acquires multiple pieces of response data Ra from the multiple messages received during the reception period TRa. The aggregation device 201A performs a predetermined process on the acquired multiple pieces of response data Ra to generate aggregated data RxA with a data volume smaller than the total data volume of the multiple pieces of response data Ra. The aggregation device 201A includes the generated aggregated data RxA in a message and transmits it to the detection device 302 via the transmission line 1A.

The aggregation device 201C also generates aggregated data RxC that aggregates the multiple response data Rc generated by the multiple response devices 102C, and transmits the generated aggregated data RxC to the detection device 302.

More specifically, the aggregation device 201C receives a message from the response device 102C via the transmission line 2C. The aggregation device 201C acquires multiple pieces of response data Rc from the multiple messages received during the reception period TRa. The aggregation device 201C performs a predetermined process on the acquired multiple pieces of response data Rc to generate aggregated data RxC with a data volume smaller than the total data volume of the multiple pieces of response data Rc. The aggregation device 201C includes the generated aggregated data RxC in a message and transmits it to the detection device 302 via the transmission line 1A.

The detection device 302 receives the aggregated data RxA and RxC from the aggregation devices 201A and 201C via the transmission line 1A. The detection device 302 performs detection processing based on the reference information RFac based on the configurations of the networks NW1a and NWc, and the aggregated data RxA and RxC received from the aggregation devices 201A and 201C.

More specifically, the detection device 302 generates a plurality of generated data Ma corresponding to the plurality of response devices 102A connected to the transmission line 2A, and a plurality of generated data Mc corresponding to the plurality of response devices 102C connected to the transmission line 2C.

The detection device 302 compares the aggregated data RxA with the generated data Ma for each response device 102A, and compares the aggregated data RxC with the generated data Mc for each response device 102C.

The detection device 302 determines that the detection condition C1 is met when at least one of the multiple response data Ra aggregated in the aggregated data RxA does not match the generated data Ma corresponding to the response device 102A that sent the response data Ra. The detection device 302 also determines that the detection condition C1 is met when at least one of the multiple response data Rc aggregated in the aggregated data RxC does not match the generated data Mc corresponding to the response device 102C that sent the response data Rc.

On the other hand, if the multiple response data Ra aggregated in the aggregated data RxA match the multiple generated data Ma that were generated, and the multiple response data Rc aggregated in the aggregated data RxC match the multiple generated data Mc that were generated, the detection device 302 determines that the detection condition C1 is not satisfied.

The aggregating device 201A may be configured to generate response data R based on response data generation information Ga received from the detection device 302, and generate aggregated data RxA by performing a predetermined process on the multiple response data Ra and the generated response data R. The aggregating device 201C may be configured to generate response data R based on response data generation information Ga received from the detection device 302, and generate aggregated data RxC by performing a predetermined process on the multiple response data Rc and the generated response data R.

In addition, the aggregation device 201 may be configured to detect abnormalities in the networks NW1a and NWc based on the number of pieces of response data R received and the timing of receiving the response data R, similar to the detection device 302.

(Variation 2)
Fig. 5 is a diagram illustrating a configuration of a detection system according to Modification 2 of the first embodiment of the present disclosure. With reference to Fig. 5, compared to detection system 401, detection system 403 includes detection device 303 instead of detection device 301A, and includes response device 103A instead of response device 101A.

The gateway device 121, the response device 103A, and the detection device 303 are connected to each other via a transmission line 2A. In addition, logical transmission paths 2A1 and 2A2 are provided using the common physical transmission line 2A.

The communication device 111A communicates with the gateway device 121 and other communication devices 111A via the response device 103A and the transmission path 2A1. As an example, the communication device 111A transmits a message conforming to Modbus addressed to the other communication devices 111 to the gateway device 121 and other communication devices 111 via the response device 103A and the transmission path 2A1.

The detection device 303 and the response device 103A multiplex and transmit the response data generation information Ga and the response data Ra on the transmission line 2A.

More specifically, the detection device 303 transmits the response data generation information Ga to the response device 103A via a logically independent transmission path 2A2 that is separate from the transmission path 2A1. For example, the detection device 303 transmits the response data generation information Ga to the response device 103A by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data generation information Ga to the transmission line 2A through which the main signal in the network NWa is transmitted.

The response device 103A generates response data Ra based on the response data generation information Ga received from the detection device 303, and transmits the generated response data Ra to the detection device 303 via the transmission path 2A1. For example, the response device 103A transmits the response data Ra to the detection device 303 by frequency division multiplexing, time division multiplexing, or code division multiplexing the response data Ra onto the transmission line 2A over which the main signal in the network NWa is transmitted.

[Operation flow]
Fig. 6 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the first embodiment of the present disclosure. Fig. 6 illustrates the detection process in the detection device 301A.

Referring to FIG. 6, first, when a predetermined transmission timing ta arrives, the detection device 301 transmits response data generation information Ga to each response device 101A via the transmission line 1A (step S11).

Next, each response device 101A generates response data Ra using the response data generation information Ga received from the detection device 301A and the key information K (step S12).

Next, each response device 101A transmits the generated response data Ra to the detection device 301A via the transmission line 2A (step S13).

Next, the detection device 301A performs detection processing based on the reference information RFa based on the configuration of the network NWa and the response data Ra received from the response device 101A. More specifically, the detection device 301A determines whether or not the detection condition C1 is satisfied by collating the received response data Ra with the generated data Ma for each response device 101A. The detection device 301A also determines whether or not the detection condition C2 is satisfied by referring to the reference information RFa and comparing the number of response data R received during the reception period TRa with the number of response devices 101A connected to the transmission line 1A. The detection device 301A also determines whether or not the detection condition C3 is satisfied based on the reception timing of the response data R. The detection device 301A determines whether or not an abnormality has occurred in the network NWa based on the determination results regarding the detection conditions C1, C2, and C3 (step S14).

