JP2017103677A - Control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize compatibility between security function and safety function in a control device and to avoid reduction of availability of a whole system including the control device.SOLUTION: A control device according to the embodiment includes a security processing unit, a safety data replacing unit, and a safety processing unit. The security processing unit monitors a denial of service attack. When a denial of service attack is detected by the security processing unit, the safety data replacing unit replaces predetermined data included in the communication frame received from the security processing unit with a value that is considered to be sound. When the soundness of the communication frame is confirmed from the predetermined data of the communication frame received from the safety data replacing section and its soundness is confirmed, Based on the data of the communication frame, the safety processing unit outputs a control value for controlling the subordinate apparatus to the subordinate apparatus.SELECTED DRAWING: Figure 1

Description

  Embodiments described herein relate generally to a control device.

  Conventionally, the most important requirement for a control system for controlling a plant or the like is that it can be operated continuously for 24 hours 365 days in order to support a social infrastructure and an industrial infrastructure. Such a control system has a great social impact when operation is hindered by an attack from a malicious third party. Since the conventional control system is composed of a closed system and is not connected to an external network, threats such as attacks from malicious third parties have hardly been recognized.

JP2013-196058A JP 2012-043230 A

  However, in recent years, general-purpose OSs have been adopted for control systems, and changes have occurred in the system configuration and usage, such as remote control from an external network. Therefore, there is a demand for a control system that achieves both safety (hereinafter referred to as “safety”) that has been conventionally required in a control system and security.

  A problem to be solved by the present invention is to provide a control device that realizes both security functions and safety functions in a control device and can avoid a reduction in the availability of a system controlled by the control device having both functions. It is to be.

  The control device of the embodiment includes a security processing unit, a safety data replacement unit, and a safety processing unit. The security processing unit includes a communication interface unit that inputs and outputs communication frames, a communication processing unit that manages statistical information related to transmission and reception of communication frames, and a monitoring unit that monitors a denial of service attack based on the statistical information. The safety data replacement unit performs a replacement process with a process execution determination unit and a process execution determination unit that determine that a replacement process for predetermined data included in a received communication frame is to be performed when a monitoring unit detects a denial of service attack. When it is determined to be implemented, the data replacement unit that replaces predetermined data of the communication frame received from the security processing unit with a value that is considered sound and the error detection code of the replaced communication frame are recalculated and assigned A code calculation / assignment unit. The safety processing unit includes a safety data confirmation unit that confirms the soundness of the communication frame from predetermined data of the communication frame received from the safety data replacement unit, and a soundness of the communication frame received from the safety data replacement unit by the safety data confirmation unit. If the data is confirmed, the control operation unit calculates a control value for controlling the subordinate apparatus based on the data of the communication frame, and outputs the control value to the subordinate apparatus, and the data from the subordinate apparatus And an I / O data input / output unit.

FIG. 1 is a block diagram illustrating a configuration of a control device according to the first embodiment. FIG. 2 is a flowchart showing an operation flow of the monitoring unit in the first embodiment. FIG. 3 is a flowchart showing an operation flow (normal process) of the safety data replacement unit in the first embodiment. FIG. 4 is a diagram illustrating an example of a frame format in the first embodiment. FIG. 5 is a flowchart illustrating an operation flow of the safety processing unit according to the first embodiment. FIG. 6 is a flowchart showing an operation flow of the safety data replacement unit when the denial-of-service attack in the first embodiment converges. FIG. 7 is a diagram illustrating a data flow and an operation between the security processing unit, the safety data replacement unit, and the safety processing unit of the control device according to the first embodiment. FIG. 8 is a block diagram illustrating a configuration of a control device according to the second embodiment. FIG. 9A is a diagram illustrating an example of a frame format in the second embodiment. FIG. 9B is a diagram illustrating an example of a data structure of an authentication database according to the second embodiment. FIG. 10 is a flowchart showing an operation flow (normal process) of the safety data replacement unit in the third embodiment. FIG. 11 is a diagram illustrating a data flow and an operation between the security processing unit, the safety data replacement unit, and the safety processing unit of the control device according to the third embodiment. FIG. 12 is a block diagram illustrating configurations of a control device and a user terminal according to the fourth embodiment. FIG. 13: is a block diagram which shows the structure (other example) of the control apparatus and user terminal concerning 4th Embodiment. FIG. 14 is a flowchart showing an operation flow of the safety data replacement unit in the fourth embodiment. FIG. 15 is a diagram illustrating a data flow and an operation between the security processing unit, the safety data replacement unit, and the safety processing unit of the control device according to the fourth embodiment.

(Overview)
The following are known regarding safety functions and security functions in a control system for controlling a plant or the like.

  From the viewpoint of safety, IEC 61508 “Functional safety of electrical / electronic / programmable electronic safety-related systems” is defined. As one of the representative methods for realizing the safety function, a method called black channel communication has been established. This is because the transmission side adds a value that changes from frame to frame, such as time information and sequence number, and an error detection code such as CRC (Cyclic Redundancy Check) in the communication frame (hereinafter referred to as a frame). This is a method for confirming the soundness of such information. Detect abnormalities where the value that changes for each frame does not change from a certain value, or abnormalities that cause a change beyond the allowable value, such as when there is a significant loss of frames, so that the system transitions to the safe side .

