JP7470320B2 - Network Management Device - Google Patents

Description

The present invention relates to a network management device used in an industrial control system.

Technology for dynamically changing the network connection topology in industrial control systems has been described (see, for example, Patent Document 1).

JP 2016-158194 A

When using the above-mentioned technology, changing the network connection topology requires complex routing using multiple pieces of hardware or changing network cables. The purpose of this disclosure is to provide a technology that makes it easier than ever to change the network connection topology in an industrial control system.

According to a first aspect of the present disclosure, a network management device used in an industrial control system includes a network interface (51) for communicating with a plurality of communication devices (30-34, 8), a network construction unit (53a) that reads configuration data (52a) describing a configuration of a virtual network (90) that mediates communication between the plurality of communication devices from a memory (52), and distributes packets transmitted and received between the plurality of communication devices in a distribution form according to the configuration of the virtual network described in the read configuration data,
and a network change unit (53b) for changing the packet delivery mode in the virtual network by rewriting the configuration data based on the occurrence of a specified event.

In this way, the network management device can flexibly change the communication paths between multiple communication devices in a centralized manner by rewriting the configuration data in response to the occurrence of a specific event. In other words, the network connection topology can be easily changed.

Also, according to a second aspect, the configuration data includes a virtual relay table that specifies the forwarding destination of packets in virtual relay devices (91, 92, 93) that relay packets in the virtual network, and the network change unit changes the packet delivery mode in the virtual network by rewriting the virtual relay table while continuing the operation of the virtual relay devices.

In this way, by rewriting the virtual relay table while the virtual relay device continues to operate, the packet delivery mode in the virtual network can be changed more quickly than if the virtual relay device were to be restarted.

Also, according to a third aspect, the virtual relay device has a plurality of ports, an ID can be set for each of the plurality of ports, and is a virtual switch that delivers packets between ports having the same ID and does not deliver packets between ports having different IDs, and the network change unit changes the packet delivery mode in the virtual network by changing the IDs of at least a portion of the plurality of ports in the virtual relay table.

In this way, the packet delivery mode in a virtual network can be changed by the simple process of changing the port ID of a virtually configured switch.

According to a fourth aspect, the plurality of communication devices are connected to a plurality of access ports (6) provided in a real relay device (55), the network interface is connected to a trunk port (5) provided in the real relay device, different IDs are assigned to the plurality of access ports, the configuration data includes a port correspondence table, and the port correspondence table describes a correspondence between IDs assigned to the plurality of access ports of the real relay device and destinations of the access ports in the virtual network, and when the real relay device receives a packet at any one of the plurality of access ports, the real relay device adds the ID assigned to the one access port to the packet and transmits the packet to the network interface via the trunk port. the network construction unit identifies a destination in the virtual network that corresponds to an ID included in a tag frame in a packet received from the network interface based on the port correspondence table, and transmits the packet to the destination in the virtual network; when there is a packet to be transmitted from a destination in the virtual network to an outside of the virtual network, the network construction unit identifies an ID corresponding to the destination based on the port correspondence table, includes a tag frame including the identified ID in the packet, and transmits the packet from the network interface to the trunk port; when the packet received at the trunk port includes a tag frame, the real relay device transmits the packet from an access port to which the ID in the tag frame is assigned.

In this way, by connecting multiple communication devices to one network interface in the network management device via a real relay device, the number of network interfaces provided on the network management device side can be reduced. Also, even if packets arrive from multiple communication devices to one network interface in the network management device 50, appropriate delivery is achieved within the virtual network 90 based on the IDs and port correspondence table included in those packets by the real relay device.

In addition, even if packets arrive from multiple communication devices to one network interface in the network management device 50, appropriate delivery is achieved within the virtual network 90 based on the IDs and port correspondence tables included in those packets by the actual relay device.

In addition, even if a packet is sent from a destination in a virtual network to an outside of the virtual network, an ID is assigned to the packet based on the destination and port correspondence table, ensuring proper delivery from within the virtual network to outside the virtual network.

Furthermore, according to a fifth aspect, the network change unit determines whether or not the specified event has occurred outside the virtual network based on the contents of a packet delivered through the virtual network. In this way, it is not necessary to adopt a complex configuration in which the network change unit is within the virtual network and transmits a packet to the network change unit via the virtual network.

According to a sixth aspect, the network change unit, based on the occurrence of the predetermined event, moves some (7d, 7e) of the communication terminals belonging to a first subnetwork (VL2) in the virtual network from the first subnetwork to a second subnetwork (VL3), and generates a relay device (9b) that relays packet delivery between the second subnetwork and another subnetwork (VL1) in the virtual network. In this way, it becomes possible to dynamically switch delivery routes by moving some communication terminals from the first subnetwork to the second subnetwork and generating a relay device that relays between the second subnetwork to which the communication terminals are moved and the other subnetwork.

The reference symbols in parentheses attached to each component indicate an example of the correspondence between the component and the specific components described in the embodiments described below.

1 is a configuration diagram of a communication network according to a first embodiment. FIG. 2 is a diagram showing the configuration of a virtual network. FIG. 13 is a diagram illustrating a configuration of a port correspondence table. 10 is a flowchart showing the process of the network construction unit when a packet is received from the outside. 10 is a flowchart showing the processing contents of the network construction unit when transmitting and receiving packets to the outside. FIG. 2 is a diagram showing VLAN IDs of each port of a virtual switch. 13 is a flowchart of a process executed by a network changing unit 53b. FIG. 2 is a diagram showing VLAN IDs of each port of a virtual switch. FIG. 13 is a diagram illustrating a state before a part of a virtual network according to another embodiment is changed. FIG. 13 is a diagram illustrating a state after a part of a virtual network according to another embodiment has been changed. FIG. 13 is a diagram illustrating a state after a part of a virtual network according to another embodiment has been changed.

The embodiment will be described below. As shown in FIG. 1, the communication system according to this embodiment is connected to a wide area network 1 such as the Internet via a router 11. This communication system is configured by connecting local area networks (hereinafter referred to as LANs) located at multiple geographically separated locations L1, L2 belonging to an organization such as a company. In the example of FIG. 1, the number of locations where the LANs that make up the communication system are located is two, but it may be three or more.

