WO2022239159A1

WO2022239159A1 - Air conditioner, security attack countermeasure method, and program

Info

Publication number: WO2022239159A1
Application number: PCT/JP2021/018105
Authority: WO
Inventors: 弘明遠藤; 弘晃小竹; 香佐藤
Original assignee: 三菱電機株式会社
Priority date: 2021-05-12
Filing date: 2021-05-12
Publication date: 2022-11-17
Also published as: JPWO2022239159A1

Abstract

An indoor unit (5) comprises: a security attack detection part (500) that determines the presence or absence of a security attack at the time of reception of a communication frame and that, when the presence of the security attack has been determined, identifies a type of the security attack; and a security attack response part (504) for, when the presence of a security attack has been determined by the security attack detection part (500), executing a security attack response process that is a process according to the type of the security attack and that is for removing the influence of the security attack.

Description

Air conditioner, security attack coping method and program

The present disclosure relates to air conditioners, security attack coping methods, and programs.

In an air conditioning system that air-conditions buildings such as buildings and stores, a configuration in which multiple outdoor units, multiple indoor units, etc. are connected via a field network within the air conditioning system is generally known. Further, in recent years, with the enhancement of the connection environment to public networks such as the Internet, there has been progress in technology for directly or indirectly connecting the devices constituting the air conditioning system to the public network.

Such air-conditioning systems may be subject to security attacks via public networks or by direct access to the field network within the air-conditioning system, and countermeasures are required.

For example, Patent Document 1 discloses an intrusion detection device that detects intrusion into a network that connects a controller that controls air conditioners and a monitoring control terminal that monitors the air conditioners in a building management system. This intrusion detection device acquires communication data relating to air conditioners flowing through a network, and adds a system state and cycle to the acquired communication data to generate communication determination data. Also, the intrusion detection device generates a communication permission rule that permits communication in the network and compares it with the communication determination data to detect intrusion into the network. When an intrusion into the network is detected, the intrusion detection device outputs an alarm to the network. The output alarm is input to the supervisory control terminal via the network and displayed on the display of the supervisory control terminal.

WO2019/004101

With the technology disclosed in Patent Document 1, when an intrusion into a network is detected, an alarm is output by the monitoring control terminal. It is possible. However, with the manual response after the alarm is output, it takes a considerable amount of time to complete the appropriate measures to respond to the intrusion into the network. There is concern that the impact of

The present disclosure has been made to solve the above problems, and aims to provide an air conditioner, a security attack coping method, and a program that can reduce the impact of security attacks.

In order to achieve the above object, the air conditioner according to the present disclosure is
security attack detection means for determining whether or not a security attack has occurred when a communication frame is received, and determining the type of the security attack if it is determined that there is a security attack;
a security attack countermeasure means for executing a security attack countermeasure process for eliminating the influence of the security attack, which is a process corresponding to the type of the security attack when the security attack detection means determines that there is a security attack; Prepare.

According to this disclosure, it is possible to reduce the impact of security attacks.

1 is a block diagram showing the configuration of an air conditioning system according to an embodiment; FIG. FIG. 2 is a block diagram showing the hardware configuration of the central control device according to the embodiment; Fig. 2 is a block diagram showing the hardware configuration of the outdoor unit according to the embodiment; Fig. 2 is a block diagram showing the hardware configuration of the indoor unit according to the embodiment; FIG. 2 is a block diagram showing the hardware configuration of the remote controller according to the embodiment; FIG. 2 is a block diagram showing the hardware configuration of the communication adapter according to the embodiment; FIG. FIG. 2 is a block diagram showing the hardware configuration of the terminal device according to the embodiment; The figure which shows the functional structure of the indoor unit in embodiment. A diagram showing an example of an attack type determination table according to the embodiment Flowchart showing the procedure of processing when receiving a communication frame according to the embodiment

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing the overall configuration of an air conditioning system 1 according to an embodiment of the present disclosure. The air conditioning system 1 is, for example, a system for air conditioning a building such as a building, a store, etc., and includes a server 2, a centralized control device 3, outdoor units 4a to 4c, indoor units 5a to 5f, a remote controller 6, and a communication adapter 7 . In addition, the terminal device 8 is temporarily connected to the air conditioning system 1 during maintenance.

