JP2020021338A - Monitoring controller - Google Patents

Abstract

To provide a monitoring controller that incorporates a firewall function without affecting computing power for monitoring or control.SOLUTION: A monitoring controller which is connected to a control network and an internal network (control information network) and which performs calculations for controlling or monitoring devices connected to the control network, comprises: an arithmetic processing unit configured to execute a calculation according to communication data communicated via the internal network; an external communication unit connected to the internal network and configured to execute communication processing including reception processing of communication via the internal network; a firewall unit having a logic circuit configured to perform a permission determination for determining whether the communication data received and processed by the external communication unit may be transferred to the arithmetic processing unit; and an intra-device communication unit configured to transfer communication data to the arithmetic processing unit when permitted by the firewall unit.SELECTED DRAWING: Figure 2

Description

  The present disclosure relates to a monitoring control device such as an industrial control system such as a plant control device.

  In recent years, the importance of security measures against cyber attacks on industrial control systems used in oil, gas, electric power, manufacturing, and the like, such as ICS (Industrial Control Systems) and SCADA (Supervisory Control And Data Acquisition), has increased. For example, in a plant such as a power plant or a manufacturing plant, a monitoring control device (plant control device) such as a DCS (Distributed Control System) is connected to a plurality of devices installed in the plant via a control network, and the plurality of devices are connected to each other. (See Patent Documents 1 and 2). Further, the plant control device is connected to an OPS (Operator Station) or the like for operating and monitoring the plant by a control information network such as Ethernet (registered trademark), and is transmitted from a computer external to the device such as the OPS. The command is executed for the target device to be controlled based on the command.

  Further, as described in Patent Document 1, for example, the control information network may be connected to an external network such as the Internet, and may include a remote OPS connected to the external network via a cloud or the like. In some cases, communication with the plant control device is enabled. In this case, a firewall device is installed at the boundary between the control information network (internal network) and the external network (see Patent Document 1). Then, the firewall device cuts off unauthorized communication from the external network and performs access control such as transferring only the allowed communication, so that the plant control device or the control network side connected to the control information network can perform the access control. Equipment is protected.

JP 2011-221846 A JP 2012-226680 A

  As disclosed in Patent Documents 1 and 2, when a dedicated firewall device is installed on a control information network (hereinafter, appropriately referred to as an internal network), for example, a physical device such as an unauthorized computer device is connected to the internal network. It is vulnerable when a route that is detoured is formed. Therefore, the present inventors have considered incorporating a software-based firewall into the monitoring control device. However, when incorporated into the monitoring control device, the calculation capability for controlling or monitoring the monitoring control device is reduced. Vulnerable, especially when a large amount of communication arrives.

  In view of the above circumstances, at least one embodiment of the present invention aims to provide a monitoring and control device incorporating a function of a firewall without affecting the computing capability for monitoring or control.

(1) The monitoring control device according to at least one embodiment of the present invention includes:
A monitoring control device that is connected to the control network and the internal network, and performs an operation for controlling or monitoring the device connected to the control network,
An arithmetic processing unit configured to execute the arithmetic according to communication data communicated via the internal network,
An external device communication unit connected to the internal network and configured to execute a communication process including a reception process of communication via the internal network,
A firewall unit having a logic circuit configured to perform a permission determination as to whether or not the communication data subjected to the reception processing by the external device communication unit may be transferred to the arithmetic processing unit,
An internal communication unit configured to transfer the communication data to the arithmetic processing unit when permitted by the firewall unit.

  According to the above configuration (1), the monitoring control device incorporates a firewall unit (hardware) having a logic circuit that performs access control for communication addressed to itself, and the communication permitted by the firewall unit is performed. The arithmetic processing unit performs arithmetic processing only on the data. In other words, a hardware-based firewall (hardware firewall) is implemented inside the monitoring control device. Therefore, access control can be performed without affecting the arithmetic performance of the arithmetic processing unit. In addition, even when a bypass route that physically bypasses the firewall device located at the boundary between the internal network and the external network is formed, the monitoring and control device is appropriately protected by the firewall unit inside the device. And its reliability can be improved.

(2) In some embodiments, in the configuration of the above (1),
A transmission line connecting the in-device communication unit and the arithmetic processing unit,
The apparatus further includes a housing that houses the external communication unit, the firewall unit, the internal communication unit, the arithmetic processing unit, and the transmission line.
According to the configuration (2), a hardware firewall that operates independently of the arithmetic processing unit is accommodated in the housing of the monitoring and control device, thereby preventing the formation of a physical bypass route of the firewall and controlling the monitoring. The reliability of the device can be improved.