  On the other hand, in terms of security, efforts for control system security, such as the establishment of standardization standards and the establishment of evaluation / certification bodies, are becoming full-scale, and the IEC international standard (IEC62443) that defines protection functions and development processes has been established. It is in. As a typical attack method in security, there is an attack method called a DoS (Denial of Service) attack that causes a communication failure by transmitting a large amount of packets (frames) to an attack target. As a method for dealing with this attack, for example, the number of received frames is monitored, and if the number exceeds a certain value, it is considered that a DoS attack has occurred and reception is prohibited, and a DoS attack is performed. After the detection, there is a DoS attack countermeasure that monitors the number of frames received at regular intervals, and determines that the DoS attack has converged when the number falls below a threshold and permits reception.

  However, when both the black channel communication function for safety and the DoS attack countermeasure function for security are mounted on the control device, the following problems occur.

  When a DoS attack is detected by the DoS attack countermeasure function and reception of a frame is prohibited, the frame is not received until the DoS attack converges. For this reason, when a new frame is received after convergence of the DoS attack, if the change in the value of the time stamp or sequence number included in the received frame is out of the allowable range, the system is safely stopped by the safety function. . That is, when a safety function and a DoS attack countermeasure function that is a security function coexist in the control device, the availability of the system is impaired by the DoS attack countermeasure function.

  The control apparatus according to the embodiments described below includes a time stamp in black channel communication between a functional unit having a security function in the former stage and a functional part having a safety function in the latter stage during a denial of service attack such as a DoS attack. A function unit is provided to prevent the system from being automatically stopped safely by the safety function by changing the sequence number (replacement), recalculating and adding the error detection code. Thus, the control device described below realizes both security functions and safety functions, and avoids reducing the availability of the system controlled by the control device.

(First embodiment)
First, the control apparatus according to the first embodiment will be described with reference to FIG. FIG. 1 is a block diagram illustrating a configuration of a control device according to the first embodiment.

  A control device 100 shown in FIG. 1 is a device that controls a subordinate device (not shown) and notifies a higher-level device of a control state, and includes a security processing unit 101, a safety data replacement unit 102, and a safety processing unit. It is composed of three blocks 103. These may be configured on the same hardware component or may be configured on separate hardware components.

  The security processing unit 101 is connected to the communication I / F unit 104 serving as an interface for transmitting and receiving frames via a network such as Ethernet (registered trademark), and processes the received frame. The communication processing unit 105 includes a communication processing unit 105 and a monitoring unit 106 that is connected to the communication processing unit 105 and monitors the frame reception status in the control device 100.

  The communication I / F unit 104 receives a frame from another device on the network such as a host device, and transfers the received frame to the communication processing unit 105. Further, the communication I / F unit 104 transmits data (frame) from the communication processing unit 105 to another device on the network such as a host device.

  The communication processing unit 105 manages statistical information such as the number of received frames (the number of received frames) as the frame reception status. Further, when reception is permitted by the monitoring unit 106, the communication processing unit 105 transfers a frame from the communication I / F unit 104 to the safety data replacing unit 102, and reception is prohibited by the monitoring unit 106. The frame from the communication I / F unit 104 is discarded. In addition, the communication processing unit 105 transfers the frame from the safety processing unit 103 to the communication I / F unit 104.

  The monitoring unit 106 monitors the frame reception status managed by the communication processing unit 105 as described above, and performs control related to prohibition / permission of frame reception. Details of the monitoring unit 106 will be described later.

  The safety data replacement unit 102 is connected to the subsequent stage of the security processing unit 101. The safety data replacement unit 102 is connected to the processing execution determination unit 107 to which information (described later) from the communication processing unit 105 and the monitoring unit 106 described above is input, and is included in the received frame. A data replacement unit 108 that performs replacement (to be described later) of the safety header of soundness confirmation data (predetermined data), and an error detection code (or error correction code) included in the soundness confirmation data connected to the data replacement unit 108 And a code calculation / addition unit 109 that re-calculates and re-adds the frame in which the safety header is replaced.

  The safety processing unit 103 is connected to the subsequent stage of the safety data replacement unit 102. The safety processing unit 103 includes a safety data generating unit 110 that generates safety data including safety confirmation data including a safety header having a value that changes from frame to frame and an error detection code, and adds the safety data to the frame. The safety data confirmation unit 112 confirms the safety of the data from 102 and transfers the confirmed safety data to the control calculation unit 111, and the data from the subordinate apparatus connected to the safety data confirmation unit 112 and not shown. Are processed and output to the safety data generation unit 110, and the control calculation unit 111 for calculating control data (control value) for the subordinate apparatus based on the data from the safety data confirmation unit 112, and the control data from the control calculation unit 111 Is output to the subordinate device and the data from the subordinate device is controlled. And an I / O data output unit 113 to be output to the section 111. Note that data input from the subordinate apparatus to the I / O data input / output unit 113 is transferred to the communication processing unit 105 via the control calculation unit 111 and the safety data generation unit 110 without passing through the safety data replacement unit 102. Then, the data is transmitted to the host device or the like via the communication I / F unit 104.

