JP4495945B2 - Control system with control program protection function - Google Patents

Description

The present invention, steel plant, paper manufacturing plant, to a control system having a coercive Mamoruki ability of the control program in the supervisory control system of industrial facilities such as chemical plants.

  In the supervisory control system, various know-how such as a control algorithm for controlling a process is standardized as a program, and the control program has a control function with a high diversion rate, thereby improving the reliability of the control system.

  In a control device such as a PLC (Programmable Logic Controller) equipped with such a control program, it is usually manufactured by adopting a common programming language defined in the IEC 61131-3 standard (International Electrotechnical Commission). It is possible to make the object library compatible with.

  The configuration of such a conventional control device will be described with reference to FIG. The control device 21 is connected to the monitor device 22 via the network 24. The monitoring device 22 performs programming and monitoring of the control program of the control device 21.

  In such a configuration, the control program can be read / written from the monitor device 22 and the control program can be tampered with. Therefore, the control program having know-how may be leaked or used after being tampered with. There is.

  As a conventional method for protecting a program, a method of encrypting information flowing through a data bus with an encryption key that changes with time is known (see, for example, Patent Document 1).

  However, in the monitor device 22 of the control device 21, it is essential to open a control program necessary for operation and maintenance, and a protection method for protecting only a specific control program to be protected included in the control program is unknown. Further, in the encryption method, the controllability of the control program situation may change due to the encryption.

Further, such encryption requires special hardware, and there is a problem that the apparatus is complicated and expensive.
Japanese Patent Laid-Open No. 10-55273

  In the conventional program protection method as described above, in a control device having a plurality of monitor devices connected to a network, a control program stored in the control device and a specific control program to be protected or protection There is no known way to protect only function programs that should be done. Moreover, the problem that controllability changes, such as response time, by protecting is not considered.

The present invention has been made to solve the above-described problems, and limits the response to access from the monitor device without altering the control or alteration of the specific control program to be protected that constitutes the control program. and to provide a control system having the coercive Mamoruki ability of the control program.

In order to achieve the above object, a control system having a control program protection function according to claim 1 includes a control program memory for storing a control program comprising a control program that can be disclosed and a specific control program to be protected; A control device comprising: a control data memory for storing variable values of the control program; and a control program execution control unit for executing the control program stored in the control program memory; and connected to the control device via a network In the control system comprising the monitor apparatus, the specific control program sends an access right designation command for instructing permission or prohibition processing to the execution monitor for tracing the program and data of the control program to the specific control program. Disperse multiple, insert in advance, A control program access right management table in which access right designation information for designating permission or prohibition for the execution monitor for the control program from the monitor device is described for each control program in advance in a memory in the control program execution control unit. The control program execution control unit stores the access right designation command every time the access right designation command is executed when there is a request for the execution monitor in the specific control program being executed from the monitor device. The execution monitor is prohibited by referring to the control program execution monitor permission / inhibition information stored in the operand and the access right designation information in the control program access right management table .

  According to the present invention, for each specific control program to be protected that constitutes the control program of the control device, the access right limiting means capable of limiting the monitoring and access of the control program and control data during the execution of the control program. Therefore, it is possible to set protection functions only for specific control programs to be protected without changing the control performance of the control program, and control with strong protection functions against tampering and unauthorized access. An apparatus can be provided.

  Embodiments of the present invention will be described below with reference to the drawings.

  A first embodiment of the present invention will be described below with reference to FIGS. FIG. 1 is a block diagram illustrating a configuration of a control system according to the first embodiment. In FIG. 1, the control device 1 stores a control program execution control unit 10 that controls the controlled object 3, a control program memory 15 that stores a control program that controls the controlled object 3, and control data that is a variable of this control program. And a control data memory 16 to be stored.

  The control program execution control unit 10, the control program memory 15, and the control data memory 16 are connected by a system bus 19 of the control program execution control unit 10.

  The control device 1 is connected to the controlled object 3 via the input / output interface 17 of the control program execution control unit 10 and controls the controlled object 3. The monitor of the control device 1 is connected to the network 4 via the communication interface 18 of the control program execution control unit 10 and is configured to be performed by the monitor device 2 connected to the network 4.

  Here, the monitor device 2 has functions necessary for operation of the control device 1 and maintenance of the control program, and is a monitor used for developing a control program and setting a control program of the control device 1 (not shown). -It is a device different from the programming device. The monitor device 2 may be composed of a plurality of units.