(3) In some embodiments, in the configuration of the above (2),
The transmission line is a common bus.
According to the above configuration (3), a hardware firewall can be implemented inside the monitoring control device.

(4) In some embodiments, in the above configurations (1) to (3),
The logic circuit configuring the firewall unit is configured by a programmable logic device (PLD).
According to the above configuration (4), a hardware firewall that operates independently of the arithmetic processing unit can be mounted inside the monitoring control device.

(5) In some embodiments, in the above configurations (1) to (4),
The firewall unit performs the permission determination using a whitelist.
According to the configuration of the above (5), only the communication registered in the white list is permitted, and other communication is blocked, so that the monitoring control device can be appropriately protected.

(6) In some embodiments, in the above configurations (1) to (5),
The arithmetic processing unit is configured to execute an operation for controlling or monitoring a plant.
According to the above configuration (6), it is possible to provide a plant monitoring and control device including a hardware firewall therein.

(7) In some embodiments, in the above configurations (1) to (6),
The internal network is connected to an external network via an external firewall device.
According to the configuration (7), the monitoring control device is double protected by the internal firewall unit and the external firewall device installed at the boundary between the control information network and the external network. Accordingly, even when a route that physically bypasses the external firewall device is formed, for example, when an unauthorized computer device is connected to the internal network, the monitoring control device can be protected.

  According to at least one embodiment of the present invention, there is provided a monitoring and control device incorporating a firewall function without affecting the computing power for monitoring or control.

It is a figure showing roughly composition of an industrial control system provided with a monitoring control device concerning one embodiment of the present invention. It is a figure showing roughly composition of a supervisory control device of a plant concerning one embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described with reference to the accompanying drawings. However, the dimensions, materials, shapes, relative arrangements, and the like of the components described in the embodiments or shown in the drawings are not intended to limit the scope of the present invention thereto, but are merely illustrative examples. Absent.
For example, expressions representing relative or absolute arrangement such as “in a certain direction”, “along a certain direction”, “parallel”, “orthogonal”, “center”, “concentric” or “coaxial” are strictly described. Not only does such an arrangement be shown, but also a state of being relatively displaced by an angle or distance that allows the same function to be obtained.
For example, expressions such as "identical", "equal", and "homogeneous", which indicate that things are in the same state, not only represent exactly the same state, but also have a tolerance or a difference to the extent that the same function is obtained. An existing state shall also be represented.
For example, the expression representing a shape such as a square shape or a cylindrical shape not only represents a shape such as a square shape or a cylindrical shape in a strictly geometrical sense, but also an uneven portion or a chamfer as long as the same effect can be obtained. A shape including a part and the like is also represented.
On the other hand, the expression “comprising”, “comprising”, “including”, “including”, or “having” one component is not an exclusive expression excluding the existence of another component.

  FIG. 1 is a diagram schematically illustrating a configuration of an industrial control system S including a monitoring control device 1 according to an embodiment of the present invention. The industrial control system S shown in FIG. 1 is a plant system for monitoring and controlling a plant 9 such as a power plant. The monitoring control device 1 illustrated in FIG. 2 is a distributed control system (DCS) such as a process station (PS) or a programmable logic controller (PLC) that performs automatic control of the plant 9 and input / output processing with a site. It is a plant control device that constitutes such as. In some other embodiments, the monitoring control device 1 is a monitoring control device 1 in another control system, such as a device that performs input / output with a device that controls manufacturing equipment and a device that performs various arithmetic processes. Is also good.

  More specifically, in the embodiment illustrated in FIG. 1, the monitoring control device 1 is connected to a plurality of field devices 91 installed in the plant 9 via a control network 6 (control network). These field devices 91 are, for example, various measuring devices (sensors) for measuring temperature, flow rate, pressure, and the like, and operating terminals such as dampers and control valves (valves). This is a communication network for connecting the monitoring control device 91 to the monitoring control device 1. Then, the monitoring control device 1 collects plant data including at least one of various measurement data measured by the measuring device and an event notification, and executes various calculations using the collected one or more plant data. Then, by transmitting the calculation result to the operation terminal, the automatic control of the plant 9 is executed.