Base L1 is, for example, a base that functions as the headquarters of an organization. LANs 20 and 30 are located at base L1. LAN 20 is a network also known as a demilitarized zone. Devices within base L1 that are connected to LAN 20 include routers 11 and 21 and terminals 22 and 23. Terminals 22 and 23 that are connected to LAN 20 other than routers 11 and 21 are allowed to connect from the wide area network due to the settings of router 11. However, due to the settings of router 21, connections to LAN 30 and devices in the network of base L2 beyond it are not allowed. Terminals 22 and 23 may be, for example, external web servers.

LAN 30 is a network also called an enterprise zone, which is installed to streamline tasks within an organization and to allow members of the organization to exchange information. Devices within base L2 that are connected to LAN 30 include routers 21 and 31, and terminals 32, 33, and 34.

Base L2 is a base that has production capabilities, such as a factory. A network management device 50, a switch 55, and multiple communication devices 8 are located at base L2. These devices located at base L2 as a whole constitute an industrial control system. The network that connects these devices is an industrial control network.

The network management device 50 is a device that mediates communication between multiple communication devices, including terminals connected to the above-mentioned enterprise zone and communication devices at base L2. The network management device 50 configures a virtual network within itself, and distributes packets sent and received between these multiple communication devices in a delivery format that conforms to that configuration. The network management device 50 then changes the configuration of that virtual network in response to the occurrence of a specified event. The configuration and operation of the network management device 50 will be described later.

The switch 55 is a real, i.e., not virtually generated, relay device that corresponds to the tagged VLAN, for example a Layer 2 switch. The switch 55 is provided with one trunk port 5 that connects to the network management device 50 via an Ethernet cable.

The switch 55 is provided with n access ports 6. n may be 2 or more, 50 or more, or 1000 or more. One of the access ports 6 is connected to the router 31 of the base L1 via an Ethernet cable or the like. The access port 6 is also connected to a communication device 8 via a real Ethernet cable.

The number of communication devices 8 may be 2 or more, 5 or more, 10 or more, 50 or more, or 1000 or more. Communication devices 8 may be terminal devices or relay devices such as gateways and switches. Communication devices 8 include a control device that controls actuators for manufacturing products on a manufacturing line installed at base L2. Communication devices 8 also include a SCADA (Supervisory Control And Data Acquisition) and an OPC server (a data management server that uses OPC:OLE for Process Control protocol for real-time data communication between various control devices from different manufacturers).

As shown in FIG. 1, a relay device among the communication devices 8 may be connected to two or more access ports 6. Also, as shown in FIG. 1, multiple communication devices 8 may be connected to an access port 6 via one communication device 8 that is a relay device.

A VLAN ID can be set for each access port 6. Packets can be distributed within the switch 55 between access ports with the same VLAN ID. Packets cannot be distributed within the switch 55 between ports with different VLAN IDs, and can only be distributed via the network management device 50. The trunk port 5 can send and receive packets of any VLAN ID.

Each access port 6 is assigned a VLAN ID that is different from the other access ports 6. In other words, the VLAN IDs assigned to the access ports 6 are all different. By doing this, packets are not forwarded from one access port 6 to another access port 6 within the switch 55. Communications between access ports 6 are always relayed by the network management device 50. Depending on the configuration, the same VLAN ID may be added to the access ports 6, in which case multiple access ports 6 are managed as a group.

The packet sent from trunk port 5 to network management device 50 is an Ethernet frame with a tag frame defined by IEEE 802.1Q. The tag frame contains data indicating the VLAN ID.

When the switch 55 receives a packet at an access port 6 sent from the communication device 8 or the router 31, it adds a tag frame including the VLAN ID assigned to the access port 6 to the packet and transmits it to the network interface 51 via the trunk port 5.

In addition, when a packet transmitted from the network management device 50 and received at the trunk port 5 contains a tag frame, the switch 55 transmits the packet from the access port 6 to which the VLAN ID in the tag frame is assigned. At this time, the switch 55 may delete the tag frame from the packet.

Here, we will explain the details of the network management device 50. The network management device 50 has a network interface, a memory 52, and a CPU 53.

The network interface 51 is connected to the trunk port 5 of the switch 55 via an Ethernet cable.

Memory 52 includes various types of memory such as RAM, ROM, and flash memory. RAM is a writable volatile storage medium. ROM is a non-writable non-volatile storage medium. Flash memory is a writable non-volatile storage medium. RAM, ROM, and flash memory are all non-transient tangible storage media. CPU 53 executes a program (not shown) stored in ROM or flash memory, and uses RAM as a working area during execution to realize various processes described below.

In this embodiment, the CPU 53 functions as the network construction unit 53a shown in FIG. 2 by executing a network construction program (not shown) stored in the ROM or flash memory. The CPU 53 also functions as the network modification unit 53b shown in FIG. 3 by executing a network modification program (not shown) stored in the ROM or flash memory.

The CPU 53 functions as a network construction unit 53a and a network modification unit 53b simultaneously in parallel by using a multitasking function. For simplicity, the process in which the CPU 53 executes the network construction program will be described below simply as the process executed by the network construction unit 53a. And the process in which the CPU 53 executes the network modification program will be described below simply as the process executed by the network modification unit 53b.

First, the network construction unit 53a will be described. As shown in FIG. 2, the network construction unit 53a reads configuration data 52a pre-recorded in the memory 52, and generates and emulates a virtual network 90 according to the contents of the read configuration data 52a. The virtual network is a virtual environment generated by software using virtualization technology with the resources of the CPU 53 and memory 52.

In the virtual network 90, a plurality of virtual communication devices are generated. The plurality of virtual communication devices includes a plurality of virtual relay devices. These virtual relay devices have the function of virtually relaying packets within the virtual network 90. Examples of virtual relay devices include a virtual router, a virtual switch, and a virtual repeater. In the virtual network 90, packet delivery paths between the plurality of virtual communication devices, and delivery paths between the plurality of virtual communication devices and an external real communication device 8 are virtually generated. The configurations and functions of the plurality of virtual communication devices, as well as information indicating the above virtual delivery paths, are described in the configuration data 52a.