  Next, a detailed configuration of the control program execution control unit 10 will be described. The control program execution control unit 10 includes a CPU 11, a CPU 14, a program memory 12 on which basic software of the two-CPU system of the CPU 11 and the CPU 14 is mounted, and a data memory for storing first access right designation information for designating access from the monitor device 2. 13, an input / output interface 17 and a communication interface 18, and these components are connected by a system bus 19.

  The work of the control device 1 is set in advance so as to be shared between the CPU 11 and the CPU 14. The CPU 11 controls the response with the monitor device 2 connected to the network 4 via the communication interface 18. The execution of the control program for controlling the controlled object 3 is controlled.

  The CPU 14 stores the control program stored in the control program memory 15 and inserted with the second access right designation information for restricting access from the monitor device 2, and the control data used in the control program stored in the control data memory 16. The control target 3 is controlled via the input / output interface 17 connected to the system bus 19 by exchanging those signals via the system bus 19 and executing the control program.

  Next, FIG. 2 shows the configuration of the control program of the control device 1 configured as described above. The configuration of the control program includes, for example, control programs a (program name: MS0001) and c (program name: MS0002) that can be disclosed in the monitor device 2 connected to the network 4, and a specific control program b (program name) to be protected. : HS0001) and d (program name: HS0003).

  The control programs a and c that can be disclosed are application programs that are opened as control programs necessary when the control device 1 is used, and the specific control programs b and d to be protected have, for example, unique know-how. Says control algorithms.

  An access right designation area is provided at each head address of the specific control program to be protected, and stored in the data memory 13 in advance as a control program head address table as shown in FIG.

  For example, the head address of the program name MS0001 is stored as OOOXXXXH.

  The control program head address table may be created for all the programs constituting the control program, but at least for the control program to be protected.

  FIG. 4 shows an example of data in the access right designation area described at the head address of the specific control program to be protected. In FIG. 4, the POU identification information is composed of information (1) to (5) and describes information for designating permission / prohibition of the access right of the control program.

  For example, (1) is control program read permission / prohibition, (2) is control program write permission / prohibition, (3) is control program execution monitor permission / prohibition, (4) is control data Read permission / prohibition, (5) control data write permission / prohibition, etc. are used as access right designation information.

  Next, the operation of the control apparatus 1 when an access response request for the control program is executed from the monitor apparatus 2 to the control apparatus 1 via the network 4 will be described with reference to FIG.

  When there is an access to the control program from the monitor device 2 via the network 4 (S51), this response is processed by the CPU 11. The CPU 11 obtains the address of the program name of the control program requested from the monitor device 2, for example, the start address OOOXXXXH in the case of MS0001 by referring to the control program start address table stored in the data memory 13, and the control program First address OOOXXXXH is searched (S52).

  Then, the CPU 11 notifies the CPU 14 of the obtained data of the start address OOOXXXXH via the system bus 19. The CPU 14 transmits data in the access right designation area, which is control program data at this address, via the system bus 19, and the CPU 11 receives the data in the access right designation area (S53).

  The CPU 11 determines whether this request is permitted or prohibited by the permission / prohibition data shown in (1) to (5) in the access right designation area of the control program requested from the monitor device 2. (S54).

  If the request is permitted, the CPU 14 is requested again for the requested control program, and the CPU 14 reads the control program from the control program memory 15 via the system bus 19, and the CPU 11 The read control program MS0001 is transmitted to the monitor device 2 (S55).

  If the request is not permitted, the monitoring device 2 is informed that the requested control program cannot be accessed.

  Here, in step S53 and step S55, the CPU 11 receives the data in the access right designation area via the CPU 14, but the CPU 11 may directly access the data via the system bus 19.

  As described above, according to the first embodiment, whether the access request from the monitor device 2 connected to the network 4 is a control program that can be transmitted for each control program is described in the control program head address. Therefore, even if there is an access response that is not permitted from the monitor device 2, the request can be limited.

  The configuration of the second embodiment is the same as the configuration shown in FIG. 1 described in the first embodiment, and the same parts are denoted by the same reference numerals and the description thereof is omitted.

  The second embodiment is different from the first embodiment in that the first access right designation information of the data memory 13 in the first embodiment is a control program head address table and the second access right designation of the control program memory 15. As information, the data of the access right designation area is inserted at the head address for each specific control program to be protected, and the access response from the monitor device 2 is determined and limited for each control program. Further, there is a configuration in which only the monitor access permission table is stored in the data memory 13 as the second access right designation information, and the response of access from the monitor device 2 is limited in advance.