FIG. 7 is a diagram showing an example of a sequence of detection processing in a detection system according to a first modified example of the first embodiment of the present disclosure. FIG. 7 shows detection processing in the detection device 302.

Referring to FIG. 7, first, when a predetermined transmission timing ta arrives, the detection device 302 transmits response data generation information Ga to the response devices 102A and 102C and the aggregation devices 201A and 201C via the transmission line 1A (step S21).

Next, each response device 102A generates response data Ra using the response data generation information Ga and key information K received from the detection device 302. Also, each response device 102C generates response data Rc using the response data generation information Ga and key information K received from the detection device 302 (step S22).

Next, each response device 102A transmits the generated response data Ra to the aggregation device 201A via the transmission line 2A. Also, each response device 102C transmits the generated response data Rc to the aggregation device 201C via the transmission line 2C (step S23).

Next, the aggregating device 201A receives the multiple response data Ra transmitted by the multiple response devices 102A, and generates aggregated data RxA by aggregating the multiple received response data Ra. The aggregating device 201C receives the multiple response data Rc transmitted by the multiple response devices 102C, and generates aggregated data RxC by aggregating the multiple received response data Rc (step S24).

Next, the aggregation device 201A transmits the generated aggregated data RxA to the detection device 302 via the transmission line 1A. In addition, the aggregation device 201C transmits the generated aggregated data RxC to the detection device 302 via the transmission line 1A (step S25).

Next, the detection device 302 performs detection processing based on the reference information RFac based on the configuration of the networks NW1a and NWc and the aggregated data RxA and RxC received from the aggregation devices 201A and 201C. More specifically, the detection device 302 compares the received aggregated data RxA with the generated data Ma for each response device 102A, and compares the aggregated data RxC with the generated data Mc for each response device 102C, thereby determining whether or not the detection condition C1 is satisfied. The detection device 302 also refers to the reference information RFa1 and compares the number of response data R aggregated in the aggregated data RxA and RxC with the number of response devices 102A and 102C connected to the transmission lines 2A and 2C, respectively, to determine whether or not the detection condition C2 is satisfied. The detection device 302 also determines whether or not the detection condition C3 is satisfied based on the timing of receiving the response data R. The detection device 302 determines whether an abnormality has occurred in the networks NW1a and NWc based on the results of the determination regarding the detection conditions C1, C2, and C3 (step S26).

In the detection system 401 according to the first embodiment of the present disclosure, the detection device 301A is configured to transmit the response data generation information Ga to the response device 101A via the transmission line 1A, but this is not limited to the above. The detection device 301A may be configured to transmit the response data generation information Ga to the response device 101A via the transmission line 2A. In this case, the response device 101A transmits the response data Ra to the detection device 301A via the transmission line 1A.

Furthermore, in the detection system 401 according to the first embodiment of the present disclosure, the detection device 301 may be configured to transmit the response data generation information G to the response device 101 by wireless communication instead of transmitting the response data generation information G to the response device 101 via the transmission line 1. Further, the response device 101 may be configured to transmit the response data R to the detection device 301 by wireless communication instead of transmitting the response data R to the detection device 301 via the transmission line 1.

In addition, in the detection device 301 according to the first embodiment of the present disclosure, the detection unit 33 is configured to detect an abnormality in the network NW based on the result of the determination as to whether or not the detection conditions C1, C2, and C3 are satisfied, but this is not limited to this. The detection unit 33 may be configured to detect an abnormality in the network NW based on the result of the determination as to whether or not any one or two of the detection conditions C1, C2, and C3 are satisfied.

Incidentally, there is a demand for technology that can improve security in networks. More specifically, for example, if communications between communication devices in a network are encrypted, problems such as a decrease in communication speed and an increase in costs can arise.

In contrast, in the detection system according to the first embodiment of the present disclosure, the detection device 301 transmits response data generation information G used to generate response data R to the response device 101 via transmission line 1A. The response device 101 generates response data R based on the response data generation information G received from the detection device 301, and transmits the generated response data R to the detection device 301 via transmission line 1B. The detection device 301 detects an abnormality in the network NW based on reference information RF based on the configuration of the network NW and the response data R transmitted by the response device 101. At least one of the transmission lines 1A and 1B includes a main transmission path that transmits a main signal in the network NW.

In this way, by using a configuration that detects an abnormality in the network NW based on the reference information RF based on the configuration of the network NW and the response data R transmitted via the transmission path 2A, it is possible to detect a change in the network configuration of the network NW as an abnormality in the network NW, for example, based on the result of comparing the reference information RF with the response data R. Therefore, it is possible to improve security in the network NW. Also, compared to a configuration in which communication between communication devices 111 in the network NW is encrypted, it is possible to detect an abnormality in the network NW while suppressing a decrease in communication speed and an increase in costs. Also, for example, by using a configuration in which the response device 101 is a connector that can be attached to the communication device 111 in the network NW, it is possible to detect an abnormality in the network NW without changing the specifications of the communication device 111.

Next, other embodiments of the present disclosure will be described with reference to the drawings. Note that the same or equivalent parts in the drawings will be given the same reference numerals and their description will not be repeated.

Second Embodiment
[Configuration and basic operation]
In comparison with the detection systems 401, 402, and 403 according to the first embodiment, this embodiment relates to a detection system 404 in which response devices are connected one-to-one via a transmission path that transmits a main signal. The contents other than those described below are the same as those of the detection systems 401, 402, and 403 according to the first embodiment.