As a network construction program for implementing the network construction unit 53a, for example, KVM (Kernel-based Virtual Machine) used in Linux (registered trademark) can be used. Applications other than KVM that build software-defined networks (SDN) can also be used. As a program for implementing a virtual relay device and the packet delivery form that results from it, OpenvSwitch, OpenFlow, etc. can be used.

In this embodiment, multiple virtual switches 91, 92, and 93 corresponding to relay devices are virtually generated in a virtual environment. Virtual switch 91 and the communication device connected to it belong to the supervisory zone. The supervisory zone is installed at the top of site L2, and is connected to a communication device that collects data from all control devices in site L2 and monitors their status in a centralized manner. In addition, the supervisory zone uses the OPC-DA protocol and OPC-UA protocol to communicate with the control zone one level below, and is connected to a terminal for a SCADA human-machine interface.

The virtual switches 92 and 93 and the communication devices connected to them belong to the control zone. The control zone is installed in smaller units than the supervisory zone and is connected to control devices such as PLCs and SLCs. Although the communication methods differ depending on the vendor and control device, an OPC server that consolidates them into one general-purpose protocol is installed in the control zone. In the control zone, information is exchanged between control devices, making it possible to grasp and control production information in real time.

The configuration data 52a is data describing the configuration of the virtual network 90 to be generated. When KVM, OpenvSwitch, and OpenFlow controller are used as the network construction programs, the configuration data includes image data of the virtual machines in the virtual environment, definition files, various OpenvSwitch setting files, OpenFlow flow tables, etc. In the network management device 50, this configuration data is created and recorded in the flash memory of the memory 52. The configuration data may have been created in advance on another computer based on the operation of an operator. Alternatively, the configuration data may be created based on the user's setting operation on the network management device 50 when the CPU 53 executes KVM, Openvswitch, and OpenFlow.

In this embodiment, in the virtual network 90 constructed by the network construction unit 53a, the above-mentioned virtual switches 91, 92, and 93 are connected to the above-mentioned router 31 and communication device 8. The connection between the virtual switches 91, 92, and 93, the router 31, and the communication device 8 is also described in the configuration data 52a. The network construction unit 53a delivers packets according to the contents of the description in this configuration data 52a.

The configuration data 52a includes a port correspondence table. This port correspondence table indicates the correspondence between the VLAN ID assigned to each access port 6 of the switch 55 and the connection destination of the access port 6 in the virtual network 90. In this embodiment, the connection destination in the virtual network 90 corresponds to communication devices such as virtual switches 91, 92, and 93 that are virtually generated within the virtual network 90 and the communication ports of the communication devices.

For example, as shown in FIG. 3, the port correspondence table includes multiple records, and each record includes the VLAN ID of an access port 6 and the communication device and port corresponding to that VLAN ID. For reference, FIG. 3 shows the actual communication device 8 corresponding to each record on the left side of the record. In FIG. 3, a one-to-one correspondence is defined between multiple VLAN IDs and multiple sets of communication devices and ports.

In the port correspondence table of FIG. 3, the VLAN ID "1" assigned to the access port 6 of the switch 55 to which the router 31 is actually connected is associated with the port 91a of the virtual switch 91.

Furthermore, the VLAN IDs "2", "3", and "4" respectively assigned to the access ports 6 of the switch 55 to which the terminals 8a, 8b, and 8c are actually connected are associated with the port 91b of the virtual switch 91, the port 92a of the virtual switch 92, and the port 93a of the virtual switch 93, respectively.

The VLAN IDs "5" and "6" assigned to the two access ports 6 of the switch 55 to which the router 8d that connects between the virtual switches 91 and 92 is actually connected correspond to the port 91c of the virtual switch 91 and the port 92b of the virtual switch 92, respectively. That is, the access port 6 to which the VLAN ID "5" is assigned in the switch 55 corresponds to the virtual switch 91 side of the router 8d. The access port 6 to which the VLAN ID "6" is assigned in the switch 55 corresponds to the virtual switch 92 side of the router 8d.

The VLAN IDs "7" and "8" assigned to the two access ports 6 of the switch 55 to which the router 8e that connects between the virtual switches 91 and 93 is actually connected are associated with the port 91d of the virtual switch 91 and the port 93b of the virtual switch 93, respectively. That is, the access port 6 to which the VLAN ID "7" is assigned in the switch 55 is the port that corresponds to the virtual switch 91 side of the router 8e. The access port 6 to which the VLAN ID "8" is assigned in the switch 55 is the port that corresponds to the virtual switch 93 side of the router 8e.

The VLAN ID "9" assigned to the access port 6 of the switch 55 to which the communication device 8f is actually connected is associated with the port 92c of the virtual switch 92. The communication device 8 is connected to real control devices 8h, 8i, and 8j via the real switch 8g. The control devices are connected to actuators that are to be controlled. These actuators are devices used to produce products on a manufacturing line, such as a robot arm.

Furthermore, the VLAN ID "10" assigned to the access port 6 of the switch 55 to which the honeypot 8k, a communication device described below, is actually connected, is associated with the port 93c of the virtual switch 93.

The network construction unit 53a distributes packets within the virtual network 90 based on this port correspondence table. Specifically, the network construction unit 53a constantly performs the process of FIG. 4. In the process of FIG. 4, the network construction unit 53a first waits in step S110 until it receives a packet from outside its own device, i.e., from the switch 55. When it receives a packet from outside, it proceeds to step S120 and reads the VLAN ID in the tag frame contained in the received packet. This tag frame and the VLAN ID therein are assigned to the packet by the switch 55.

Then, in step S130, the network construction unit 53a identifies the virtual switch and port corresponding to the read VLAN ID based on the port correspondence table. For example, in the example of FIG. 3, if the VLAN ID read in step S120 is 1, the virtual switch 91 and its port 91a are identified in step S130.

Next, in step S140, the tag frame is removed from the packet received in step S110. Next, in S150, the packet from which the tag frame has been removed in step S140 is transmitted within the virtual network 90 to the port of the virtual switch identified in step S130. This causes the virtual switch to relay the packet in accordance with the operation defined in the configuration data 52a for the virtual switch. After step S150, the network construction unit 53a returns to step S110.

As described above, the network construction unit 53a identifies a connection destination in the virtual network 90 that corresponds to the ID included in the tag frame in the packet received from the network interface 51, based on the port correspondence table. Then, the network construction unit 53a transmits the packet to the connection destination identified as described above in the virtual network 90.