<Server 2>
The server 2 is, for example, a cloud server that implements a public cloud such as AWS (Amazon Web Services), and is connected to a network N such as the Internet. The server 2 transmits update firmware to the air conditioners (outdoor units 4a to 4c and indoor units 5a to 5f) whose firmware needs to be updated. In addition, the server 2 collects data on the operation of each air conditioner (outdoor units 4a to 4c, indoor units 5a to 5f), and provides a service for controlling each air conditioner based on the collected data, or a service based on the collected data. A service is provided for presenting information to persons concerned with the air conditioning system 1 (owner of the building, system manager, maintenance staff, etc.).

<Central control device 3>
The centralized control device 3 is a device for centrally managing each air conditioner (outdoor units 4a to 4c, indoor units 5a to 5f) in the air conditioning system 1. It is installed in a place where no one can enter. As shown in FIG. 2, the centralized control device 3 has a hardware configuration including a first communication interface 30, a second communication interface 31, an operation reception unit 32, a display 33, a control circuit 34, and an auxiliary storage device. 35.

The first communication interface 30 is an interface for connecting to the network N and communicating with the server 2, for example, an interface based on Ethernet (registered trademark). The second communication interface 31 is an interface for communicating with the outdoor units 4a to 4c via the transmission line 9, which is a centralized transmission line, for example, by a communication method in which an AMI waveform is superimposed on a DC power supply.

The operation reception unit 32 includes, for example, one or more input devices such as a keyboard, mouse, keypad, push button, touch panel, and touch pad, and receives an input operation from the user, and performs processing related to the received input operation. A signal is output to the control circuit 34 . The display 33 includes a display device such as a liquid crystal display and an organic EL (Electro Luminescence) display. The display 33 displays a screen or the like for managing the air conditioning system 1 under the control of the control circuit 34 .

The control circuit 34 includes a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and controls the centralized control device 3 in an integrated manner. The auxiliary storage device 35 is composed of a readable/writable non-volatile semiconductor memory, HDD (Hard Disk Drive), or the like. The readable and writable nonvolatile semiconductor memory is, for example, EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, or the like. The auxiliary storage device 35 stores a management program for managing the air conditioning system and data used when executing the management program.

<Outdoor units 4a to 4c, indoor units 5a to 5f>
The outdoor unit 4a, the indoor units 5a, and the indoor units 5b are bus-connected to a transmission line 10a, which is an internal/external transmission line, and are also connected via a first refrigerant pipe (not shown) for circulating the refrigerant. That is, the outdoor unit 4a, the indoor unit 5a, and the indoor unit 5b constitute one refrigerant system.

The outdoor unit 4b, the indoor unit 5c, and the indoor unit 5d are bus-connected to a transmission line 10b, which is an internal/external transmission line, and are connected via a second refrigerant pipe (not shown) different from the first refrigerant pipe. be. That is, the outdoor unit 4b, the indoor unit 5c, and the indoor unit 5d constitute one refrigerant system.

The outdoor unit 4c, the indoor unit 5e, and the indoor unit 5f are bus-connected to a transmission line 10c, which is an internal/external transmission line. Connected via piping. That is, the outdoor unit 4c and the

indoor units

5e and 5f constitute one refrigerant system.

Hereinafter, descriptions common to the outdoor units 4a to 4c will be referred to as the outdoor unit 4 without specifying each one, and descriptions common to the indoor units 5a to 5f will be referred to as the indoor unit 5 without specifying each one. , and the description common to the transmission lines 10a to 10c will be referred to as the transmission line 10 without specifying each one.

The outdoor unit 4 is an example of an air conditioner according to the present disclosure. As shown in FIG. 3, the outdoor unit 4 includes a first communication interface 40, a second communication interface 41, a main unit 42, a control circuit 43, and an auxiliary storage device 44 as a hardware configuration. The first communication interface 40 is an interface for communicating with the central control device 3 , the remote control 6 and other outdoor units 4 via the transmission line 9 . The second communication interface 41 is an interface for communicating with each indoor unit 5 connected to itself via the transmission line 10, which is an internal/external transmission line. In this embodiment, the communication method of the transmission line 9, which is a centralized transmission line, and the communication method of the transmission line 10, which is an internal/external transmission line, are the same (for example, a communication method in which an AMI waveform is superimposed on a DC power supply).

The main unit 42 is a component for realizing the essential functions of a general outdoor unit, and includes, for example, a compressor, a heat exchanger, an expansion valve, a four-way valve, a fan, and various sensors (current sensor, temperature sensor, etc.). sensor, pressure sensor, frequency sensor, acceleration sensor, etc.). The control circuit 43 is a microcontroller that controls the outdoor unit 4 in an integrated manner.