  Next, details of the operation of the monitoring unit 106 configured as described above will be described with reference to FIG. FIG. 2 is a flowchart showing an operation flow of the monitoring unit 106.

  The monitoring unit 106 obtains statistical information including the number of received frames managed by the communication processing unit 105 at regular intervals, calculates a difference between the previous value and the current value from the number of received frames included in the statistical information, The number of frames received within the specified time (specified number of received times) is calculated (S101).

  When the calculated value (number of receptions for the specified time) is equal to or greater than the specified value (threshold) (Yes in S102), it is regarded as a denial of service attack, and the monitoring unit 106 issues a command to the communication processing unit 105 to stop reception (reception) Stop processing: S103), and further, a reception prohibition signal ON is transmitted to the processing execution determination unit 107 of the safety data replacement unit 102 (S104). On the other hand, when the calculated value (number of receptions for the specified time) is less than the specified value (threshold value) (No in S102), the monitoring unit 106 issues a command for permitting reception to the communication processing unit 105 (reception permission processing: S105). Then, the reception prohibition signal OFF is transmitted to the processing execution determination unit 107 of the safety data replacement unit 102 (S106).

  As described above, in the present embodiment, when the security processing unit 101 receives a number of frames exceeding a predetermined allowable value such as a denial of service attack represented by a DoS attack, it is forcibly received. To refuse. When the number of frames received within the specified time falls below the specified value, the monitoring unit 106 determines that the denial of service attack has converged and permits the communication processing unit 105 to receive again. The communication processing unit 105 that has received the permission transfers the received frame to the processing execution determination unit 107 of the safety data replacement unit 102, and the monitoring unit 106 transmits a reception prohibited signal OFF to the processing execution determination unit 107. The above processing is repeated at regular intervals.

  Next, the operation (normal process) of the safety data replacement unit 102 will be described with reference to FIG. FIG. 3 is a flowchart showing an operation flow in normal processing of the safety data replacement unit 102.

  The processing execution determination unit 107 of the safety data replacement unit 102 determines ON / OFF of the reception-prohibited signal, and when it is OFF (No in S201), if there is a frame received from the security processing unit 101 (Yes in S206). The frame is transferred to the safety processing unit 103 as it is (S207), and when there is no frame (No in S206), the process returns to S201.

  On the other hand, when the reception prohibition signal is ON (Yes in S201), the processing execution determination unit 107 adopts the frame (previous output frame) transmitted last time from the safety data replacement unit 102 to the safety processing unit 103. The output frame is transferred to the data replacement unit 108 (S202).

  The data replacement unit 108 performs replacement (described later) for updating the safety header of the previous output frame (S203).

  Here, FIG. 4 shows an example of the frame format. As shown in the figure, one frame is composed of a destination address, a transmission source address, data identification information indicating the type of data, and soundness confirmation data for confirming the soundness of the data body and the frame. It includes safety data. The soundness confirmation data includes a security header including a value that changes for each frame, such as a sequence number and a time stamp, and an error detection code (CRC in the example of FIG. 4). Note that the soundness confirmation data may include any one of the sequence numbers, time stamps, and error detection codes, or all of them.

  The data replacement unit 108 sets safety headers such as sequence numbers and time stamps in the soundness confirmation data included in the frame shown in FIG. 4 so that the change in the value of the safety header is within an allowable range in the safety processing unit 103 at the subsequent stage. Replace with another value as determined. The replacement method may be an increment of the previous value of the safety header, or may be based on an arithmetic calculation such as n times.

  Thereafter, the code calculation / assignment unit 109 recalculates the error detection code for this frame using the replaced frame, and newly assigns the calculated code to the replaced frame as a new error detection code (S204), It transmits to the safety processing part 103 (S205).

  Next, the operation of the safety processing unit 103 will be described with reference to FIG. FIG. 5 is a flowchart showing an operation flow of the safety processing unit 103.

  When the safety processing unit 103 receives the frame from the safety data replacement unit 102, the safety data confirmation unit 112 updates the safety header (sequence number and time stamp) included in the soundness confirmation data in the received frame from the previous value. If it has not been updated, it is determined that there is an error (No in S301), and the control calculation unit 111 shifts to a safe stop process for safely stopping the system (S305). Otherwise, the safety data confirmation unit 112 moves the process to S302.

  In S302, the safety data confirmation unit 112 confirms whether or not the difference between the current value and the previous value of the safety header exceeds the allowable value X. No), the control calculation unit 111 transitions to a safety stop process (S305).