  As shown in FIG. 1, the monitoring control device 1 is connected to a control information network 7 (internal network; the same applies hereinafter) such as a LAN (Local Area Network) constructed by Ethernet (registered trademark) or the like. The control information network 7 is a communication network for connecting various computer devices for controlling, monitoring, and managing the plant to the monitoring control device 1.

  In the embodiment shown in FIG. 1, the control information network 7 is an IP network, for example, an operator station (OPS71) serving as a human-machine interface (HMI) for operating and monitoring the plant 9 and a large-capacity storage / storage of plant data. An ACS 72 (Accessory Station) for management is connected. Then, the monitoring control device 1 transmits the plant data collected via the control network 6 to an ACS 72 (Accessory Station) connected to the control information network 7 periodically or as requested. Further, the monitoring control device 1 communicates with the OPS 71 or the like via the control information network 7, executes a process according to the communication data D transmitted from the OPS 71 or the like, and responds to the communication source as necessary. Or

  Further, a firewall device (external firewall device 73) is provided between the control information network 7 and an external network 8 such as the Internet, and the above-described monitoring control device 1 connected to the control information network 7 , And a computer device such as OPS and ACS on the external network 8 side can perform bidirectional communication. More specifically, for example, the plant data stored in the ACS 72 of the control information network 7 is transmitted to a cloud (not shown) or a remote OPS (not shown) of the external network 8 or connected to the cloud. Transmission and reception of communication data D (for example, a command and its response) between a cloud OPS (not shown) and a remote OPS (not shown) may be enabled.

  At this time, the external firewall device 73 performs access control on communication between the external network 8 and the control information network 7 via the own device, thereby enabling unauthorized communication from the external network 8 to occur. And the control information network 7 is protected from unauthorized access and attacks. Specifically, the external firewall device 73 may execute packet filtering, stateful inspection, or function as an application firewall. In some other embodiments, the OPS 71 and the ACS 72 installed in the control information network 7 may be directly connected to the monitoring control device 1 by individual wiring. In this case, the above-described external firewall device is used. 73 is not installed.

  Hereinafter, the monitoring and control device 1 of the present invention will be described using the above-described plant system as an example. FIG. 2 is a diagram schematically showing a configuration of the monitoring control device 1 of the plant 9 according to one embodiment of the present invention.

The monitoring control device 1 is connected to a control network 6 and a control information network 7 (an internal network; the same applies hereinafter), and controls or monitors devices (various field devices 91 in FIG. 1) connected to the control network 6. Is a device configured to perform an operation for. As illustrated in FIG. 2, the monitoring control device 1 includes an external communication unit 21, a firewall unit 22, an internal communication unit 23, and an arithmetic processing unit 3.
The configurations of these monitoring control devices 1 will be described respectively.

  In the embodiment shown in FIG. 2, the external communication unit 21, the firewall unit 22, and the internal communication unit 23 constitute the interface unit 2 for the control information network 7. That is, the interface unit 2 is connected to the control information network 7 and the arithmetic processing unit 3, respectively, and is configured to provide a function for the arithmetic processing unit 3 to perform communication via the control information network 7.

  The arithmetic processing unit 3 is configured to execute arithmetic for control or monitoring according to the communication data D communicated via the control information network 7. More specifically, the arithmetic processing unit 3 includes a CPU (processor) (not shown) and a memory such as a ROM or a RAM. The CPU operates (eg, calculates data) according to a program instruction loaded in the memory. An operation corresponding to the communication data D, such as a control operation, is executed. The operation processing unit 3 transmits the result of the execution of the operation to the field device 91 connected to the control network 6 and the communication source of the communication data D as necessary.

  For example, the communication data D includes an instruction for the monitoring control device 1. This command may be, for example, a control command issued to the field device 91 or a command for acquiring a measured value, device information, or the like. The above-described command may be a command for reading information of the monitoring control device 1 or performing setting. Such a command may be transmitted when an operator operates a device such as the OPS 71 connected to the control information network 7 or a device such as the OPS connected to the external network 8.

  The external device communication unit 21 is connected to the control information network 7 so that communication via the control information network 7 is possible, and is configured to execute communication processing including reception processing of communication via the control information network 7. . For example, a computer device such as the OPS 71 connected to the control information network 7 or the external network 8 performs transmission processing such as IP packetization and MAC frame formation of the communication data D to be transmitted to the communication destination, and transmits the communication data D to the control information network 7. Send. The external device communication unit 21 takes in the transmission frame Fr addressed to the own device among the transmission frames Fr transmitted through the control information network 7 by the reception processing.