The auxiliary storage device 44 is composed of a readable and writable non-volatile semiconductor memory such as EEPROM and flash memory, for example. The auxiliary storage device 44 stores firmware, which is a software program for the control circuit 43 to control the outdoor unit 4 to implement functions related to air conditioning, and data used when executing the firmware. Furthermore, in the auxiliary storage device 44, a security attack countermeasure program, which is a program for realizing the functions according to the present disclosure and is a program for countering security attacks from the outside, and when the security attack countermeasure program is executed, The data used are stored.

The above security attack countermeasure program can be downloaded to the outdoor unit 4 via the network N from another device such as the server 2. The outdoor unit 4 can also receive a security attack countermeasure program from the terminal device 8 through communication via the remote controller 6 . In addition, security attack countermeasure programs include CD-ROM (Compact Disc Read Only Memory), DVD (Digital Versatile Disc), magneto-optical disc, USB (Universal Serial Bus) memory, HDD, SSD (Solid State Drive), memory card, etc. It is also possible to store and distribute on a computer-readable recording medium. When such a recording medium is attached to the outdoor unit 4, the outdoor unit 4 can also read and import the security attack countermeasure program from the recording medium.

The indoor unit 5 is an example of an air conditioner according to the present disclosure. As shown in FIG. 4, the indoor unit 5 includes a first communication interface 50, a second communication interface 51, a main unit 52, a control circuit 53, and an auxiliary storage device 54 as a hardware configuration. The first communication interface 50 is an interface for communicating with the outdoor unit 4 and other indoor units 5 via the transmission line 10 . The second communication interface 51 is an interface for electrically connecting to the communication adapter 7 so as to be communicable. In this embodiment, the second communication interface 51 is a serial interface such as UART (Universal Asynchronous Receiver/Transmitter).

The main unit 52 is a component for realizing the essential functions of a general indoor unit, and includes, for example, a fan, a heat exchanger, a temperature sensor, a humidity sensor, and the like. The control circuit 53 is a microcontroller that comprehensively controls the indoor unit 5 .

The auxiliary storage device 54 is composed of a readable and writable non-volatile semiconductor memory such as EEPROM, flash memory, etc., for example. The auxiliary storage device 54 stores firmware, which is a software program for the control circuit 53 to control the indoor unit 5 to realize functions related to air conditioning, and data used when executing the firmware. Furthermore, in the auxiliary storage device 54, as in the outdoor unit 4, a security attack countermeasure program and data used when executing the security attack countermeasure program are stored.

The above security attack countermeasure program can be downloaded to the indoor unit 5 via the network N from another device such as the server 2. Also, the indoor unit 5 can receive the security attack countermeasure program from the terminal device 8 by communication via the remote controller 6 . Further, when the above-described recording medium storing the security attack countermeasure program is attached to the indoor unit 5, the indoor unit 5 can read and load the security attack countermeasure program from the recording medium.

<Remote control 6>
The remote controller 6 is a remote controller for air conditioning, is connected to the transmission line 9, and receives operations related to air conditioning from the user. As shown in FIG. 5, the remote controller 6 includes a first communication interface 60, a second communication interface 61, an operation reception unit 62, a display 63, a control circuit 64, and an auxiliary storage device 65 as hardware configuration. Prepare.

The first communication interface 60 is an interface for communicating with each outdoor unit 4 and the central control device 3 via the transmission line 9 . The second communication interface 61 is an interface for performing short-range wireless communication with the terminal device 8, such as NFC (Near Field Communication), BLE (Bluetooth (registered trademark) Low Energy) communication, visible light communication, and infrared communication. .

The operation reception unit 62 includes, for example, one or more input devices such as a push button, a touch panel, and a touch pad, receives an input operation from the user, and outputs a signal related to the received input operation to the control circuit 64. do.

The display 63 includes, for example, a display device such as a liquid crystal display or an organic EL display. The display 63 displays various screens under the control of the control circuit 64 . For example, the display 63 is an air conditioning unit for accepting user operations related to air conditioning, such as switching between start/stop of operation, switching between operation modes such as cooling, heating, dehumidification, and ventilation, and changing set temperature, set humidity, wind speed, and the like. Displays the operation screen, etc.