FIG. 8 is a diagram showing the configuration of a detection system according to a second embodiment of the present disclosure. The detection system 404 includes response devices 104A, 104B, 104C, and 104D that are response devices 104, response devices 105A, 105B, 105C, and 105D that are response devices 105, communication devices 112A, 112B, 112C, and 112D that are communication devices 112, switch devices 141A and 141B that are switch devices 141, a gateway device 122, and detection devices 304A, 304B, 304C, and 304D that are detection devices 304. The response device 104 is an example of a second response device. The response device 105 is an example of a first response device. The detection system 404 is not limited to a configuration including four detection devices 304, and may be a configuration including one detection device 304. In this case, the detection device 304 monitors all networks NW2, described below, in the detection system 404.

The gateway device 122 is connected to the switch devices 141A and 141B via transmission lines 5A and 5B, respectively. Hereinafter, each of the transmission lines 5A and 5B will also be referred to as a transmission line 5. The transmission line 5 is, for example, an Ethernet (registered trademark) cable.

For example, the response device 104 is a connector that can be attached to the switch device 141. In the example shown in FIG. 8, response devices 104A and 104B are attached to two communication ports (not shown) of the switch device 141A, and response devices 104C and 104D are attached to two communication ports (not shown) of the switch device 141B.

Also, for example, the response device 105 is a connector that can be attached to the communication device 112. In the example shown in FIG. 8, the response device 105A is attached to a communication port (not shown) of the communication device 112A, the response device 105B is attached to a communication port (not shown) of the communication device 112B, the response device 105C is attached to a communication port (not shown) of the communication device 112C, and the response device 105D is attached to a communication port (not shown) of the communication device 112D.

The response device 104 and the response device 105 are connected one-to-one. More specifically, the response device 104A and the response device 105A are connected to each other via a transmission line 4A. Furthermore, the response device 104B and the response device 105B are connected to each other via a transmission line 4B. Furthermore, the response device 104C and the response device 105C are connected to each other via a transmission line 4C. Furthermore, the response device 104D and the response device 105D are connected to each other via a transmission line 4D. Hereinafter, each of the transmission lines 4A, 4B, 4C, and 4D will also be referred to as a transmission line 4. The transmission line 4 is a physical transmission path.

Detection device 304 and response devices 104, 105 are connected to each other. More specifically, detection device 304A and response devices 104A, 105A are connected to each other via transmission line 3A. Detection device 304B and response devices 104B, 105B are connected to each other via transmission line 3B. Detection device 304C and response devices 104C, 105C are connected to each other via transmission line 3C. Detection device 304D and response devices 104D, 105D are connected to each other via transmission line 3D. Hereinafter, each of transmission lines 3A, 3B, 3C, 3D will also be referred to as transmission line 3. Transmission line 3 is a physical transmission path.

The detection system 404 includes networks NW2a and NW2b. Network NW2a is composed of switch device 141A, response devices 104A, 104B, 105A, 105B, communication devices 112A, 112B, and transmission lines 4A, 4B. Network NWb is composed of switch device 141B, response devices 104C, 104D, 105C, 105D, communication devices 112C, 112D, and transmission lines 4C, 4D. Hereinafter, each of networks NW2a and NW2b will also be referred to as network NW2.

Transmission lines 4A and 4B include a main transmission path that transmits a main signal in network NW2a. Transmission lines 4C and 4D include a main transmission path that transmits a main signal in network NW2b. Transmission lines 3A and 3B are dedicated lines used to detect abnormalities in network NW2a. Transmission lines 3C and 3D are dedicated lines used to detect abnormalities in network NW2b. Transmission line 3 is an example of a first transmission path, and transmission line 4 is an example of a second transmission path.

Transmission line 3 is, for example, a transmission line for serial communication conforming to standards such as RS-232C, RS-422A, and RS-485. Transmission line 4 is, for example, an Ethernet cable.

The communication device 112 and the switch device 141 communicate with each other via the corresponding response device 104, 105 and the corresponding transmission line 4. As an example, the communication device 112 transmits an Ethernet frame addressed to another communication device 112 to the switch device 141 via the corresponding response device 105 and the transmission line 4. The switch device 141 transmits the Ethernet frame received via the corresponding response device 104 to the destination communication device 112 via the corresponding response device 104 and the corresponding transmission line 4 according to the destination address of the Ethernet frame, or transmits it to the gateway device 122 via the corresponding transmission line 5. The switch device 141 also transmits the Ethernet frame received from the gateway device 122 to the destination communication device 112 via the corresponding response device 104 and the corresponding transmission line 4 according to the destination address of the Ethernet frame.

Gateway device 122 performs relay processing to relay, for example, messages exchanged between communication devices 112 and messages exchanged between communication devices 112 and an external network (not shown) outside detection system 404. For example, communication devices 112C and 112D send and receive low-confidentiality messages, and are communicatively connected to the external network via gateway device 122. On the other hand, communication devices 112A and 112B send and receive highly confidential messages, and their communicative connections to the external network are restricted.

In the detection system 404, a detection process is performed to detect an abnormality in the network NW2 during a detection period Pd, which is a period of a predetermined length. More specifically, during the detection period Pd, the detection device 304A transmits response data generation information Ga used to generate response data Ra to the response devices 104A and 105A via the transmission line 3A. During the detection period Pd, the detection device 304B transmits response data generation information Gb used to generate response data Rb to the response devices 104B and 105B via the transmission line 3B. During the detection period Pd, the detection device 304C transmits response data generation information Gc used to generate response data Rc to the response devices 104C and 105C via the transmission line 3C. During the detection period Pd, the detection device 304D transmits response data generation information Gd used to generate response data Rd to the response devices 104D and 105D via the transmission line 3D. Hereinafter, each of the response data Ra, Rb, Rc, and Rd will also be referred to as response data R, and each of the response data generation information Ga, Gb, Gc, and Gd will also be referred to as response data generation information G. For example, the detection period Pd is a period during which no communication is performed using the transmission line 4.