  The second embodiment configured as described above will be described with reference to FIGS. 1 and 6 to 8. In FIG. 6, the IP address and MAC (Media Access Control) address of the monitor device 2 connected to the network 4 are stored in advance in the data memory 13 as a table of access permission / prohibition information for the control program.

  For example, the monitor device number 1 is stored in advance as an IP address 133.113.91.238 and a MAC address 00-00-39-02-33-99.

  Alternatively, as shown in FIG. 7, when the control program is downloaded, the control program storage IP address is assigned to the IP address and the MAC address permitted to download the control program for each specific control program to be protected in the data memory 13. Store as a table.

  For example, the program name MS0001 is stored in advance as an IP address 133.113.91.238 and a MAC address 00-00-39-02-33-99.

  Next, the operation of the second embodiment in response to an access response request from the monitor device 2 connected to the network 4 using the table created in this way will be described with reference to FIG.

  The CPU 11 determines whether or not there is an access response from the monitor device 2 (S61), and there is a match with the requested monitor device 2 number or the IP address and MAC address corresponding to the name of the requested control program. Alternatively, the determination is made with reference to the monitor device access permission table or the control program storage IP address table stored in the data memory 13 (S62).

  The subsequent processing operation is the same as that shown in FIG.

  As described above, according to the second embodiment, the IP address and MAC address of the monitor device 2 that has previously permitted the control program access request from the monitor device 2 are stored as a table, and the monitor is referred to this table. Since the access from the device 2 is restricted in advance, the control program can be further protected.

  The configuration of the third embodiment is the same as the configuration shown in FIG. 1 described in the first and second embodiments, and the same parts are denoted by the same reference numerals and the description thereof is omitted.

  The third embodiment differs from the first and second embodiments in that in the first and second embodiments, the CPU 11 performs the first access stored in the data memory 13 in response to an access request from the monitor device 2. Reference is made to the control program start address table and the monitor access permission table, which are right designation information, and the start address for each specific control program to be protected is inserted in the control program memory 15 in which the second access right designation information is stored. The access response from the monitor device 2 is determined and limited for each control program with reference to the data in the access right designation area. In the third embodiment, the control program being executed is further In response to a monitor request for tracing the program and data (hereinafter referred to as an execution monitor), the CPU 14 that executes the control program The access right designation information is inserted into the head address of each specific control program to be protected as access right designation information, and the response to the execution monitor request for the specific control program to be protected from the monitor device 2 is controlled. It is configured so as to try to restrict it while the program is running.

  That is, the CPU 14 executes a restriction on the response to the control program being executed.

  The third embodiment configured as described above will be described with reference to FIGS. 1, 9, and 10. FIG. 9 shows an example of an access right designation instruction to be inserted at the head address for each specific control program to be protected of the control program stored in the control program memory 15. For example, the structure of the instruction includes an instruction code POU, an operand In the part, permission / prohibition (3) of the control program execution monitor is described as immediate access right information.

  The configuration of the CPU 14 that executes the control program will be described with reference to FIG. In FIG. 10, the CPU 14 reads out the control program stored in the control circuit 141, the instruction counter 142, and the control program memory 15 via the address buffer 143 and the system bus 19, and reads the read control program into the data buffer. An instruction register 145 to be stored via 144, an instruction decoder 146 to decode an instruction of the stored instruction register, an arithmetic circuit 149 that performs an operation according to the decoded instruction and its work register 149 a, and an operation result and read data to be primary It comprises a data register 147 for storing and an access flag control circuit 148 for storing decoded information.

  Next, the operation of the CPU 14 will be described with reference to FIG. In FIG. 10, the control circuit 141 outputs the address of the read instruction of the control program memory 15 set in the instruction counter 142 to the system bus 19 via the address buffer 143.

  Then, the instruction read from the control program in the control program memory 15 is stored in the instruction register 145 via the data buffer 144. The instruction code of the control program stored in the instruction register 145 is decoded by the instruction decoder 146 and output to the access flag control circuit 148 and the arithmetic circuit 149.

  When the read instruction is the access right designation instruction shown in FIG. 9, the access control circuit 148 stores the control program execution monitor permission / prohibition (3) information indicated by the operand.

  Thereafter, a monitor request is accessed from the monitor device 2 to the specific control program to be protected via the system bus 19 with the control program execution monitor permission / prohibition (3) information stored in the access flag control circuit 148. In this case, the information of the operand part indicated by the access right designation instruction inserted at the read start address of the specific control program to be protected is read from the access right control flag circuit 148, and the control program execution monitor permission / According to the prohibited data (3), the result is output from the data buffer 144 to the system bus 19 via the data register 147, and a response is returned to the monitor device 2.