The control circuit 64 includes a CPU, ROM, RAM, etc., and controls the remote control 6 in a centralized manner. The auxiliary storage device 65 is composed of, for example, a readable/writable non-volatile semiconductor memory such as an EEPROM and a flash memory. The auxiliary storage device 65 stores a program for functioning as a user interface, a program for communication with the terminal device 8, and data used when these programs are executed.

<Communication adapter 7>
The communication adapter 7 is a device for connecting the indoor unit 5 to the network N for communication. As shown in FIG. 6, the communication adapter 7 includes a first communication interface 70, a second communication interface 71, a control circuit 72, and an auxiliary storage device 73 as a hardware configuration.

The first communication interface 70 is an interface for electrically connecting to the indoor unit 5 so as to be communicable. In this embodiment, the first communication interface 70 is a serial interface such as UART. The second communication interface 71 is a wireless LAN (Local Area Network) interface for connecting to the network N and communicating with the server 2, or hardware for mobile data communication.

The control circuit 72 includes a CPU, ROM, RAM, etc., and controls the communication adapter 7 in an integrated manner. The auxiliary storage device 73 is composed of, for example, a readable/writable non-volatile semiconductor memory such as an EEPROM or a flash memory. The auxiliary storage device 73 stores a program for communicating with the indoor unit 5, a program for communicating with the server 2, and data used when these programs are executed.

<Terminal device 8>
The terminal device 8 is a portable electronic device such as a smart phone or a tablet terminal possessed by a person in charge of maintenance of the air conditioning system 1 . As shown in FIG. 7, the terminal device 8 includes a communication interface 80, an operation receiving section 81, a display 82, a control circuit 83, and an auxiliary storage device 84 as a hardware configuration.

The communication interface 80 is an interface for performing the above-described short-range wireless communication with the remote control 6. The operation reception unit 81 includes one or more input devices such as a push button, a touch panel, and a touch pad, receives operation input from the user, and outputs a signal related to the received operation to the control circuit 83 .

The display 82 includes a display device such as a liquid crystal display and an organic EL display. Under the control of the control circuit 83, the display 82 displays various screens and the like according to the user's operation.

The control circuit 83 includes a CPU, ROM, RAM, etc., and controls the terminal device 8 in an integrated manner. The auxiliary storage device 84 is composed of, for example, a readable/writable non-volatile semiconductor memory such as an EEPROM or a flash memory. The auxiliary storage device 84 stores a program executed during maintenance of the air conditioning system 1 and data used during execution of the program.

<Functional Configuration of Outdoor Unit 4 and Indoor Unit 5>
Subsequently, functional configurations of the outdoor unit 4 and the indoor unit 5, which are both examples of the air conditioner according to the present disclosure, will be described. In addition, since the functional configuration of each of the outdoor unit 4 and the indoor unit 5 has a common characteristic configuration according to the present disclosure, the functional configuration of the indoor unit 5 will be described in detail below as a representative of both.

As shown in FIG. 8, the indoor unit 5 includes a security attack detection unit 500, a communication anomaly detection unit 501, a normal response unit 502, a communication anomaly response unit 503, and a security attack response unit 504. These functional units are implemented by the control circuit 53 executing the above-described security attack countermeasure program stored in the auxiliary storage device 54 .

The security attack detection unit 500 is an example of security attack detection means according to the present disclosure. The security attack detection unit 500 determines whether or not there is a security attack when a communication frame is received, and if it determines that there is a security attack, determines its type. Specifically, the security attack detection unit 500 includes an attack presence/absence determination unit 510 and an attack type determination unit 511. The attack presence/absence determination unit 510 determines whether or not there is a security attack. Determine the type of attack.

Specifically, the attack presence/absence determination unit 510 determines whether the received communication frame satisfies each of the following conditions A to C. The attack presence/absence determination unit 510 determines that there is a security attack if the received communication frame satisfies any one of the conditions A to C, and determines that there is no security attack if none of the conditions apply.

(Condition A) The sender address and own address are the same (Condition B) The same communication frame is received from the same sender within a given period of time more than a given number of times (Condition C) The combination of the sender and the command does not match

In the above condition B, the fixed time is, for example, 1 minute, and the fixed number of times is, for example, 15 times. Also, the same communication frame means that the commands, data values, and sequence numbers are the same. In addition, the above condition C means that the type of the transmission source device and the content of the command do not match. (Usually, the central control device 3, the remote controller 6, and the representative unit of the indoor unit 5 send the operation start command/operation stop command to the other indoor units 5 and the outdoor unit 4.). A table (not shown) showing combinations of device types and commands is stored in the auxiliary storage device 54 in advance.