By doing this, the network construction unit 53a can distribute packets received from the outside via the network interface 51 within the virtual network 90 in the format specified in the port correspondence table. Therefore, data is distributed according to the network configuration of the virtual network 90.

Therefore, even if packets arrive from multiple communication devices 8 to the network interface 51 in the network management device 50, the switch 55 ensures appropriate delivery within the virtual network 90 based on the IDs and port correspondence table included in those packets.

The network construction unit 53a constantly performs the process of FIG. 5 in parallel with the process of FIG. 4 and other processes. In the process of FIG. 5, the network construction unit 53a first acquires a packet in the virtual network 90, which is sent from a port of a virtual switch to the outside of the virtual network 90, in step S210. This packet is a packet received by the virtual switch from another port, and is therefore recorded in the RAM of the memory 52.

Then, in step S220, the network construction unit 53a identifies the VLAN ID corresponding to the identified virtual switch and port based on the port correspondence table. Then, in step S230, a tag frame including the VLAN ID identified in step S220 is added to the packet obtained in step S210.

Next, in step S240, the packet to which the tag frame was added in step S230 is sent to an external device, i.e., the switch 55, using the network interface 51. After step S240, the process returns to step S210.

The packet transmitted from the network interface 51 in this way is received by the trunk port 5 of the switch 55. The switch 55 identifies the access port 6 to which the VLAN ID in the received packet is assigned, removes the tag frame from the packet, and transmits the packet after removal from the identified access port 6.

As described above, when a packet is to be sent from a connection destination of the virtual network 90 to an outside of the virtual network 90, the network construction unit 53a identifies the ID corresponding to the connection destination based on the port correspondence table. Then, the network construction unit 53a includes a tag frame including the identified ID in the packet and transmits the packet from the network interface 51 to the trunk port 5 of the switch 55.

By doing this, the network construction unit 53a transmits packets from the virtual switch to the real communication device 8 within the virtual network 90 in the format defined in the port correspondence table. Therefore, data is delivered according to the network configuration of the virtual network 90.

Even if a packet is sent from a certain destination of virtual network 90 (e.g., a specific port of a specific virtual switch) to an outside of virtual network 90, an ID is assigned to the packet based on the destination and port correspondence table, thereby realizing appropriate delivery from within virtual network 90 to outside virtual network 90.

In addition, even if multiple communication devices 8 are connected to one network interface 51 in the network management device 50 via a switch 55, which is an actual relay device, the number of network interfaces provided on the network management device 50 side can be reduced by the processing shown in Figures 4 and 5.

In virtual network 90, virtual switch 91 is connected to virtual switch 92 via router 8d, and is connected to virtual switch 93 via router 8e. There are no other packet delivery paths between virtual switches 91, 92, and 93.

Next, the network change unit 53b will be described. The network change unit 53b changes the configuration of the virtual network 90 configured by the network construction unit 53a by changing the configuration data 52a. Specifically, the change in the configuration of the virtual network 90 is realized by changing the VLAN ID of the port of the virtual switch.

A VLAN ID can be set for each of the ports of virtual switches 91, 92, and 93. The VLAN ID for each port is described in the virtual relay table in configuration data 52a. Specifically, the virtual relay table describes the VLAN ID to be assigned to each of the multiple ports that virtual switches 91, 92, and 93 have.

Then, the network construction unit 53a controls the delivery mode of packets delivered to the virtual switches 91, 92, and 93 based on this virtual relay table. That is, when a port of a virtual switch receives a packet, the packet is transmitted from a port in the same virtual switch to which the same VLAN ID as that port is assigned in the virtual relay table. The packet is not transmitted from a port in the same virtual switch to which a different VLAN ID than that of the port is assigned in the virtual relay table. Therefore, assigning a VLAN ID to a port of a virtual switch corresponds to specifying the forwarding destination of a packet in the virtual switch.

To explain the operation of the network change unit 53b, it is assumed that the VLAN IDs of the ports of the virtual switches 91, 92, and 93 in the virtual network 90 shown in FIG. 2 are as shown in FIG. 6. In FIG. 6, the ports shown only in a square frame are assigned a VLAN ID of 100, and the ports shown in a filled-in square are assigned a VLAN ID of 200.

Therefore, each port of virtual switch 92 is assigned a VLAN ID of 100, and each port of virtual switch 93 is assigned a VLAN ID of 200. And, of the ports of virtual switch 91, all ports except port 91d connected to router 8e are assigned a VLAN ID of 100, and port 91d is assigned a VLAN ID of 200.

In this state, packets can be sent and received via virtual switches 91 and 92, but packets cannot be sent and received via virtual switches 91 and 93. This is because the VLAN IDs assigned to the ports of virtual switches 91 and 92 are the same, but the VLAN ID assigned to virtual switch 93 is different.

In addition, a honeypot 8k, which is set to the same IP address and MAC address as the communication device 8f, is connected to the virtual switch 93. The honeypot 8k is a communication device for deceiving an attacker who sends malicious packets to the communication device 8f.

The network change unit 53b constantly executes the process shown in FIG. 7. In this process, the network change unit 53b first determines whether a predetermined event has occurred in step S310. The predetermined event may be, for example, an event in which a packet addressed to the communication device 8f that does not satisfy a predetermined communication permission condition has arrived at the virtual switch 91f.

The predetermined communication permission conditions may be recorded in advance as a whitelist (not shown) in, for example, a flash memory of the memory 52. For example, the whitelist contains a plurality of records each consisting of one or more parameters selected from the source IP address, destination IP address, source port number, destination port number, and protocol.

Then, if the characteristics of a packet that arrives at the virtual switch 91f and is addressed to the communication device 8f exactly match the contents of any one of the multiple records, the network change unit 53b determines that the packet satisfies the specified communication permission condition. In this case, the network change unit 53b determines that the specified event has not occurred.

In addition, if the characteristics of a packet addressed to communication device 8f that arrives at virtual switch 91f do not completely match the contents of any of these multiple records, network change unit 53b determines that the packet does not satisfy the specified communication permission conditions. In this case, network change unit 53b determines that a specified event has occurred. A packet that does not satisfy the communication permission conditions is likely to be a packet for port scanning, sending malware, etc., that is, for attacking communication device 8f. This packet may arrive via wide area network 1, or may be sent from a communication device at base L1 that has been taken over by a malicious attacker.