  On the other hand, when the safety data confirmation unit 112 confirms that the difference between the current value and the previous value of the safety header is less than or equal to the allowable value (within the normal range) (Yes in S302), the control calculation unit 111 causes the safety data replacement unit 102 to Is used to calculate a control value for controlling an I / O (input device / output device) which is a subordinate device (control value calculation: S303). The data is output to the / O data input / output unit 113 (I / O output: S304).

  As a configuration that further considers system availability by the control apparatus 100, the number of retries may be provided in addition to the allowable value. In this case, when the safety data checking unit 112 determines that an error has occurred as described above, the frame data transmitted to the safety processing unit 103 is used without using the frame data at that time, and the number of errors is set. Try to keep. When the safety data confirmation unit 112 detects that an error has occurred continuously for the number of retries, it is regarded as abnormal, and the control calculation unit 111 shifts to the safety stop process, thereby exceeding the allowable value as described above. As a result, the system availability is maintained rather than immediately shifting to the safety stop process.

  Next, the operation of the safety data replacement unit 102 when the denial-of-service attack converges will be described with reference to FIG. FIG. 6 is a flowchart showing an operation flow of the safety data replacement unit 102 when the denial-of-service attack converges.

  During the denial of service attack, as described above, the safety data replacement unit 102 generates a frame in which the soundness confirmation data is replaced, and transmits the frame to the safety processing unit 103. After that, when the denial of service attack converges, if there is a discrepancy between the soundness confirmation data of the safety data replacement unit 102 at that time and the soundness confirmation data of the newly received frame, it is received by the safety processing unit 103 There is a concern that the frame is judged to be abnormal.

  In order to avoid such a situation, when the processing execution determination unit 107 of the safety data replacement unit 102 detects that the reception-inhibited signal has changed from ON to OFF (S401), the safety data replacement unit 102 previously sends the safety processing unit to the safety processing unit. The safety header (current safety header) of the frame transmitted to 103 is acquired from the data replacement unit 108 (S402), and the safety header (new reception safety header) of the newly received frame is extracted (S403). Then, the process execution determination unit 107 calculates a difference between the data (for example, sequence number) of the newly received safety header and the data of the current safety header (S404). Thereafter, the process execution determination unit 107 branches the process depending on the magnitude relationship between the differences.

  When the value of the new reception safety header (new reception value) is greater than the value of the current safety header (current output value) (Yes in S405), and the difference is equal to or less than the allowable value (Yes in S406), processing execution determination The unit 107 adopts the newly received value and transfers the newly received frame as it is to the safety processing unit 103 (S407), and then the safety data replacement unit 102 transitions to the normal processing described above with reference to FIG. S411).

  On the other hand, if the difference exceeds the allowable value (No in S406), the processing execution determining unit 107 outputs the value calculated by dividing the difference between the newly received value and the current output value by the allowable value. Calculated as I (however, the fractional part is rounded down) (S408). Then, the output number of times I, the data replacement unit 108 generates an incremented safety header by sequentially adding an allowable value to the current output value of the safety header, replaces the generated safety header with the original safety header, The code calculation / assignment unit 109 recalculates and assigns the error detection code, and sequentially transmits the frames subjected to the replacement processing (update) (post-replacement frames) to the safety processing unit 103 (S409), and then the safety data. The replacement unit 102 transitions to the normal process described above with reference to FIG. 3 (S411).

  On the other hand, if the newly received value is smaller or the same as the current output value of the safety header (No in S405), the difference between the current output value of the safety header and the newly received value is subtracted from the maximum value that the safety header can take. A value calculated by dividing the obtained value by the allowable value is calculated as the output count I (however, the fractional part is rounded down) (S410). Then, the output number of times I, the data replacement unit 108 generates an incremented safety header by sequentially adding an allowable value to the current output value of the safety header, replaces the generated safety header with the original safety header, The code calculation / assignment unit 109 recalculates and assigns the error detection code, and sequentially transmits the frames subjected to the replacement processing (post-replacement frames) to the safety processing unit (S411), and then the safety data replacement unit 102 Then, the process proceeds to the normal process described with reference to FIG. 3 (S411).

  As a specific example of the case where the difference between the new reception value and the current output value is less than or equal to the allowable value when the new reception value is larger than the current output value, for example, the allowable value is 256, the current output value of the sequence number is 100, When the sequence number of the new reception frame is 101, the difference is within the allowable range, so the processing execution determination unit 107 outputs the new reception frame as it is.

On the other hand, as a specific example of the case where the new received value is larger than the current output value and the difference between the new received value and the current output value exceeds the allowable value, for example, the allowable value is 256 and the data replacement unit 108 outputs the current value. When the sequence number being 100 is 100 and the sequence number of a newly received frame is 3000, the difference is outside the allowable range. At this time, the output count I is
I = (3000-100) /256=11.3=> 11
Thus, the safety data replacement unit 102 transmits a frame having a safety header in which an allowable value 256 is sequentially incremented internally to the security processing unit 101 in order 11 times. In other words, the sequence number when this processing is completed is
100 + 11 × 256 = 2916
It becomes. Thus, even if the next frame of sequence number 3000 is received, the difference is
3000-2916 = 84 ≦ 256
Therefore, the subsequent safety processing unit does not detect an error. This process is performed not only on the sequence number but also on other soundness confirmation data such as a time stamp. The same result is obtained when the newly received value is equal to or less than the current output value.