When the attack presence/absence determination unit 510 determines that there is no security attack, it notifies the normal response unit 502 that no security attack has been detected. On the other hand, if the attack presence/absence determination unit 510 determines that there is a security attack, the attack type determination unit 510 determines that the security attack has been detected and determines the determination results (that is, whether or not the conditions are met) for each of the conditions A to C. Notify 511.

When a security attack is detected by the attack presence/absence determination unit 510, the attack type determination unit 511 determines the type of security attack. In this embodiment, three types of security attacks are assumed: "replay attack", "spoofing", and "takeover". The attack type determination unit 511 determines whether or not each of the conditions A to C notified from the attack presence/absence determination unit 510 is met, and the attack type determination table stored in the auxiliary storage device 54 in advance. Based on this, the type of the security attack is determined.

The attack type determination table is a table in which rules for determining the type of security attack are defined. Specifically, as shown in FIG. It is a table that associates . In FIG. 9, "O" means that the determination condition is met, and "X" means that the determination condition is not met. Further, the determination conditions include the above conditions A to C and the following condition D.

(Condition D) No normal reception of periodic communication frames or no normal response from the sender

In the above condition D, the periodic communication frame is a communication frame that is periodically received from the transmission source. is a communication frame showing Also, "normal reception of the periodic communication frame" means reception of the periodic communication frame in the correct period. Equipment (server 2, centralized control device 3, outdoor unit 4, other indoor unit 5 or remote control 6) that is the transmission source of the air conditioner (here, indoor unit 5), content of periodic communication frame, and reception A table (not shown) in which the period is associated is stored in advance in the auxiliary storage device 54 .

Further, in the condition D, "no normal response" means that the response to the communication frame previously transmitted from the air conditioner (here, the indoor unit 5) to the transmission source is a predetermined timeout from the transmission source. It means if you don't get back in time.

If the received communication frame does not meet conditions A and C but meets condition B, the attack type determination unit 511 determines that the type of security attack is a "replay attack" regardless of the determination result of condition D. and discriminate. In addition, if the received communication frame does not meet condition A but meets condition C, the attack type determination unit 511 further determines whether the transmission source meets condition D regardless of the determination result of condition B. Based on the result, the type of security attack is determined. Specifically, if the source does not meet condition D, the attack type determination unit 511 determines that the type of security attack is “spoofing”. The type of security attack is determined to be "hijacking".

In addition, if the received communication frame satisfies condition A, the attack type determination unit 511 determines that the type of security attack is "spoofing" regardless of the determination results of conditions B to D. The attack type determination unit 511 notifies the security attack response unit 504 of the determined type of security attack.

Returning to FIG. 8, the communication abnormality detection unit 501 detects communication abnormality. Specifically, the communication error detection unit 501 periodically determines whether or not there is a communication destination that satisfies the condition D described above. If there is a communication destination that satisfies the condition D, the communication error detection unit 501 notifies the communication error handling unit 503 that the communication error has been detected.

The normal handling unit 502 executes normal processing based on the content of the received communication frame. For example, when the received communication frame includes a command to change the operation, the normal response unit 502 executes processing for changing the operation of its own device (here, the indoor unit 5) according to the command. . Further, when the received communication frame includes a command to inquire about the state, the normal response unit 502 executes processing for transmitting the state of the device to the transmission source according to the command.

The communication anomaly handling unit 503 executes processing corresponding to the occurrence of a communication anomaly. For example, the communication abnormality handling unit 503 notifies the central control device 3, the remote controller 6, or the terminal device 8 that an abnormality has occurred in communication with the communication destination. The central control device 3, the remote controller 6, or the terminal device 8 that has received such notification displays the information regarding the abnormality on the display 33, the display 63, or the display 82 to notify the user. In addition, when the device is equipped with an LED (Light Emitting Diode), the communication abnormality handling unit 503 may notify the user of the communication abnormality by causing the LED to emit light in a predetermined manner, If the device has a speaker, the user may be notified of the communication abnormality by outputting an electronic sound from the speaker.

The security attack handling unit 504 is an example of security attack handling means according to the present disclosure. When the security attack detection unit 500 determines that there is a security attack, the security attack countermeasure unit 504 executes security attack countermeasure processing to eliminate the influence of the security attack. Specifically, the security attack handling unit 504 executes security attack handling processing according to the type of security attack determined by the attack type determining unit 511 as follows.