The response device 105A generates response data Ra based on the response data generation information Ga received from the detection device 304A, and transmits the generated response data Ra to the response device 104A via the transmission line 4A by including it in an Ethernet frame. That is, the response device 105A transmits the response data Ra to the response device 104A by time division multiplexing the response data Ra on the transmission line 4A through which the main signal in the network NW2a is transmitted. The response device 104A generates response data Ra based on the response data generation information Ga received from the detection device 304A, generates aggregated data Rx2a by aggregating the generated response data Ra and the response data Ra received via the transmission line 4A, and transmits the generated aggregated data Rx2a to the detection device 304A via the transmission line 3A. The detection period Pd may be a period during which communication is performed using the transmission line 4. In this case, the response device 105A transmits the response data Ra to the response device 104A by frequency division multiplexing or code division multiplexing the response data Ra onto the transmission line 4A.

Furthermore, like the response device 105A, the response device 105B transmits response data Rb to the response device 104B via transmission line 4B. Like the response device 104A, the response device 104B generates aggregate data Rx2b and transmits it to the detection device 304B via transmission line 3B.

Furthermore, like the response device 105A, the response device 105C transmits response data Rc to the response device 104C via transmission line 4C. Like the response device 104A, the response device 104C generates aggregate data Rx2c and transmits it to the detection device 304C via transmission line 3C.

Furthermore, the response device 105D, like the response device 105A, transmits response data Rd to the response device 104D via transmission line 4D. The response device 104D, like the response device 104A, generates aggregate data Rx2d and transmits it to the detection device 304D via transmission line 3D.

The response data R generated by the response device 105 is an example of first response data. The response data R generated by the response device 104 is an example of second response data. Hereinafter, each of the aggregate data Rx2a, Rx2b, Rx2c, and Rx2d will also be referred to as aggregate data Rx2.

Detection device 304A detects an abnormality in network NW2a based on reference information RF2a based on the configuration of network NW2a and aggregated data Rx2a. Detection device 304B detects an abnormality in network NW2a based on reference information RF2a and aggregated data Rx2b. Detection device 304C detects an abnormality in network NW2b based on reference information RF2b based on the configuration of network NW2b and aggregated data Rx2c. Detection device 304D detects an abnormality in network NW2b based on reference information RF2b and aggregated data Rx2d. Hereinafter, each of reference information RF2a and RF2b will also be referred to as reference information RF2.

For example, the detection device 304 detects a path block in the network NW2 as an abnormality in the corresponding network NW2. The path block includes a physical path block by cutting the transmission line 4, and a logical path block by adding an unauthorized filter device to the transmission line 4 that discards some or all messages.

Also, for example, the detection device 304 detects, as an abnormality in the network NW2, the insertion of a detour between the networks NW2a and NW2b, which is a transmission path that does not pass through the switch device 141 and the gateway device 122. The insertion of a detour includes the insertion of a physical detour by changing the wiring between the transmission line 4 in the network NW2a and the transmission line 4 in the network NW2b, and the insertion of a logical detour by inserting an unauthorized repeater that relays an Ethernet frame transmitted on the transmission line 4 of one of the networks NW2a and NW2b to the transmission line 4 of the other network NW2a and NW2b.

As described above, communication devices 112C and 112D are communicatively connected to an external network via gateway device 122, while communication devices 112A and 112B are restricted from communicating with the external network. If a detour is inserted between networks NW2a and NW2b, communication devices 112A and 112B will be communicatively connected to the external network via gateway device 122, switch device 141B, and the detour. Therefore, detection device 304 detects the insertion of the detour as an abnormality in network NW2.

(Transmission of response data generation information G)
Fig. 9 is a diagram showing a configuration of a detection device in a detection system according to a second embodiment of the present disclosure. Referring to Fig. 9, the detection device 304 includes a transmission/reception unit 41, a detection unit 42, and a storage unit 43. A part or the whole of the transmission/reception unit 41 and the detection unit 42 is realized, for example, by a processing circuit including one or more processors. The storage unit 43 is, for example, a non-volatile memory included in the processing circuit.

During the detection period Pd, the detection unit 42 generates response data generation information G and a verification start command, and outputs the generated response data generation information G and verification start command to the transmission/reception unit 41.

For example, the detection units 42 in the detection devices 304A and 304C generate response data generation information Ga and Gc and a verification start command at transmission timing ta and output them to the transmission/reception unit 41, respectively, and the detection units 42 in the detection devices 304B and 304D generate response data generation information Gb and Gd and a verification start command at transmission timing tb that is different from the transmission timing ta and output them to the transmission/reception unit 41, respectively.

The transmitting/receiving unit 41 transmits the response data generation information G to the corresponding response device 104, 105 via the transmission line 3. More specifically, the transmitting/receiving unit 41 in the detection device 304A receives the response data generation information Ga from the detection unit 42, and transmits the received response data generation information Ga and a verification start command in a message to the response device 104, 105 via the transmission line 3A.

(Transmission of response data R)
The following describes the transmission of response data R by the response devices 104 and 105. Unless otherwise specified, the following content regarding the transmission of response data R is common to the response devices 104A, 104B, 104C, 104D, 105A, 105B, 105C, and 105D.