  FIG. 7 shows the data flow and operation among the security processing unit 101, the safety data replacement unit 102, and the safety processing unit 103 described above.

  As shown in the figure, the safety data replacement unit 102 normally transmits the received frame (data1) to the safety processing unit 103 without performing the replacement processing for the soundness confirmation data. After that, when the reception prohibition signal ON is received from the security processing unit 101 due to a denial of service attack such as a Dos attack, the safety data replacement unit 102 performs replacement processing on the soundness confirmation data, and replaces the frame (data2-1) , Data2-2) is transmitted to the safety processing unit 103. Thereafter, when the safety data replacement unit 102 detects that the reception-inhibited signal is OFF, the replacement process is performed for the current output value of the safety header immediately after detection within the number I of outputs to the safety processing unit 103 as described above. The frames (data 2 -n) are sequentially transmitted to the safety processing unit 103, and then the process proceeds to the normal processing described above with reference to FIG. 3, and the newly received frame (data k) is transferred to the safety processing unit 103 as it is. .

  As described above, in the control device 100 of the present embodiment, even if the protection function from the denial of service attack by the security processing unit 101 works, the device that performs the process of avoiding the safety stop process of the safety processing unit 103 by the safety processing unit By providing in front of the unit 103, it is not preferable to make changes to ensure safety, so both security and safety functions can be realized without making changes on the safety processing unit 103 side. It is possible to suppress a reduction in system availability when coexisting with a security function for dealing with attacks.

(Second Embodiment)
Next, a control apparatus according to the second embodiment having a system configuration more secure than that of the first embodiment will be described with reference to FIG. FIG. 8 is a block diagram illustrating a configuration of a control device according to the second embodiment. In addition, about the structure, the part which overlaps with above-mentioned 1st Embodiment uses the same code | symbol, and abbreviate | omits description.

  As shown in FIG. 8, the control device 100 of the present embodiment has a configuration in which a security authentication unit 200 is added to the basic configuration of the first embodiment shown in FIG. The security authentication unit 200 includes an encryption / decryption unit 201, an authentication function unit 202, and an authentication database (authentication DB) 203. In this embodiment, the safety data portion of the frame to be transmitted / received includes a security header including specific data for determining whether or not the decryption has been normally performed and authentication data (ID and password) (see FIG. 9A).

  The encryption / decryption unit 201 is a functional unit that performs data encryption / decryption at the time of transmission / reception of a frame. Use a unique encryption method for each unit. Also, the encryption / decryption unit 201 decrypts the decryption target data (for example, safety data) in the received frame using a predetermined key, and if the specific data in the decryption target data can be read normally The frame including the decoded data is transferred to the subsequent stage as the decoding success, and when the specific data cannot be read normally, the received frame is discarded as the decoding failure.

  In addition, the encryption / decryption unit 201 uses the authentication function unit 202 to transmit the source address (IP address in FIG. 9B) as shown in FIG. 9B even when the encrypted safety data of the received frame can be successfully decrypted. The authentication DB 203 that stores authentication data including an ID and a password is referred to, and authentication is performed to determine whether or not the transmission source of the data transmits a valid ID and password. The authentication function unit 202 transfers the received frame to the subsequent stage when the authentication is successful, and discards the received frame when the authentication fails. With this configuration, data that has not been correctly encrypted and a received frame that has failed in authentication are discarded before the safety processing unit 103, so that more secure control is possible. As shown in FIG. 9B, an authenticated determination item is provided in the authentication DB 203. If the authentication is successful, “completed” is set as the authenticated determination, and if “completed”, it is received from the same transmission source. Frame authentication can also be omitted.

(Third embodiment)
Next, a control device according to a third embodiment will be described with reference to the drawings. The configuration will be described based on FIG. 1 described in the first embodiment. Note that a detailed description of portions overlapping the first embodiment is omitted.

  The security processing unit 101 in this embodiment is the same as that of the first embodiment described above, detects a denial of service attack based on the monitoring processing flow shown in FIG. Communicate the signal.

  While the safety data replacement unit 102 in the present embodiment performs the process of replacing the soundness confirmation data only during and immediately after detecting the denial of service attack in the first embodiment described above, In the present embodiment, the safety data replacement unit 102 continuously performs replacement processing on the soundness confirmation data after receiving a denial of service attack regardless of whether or not a denial of service attack is detected. Hereinafter, the processing of the safety data replacement unit 102 will be described with reference to FIG. FIG. 10 is a flowchart showing an operation flow of the safety data replacement unit 102.