(replay attack)
If the security attack is determined to be a "replay attack", the security attack response unit 504 detects the communication frame corresponding to condition B, that is, the same communication sent in large quantities from the same source within a certain period of time. Discard all frames without doing anything. However, communication frames that do not meet the condition B are treated as normal even if they are from the same source, and the same processing as the normal handling unit 502 is executed.

(impersonation)
If the security attack is determined to be "spoofing", the security attack response unit 504 detects communication frames that meet condition B or condition C, that is, identical communication frames or communication frames in which the combination of the source and the command does not match are all discarded without doing anything. However, communication frames that do not meet either condition B or condition C are treated as usual even if they are from the same source, and the same processing as the normal handling unit 502 is executed.

(takeover)
If the security attack is determined to be "hijacking", the security attack response unit 504 discards all communication frames from the transmission source without doing anything. In addition, the security attack handling unit 504 prohibits transmission of communication frames addressed to the source.

FIG. 10 is a flow chart showing the procedure of communication frame reception processing executed by the air conditioners (outdoor unit 4 and indoor unit 5).

(Step S101)
The air conditioner determines whether or not a new communication frame has been received from any device in the air conditioning system 1 . When a communication frame is received from any device (step S101; YES), the processing of the air conditioner transitions to step S102.

(Step S102)
The air conditioner determines whether there is a security attack. Specifically, the air conditioner determines whether the received communication frame satisfies each of the conditions A to C described above. The air conditioner determines that there is a security attack if the received communication frame satisfies any one of the conditions A to C, and determines that there is no security attack if none of the conditions apply. When it is determined that there is no security attack (step S102; NO), the processing of the air conditioner transitions to step S103. On the other hand, when it is determined that there is a security attack (step S102; YES), the processing of the air conditioner transitions to step S104.

(Step S103)
The air conditioner performs normal processing based on the content of the received communication frame. After that, the processing of the air conditioner returns to step S101.

(Step S104)
The air conditioner determines the type of security attack. Specifically, the air conditioner uses the attack type determination table shown in FIG. 9 to determine which type of security attack is "replay attack", "spoofing", or "takeover". discriminate. After that, the processing of the air conditioner transitions to step S105.

(Step S105)
The air conditioner executes security attack countermeasure processing according to the determined type of security attack. After that, the processing of the air conditioner returns to step S101.

As described above, according to the air conditioning system 1 of the present embodiment, when each air conditioner (each outdoor unit 4 and each indoor unit 5) detects a security attack, it determines the type of the security attack, determines Security attack countermeasure processing corresponding to the type of attack is immediately executed. Therefore, the impact of the security attack can be quickly eliminated, and the impact of the security attack can be suppressed.

In addition, in the security attack response process, each air conditioner restricts specific processing based on communication with the sender determined to have a security attack as high-risk processing, but other processing is normal processing. , the influence on the air conditioning system 1 can be suppressed as much as possible, and the user's comfort can be maintained.

The present disclosure is not limited to the above embodiments, and various modifications are of course possible without departing from the gist of the present disclosure.

(Modification 1)
For example, the conditions under which the security attack detection unit 500 determines whether or not there is a security attack (for example, the condition for determining whether a certain number of times and for a certain period of time in condition B, the same communication frame, etc.), and the type of security attack. (contents of the attack type determination table in FIG. 9) and the like may be changed appropriately via the server 2, the central control device 3, the remote controller 6, the terminal device 8, and the like. Also, the air conditioner may learn and update the contents of conditions such as condition B during operation.

(Modification 2)
In the air conditioner (outdoor unit 4 and indoor unit 5), when the security attack detection unit 500 determines that there is a security attack, a user notification unit (user according to the present disclosure) that notifies the user that a security attack has been detected An example of notification means) may be further provided. For example, when the security attack detection unit 500 determines that there is a security attack, the user notification unit includes the time when the security attack was detected (that is, the current time) and information indicating the type of security attack. A notification (security attack detection notification) is issued to the centralized control device 3, the server 2, the remote controller 6, or the terminal device 8 (hereinafter referred to as the centralized control device 3, etc.).