  In the embodiment shown in FIG. 2, the external communication unit 21 includes a reception processing unit 21r that executes the above-described reception processing. The reception processing unit 21r is configured to receive the transmission frame Fr addressed to the own device transmitted through the control information network 7 by confirming the destination address of the transmission frame Fr. In addition, the external communication unit 21 further includes a transmission processing unit 21s that transmits the communication data D to the communication destination. The transmission processing unit 21s transmits (transmits) the communication data transmitted from the arithmetic processing unit 3. It is configured to perform transmission processing (described above) on data D (transmission data Ds) and transmit a transmission frame Fs to the control information network 7.

  The firewall unit 22 includes a logic circuit 22c configured to determine whether or not to transfer (transmit) the communication data D received and processed by the above-described external device communication unit 21 to the arithmetic processing unit 3. . As shown in FIG. 2, the firewall unit 22 is connected to the external device communication unit 21 and transfers data (hereinafter, reception data Dr) taken into the device by the reception processing from the external device communication unit 21. Is done. When the communication is permitted, the firewall unit 22 transfers at least the communication data D included in the received data Dr to the in-device communication unit 23 connected to the firewall unit 22.

  In the embodiment illustrated in FIG. 2, the firewall unit 22 (the logic circuit 22c) performs access control such as packet filtering for permitting or disallowing communication (reception data Dr) based on a preset rule such as a whitelist. Is configured. For example, packet filtering may be performed based on a layer 2 address such as a MAC address, a layer 3 address such as an IP address, a port number, a combination of at least two of them, or data of an application layer (communication data Filtering may be performed based on D). Further, stateful inspection may be performed.

  The in-device communication unit 23 is configured to transfer (transmit) the communication data D to the arithmetic processing unit 3 when permitted by the firewall unit 22 described above. When transferring the communication data D to the arithmetic processing unit 3, the intra-device communication unit 23 transmits information specifying the communication source device, such as an IP address and a port number, to the arithmetic processing unit 3 together with the communication data D. You may. In the embodiment shown in FIG. 2, the in-device communication unit 23 and the arithmetic processing unit 3 are connected by the transmission line 4, and the communication data D and the like are transferred via the transmission line 4. More specifically, in the embodiment shown in FIG. 2, the transmission line 4 is a common bus such as a PCI (Peripheral Components Interconnect) bus, but in some other embodiments, the transmission line 4 is a serial transmission line for serial communication. There may be.

  In addition, as shown in FIG. 2 (also in FIG. 1), the monitoring control device 1 has an interface unit (network adapter; hereinafter, a control network IF unit 5) for connecting to the control network 6. The control network IF unit 5 can communicate with the arithmetic processing unit 3 by being connected to a common bus (transmission line 4). Further, the field device 91 is connected to the control network 6 via the IO module 14, and communication between the monitoring control device 1 and the field device 91 is performed via the control network 6 and the IO module 14.

  Note that the above-described external device communication unit 21 and internal device communication unit 23 may also be configured by separate arithmetic circuits, respectively. The external device communication unit 21, the firewall unit 22, and the internal device communication unit, 23 may be connected by a signal line such as an internal bus or a high-speed serial transfer device. Alternatively, at least one of the external device communication unit 21 and the internal device communication unit 23 may be formed on the same package substrate as the logic circuit 22c configuring the firewall unit 22. When the external communication unit 21, the firewall unit 22, and the internal communication unit are modularized, a CPU and a memory are provided in the module, and the external communication unit 21 and the internal communication unit 23 are implemented in software. May be realized. At this time, the CPU and the memory may be configured in the logic circuit 22c of the firewall unit 22.

  According to the above configuration, the firewall unit 22 (hardware) having the logic circuit 22c for performing access control on the communication addressed to itself is incorporated into the monitoring control device 1, and the monitoring unit 1 is permitted by the firewall unit 22. The arithmetic processing unit 3 performs arithmetic processing only on the communication data D. In other words, a hardware-based firewall (hardware firewall) is mounted inside the monitoring control device 1. Therefore, access control can be performed without affecting the arithmetic performance of the arithmetic processing unit 3. Further, even when a bypass route that physically bypasses the firewall device (73) located at the boundary between the control information network 7 and the external network 8 is formed, the firewall unit 22 inside the device performs monitoring and control. The device 1 can be appropriately protected, and its reliability can be improved.