  In this embodiment, when the reception prohibition signal is ON (Yes in S501), that is, when a denial-of-service attack is received, the process execution determination unit 107 performs the safety data replacement last time, as in the first embodiment. The frame (previous output frame) transmitted from the unit 102 to the safety processing unit 103 is adopted (S502), the data replacement unit 108 replaces the safety header (S503), and the code calculation / assignment unit 109 recalculates the error. A detection code is assigned (S504), and the replaced frame subjected to these replacement processes is transmitted to the safety processing unit 103 (S505). When the reception-inhibited signal is turned on once, the process execution determination unit 107 stores that the reception-inhibited signal is turned on.

  On the other hand, when the reception prohibited signal is OFF (No in S501) and there is a frame received from the security processing unit 101 (Yes in S506), the processing execution determining unit 107 turns on the reception prohibited signal in the past. It is determined whether or not (S507). If there has been no denial of service attack in the past (No in S507), the processing execution determination unit 107 transfers the received frame to the safety processing unit 103 as it is (S513). If there is no frame received from the security processing unit 101 (No in S506), the process returns to S501.

  Also, if there has been a denial-of-service attack even once in the past (Yes in S507), it is confirmed whether there is a further received frame (Yes in S508). The soundness of the data is confirmed using an error detection code (CRC) included in the received frame (S509). If an error is detected in this confirmation (No in S509), the process execution determination unit 107 discards the received frame (S513). Otherwise (Yes in S509), the data replacement unit 108 replaces the safety header (S510), the code calculation / addition unit 109 recalculates and adds the error detection code (S511), and the replaced frame is displayed. It transmits to the safety processing part 103 (S512). In addition, after S512 and S513, and when it is determined that there is no reception frame in S508 (No determination), the process returns to S508.

  The increment value when the data replacement unit 108 updates the safety header (for example, sequence number) in S509 is the value of the safety header of the frame transmitted from the safety data replacement unit 102 to the security processing unit 101 when returning from the denial of service attack. The difference between the previous value and the value of the safety header of the newly received frame is used.

For example, if the sequence number is incremented to 200 during a denial of service attack and the next received sequence number is 190, the difference value is
200-190 = 10,
It becomes. That is, by incrementing the sequence number by 10 + 1 = 11 from the newly received frame to be output next time, the sequence number in the replaced frame is 190 + 111 = 201> 200 (previous value),
Thus, the safety processing unit 103 that receives the replaced frame can continue to operate normally. Conversely, if the sequence number in the newly received frame is 230, which is ahead of the previous value of 200, the difference value is
200−230 = −30,
It becomes. That is, by incrementing the sequence number by −30 + 1 = −29 (29 decrement) from the newly received frame to be output next time, the sequence number in the replaced frame becomes
230−29 = 201> 200 (previous value),
In this case, the safety processing unit 103 can continue to operate normally. This process is performed not only on the sequence number but also on other soundness confirmation data such as a time stamp.

  The operation of the safety processing unit 103 at the subsequent stage is as described above in the first embodiment.

  In this embodiment, the number of retries may be provided as an allowable value as a configuration that further considers system availability. In this case, when the safety data checking unit 112 determines that an error has occurred as described above, the data of the frame is not used, the data of the frame transmitted to the safety processing unit 103 is used, and the number of errors is held. To. Then, when the number of errors is the same as the number of retries, the safety data confirmation unit 112 regards it as abnormal and causes the control calculation unit 111 to shift to the safety stop process, thereby exceeding the allowable value as described above. As a result, the system availability is maintained rather than immediately shifting to the safety stop process.

  FIG. 11 shows the data flow and operation among the security processing unit 101, the safety data replacement unit 102, and the safety processing unit 103 of the control device 100 according to the present embodiment.

  As shown in FIG. 11, in a normal time, the received frame (data 1) is transferred to the safety processing unit 103 as it is, and during a denial of service attack (reception prohibited signal ON), the safety data replacement unit 102 The frame (data 2) transmitted to the processing unit 103 is adopted, and frames (data 2-1, data 2-2) in which the soundness confirmation data is replaced are generated and transmitted to the safety processing unit 103. In addition, the safety data replacement unit 102 continues to replace the soundness confirmation data in the newly received frame even after the denial of service attack is settled, and the replaced frames (data k-3, data L-4) are succeeded. To the safety processing unit 103.

  According to the present embodiment, in addition to the effects of the first embodiment, the replacement process of soundness confirmation data is continuously performed even after the convergence of the denial of service attack is detected, so that FIG. Thus, the processing for transmitting the frame subjected to the replacement processing for a certain number of output times as described above to the safety processing unit 103 becomes unnecessary, and the control device 100 in which the processing of the safety data replacement unit 102 is simplified can be provided.

  Further, it is possible to adopt a more secure configuration including the security authentication unit 200 shown in FIG. 8 described above as the second embodiment. When this configuration is adopted, only legitimate frames are transmitted to the safety data replacement unit 102 by the encryption function and the authentication function, and the security function is further improved.

(Fourth embodiment)
Next, a control device according to a fourth embodiment will be described with reference to FIGS. 12 and 13 are block diagrams showing the configuration of the control device 100 and the user terminal according to the present embodiment. In addition, about the structure, the part which overlaps with above-mentioned embodiment uses the same code | symbol, and abbreviate | omits description.