To determine whether a specific event has occurred using this method, the network change unit 53b outside the virtual network 90 reads the contents of the packet that has arrived at the virtual switch 91f within the virtual network 90. This is achieved by data exchange between the virtual switch 91f and the network change unit 53b without using the virtual network 90. Examples of data exchange without using the virtual network 90 include memory area sharing and inter-process communication.

In this way, the network change unit 53b determines whether or not a specified event has occurred outside the virtual network 90, based on the contents of the packet delivered through the virtual network 90. In this way, by allowing the network change unit 53b to make a determination based on a packet delivered through the virtual network 90 even outside the virtual network 90, it is not necessary to employ a complex configuration in which the network change unit 53b transmits a packet to the network change unit 53b via the virtual network 90 within the virtual network 90.

If the network change unit 53b determines in step S31 that a specified event has occurred, it proceeds to step S320, and if it determines that a specified event has not occurred, it repeats the determination in step S310.

In step S320, the network change unit 53b changes the network configuration of the virtual network 90. Specifically, the virtual relay table in the configuration data 52a is rewritten to change the VLAN IDs of the ports of the virtual switches 91, 92, and 93 to the form shown in FIG. 8.

That is, the VLAN IDs of the ports of virtual switch 92 and 93 are not changed, and the VLAN IDs of the ports of virtual switch 91 are changed. Specifically, the VLAN IDs of all ports of virtual switch 91 other than ports 91c and 91d connected to routers 8d and 8e are changed from 100 to 200, and the VLAN IDs of ports 91c and 91d are not changed. As a result, the VLAN ID of 200 is assigned to all ports of virtual switch 91 other than port 91c connected to router 8d, and the VLAN ID of port 91c is assigned to 100.

In this state, packets can be sent and received via virtual switches 91 and 93, but packets cannot be sent and received via virtual switches 91 and 92. This is because the VLAN IDs assigned to the ports of virtual switches 91 and 93 are the same, but the VLAN ID assigned to virtual switch 92 is different.

Since honeypot 8k has the same IP address and MAC address as communication device 8f, packets addressed to communication device 8f that arrive at virtual switch 91 are delivered to honeypot 8k via virtual switch 93. Note that honeypot 8k may be a real communication device connected to switch 55, or a virtual machine virtually generated within virtual network 90. Honeypot 8k records the received packets in its own storage medium, and also records malware sent by an attacker in its own storage medium. This makes it possible to prevent attacks on communication device 8f, and allows honeypot 8k to obtain information about the attacker without being aware of the network switch.

After step S320, the network change unit 53b returns to step S310 and determines whether a predetermined event has occurred. For example, after it is determined that a packet does not satisfy a predetermined communication permission condition, the predetermined event may be the passage of a predetermined time (e.g., one hour) or more since the last transmission of a packet that does not satisfy the communication permission condition.

In this case, if a predetermined time or more has passed since the last packet that does not satisfy the communication permission conditions was sent, the network change unit 53b proceeds from step S310 to step S320 and rewrites the virtual relay table to return the VLAN IDs of each port of the virtual switches 91, 92, and 93 to the form shown in FIG. 6.

That is, the VLAN IDs of the ports of virtual switch 92 and 93 are not changed, and the VLAN IDs of the ports of virtual switch 91 are changed. Specifically, the VLAN IDs of all ports of virtual switch 91 other than ports 91c and 91d connected to routers 8d and 8e are changed from 200 to 100, and the VLAN IDs of ports 91c and 91d are not changed. As a result, the VLAN ID of 100 is assigned to all ports of virtual switch 91 other than port 91d connected to router 8e, and the VLAN ID of port 91d is assigned to 200.

By doing this, packets can be sent and received via virtual switches 91 and 92, but packets cannot be sent and received via virtual switches 91 and 93. In other words, communication devices connected to virtual switch 92, such as communication device 8f, can again communicate via virtual switch 91.

As described above, the network change unit 53b changes the packet delivery mode in the virtual network 90 by rewriting the configuration data 52a based on the occurrence of a specified event. In this way, by rewriting the configuration data in response to the occurrence of a specified event, it is possible to centrally and flexibly change the communication paths between multiple communication devices. In other words, the network connection mode can be easily changed.

If this were not the case and a network were constructed by connecting multiple real communication devices 8 at site L2 with multiple real network cables and multiple real relay devices, it would be necessary to change the settings on each of the multiple real relay devices and manually change the connection destinations of the multiple network cables. In other words, it would be difficult to change the communication paths centrally or flexibly.

The network change unit 53b also changes the packet delivery mode in the virtual network by rewriting the virtual relay table while continuing to operate the virtual switches 91, 92, and 93.

In this way, by creating a virtual relay table while the relay device continues to operate, the packet delivery mode in the virtual network can be changed more quickly than if the relay device were to be virtually restarted.

The network change unit 53b also changes the packet delivery mode in the virtual network by changing the IDs of at least some of the multiple ports in the virtual relay table. In this way, the packet delivery mode in the virtual network 90 can be changed by the simple process of changing the IDs of the ports of the virtual switch.

Other Embodiments
It should be noted that the present disclosure is not limited to the above-mentioned embodiment, and can be modified as appropriate. In addition, in the above-mentioned embodiment, the elements constituting the embodiment are not necessarily essential, except when it is specifically stated that they are essential or when it is clearly considered to be essential in principle. In addition, in the above-mentioned embodiment, when the numerical values of the number, numerical value, amount, range, etc. of the components of the embodiment are mentioned, they are not limited to the specific number, except when it is specifically stated that they are essential or when it is clearly limited to a specific number in principle. In particular, when multiple values are exemplified for a certain amount, it is also possible to adopt a value between those multiple values, except when it is specifically stated otherwise or when it is clearly impossible in principle. In addition, in the above-mentioned embodiment, when referring to the shape, positional relationship, etc. of the components, etc., they are not limited to the shape, positional relationship, etc., except when it is specifically stated or when it is limited to a specific shape, positional relationship, etc. in principle. In addition, the present disclosure also allows the following modified examples and modified examples within an equivalent range to the above-mentioned embodiment. It should be noted that the following modified examples can be independently selected to be applied or not applied to the above-mentioned embodiment. That is, any combination of the following modified examples, except for combinations that are obviously contradictory, can be applied to the above-mentioned embodiment.