  In some embodiments, as shown in FIGS. 1 and 2, the above-described monitoring control device 1 includes the above-described external device communication unit 21, firewall unit 22, internal device communication unit 23 (interface unit 2) It further includes a housing for housing the processing unit 3 and the transmission line 4. More specifically, in the embodiment shown in FIGS. 1 and 2, the interface unit 2, the arithmetic processing unit 3, and the control network IF unit 5 are modularized by being configured on different circuit boards in this unit, respectively. Card). Further, by mounting (installing) each module (card) inside the housing 12, the module (card) is connected to the transmission line 4 (common bus) installed inside the housing 12 and interconnecting the modules. It has become so.

  However, the present invention is not limited to this embodiment. In some other embodiments, the function distribution for each module (hardware) may be arbitrary such that the firewall unit 22 is provided in a module of the arithmetic processing unit 3. In another embodiment, the interface unit 2, the arithmetic processing unit 3, and the transmission line 4 may be mounted on the same circuit board.

  According to the above configuration, a hardware firewall that operates separately from the arithmetic processing unit 3 is accommodated in the housing 4 of the monitoring and control device 1, thereby preventing the formation of a physical bypass of the firewall and monitoring. The reliability of the control device 1 can be improved.

  Further, in some embodiments, the logic circuit 22c included in the firewall unit 22 may be configured by a programmable logic device (PLD). That is, the firewall unit 22 is configured using an integrated circuit such as a PLD (Programmable Logic Device) such as an FPGA (Field-Programmable Gate Array), which allows a designer to configure an arbitrary logic circuit 22c. In the embodiment shown in FIG. 2, a CPU (processor) (not shown) or a memory such as a ROM or a RAM is formed on the FPGA, and the CPU operates (eg, calculates data) in accordance with instructions of a program loaded in the memory. The function of the firewall unit 22 is realized.

  In some other embodiments, each logic of packet filtering may be realized by combining the logic circuit 22c on the FPGA. In some other embodiments, the firewall unit 22 may be configured with an ASIC. Further, the external communication unit 21, the firewall unit 22, and the internal communication unit 23 may be configured by an FPGA (PLD).

  According to the above configuration, a hardware firewall that operates separately from the arithmetic processing unit 3 can be mounted inside the monitoring control device 1.

  The present invention is not limited to the above-described embodiment, and includes a form in which the above-described embodiment is modified and a form in which these forms are appropriately combined.

REFERENCE SIGNS LIST 1 monitoring control device 12 housing 14 IO module 2 interface unit 21 external device communication unit 21 r reception processing unit 21 s transmission processing unit 22 firewall unit 22 c logic circuit 23 internal device communication unit 3 arithmetic processing unit 4 transmission line 5 control network IF unit 6 Control network 7 Control information network 73 External firewall device 8 External network 9 Plant 91 Field device D Communication data Dr Receive data Ds Transmission data Fr Transmission frame Fs Transmission frame

Claims (7)

A monitoring control device that is connected to the control network and the internal network, and performs an operation for controlling or monitoring the device connected to the control network,
An arithmetic processing unit configured to execute the arithmetic according to communication data communicated via the internal network,
An external device communication unit connected to the internal network and configured to execute a communication process including a reception process of communication via the internal network,
A firewall unit having a logic circuit configured to perform a permission determination as to whether or not the communication data subjected to the reception processing by the external device communication unit may be transferred to the arithmetic processing unit,
And a communication unit configured to transfer the communication data to the arithmetic processing unit when permitted by the firewall unit. A transmission line connecting the in-device communication unit and the arithmetic processing unit,
The monitoring control apparatus according to claim 1, further comprising: a housing that houses the external communication unit, the firewall unit, the internal communication unit, the arithmetic processing unit, and the transmission line.   The supervisory control device according to claim 2, wherein the transmission line is a common bus.   The monitoring control device according to any one of claims 1 to 3, wherein the logic circuit configuring the firewall unit is configured by a programmable logic device.   The monitoring control device according to any one of claims 1 to 4, wherein the firewall unit performs the permission determination using a whitelist.   The monitoring control device according to any one of claims 1 to 5, wherein the arithmetic processing unit is configured to execute an operation for controlling or monitoring a plant.   The supervisory control device according to any one of claims 1 to 6, wherein the internal network is connected to an external network via an external firewall device.

Images