  That is, according to the access right designation command inserted at the head address of the specific control program to be protected, the reply to the monitor device 2 is limited, and each specific control program to be protected against the monitor request for the control program being executed. A protection function can be set in

  The configuration of the fourth embodiment is the same as the configuration shown in FIG. 1 described in the first to third embodiments, and the same portions are denoted by the same reference numerals and the description thereof is omitted.

  The fourth embodiment is different from the third embodiment in that in the third embodiment, the CPU 14 inserts an instruction as the second access right designation information fixed at the head address position for each specific control program to be protected, Although the response to the execution monitor request from the monitor device 2 is limited, the fourth embodiment is different from the third embodiment in that a plurality of specific control programs to be protected as the second access right designation information are in arbitrary positions. Access right specification instructions are distributed and inserted, and the read request by the execution monitor of the control program and control data is verified to increase the number of times that it is not a falsified request, and the response can be surely restricted. There is.

  The fourth embodiment will be described with reference to FIG. FIG. 11 shows an example of an access right designation instruction. This instruction code is ACCNTL, and the operand section describes execution monitor permission / prohibition (3).

  When the CPU 14 executes this example, the control program execution monitor permission / prohibition (3) information described in the control program access right management table and the operand of the access right designation instruction (ACCNTL) is stored in the access control flag circuit 148. Is done.

  By inserting a plurality of these instructions into arbitrary addresses of the specific control program to be protected, the access right information of the access control circuit 148 is randomly updated by the number of insertions in the same program.

  In other words, even if the control program access right management table or the operand information of the access right designation command (ACCNTL) in multiple places is falsified, the control program execution monitor is prohibited in any one place (3) Access to the monitor request for the control program from the monitor device 2 can be restricted, and the protection function against tampering can be enhanced.

  In addition, the access right designation command (ACCNTL) can be set to NOP so as not to affect the control response.

  The configuration of the fifth embodiment is the same as the configuration shown in FIG. 1 described in the first to third embodiments, and the same portions are denoted by the same reference numerals and the description thereof is omitted.

The fifth embodiment is different from the fourth embodiment in that, in the fourth embodiment, a plurality of access right designation instructions are distributed and inserted at arbitrary positions for each specific control program to be protected as the second access right designation information. In response to a read request by the execution monitor of the control program and control data, it is verified that the request is not falsified by increasing the number of times, and the response can be surely limited. The difference is that, for each specific control program to be protected as the second access right designation information, a plurality of access right designation instructions are distributed and inserted at arbitrary positions, and the control program is used as the first access right designation information. Set the access right management table, compare and judge each access right information, and more reliably verify that it is not a falsified request, and control program In that so as to limit the response to a read request by the execution monitor control data.

The fifth embodiment will be described with reference to FIGS. Figure 1 3 is an example of the access right specified instruction, the instruction code ACCVERFY, the operand unit execution monitor enable / disable control program (3) is described.

  FIG. 12 shows an example of a control program access right designation management table. For example, for the program name MS0002, execution monitoring permission / prohibition (3) of the control program is set in advance as access right designation information.

  When the CPU 14 executes this access right designation command (ACCVERFY), permission / prohibition of the control program execution monitor described in the access right information of this control program access right management table and the operand of the access right designation command (ACCVERFY) (3) The information is stored in the access flag control circuit 148, and is compared by the arithmetic circuit 149 with the access flag control circuit 148 stored at the time of this previous instruction.

Then, by inserting this instruction at an arbitrary address of the specific control program to be protected, the access right information of the access flag control circuit 148 can be changed multiple times according to the number of instructions inserted in the same program. Further, the arithmetic circuit 149 compares the access right information of the control program access right management table and the access right designation command (ACCV E RFY) with the respective previous data, or at least one of them is compared, and the difference Presence / absence is determined.

  If there is a difference in the access designation right information even at one place, the response to the monitor device 2 is prohibited and restricted.

  In other words, even if the control program access right management table or the operand information of the access right designation instruction (ACCVERFY) inserted in a plurality of places is falsified, if access prohibition is judged and output in any one place, the falsification is abnormal. And the response is restricted (prohibited), and the control program and its data are protected.

Hereinafter, a processing flow when these instructions of the fifth embodiment are used will be described with reference to FIG. In FIG. 14, a plurality of access right designation instructions (ACCVERFY) shown in FIG. 13 are inserted into arbitrary addresses for each control program to be protected (S141).

  Further, as the first access right designation information to be protected, the access right management table shown in FIG. 12 is stored in the data memory 13 in advance (S142).