(Variation 1)
In the above embodiment, the network change unit 53b changes the packet delivery mode in the virtual network 90 by rewriting the virtual relay table in the configuration data 52a while continuing the operation of the virtual switches 91, 92, and 93. However, this does not necessarily have to be the case.

For example, the network change unit 53b may change the combination of connections between the virtual switches 91, 92, and 93 and the communication device 8 due to the occurrence of a specified event. For example, in the above embodiment, based on the occurrence of an event, the actual communication device connected to port 91e of the virtual switch 92 may be replaced from communication device 8f to honeypot 8k. To do this, the network change unit 53b swaps the VLAN IDs 8 and 10 in the port correspondence table shown in FIG. 3 in the configuration data 52a.

Alternatively, the network change unit 53b may replace the relay device group in the virtual network 90 with another relay device group due to the occurrence of a predetermined event. To do this, the network change unit 53b replaces the relay device group in the virtual network 90 with a new one by rewriting the configuration data 52a, and further restarts the network construction unit 53a. As a result, the network construction unit 53a constructs the virtual network 90 having the new relay device group according to the rewritten network construction unit 53a. This replacement may increase or decrease the number of relay devices in the virtual network 90. In addition, multiple communication devices connected to the same relay device in the virtual network 90 may be connected to different relay devices in the virtual network 90 as a result of this replacement. Conversely, multiple communication devices connected to different relay devices in the virtual network 90 may be connected to the same relay device in the virtual network 90 as a result of this replacement.

A specific example of such a relay device replacement will be described with reference to Figures 9, 10, and 11. In this example, at a certain point in time, virtual subnets VL1 and VL2 constitute part of the virtual network 90.

The communication terminal 7a is connected to the subnetwork VL1, and the communication terminals 7b, 7c, 7d, and 7e are connected to the subnetwork VL2. These communication terminals 7a-7e may be SCADA or OPC servers, or may be computers with other functions.

Each of the communication terminals 7a-7e may be a real device, or may be a virtual device within the virtual network 90. If each of the communication terminals 7a-7e is a real device, it is connected to the access port 6 of the switch 55 as in the above embodiment, and is specified to be connected to the subnetwork VL1 or the subnetwork VL2 by the port correspondence table. If each of the communication terminals 7a-7e is a virtually configured device, it is generated and emulated in software by the network construction unit 53a using virtualization technology based on the configuration data 52a as in the above embodiment. For example, as shown in FIG. 9, the communication terminals 7a, 7b, and 7e may be real devices, and the communication terminals 7c and 7d may be virtually configured devices.

A virtual relay device 9a is connected to the subnets VL1 and VL2. The relay device 9a is virtually configured as a router or gateway that relays packets flowing from the subnet VL1 to the subnet VL2 and packets flowing in the opposite direction. That is, the relay device 9a is generated and emulated in software by the network construction unit 53a using virtualization technology based on the configuration data 52a, as in the above embodiment.

The network address of subnet VL1 is 192.168.1.0, and the subnet mask is 255.255.255.0. The network address of subnet VL2 is 192.168.2.0, and the subnet mask is 255.255.255.0. The IP address of the network interface on the subnet VL1 side of relay device 9a is 192.168.1.1, and the IP address of the network interface on the subnet VL2 side is 192.168.2.1.

The IP addresses of communication terminals 7a-7e are as shown in FIG. 9. Specifically, the IP address of communication terminal 7a is an IP address assigned to subnet VL1, and the IP addresses of communication terminals 7b-7e are IP addresses assigned to subnet VL2.

In this configuration, it is assumed that the network change unit 53b determines in step S310 in the process shown in FIG. 7 that a specified event has occurred. The criteria for determining whether or not a specified event has occurred are the same as in the above embodiment. In this case, the network change unit 53b then proceeds to step S320 and changes the network configuration of the virtual network 90. Specifically, as shown in FIG. 10, by rewriting the configuration data 52a, a new virtual subnet VL3 different from the subnets VL1 and VL2 is generated, and the connection destination of the communication terminals 7d and 7e is switched from the subnet VL2 to the subnet VL3.

The network address of the subnet VL3 generated at this time is 192.168.2.0, and the subnet mask is 255.255.255.0. The IP addresses of the communication terminals 7d and 7e are not changed.

In addition, neither a relay device that relays data delivery between subnetwork VL3 and subnetwork VL1 nor a relay device that relays data delivery between subnetwork VL3 and subnetwork VL2 is generated. Therefore, subnetwork VL3 is completely isolated from other subnetworks in virtual network 90. That is, communication terminals 7d and 7e in subnetwork VL3 will be unable to communicate with communication devices connected to other subnetworks in virtual network 90. In other words, communication terminals 7d and 7e that were originally in subnetwork VL2 can be isolated as a zone. In this way, if an event occurs as a result of an external attack on virtual network 90, communication terminals 7d and 7e can be protected from attack.

Note that other methods may be used to separate communication terminals 7d and 7e as zones. For example, relay device 9a and communication terminals 7b-7e belonging to subnet VL2 may each be connected to each port of a virtually configured virtual switch (not shown). This virtual switch is generated and emulated in software by network construction unit 53a using virtualization technology based on configuration data 52a, similar to virtual switches 91-93 in the above embodiment. Also, a VLAN ID can be set for each port of this virtual switch using a virtual relay table, similar to virtual switches 91-93 in the above embodiment.

In this case, in step S320, the network change unit 53b assigns a different VLAN ID only to the VLAN ID of the port to which the communication terminals 7d and 7e are connected, whereas the same VLAN ID was previously assigned to all ports of this virtual switch. This VLAN ID switching is achieved by rewriting the virtual relay table. This allows the communication terminals 7d and 7e to be separated as zones. At this time, the changed VLAN ID of the port to which the communication terminal 7d is connected and the changed VLAN ID of the port to which the communication terminal 7e is connected may be the same or different.