The above security attack detection notification may further include a combination of determination conditions when the type of security attack is determined, the content of security attack response processing, and the like. Upon receiving the security attack detection notification, the central control device 3 or the like displays the information indicated by the security attack detection notification on the display 33 or the like, or outputs it by voice, etc., to notify the user such as the system administrator or the maintenance staff. do. In addition, the security attack detection unit 500 may transmit the security attack detection notification to a pre-registered destination by e-mail, SMS (Short Message Service), or the like.

Instead of or in combination with the above, the user notification unit may notify the user that a security attack has been detected by causing an LED provided in the device to emit light in a predetermined manner. A user may be notified that a security attack has been detected by outputting a sound from a speaker provided.

(Modification 3)
When the security attack detection unit 500 determines that there is a security attack when receiving a communication frame transmitted from a device having a user interface (the central control device 3, the remote controller 6, and the terminal device 8), the security attack response unit 504 , if a confirmation request frame requesting user confirmation is sent to the device, and then a response frame indicating that the user has been confirmed is received from the device, the previously received communication frame should be treated as a normal communication frame. and normal processing based on the content of the communication frame may be executed.

(Modification 4)
In the air conditioner (outdoor unit 4 and indoor unit 5), a communication frame with the same content as the communication frame determined to be a "replay attack" (meaning that the command, data value, etc. are the same) is sent to other devices. If it must be done, the security attack response unit 504 may change the content of the communication frame to the extent that it does not affect the operation of the air conditioner, the user's comfort, and the like. For example, if a communication frame determined to be a "replay attack" indicates a change in the set temperature and the set temperature is "26°C", it is necessary to send a communication frame with the same content. Then, the security attack response unit 504 transmits a communication frame in which the set temperature value is changed to "25.5°C".

In addition, the security attack response unit 504 issues a notification including the content of the communication frame determined to be a “replay attack” (hereinafter referred to as a replay attack detection notification) to each device of the air conditioning system 1. You may In this case, each outdoor unit 4 and each indoor unit 5 that has received the replay attack detection notification may change the content of the communication frame to be transmitted as described above.

(Modification 5)
The security attack response unit 504 issues a notification (hereinafter referred to as a spoofing detection notification) including the address of the transmission source of the communication frame determined to be "spoofing" to each device of the air conditioning system 1. may In this case, the authorized device with the same address as the address indicated by the spoofing detection notification changes its own address to another authorized address, and transmits a notification indicating the address change to each device in the air conditioning system 1. You may Alternatively, the central control device 3, the outdoor unit 4, or the like reassigns a different authorized address to the authorized device with the address indicated by the spoofing detection notification, and sends a notification indicating a change in the address of the device to the air conditioning system 1. may be issued to each device in the

(Modification 6)
The security attack response unit 504 issues a notification (hereinafter referred to as a hijacking detection notification) containing the address of the transmission source of the communication frame determined to be "hijacking" to each device of the air conditioning system 1. may In this case, each device that receives the hijacking detection notification discards all communication frames from the address indicated in the hijacking detection notification without doing anything, and transmits communication frames addressed to the address. may be omitted.

In addition, the authorized device having the same address as the address indicated by the takeover detection notification changes its own address to another authorized address, and issues a notification indicating the address change to each device of the air conditioning system 1. You may Alternatively, the central control device 3, the outdoor unit 4, or the like reassigns a different authorized address to the authorized device with the address indicated by the takeover detection notification, and sends a notification indicating a change in the address of the device to the air conditioning system 1. may be issued to each device in the

(Modification 7)
When the security attack detection unit 500 determines that there is a security attack, the security attack response unit 504 performs security attack response processing according to the security attack described above. , change the order. For example, in a set of communication frames for inquiring about the state of an air conditioner (operation mode, wind speed, suction temperature, etc.), in the past, when the inquiry communication frames were transmitted in the order of A state, B state, and C state. Furthermore, the security attack countermeasure unit 504 is changed so that communication frames are transmitted in the order of B state, A state, and C state. In addition, the security attack response unit 504 issues a notification indicating the change (hereinafter referred to as a transmission order change notification) to the inquiry destination of the state.

After receiving the above transmission order change notification, the device treats the communication frames related to the status inquiry as normal communication frames only if they are received in the order indicated by the transmission order change notification.

(Modification 8)
When the security attack detection unit 500 determines that there is a security attack, the security attack response unit 504 performs security attack response processing in response to the security attack described above, and also detects communication frames related to predetermined highly important information. may restrict the transmission and reception of For example, the security attack response unit 504 restricts the transmission and reception of information used for advanced control such as information indicating whether or not a person is detected by the thermal image sensor provided in the indoor unit 5, or the outdoor unit 4 and the indoor unit 5 Restricts download of firmware, etc. when updating firmware.