  In the present embodiment, a user terminal (user side device) 300 including an allowable time input unit 301 and an alarm display unit 302 is provided outside the control device 100, and the allowable time input unit 301 and the alarm display unit 302 are replaced with safety data, respectively. Connected to the processing execution determination unit 107 of the unit 102. The connection means between the control device 100 and the user terminal 300 is not limited to a dedicated connection line as shown in FIG. 12, but a control communication path (network) for connecting to a higher-level device or the like as shown in FIG. It is good also as a structure using. The user terminal 300 may be a general-purpose information processing device such as a PC that includes an input device such as a keyboard and a mouse, a display device such as a liquid crystal monitor, and an interface for connecting to the processing execution determination unit 107. Alternatively, dedicated hardware may be used. When a general-purpose information processing device such as a PC is used, the allowable time input unit 301 and the alarm display unit 302 are obtained by cooperation between a control program installed in the information processing device and hardware of the information processing device. Realize the function.

  Next, operations of the control device 100 according to the present embodiment and the user terminal 300 connected to the control device 100 will be described with reference to FIG. FIG. 14 is a flowchart showing an operation flow of the safety data replacement unit 102 in the fourth embodiment.

  In the following, it is assumed that an allowable time for a denial of service attack is set from the allowable time input unit 301 in the user terminal 300 to the processing execution determination unit 107.

  When the reception prohibition signal is OFF (No in S601), the processing execution determination unit 107 transfers the received frame to the safety processing unit 103 as it is when there is a frame received from the security processing unit 101 (Yes in S610). If not (No in S610), the process returns to S601. On the other hand, when the reception prohibiting signal is ON (Yes in S601), the time (duration) during which a denial of service attack occurs is measured (S602).

  If the duration of the denial of service attack is within the set allowable time (allowable value) (Yes in S603), the processing execution determining unit 107 transmits the frame transmitted from the safety data replacing unit 102 to the safety processing unit 103 last time. (Previous output frame) is adopted, and this previous output frame is transferred to the data replacement unit 108 (S604).

  As described above in the first embodiment, the safety header of the previous output frame is replaced by the data replacement unit 108 (S605), and the error detection code is recalculated and added by the code calculation / addition unit 109. (S606), the replaced frame is transmitted to the safety processing unit 103 (S607).

  On the other hand, when the denial-of-service attack exceeds the set allowable time (No in S603), the processing execution determination unit 107 notifies the user terminal 300 of a warning (S608). The warning notification to the user terminal 300 is performed via a connection means (a dedicated connection line or a control communication path (network)) between the control device 100 and the user terminal 300. In the case of a control communication path, During a denial of service attack, the warning cannot be notified by half-duplex communication, so the communication I / F unit 104 has a function of notifying the warning by full-duplex communication.

  After the processing execution determination unit 107 notifies the user terminal 300 of a warning, the safety data replacement unit 102 uses the data replacement unit 108 and the code calculation / grant unit to check the soundness confirmation data of the frame transmitted to the safety processing unit 103 last time. The frame is transmitted as it is to the safety processing unit 103 without being updated at 109 (S609). From the viewpoint of system availability, if the error determination of the safety processing unit 103 is designed to safely stop with n consecutive detections, the safety data replacement unit 102 receives the health check data having the previous value for n consecutive times. The included frame is transmitted to the safety processing unit 103. The safety processing unit 103 operates based on the operation flow shown in FIG. 5, and when the safety data confirmation unit 112 detects that the soundness confirmation data has not been updated, the control calculation unit 111 transitions to the safety stop process.

  FIG. 15 shows the flow and operation of data (frames) among the security processing unit 101, the safety data replacement unit 102, and the safety processing unit 103 of the control device 100 according to the present embodiment.

  As shown in the figure, in the normal state and when the reception-prohibited signal is ON and the subsequent elapsed time is within the allowable time, the data flow described above with reference to FIG. 7 is performed, but the elapsed time exceeds the allowable time. (Allowable time OVER), and then the frame (data2-2) immediately before the elapsed time exceeds the allowable time is continuously (repeatedly) transmitted to the safety processing unit 103. As a result, the safety processing unit 103 makes a transition to the safety stop process, and the system is safely stopped.

  In this embodiment, as described above, a denial-of-service attack occurs, the data replacement unit 108 replaces the soundness confirmation data described above until the allowable time, and the code calculation / assignment unit 109 sets the error detection code. The recalculated and attached frame is generated and transferred to the safety processing unit 103, but when the allowable time is exceeded, the safety data replacement unit 102 stops the replacement processing by the data replacement unit 108 and the code calculation / addition unit 109. The system is safely stopped by transferring the same frame to the safety processing unit 103.

  According to the present embodiment, before the transition to the safe stop process, the user can be provided with an opportunity to cope by notifying the user of the warning that the system will be safely stopped as described above. By allowing the user to set the permissible time arbitrarily, the user adjusts the determination time to determine whether or not to transition to the safe stop process associated with a denial of service attack according to the permissible control response time for each controlled plant. It becomes possible to do.