Alternatively, in step S320, the network change unit 53b may not only change the connection destination of the communication terminals 7d and 7e from the original subnetwork VL2 to the new subnetwork VL3, but may also generate a new virtual relay device 9b as shown in FIG. 11. This relay device 9b is generated and emulated in software by the network construction unit 53a using virtualization technology based on the configuration data 52a, as in the above embodiment. When generating the relay device 9b, if necessary, the network construction unit 53a is restarted, as in the above embodiment.

Relay device 9b is virtually configured as a router or gateway that relays packets flowing from subnet VL1 to subnet VL3 and vice versa. The IP address of the network interface on the subnet VL1 side of relay device 9b is set to 192.168.1.2 so that it is different from that of relay device 9a. The IP address of the network interface on the subnet VL3 side of relay device 9b is 192.168.2.1, which belongs to the same subnet as communication terminals 7d and 7e. This allows relay device 9b and communication terminals 7d and 7e to communicate within the same subnet without changing the IP addresses of communication terminals 7d and 7e.

In this way, the network change unit 53b moves the communication terminals 7d and 7e belonging to the subnetwork VL2 in the virtual network 90 from the subnetwork VL2 to the subnetwork VL3. The network change unit 53b then generates a relay device 9b that relays the delivery of packets between the subnetwork VL3 and another subnetwork VL1 in the virtual network 90. This makes it possible to dynamically switch the delivery route by moving some communication terminals from the subnetwork VL2 to the subnetwork VL3 and generating a relay device 9b that relays between the destination subnetwork VL3 and the other subnetwork VL1. This switching makes it possible to ensure both the safety of the some communication terminals and the communication route.

In addition, by making the settings of the generated relay device 9b different from those of the relay device 9a, a communication environment that is more resistant to attacks is realized. Examples of settings of the relay device 9b that are made different from those of the relay device 9a include the operating system (e.g., Linux, BSD/OS), distribution (e.g., CentOS, Fedora), and login password of the administrator account (e.g., root). The relay devices 9a and 9b may also have a firewall function. Note that the subnetwork VL2 corresponds to the first subnetwork, and the subnetwork VL3 corresponds to the second subnetwork.

Note that the IP address of relay device 9a on the subnet VL2 side and the IP address of relay device 9b on the subnet VL3 side will be the same, but this does not cause a problem in terms of packet delivery. This is because, as viewed from devices in subnet VL2, the IP address of relay device 9b is 192.168.1.2, which is different from the IP address of relay device 9a, 192.168.2.1. And, as viewed from devices in subnet VL3, the IP address of relay device 9a is 192.168.1.1, which is different from the IP address of relay device 9b, 192.168.2.1.

If necessary, the relay devices 9a and 9b may have an IP masquerading function to hide the IP addresses in the subnets VL2 and VL3 from outside. In other words, the IP addresses in the subnets VL2 and VL3 may be used as private IP addresses. The relay devices 9a and 9b may also have a NAT (Network Address Translation) function.

In addition, in step S320, the network change unit 53b may switch between changing the virtual network 90 as shown in FIG. 10 and changing the virtual network 90 as shown in FIG. 11 depending on the type of event that has occurred. For example, if a more dangerous attack has occurred, the virtual network 90 may be changed as shown in FIG. 10, and if a less dangerous attack has occurred, the virtual network 90 may be changed as shown in FIG. 10. In other words, the network change unit 53b may switch the change in the packet delivery mode depending on the content of the event that has occurred.

(Variation 2)
In the above embodiment, the network change unit 53b changes the VLAN IDs of only some of the ports of the virtual switch 91 among the ports of the virtual switches 91, 92, and 93 based on the occurrence of an event. However, this does not necessarily have to be the case.

For example, the network change unit 53b may change the VLAN IDs of some of the ports of virtual switches 91, 92, and 93, in addition to some of the ports of virtual switch 91, based on the occurrence of an event.

(Variation 3)
In the above embodiment, examples of specified events that cause the network change unit 53b to rewrite the configuration data 52a include "an event in which a packet addressed to a communication device 8f that does not satisfy the specified communication permission conditions arrives" and "an event in which a specified amount of time has passed since a packet that does not satisfy the communication permission conditions was last transmitted."

However, the specified event is not limited to these. For example, the specified event may be an event that a particular type of packet is transmitted within the virtual network 90. Alternatively, the specified event may be an event that a failure occurs in a real communication device outside the virtual network 90. Alternatively, the specified event may be an event that a pre-specified time has arrived.

In the above embodiment, the network change unit 53b rewrites the configuration data 52a for the purpose of deceiving a malicious attacker and obtaining information about the attacker, but the purpose of rewriting the configuration data 52a is not limited to this. It may be simply for the purpose of reducing the load on the communication device, or for the purpose of responding to changes in the products being manufactured.

(Variation 4)
In the above embodiment, the multiple communication devices 8 are connected to the network management device 50 via the switch 55. However, the switch 55 may be eliminated from the above embodiment, and each of the multiple communication devices 8 may be directly connected to a port of the network management device 50 via an Ethernet cable. In this case, the network management device 50 has multiple ports. In this case, the port correspondence table describes the correspondence between IDs uniquely assigned to the multiple ports of the network management device 50 and the connection destinations of the ports in the virtual network 90.

(Variation 5)
In the above embodiment, the switch 55, which is a Layer 2 switch that supports tagged VLANs, is described as an example of an actual relay device. However, the actual relay device may be a router or a Layer 3 switch.

(Variation 6)
In the above embodiment, examples of virtual relay devices are the virtual switches 91, 92, and 93. However, the virtual relay devices are not limited to switches and may be routers.

(Variation 7)
In the above embodiment, the network management device 50 has a single network interface 51. However, the network management device 50 may have a network interface other than the network interface 51.

(Variation 8)
In the above embodiment, the connection destination in the virtual network 90 for the access port 6 of the switch 55 is the virtual switches 91, 92, and 93. However, this does not necessarily have to be the case. The connection destination in the virtual network 90 for the access port 6 of the switch 55 may be a virtual communication device other than a virtual switch.