  Next, it is assumed that an execution program monitor request is issued from the monitor device 2 to the control program being executed (S143).

  Then, the CPU 14 refers to the data memory 13 and executes the requested control program, for example, MS0002 (S144).

If the requested control program is executed and if it is a control program to be protected, the access right designation instruction (ACC VERFY ) written in the control program is executed, and the control program execution of the written operand part is executed Monitor permission / prohibition (3) The information and the access right information of the control program management table stored in the data memory are read into the access flag control circuit 148 and it is determined whether or not the respective access right designation data match. (S145).

  For example, if there is a difference in the access right designation data of the control program MS0002 requested from the monitor device 2 and the request is for a prohibited control program and its data, it is determined that there has been tampering and the requested Information indicating that the program and control data cannot be transmitted is transmitted (S147). If there is no discrepancy between the request for the permitted control program and its data, the requested control program and data are transmitted (S147).

  When the access right designation command (ACCVERFY) is inserted at a plurality of locations, the above operation is executed a plurality of times.

  According to the fifth embodiment, for each control program to be protected, a plurality of access right designation instructions are inserted at arbitrary locations, and a preset monitor device access permission table is set. However, since a difference in access right designation information is detected, protection for each control program with a very low probability of falsification can be easily realized.

  In addition, this access right designation command (ACCVRFY) is also set to NOP so that it does not affect the control response.

  In the above description, the CPU is described as a two-CPU system including the CPU 11 and the CPU 14, but may be configured as a one-CPU system. It is also possible to configure the memory including the data memory 13 and the control data memory 16 and store the control data and the first access right information on the memory.

  The present invention is not limited to the above-described embodiment, and a combination of the first access right control information for restricting access from the monitor device 2 and the second access right designation information as an execution instruction. The present invention can be executed in a different manner, and various modifications can be made without departing from the spirit of the present invention.

The block diagram of the control apparatus which concerns on this invention. The block diagram of the control data memory of a control program. An example of a control program head address table. An example of data in the access right specification area. FIG. 3 is a process flow diagram of the first embodiment. Control program storage IP address table. Monitor device access permission table. FIG. 6 is a processing flowchart of the second embodiment. An example of a monitor right designation command. Control program execution control circuit. An example of an access right designation command (ACCNTL). Control program access right information management table. An example of an access right designation command (ACCVRFY). The processing flow figure by an access right designation | designated instruction. Example of monitor configuration of a conventional control device

1, 21 Control device 2, 22 Monitor device 3 Control target 4, 24 Network 10 Control program execution control unit 11 CPU
12 Program memory 13 Data memory 14 CPU
15 control program memory 16 control data memory 17 input / output interface 18 communication interface 19 system bus 141 bus control circuit 142 instruction counter 143 address buffer 144 data buffer 145 instruction register 146 instruction decoder 147 data register 148 access flag control circuit 149 arithmetic circuit 149a work register

Claims (4)

A control program memory for storing a control program comprising a control program that can be disclosed and a specific control program to be protected; a control data memory for storing variable values of the control program; and the control stored in the control program memory A control device comprising a control program execution control unit for executing a program;
In a control system comprising a monitor device connected to the control device via a network,
The specific control program, a plurality of access right designation instructions for instructing permission or prohibition processing for the execution monitor that traces the program and data of the control program are distributed in the specific control program and inserted in advance.
Further, a control program access right management table in which access right designation information for designating permission or prohibition for the execution monitor for the control program from the monitor device is described for each control program is stored in the memory in the control program execution control unit. In advance,
When there is a request for execution monitoring from the monitor device to the specific control program being executed, the control program execution control unit sets an operand of the access right designation instruction every time the access right designation instruction is executed. A control program protection function characterized in that the execution monitor is prohibited with reference to stored control program execution monitor permission / prohibition information and access right designation information in the control program access right management table. Control system. The access right specifying instruction refers to whether or not the execution monitor prohibition information is described in any one of the control program execution monitor permission / prohibition information and the access right specification information. 2. The control system having a control program protection function according to claim 1, wherein the instruction prohibits the execution monitor . The access right designation command compares the previous control program execution monitor permission / prohibition information with the current control program execution monitor permission / prohibition information,
Furthermore, the previous access right designation information in the control program access right management table is compared with the current access right designation information,
2. The control program according to claim 1, wherein at least one of the comparisons is performed, and whether or not there is a difference at one place is referred to, and if there is a difference, the instruction is prohibited from the execution monitor . Control system with protection function. 2. The control system having a control program protection function according to claim 1, wherein the access right designation command is NOP .

Images