  Also in this embodiment, it is possible to adopt a more secure configuration including the security authentication unit 200 shown in FIG. 8 described above as the second embodiment. When this configuration is adopted, only legitimate frames are transmitted to the safety data replacement unit 102 by the encryption function and the authentication function, and the security function is further improved.

  As described above, according to the first to fourth embodiments, it is possible to realize both the security function and the safety function in the control device, and avoid the reduction of the availability of the entire system including the control device.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 100 Control apparatus 101 Security processing part 102 Safety data replacement part 103 Safety processing part 104 Communication I / F part 105 Communication processing part 106 Monitoring part 107 Processing execution determination part 108 Data replacement part 109 Code calculation and provision part 110 Safety data generation part 111 Control calculation unit 112 Safety data confirmation unit 113 I / O data input / output unit 200 Security authentication unit 201 Encryption / decryption unit 202 Authentication function unit 203 Authentication DB
300 User terminal 301 Allowable time input unit 302 Alarm display unit

Claims (11)

A communication interface unit for inputting and outputting communication frames; and
A communication processing unit for managing statistical information related to transmission and reception of the communication frame;
A monitoring unit for monitoring a denial of service attack based on the statistical information;
A security processing unit having
A process execution determination unit that determines to perform a replacement process on predetermined data included in a received communication frame when a denial of service attack is detected by the monitoring unit;
A data replacement unit that replaces the predetermined data of the communication frame received from the security processing unit with a value that is sound when it is determined that the processing execution determination unit performs the replacement processing;
A code calculation / attachment unit that recalculates and gives an error detection code of the communication frame subjected to the replacement;
A safety data replacement unit having
A safety data confirmation unit that confirms the soundness of the communication frame from the predetermined data of the communication frame received from the safety data replacement unit;
A control arithmetic unit that calculates a control value for controlling a subordinate device based on data of the communication frame when the safety of the communication frame received from the safety data replacement unit is confirmed by the safety data confirmation unit When,
An I / O data input / output unit that outputs the control value to the subordinate apparatus and inputs data from the subordinate apparatus;
And a safety processing unit.   The control device according to claim 1, wherein the processing execution determination unit transfers the received communication frame to the safety processing unit when a denial of service attack is not detected by the monitoring unit.   The encryption / decryption unit that is connected between the security processing unit and the safety data replacement unit and performs encryption / decryption processing on a communication frame to be transmitted / received is further provided. Control device.   The safety processing unit further includes a safety data generation unit that generates safety data including a safety header that changes for each communication frame, generates the safety data for input data from a subordinate device, and generates the safety data The control device according to any one of claims 1 to 3, wherein a communication frame including a message is output via the security processing unit. The monitoring unit monitors the number of received communication frames as the statistical information, and prohibits the communication processing unit from newly receiving a communication frame if the received number exceeds a predetermined value within a predetermined time. And transmit a reception prohibition signal to the processing execution determination unit of the safety data replacement unit,
The process execution determination unit determines to perform a replacement process when the reception prohibition signal is received,
The data replacement unit replaces the safety header in the communication frame transmitted from the safety data replacement unit to the safety processing unit last time with a value incremented so that the difference between the current value and the previous value is within an allowable range. The control device according to claim 4, wherein the code calculation / assignment unit transmits a communication frame obtained by calculating and adding an error detection code again based on the replaced communication frame to the safety processing unit.   When the data replacement unit detects the release of the reception prohibition signal from the monitoring unit, the data replacement unit detects the current value of the safety header in the newly received communication frame and the safety processing from the safety data replacement unit. The control device according to claim 4, wherein replacement is performed so that a difference from a previous value of the safety header included in the communication frame transmitted to the unit is within an allowable range.   When the processing execution determination unit detects the release of the reception prohibition signal, the data replacement unit calculates a difference between the safety header of the newly received communication frame and the safety header replaced last time, and the difference is newly determined. The control device according to claim 6, wherein the difference between the current value and the previous value is replaced within the allowable range by adding / subtracting to the safety header in the received communication frame.   The safety data replacement unit, after the monitoring unit detects the denial of service attack once, continues the predetermined data in the communication frame received from the security processing unit regardless of the presence of the denial of service attack. 4. The control device according to claim 1, wherein updating is performed by the data replacement unit and the code calculation / grant unit. 5.   The control device according to any one of claims 1 to 8, wherein an allowable value for a duration of a denial of service attack can be input from the outside to the processing execution determination unit.   The control device according to claim 9, wherein when the duration of a denial of service attack exceeds the allowable value, the processing execution determination unit can transmit a warning to a user side device.   When the duration of a denial of service attack exceeds the allowable value, the safety data replacement unit does not update the predetermined data by the data replacement unit and the code calculation / assignment unit, and the communication frame output last time The control device according to claim 9, wherein the control device is transferred to the safety processing unit.

Images