(Variation 9)
In the above embodiment, the network construction unit 53a may realize a firewall function in the virtual network 90. For example, when a packet that has arrived at the virtual switches 91, 92, and 93 is a packet that complies with a predetermined protocol (for example, a protocol defined in OPC-UA), the network construction unit 53a may permit the virtual switches 91, 92, and 93 to transfer the packet. When a packet that has arrived at the virtual switches 91, 92, and 93 is a packet that does not complies with the predetermined protocol, the network construction unit 53a may prohibit the virtual switches 91, 92, and 93 from transferring the packet.

1...wide area network, 5...trunk port, 6...access port, 8...communication device, 50...network management device, 51...network interface, 52a...configuration data, 53a...network construction unit, 53b...network modification unit, 55...switch, 91, 92, 93...virtual switch, L1, L2...base.

Claims (6)

A network management device for use in an industrial control system, comprising:
A network interface (51) for communicating with a plurality of communication devices (30 to 34, 8);
a network construction unit (53a) that reads configuration data (52a) describing a configuration of a virtual network (90) that mediates communications between the plurality of communication devices from a memory (52), and distributes packets to be transmitted and received between the plurality of communication devices in a distribution form according to the configuration of the virtual network described in the read configuration data;
a network change unit (53b) for changing a packet delivery mode in the virtual network by rewriting the configuration data based on the occurrence of a predetermined event ;
The configuration data includes a virtual relay table that specifies a packet forwarding destination in a virtual relay device (91, 92, 93) that relays packets in the virtual network,
The network change unit changes a packet delivery mode in the virtual network by rewriting the virtual relay table while continuing operation of the virtual relay device . the virtual relay device is a virtual switch having a plurality of ports, an ID being configurable for each of the plurality of ports, delivering packets between ports having the same ID and not delivering packets between ports having different IDs,
2. The network management device according to claim 1 , wherein the network change unit changes the IDs of at least a part of the plurality of ports in the virtual relay table, thereby changing a packet delivery mode in the virtual network. The plurality of communication devices are connected to a plurality of access ports (6) provided in a real relay device (55);
The network interface is connected to a trunk port (5) provided in the actual relay device,
The plurality of access ports are assigned different IDs,
The configuration data includes a port correspondence table;
the port correspondence table describes a correspondence relationship between IDs assigned to the plurality of access ports of the real relay device and connection destinations of the access ports in the virtual network,
when the actual relay device receives a packet at any one of the plurality of access ports, the actual relay device adds an ID assigned to the one access port to the packet and transmits the packet to the network interface via the trunk port;
the network construction unit specifies a connection destination in the virtual network corresponding to an ID included in a tag frame in a packet received from the network interface based on the port correspondence table, and transmits the packet to the connection destination in the virtual network;
the network construction unit, when a packet is to be transmitted from a connection destination of the virtual network to an outside of the virtual network, identifies an ID corresponding to the connection destination based on the port correspondence table, includes a tag frame including the identified ID in the packet, and transmits the packet from the network interface to the trunk port;
3. The network management device according to claim 1, wherein when a packet received at the trunk port contains a tag frame, the actual relay device transmits the packet from an access port to which an ID in the tag frame is assigned. A network management device for use in an industrial control system, comprising:
A network interface (51) for communicating with a plurality of communication devices (30 to 34, 8);
a network construction unit (53a) that reads configuration data (52a) describing a configuration of a virtual network (90) that mediates communications between the plurality of communication devices from a memory (52), and distributes packets to be transmitted and received between the plurality of communication devices in a distribution form according to the configuration of the virtual network described in the read configuration data;
a network change unit (53b) for changing a packet delivery mode in the virtual network by rewriting the configuration data based on the occurrence of a predetermined event ;
The plurality of communication devices are connected to a plurality of access ports (6) provided in a real relay device (55);
The network interface is connected to a trunk port (5) provided in the actual relay device,
The plurality of access ports are assigned different IDs,
The configuration data includes a port correspondence table;
the port correspondence table describes a correspondence relationship between IDs assigned to the plurality of access ports of the real relay device and connection destinations of the access ports in the virtual network,
when the actual relay device receives a packet at any one of the plurality of access ports, the actual relay device adds an ID assigned to the one access port to the packet and transmits the packet to the network interface via the trunk port;
the network construction unit specifies a connection destination in the virtual network corresponding to an ID included in a tag frame in a packet received from the network interface based on the port correspondence table, and transmits the packet to the connection destination in the virtual network;
the network construction unit, when a packet is to be transmitted from a connection destination of the virtual network to an outside of the virtual network, identifies an ID corresponding to the connection destination based on the port correspondence table, includes a tag frame including the identified ID in the packet, and transmits the packet from the network interface to the trunk port;
A network management device in which, when a packet received at the trunk port contains a tag frame, the actual relay device transmits the packet from an access port to which an ID in the tag frame is assigned . A network management device for use in an industrial control system, comprising:
A network interface (51) for communicating with a plurality of communication devices (30 to 34, 8);
a network construction unit (53a) that reads configuration data (52a) describing a configuration of a virtual network (90) that mediates communications between the plurality of communication devices from a memory (52), and distributes packets to be transmitted and received between the plurality of communication devices in a distribution form according to the configuration of the virtual network described in the read configuration data;
a network change unit (53b) for changing a packet delivery mode in the virtual network by rewriting the configuration data based on the occurrence of a predetermined event ;
The network change unit determines whether or not the predetermined event has occurred outside the virtual network based on the contents of a packet delivered through the virtual network. A network management device for use in an industrial control system, comprising:
A network interface (51) for communicating with a plurality of communication devices (30 to 34, 8);
a network construction unit (53a) that reads configuration data (52a) describing a configuration of a virtual network (90) that mediates communications between the plurality of communication devices from a memory (52), and distributes packets to be transmitted and received between the plurality of communication devices in a distribution form according to the configuration of the virtual network described in the read configuration data;
a network change unit (53b) for changing a packet delivery mode in the virtual network by rewriting the configuration data based on the occurrence of a predetermined event ;
The network change unit is a network management device that moves a portion (7d, 7e) of communication terminals belonging to a first subnet (VL2) in the virtual network from the first subnet to a second subnet (VL3) based on the occurrence of the specified event, and generates a relay device (9b) that relays the delivery of packets between the second subnet and another subnet (VL1) in the virtual network.

Images