(Modification 9)
The attack presence/absence determination unit 510 may further determine the necessity of warning, and may newly add a warning unit to the functional configuration of the air conditioner (see FIG. 8). In this case, the conditions for determining that a warning is necessary are less stringent than the conditions for determining that there is a security attack. For example, in condition B, if the same communication frame is received 15 times or more within a certain period of time, it is determined that there is a security attack. determines that a warning is necessary.

If the conditions for judging that there is a security attack are not satisfied but the conditions for judging that a warning is necessary, the warning unit notifies the central control device 3, the server 2, and the remote controller 6 , the terminal device 8 or the like, emits light from the LED of its own device, or outputs voice or electronic sound from its own device to warn the user. However, in this case, the security attack handling unit 504 does not execute security attack handling processing.

(Modification 10)
Also, the central control device 3 and the remote controller 6 may have the same functional configuration (see FIG. 8) as the air conditioner in the above embodiment.

(Modification 11)
Also, all or part of the functional units (see FIG. 8) of the air conditioners (outdoor unit 4 and indoor unit 5) may be realized by dedicated hardware. Dedicated hardware is, for example, a single circuit, a composite circuit, a programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a combination thereof.

The technical ideas related to each of the modifications above may be realized independently, or may be realized in combination as appropriate.

Various embodiments and modifications are possible for the present disclosure without departing from its broad spirit and scope. In addition, the embodiments described above are for explaining the present disclosure, and do not limit the scope of the present disclosure. In other words, the scope of the present disclosure is indicated by the claims rather than the embodiments. Various modifications made within the scope of the claims and within the scope of equivalent disclosure are considered to be within the scope of the present disclosure.

The present disclosure can be suitably applied to an air conditioning system configured with multiple air conditioners.

1 air conditioning system, 2 server, 3 centralized control device, 4, 4a ~ 4c outdoor unit, 5, 5a ~ 5f indoor unit, 6 remote control, 7 communication adapter, 8 terminal device, 9, 10, 10a ~ 10c transmission line, 30 , 40, 50, 60, 70 first communication interface, 31, 41, 51, 61, 71 second communication interface, 32, 62, 81 operation receiving unit, 33, 63, 82 display, 34, 43, 53, 64 , 72, 83 control circuit, 35, 44, 54, 65, 73, 84 auxiliary storage device, 42, 52 main unit, 80 communication interface, 500 security attack detection unit, 501 communication abnormality detection unit, 502 normal response unit, 503 Communication anomaly response unit, 504 Security attack response unit, 510 Attack presence/absence determination unit, 511 Attack type determination unit, N Network

Claims

security attack detection means for determining whether or not a security attack has occurred when a communication frame is received, and determining the type of the security attack if it is determined that there is a security attack;
a security attack countermeasure means for executing a security attack countermeasure process for eliminating the influence of the security attack, which is a process corresponding to the type of the security attack when the security attack detection means determines that there is a security attack; An air conditioner.
The air conditioner according to claim 1, further comprising user notification means for notifying a user when the security attack detection means determines that there is a security attack.
When the security attack detecting means determines that there is a security attack when receiving a communication frame transmitted from a device having a user interface, the security attack handling means requests confirmation from the user to the device. 3. The air conditioner according to claim 1, wherein when a request frame is transmitted and then a response frame indicating confirmation is received from said device, said received communication frame is treated as a normal communication frame.
4. Any one of claims 1 to 3, wherein when said security attack detection means determines that there is a security attack, said security attack countermeasure means further restricts transmission and reception of predetermined highly important information. Air conditioner described in paragraph.
determining whether or not there is a security attack when a communication frame is received, and if determining that there is a security attack, determining the type of security attack,
A security attack countermeasure method for, when it is determined that there is a security attack, executing a security attack countermeasure process for eliminating the influence of the security attack, which is a process corresponding to the type of the security attack.
the air conditioner,
security attack detection means for determining the presence or absence of a security attack when a communication frame is received, and determining the type of the security attack if it is determined that there is a security attack;
security attack countermeasure means for executing a security attack countermeasure process for eliminating the effects of the security attack, which is a process corresponding to the type of security attack when the security attack detection means determines that there is a security attack; A program that works.