10 is a diagram showing the configuration of a response device in a detection system according to a second embodiment of the present disclosure. Referring to FIG. 10, the response device 104 includes a connection switch 50 and a response unit 60. The response unit 60 includes a communication unit 61, a processing unit 63, and a storage unit 64. The communication unit 61 is an example of a receiving unit and an example of a transmitting unit. The processing unit 63 is an example of a generating unit. A part or all of the communication unit 61 and the processing unit 63 are realized, for example, by a processing circuit including one or more processors. The storage unit 64 is, for example, a non-volatile memory included in the processing circuit. The storage unit 64 stores key information K unique to the response device 104. The connection switch 50 connects or disconnects the transmission line 4 and the switch device 141. The communication unit 61 and the switch device 141 may or may not be connected via the connection switch 50, and the connection state may be switchable. The transmission line 4 and the communication unit 61 may be constantly connected via the connection switch 50, or may be disconnected when the transmission line 4 and the switch device 141 are connected.

The response device 105 includes a connection switch 70 and a response unit 80. The response unit 80 includes a communication unit 81, a processing unit 83, and a storage unit 84. The communication unit 81 is an example of a receiving unit and an example of a transmitting unit. The processing unit 83 is an example of a generating unit. The communication unit 81 and the processing unit 83 are partly or entirely realized by a processing circuit including one or more processors. The storage unit 84 is, for example, a non-volatile memory included in the processing circuit. The storage unit 84 stores key information K unique to the response device 105. The connection switch 70 connects or disconnects the transmission line 4 and the communication device 112. The communication unit 81 and the communication device 112 may be connected or disconnected via the connection switch 70, or the connection state may be switchable. The transmission line 4 and the communication unit 81 may always be connected via the connection switch 70, or may be disconnected when the transmission line 4 and the communication device 112 are connected.

The processing unit 63 in the response device 104 can switch the state of the connection switch 50 between a first state in which the transmission line 4 and the switch device 141 are electrically connected, and a second state in which the transmission line 4 and the switch device 141 are not connected and the transmission line 4 and the communication unit 61 are electrically connected, by outputting a control signal to the connection switch 50. The processing unit 63 sets the state of the connection switch 50 to the first state during a communication period Pc, which is a period during which communication is performed using the transmission line 4.

The processing unit 83 in the response device 105 can output a control signal to the connection switch 70 to switch the state of the connection switch 70 between a third state in which the transmission line 4 and the communication device 112 are electrically connected, and a fourth state in which the transmission line 4 and the communication device 112 are not connected and the transmission line 4 and the communication unit 81 are electrically connected. The processing unit 68 sets the state of the connection switch 70 to the third state during the communication period Pc.

In the response device 105, the communication unit 81 receives a message from the detection device 304 via the transmission line 3, and acquires response data generation information G from the received message. The communication unit 81 outputs the acquired response data generation information G to the processing unit 83. The processing unit 83 receives the response data generation information G from the communication unit 81 and outputs a control signal to the connection switch 70, thereby switching the state of the connection switch 70 to the fourth state described above. The processing unit 83 also uses the response data generation information G and the key information K in the memory unit 84 to generate response data R including the ID of the response device 105 that generated it.

In the response device 104, the communication unit 61 receives a message from the detection device 304 via the transmission line 3 and acquires response data generation information G from the received message. The communication unit 61 outputs the acquired response data generation information G to the processing unit 63. The processing unit 63 receives the response data generation information G from the communication unit 61 and outputs a control signal to the connection switch 50, thereby switching the state of the connection switch 50 to the second state described above. The processing unit 63 also uses the response data generation information G and the key information K in the storage unit 64 to generate response data R including the ID of the response device 104 that generated it. The processing unit 63 also outputs a transmission command to the communication unit 61 indicating that the response data R should be transmitted. The communication unit 61 transmits the transmission command received from the processing unit 63 to the response device 105 via the connection switch 50 and the transmission line 4, including the transmission command in an Ethernet frame.

In the response device 105, the communication unit 81 receives an Ethernet frame from the response device 104 via the transmission line 4 and the connection switch 70, acquires a transmission command from the received Ethernet frame, and outputs the acquired transmission command to the processing unit 83. The processing unit 83 receives a transmission command from the communication unit 81 and outputs response data R generated using response data generation information G and key information K to the communication unit 81. The communication unit 81 includes the response data R received from the processing unit 63 in an Ethernet frame and transmits it to the response device 104 via the connection switch 70 and the transmission line 4. Note that the response device 104 may be configured not to transmit a transmission command to the response device 105. In this case, the response device 105 receives a message including response data generation information G from the detection device 304 and spontaneously transmits the response data R to the response device 104.

In the response device 104, the communication unit 61 acquires response data R from the Ethernet frame received via the transmission line 4 and the connection switch 50 during the reception period TRa, and outputs the acquired response data R to the processing unit 63. The processing unit 63 receives the response data R from the communication unit 61, and performs a predetermined process on the received response data R and the generated response data R, thereby generating aggregate data Rx2 having a data amount smaller than the total data amount of the two response data R. The processing unit 63 outputs the generated aggregate data Rx2 to the communication unit 61. The communication unit 61 generates a message including the aggregate data Rx2 received from the processing unit 63, and transmits the generated message to the detection device 304 via the transmission line 3.

(Detection process)
9 again, the transmitting/receiving unit 41 in the detection device 304 receives aggregated data Rx2, which is an aggregate of response data R generated by the response devices 104, 105, via the transmission line 3. The detection unit 42 performs detection processing to detect an abnormality in the network NW2, based on reference information RF2 based on the configuration of the network NW2 and the aggregated data Rx2 received by the transmitting/receiving unit 41. The detection processing in the detection device 304A will be representatively described below.

For example, the memory unit 43 in the detection device 304A stores reference information RF2a indicating two types of key information K for the response devices 104A and 105A connected to the transmission line 4A.

The transmitter/receiver 41 in the detection device 304A receives a message from the response device 104 via the transmission line 3A. The transmitter/receiver 41 acquires aggregate data Rx2a from the received message and outputs the acquired aggregate data Rx2a to the detection unit 42.

The detection unit 42 uses the response data generation information Ga sent to the response devices 104A, 105A via the transmission/reception unit 41 and each key information K in the memory unit 43 to generate two pieces of generation data Ma corresponding to the two pieces of response data Ra, respectively, that correspond to the response devices 104A, 105A connected to the transmission line 3A.

The detection unit 42 compares the aggregated data Rx2a received from the transmission/reception unit 41 with the generated data Ma corresponding to the response device 104A and the generated data Ma corresponding to the response device 105A. For example, the detection unit 42 determines that the detection condition C1 is met when at least one of the two response data Ra aggregated in the aggregated data Rx2a does not match the corresponding generated data Ma. On the other hand, the detection unit 42 determines that the detection condition C1 is not met when the two response data Ra aggregated in the aggregated data Rx2a received by the transmission/reception unit 41 match the two generated generated data Ma.

Furthermore, if the number of response data R aggregated in the aggregated data Rx2a is not two, the detection unit 42 determines that the detection condition C2 is satisfied. On the other hand, if the number of response data R aggregated in the aggregated data Rx2a is two, the detection unit 42 determines that the detection condition C2 is not satisfied.

The detection unit 42 also checks whether or not there is response data R received by the transmission/reception unit 41 during a period other than the reception period TRa. For example, if there is response data R received by the transmission/reception unit 41 separately from the aggregated data Rx2a, the detection unit 42 determines that the detection condition C3 is satisfied. On the other hand, if there is no response data R received by the transmission/reception unit 41 separately from the aggregated data Rx2a, the detection unit 42 determines that the detection condition C3 is not satisfied.

In the detection process, the detection unit 42 detects an abnormality in the network NW2a based on the result of the determination of whether or not the detection conditions C1, C2, and C3 are satisfied. More specifically, when the detection unit 42 determines that at least one of the detection conditions C1, C2, and C3 is satisfied, it determines that an abnormality has occurred in the network NW2a.

For example, if detection condition C1 is satisfied, the detection unit 42 determines that there is an unauthorized device masquerading as the response device 104A, 105A. Also, for example, if detection condition C2 is satisfied and the number of response data R aggregated in aggregated data Rx2a is less than two, the detection unit 42 determines that a route blockage has occurred in the network NW2a. Also, for example, if detection condition C2 is satisfied and the number of response data R aggregated in aggregated data Rx2a is more than two, or if detection condition C3 is satisfied, the detection unit 42 determines that a detour has been inserted in the network NW2a.

When the detection unit 42 determines that an abnormality has occurred in the network NW2a, it transmits abnormality information indicating that an abnormality has occurred in a message to the response devices 104A, 105A via the transmission line 3A. The detection unit 42 also notifies the user of the detection system 404 that an abnormality has occurred in the network NW2a by voice or display. The detection unit 42 may be configured not to transmit the abnormality information to the response devices 104A, 105A and/or notify the user. The detection unit 42 may also be configured to transmit a message indicating that an abnormality has occurred in the network NW2a to a user terminal owned by the user via a network not shown.

Referring again to FIG. 10, for example, when the processing unit 83 in the response device 105A receives abnormality information from the detection device 304A via the transmission line 3A and the communication unit 81, it cuts off the electrical connection between the transmission line 4A in the connection switch 70 and the communication device 112A. Note that the processing unit 83 may be configured not to cut off the electrical connection between the transmission line 4A and the communication device 112A.

In addition, in the response device 104, the processing unit 63 may be configured to output the response data R generated in the response device 105 and the response data R generated by the processing unit 63 to the communication unit 61, instead of generating aggregate data Rx2. In this case, the communication unit 61 generates a message including the two response data R received from the processing unit 63, and transmits the generated message to the detection device 304 via the transmission line 3.

Furthermore, the response device 104 may be configured to detect abnormalities in the networks NW2a and NW2b based on the number of response data R received from the response device 104 and the timing of receiving the response data R, similar to the detection device 304.

Furthermore, in addition to the response devices 104, 105 and the detection device 304, or instead of the response devices 104, 105 and the detection device 304, the detection system 404 may be configured to include two response devices attached to the gateway device 122 and the switch device 141, respectively, and connected to each other via the transmission line 5, and a detection device that detects abnormalities in the network including the gateway device 122, the switch device, and the transmission line 5. In this case, the detection device detects the path interruption and the insertion of a detour between the gateway device 122 and the switch device based on the response data R received from the two response devices.

Also, as described above, the detection system 404 is not limited to a configuration including four detection devices 304, and may be configured to include one detection device 304 that monitors all of the networks NW2. In this case, the detection device 304 transmits response data generation information Ga to the response devices 104A and 105A via the transmission line 3A, transmits response data generation information Gb to the response devices 104B and 105B via the transmission line 3B, transmits response data generation information Gc to the response devices 104C and 105C via the transmission line 3C, and transmits response data generation information Gd to the response devices 104D and 105D via the transmission line 3D. Then, the detection device 304 detects an abnormality in the network NW2a based on the reference information RF2a and the aggregated data Rx2a and Rx2b, and detects an abnormality in the network NW2b based on the reference information RF2b and the aggregated data Rx2c and Rx2d.

(Variation 3)
Fig. 11 is a diagram showing a configuration of a detection system according to a third modification of the second embodiment of the present disclosure. Referring to Fig. 11, compared to the detection system 404, the detection system 405 includes a detection device 305 instead of the detection device 304, response devices 106A, 106B, 106C, and 106D that are response devices 106 instead of the response devices 104A, 104B, 104C, and 104D, and response devices 107A, 107B, 107C, and 107D that are response devices 107 instead of the response devices 105A, 105B, 105C, and 105D.

The detection device 305 is connected to the gateway device 122 via a transmission line 6. The transmission line 6 is, for example, an Ethernet cable.

During the detection period Pd, the detection device 305 transmits response data generation information G used to generate response data R to the response devices 106 and 107. More specifically, the detection device 305 sets detection periods Pda, Pdb, Pdc, and Pdd into which the detection period Pd is divided into four. During the detection period Pda, the detection device 305 includes response data generation information Ga in an Ethernet frame and transmits it by multicast to the response devices 106A and 107A. Furthermore, during the detection period Pdb, the detection device 305 includes response data generation information Gb in an Ethernet frame and transmits it by multicast to the response devices 106B and 107B. Furthermore, during the detection period Pdc, the detection device 305 includes response data generation information Gc in an Ethernet frame and transmits it by multicast to the response devices 106C and 107C. In addition, during the detection period Pdd, the detection device 305 includes response data generation information Gd in an Ethernet frame and transmits it by multicast to the response devices 106D and 107D.

FIG. 12 is a diagram showing the configuration of a response device in a detection system according to the third modification of the second embodiment of the present disclosure. With reference to FIG. 12, response device 106 is different from response device 104 in that it has a relay unit 51 instead of a connection switch 50. Response device 107 is different from response device 105 in that it has a relay unit 71 instead of a connection switch 70. The relay units 51 and 71 perform relay processing of Ethernet frames.

Referring again to FIG. 11, the response device 106 receives response data generation information G from the detection device 305 via the gateway device 122 and the corresponding switch device 141, and generates response data R based on the received response data generation information G. The response device 106 includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the corresponding switch device 141 and gateway device 122.

The response device 107 receives response data generation information G from the detection device 305 via the gateway device 122, the corresponding switch device 141, and the corresponding response device 106, and generates response data R based on the received response data generation information G. The response device 107 includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the corresponding response device 106, the corresponding switch device 141, and the gateway device 122.

Like detection device 304, detection device 305 detects anomalies in network NW2 based on reference information RF2 based on the configuration of network NW2 and response data R transmitted by response devices 106 and 107, respectively. Unlike detection system 404, detection system 405 can detect anomalies in network NW2 without using transmission line 3.

The detection system 405 may be configured to include two response devices, in addition to or instead of the response devices 106 and 107, that are attached to the gateway device 122 and the switch device 141, respectively, and connected to each other via the transmission line 5. In this case, the detection device 305 detects the path interruption and the insertion of a detour between the gateway device 122 and the switch device based on the response data R received from the two response devices.

[Operation flow]
Fig. 13 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the second embodiment of the present disclosure. Fig. 13 illustrates the detection process in the detection device 304A.

Referring to FIG. 13, first, when the transmission timing ta arrives, the detection device 304A transmits the response data generation information Ga to the response devices 104A and 105A via the transmission line 3A (step S31).

Next, the response device 104A switches the state of the connection switch 50 to the second state described above. Also, the response device 105A switches the state of the connection switch 70 to the fourth state described above (step S32).

Next, the response devices 104A and 105A generate response data Ra using the response data generation information Ga received from the detection device 304A and the key information K (step S33).

Next, the response device 104A transmits the transmission command to the response device 105A via the transmission line 4A (step S34).

Next, the response device 105A receives the transmission command and transmits the response data Ra to the response device 104A via the transmission line 4A (step S35).

Next, the response device 104A generates aggregated data Rx2a that aggregates the response data Ra received from the response device 105A and the generated response data Ra (step S36).

Next, the response device 104A transmits the generated aggregate data Rx2a to the detection device 304A via the transmission line 3A (step S37).

Then, the detection device 304A performs detection processing based on the reference information RF2a based on the configuration of the network NW2a and the aggregated data Rx2A received from the response device 104A (step S38).

FIG. 14 is a diagram showing an example of a detection processing sequence in a detection system according to Variation 3 of the second embodiment of the present disclosure.

Referring to FIG. 14, first, when the transmission timing ta arrives, the detection device 305 includes the response data generation information Ga in an Ethernet frame and transmits it by multicast to the response devices 106A and 107A (step S41).

Next, the response devices 106A and 107A generate response data Ra using the response data generation information Ga received from the detection device 305 and the key information K (step S42).

Then, the response device 106A includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the switch device 141A and the gateway device 122 (step S43).

The response device 107A also includes the generated response data R in an Ethernet frame and transmits it to the detection device 305 via the response device 106A, the switch device 141A, and the gateway device 122 (step S44).

Next, the detection device 305 performs detection processing based on the reference information RF2a based on the configuration of the network NW2a and the response data Ra received from the response devices 106A and 107A, respectively (step S45).

The above-described embodiments should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is indicated by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

The above description includes the following additional features.
[Appendix 1]
A detection device;
a response device;
the detection device transmits response data generation information used to generate response data to the response device via a first transmission path;
the response device transmits the response data based on the response data generation information received from the detection device to the detection device via a second transmission path;
the detection device detects an anomaly in the network based on reference information based on a configuration of the network and the response data transmitted by the response device;
the first transmission line is a dedicated line used for detecting an abnormality in the network,
the second transmission path is a main transmission path that transmits a main signal in the network,
The network includes the response device and the second transmission path.

1, 1A, 1B, 2, 2A, 2B, 2C, 3, 3A, 3B, 3C, 3D, 4, 4A, 4B, 4C, 4D, 5, 5A, 5B, 6 Transmission line 2A1, 2A2 Transmission line 10 Connection section 20 Response section 21 Receiving section 22 Transmission section 23 Processing section (generation section)
24 Memory unit 31 Transmission unit 32 Reception unit 33 Detection unit 34 Memory unit 41 Transmission/reception unit (transmission unit, reception unit)
42 Detection unit 43 Storage unit 50 Connection switch 51 Relay unit 60 Response unit 61 Communication unit (transmission unit, reception unit)
63 Processing unit (generation unit)
64 Memory unit 70 Connection switch 71 Relay unit 80 Response unit 81 Communication unit (transmission unit, reception unit)
83 Processing unit (generation unit)
84 Memory unit 101, 101A, 101B, 102, 102A, 102C, 103A, 104, 104A, 104B, 104C, 104D, 105, 105A, 105B, 105C, 105D, 106, 106A, 106B, 106C, 106D, 107, 107A, 107B, 107C, 107D Response device 111, 111A, 111B, 111C, 112, 112A, 112B, 112C, 112D Communication device 121, 122 Gateway device 141, 141A, 141B Switch device 201, 201A, 201B Aggregation device 301, 301A, 301B, 302, 303, 304, 304A, 304B, 304C, 304D, 305 Detection device 401, 402, 403, 404, 405 Detection system NW, NWa, NWb, NWc, NW1a, NW2, NW2a, NW2b Network

Claims (13)

A response device;
a detection device for detecting an abnormality in a network including the response device and a transmission line,
the detection device transmits response data generation information used to generate response data to the response device via a first transmission path;
the response device generates the response data based on the response data generation information received from the detection device, and transmits the generated response data to the detection device via a second transmission path;
the detection device detects an anomaly in the network based on reference information based on a configuration of the network and the response data transmitted by the response device;
At least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network. The detection system according to claim 1, wherein the first transmission path is the main transmission path and the second transmission path is a dedicated line used to detect anomalies in the network, or the second transmission path is the main transmission path and the first transmission path is a dedicated line used to detect anomalies in the network. the first transmission path is the dedicated line,
The detection system of claim 2 , wherein the second transmission line is the main transmission line. the response device generates the response data further based on the unique information of the response device, and transmits the generated response data to the detection device via the second transmission path;
The reference information includes the unique information,
The detection system according to any one of claims 1 to 3, wherein the detection device generates generated data based on the unique information contained in the reference information and the response data generation information sent to the response device, compares the received response data with the generated data, and detects an abnormality in the network based on the comparison result. The detection system according to any one of claims 1 to 4, wherein the detection device detects an anomaly in the network based on the number of received response data. The detection system according to any one of claims 1 to 5, wherein the detection device detects an anomaly in the network based on the timing of receiving the response data. the first logical transmission path and the second logical transmission path are provided using a common physical transmission line;
7. The detection system according to claim 1, wherein the detection device and the response device multiplex the response data generation information and the response data and transmit them via the transmission line. The detection system further comprises:
A consolidation device is provided.
The detection system according to claim 1 , wherein the aggregation device generates aggregated data by aggregating the response data generated by each of the response devices, and transmits the generated aggregated data to the detection device. a first answering device;
a second answering device;
a detection device that detects an abnormality in a network including the first response device, the second response device, and a transmission line;
the detection device transmits response data generation information used to generate response data to the first response device and the second response device via a first transmission path;
the first response device generates first response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated first response data to the second response device via a second transmission path;
the second response device generates second response data, which is the response data, based on the response data generation information received from the detection device, and transmits the generated second response data and the first response data received from the first response device to the detection device;
the detection device detects an anomaly in the network based on reference information based on a configuration of the network, the first response data transmitted by the first response device, and the second response data transmitted by the second response device;
At least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network. a transmitting unit that transmits response data generation information used for generating response data to a response device in the network via a first transmission path;
a receiving unit that receives the response data based on the response data generation information and transmitted by the response device via a second transmission path;
a detection unit that detects an abnormality in the network based on reference information based on a configuration of the network and the response data received by the receiving unit,
At least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network. An answering device attached to a communication device in a network, comprising:
a receiving unit that receives response data generation information used for generating response data from a detection device that detects an anomaly in the network via a first transmission path;
a generation unit that generates the response data based on the response data generation information received by the receiving unit;
a transmission unit that transmits the response data generated by the generation unit to another device via a second transmission path;
At least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network. a receiving unit that receives response data generation information used for generating response data from a detection device that detects an anomaly in a network via a first transmission path;
a generation unit that generates the response data based on the response data generation information received by the receiving unit;
a transmission unit that transmits the response data generated by the generation unit to another device via a second transmission path;
A response device, wherein the first transmission path is a main transmission path for transmitting a main signal in the network, and the second transmission path is a dedicated line used for detecting abnormalities in the network, or the second transmission path is the main transmission path, and the first transmission path is a dedicated line used for detecting abnormalities in the network. A detection method in a detection system including a response device and a detection device that detects an abnormality in a network including the response device and a transmission line, comprising:
a step of transmitting, from the detection device, response data generation information used for generating response data to the response device via a first transmission path;
the response device generating the response data based on the response data generation information received from the detection device, and transmitting the generated response data to the detection device via a second transmission path;
The detection device detects an anomaly in the network based on reference information based on a configuration of the network and the response data transmitted by the response device;
A detection method, wherein at least one of the first transmission path and the second transmission path includes a main transmission path that transmits a main signal in the network.

Images