JP6594213B2 - Control device and program - Google Patents

Description

  Embodiments described herein relate generally to a control device and a program.

  A signature-based detection method is known as a method for detecting a security attack such as unauthorized access. In this signature-based detection method, a well-known attack pattern is defined in advance as a signature (a blacklist is defined), and the presence or absence of a security attack is detected by comparing the operation of the monitored device with this signature. . However, this signature-based detection method cannot generalize the attack pattern, so when a new attack is received or when a well-known attack is modified and no longer matches a predefined signature May not be able to detect attacks.

  There is also known a method for detecting unauthorized access by comparing the operation of a monitoring target device with an expected normal operation (white list). However, when the attacker can grasp the contents of the normal operation of this apparatus, there are cases where the attack cannot be detected by imitating the contents of the normal operation of this apparatus.

JP 2010-257150 A JP 2011-258019 A JP 2007-286656 A JP 2007-148818 A Japanese Patent Laid-Open No. 2005-234849

H. Feng et al., “Anomaly Detection Using Call Stack Information”, Proceedings of the IEEE Symposium on Security and Privacy, 2003, p. 62 H. Xu, W. Du, and SJ Chapin. “Context sensitive anomaly monitoring of process control flow to detect mimicry attacks and impossible paths”, Proceedings of the International Symposium on Recent Advances in Intrusion Detection RAID, Springer, 2004, 21-38 page Danilo Bruschi et al., “An Efficient Technique for Preventing Mimicry and Impossible Paths Execution Attacks”, Proceedings of the performance, computing, and communications conference (IPCCC), 2007, pp. 418-425

  The problem to be solved by the present invention is to provide a control device and a program capable of enhancing a protection function against a security attack.

  The control device of the embodiment includes a storage unit, a memory, a valid / invalid processing unit, and a detection unit. The storage unit stores a program including at least one dummy process. The valid / invalid processing unit validates or invalidates each dummy process included in the program loaded from the storage unit into the memory. The detecting unit monitors the execution state of the program, and detects whether the program has been tampered with by determining whether or not the dummy process is matched with the result of validation or invalidation by the validation / invalidation processing unit.

The figure which shows an example of the control system in 1st Embodiment. The functional block diagram of the control apparatus in 1st Embodiment. The figure which shows an example of the control program in 1st Embodiment. The figure which shows an example of the setting file which shows the content and position of the fake call contained in the control program in 1st Embodiment. The flowchart which shows an example of the flow of a process of the control apparatus in 1st Embodiment. The figure which shows an example of the condition where the fake call contained in the control program in a 1st embodiment is validated or invalidated. The flowchart which shows an example of the flow of a process of the control apparatus in 2nd Embodiment. The figure which shows an example of the condition where the fake call contained in the control program in a 2nd embodiment is validated or invalidated.

  Hereinafter, a control device and a program according to an embodiment will be described with reference to the drawings.

(First embodiment)
FIG. 1 is a diagram illustrating an example of a control system according to the first embodiment. The control system 1 may include the control device 3 and the control target device 5, but is not limited to this. For example, the control system 1 includes an automatic ticket gate control system that manages entry / exit at a railway station, a device control system for various devices such as boiler equipment in a factory, a paper sheet processing control system in a bank, and an operation processing control system in a passenger car. Can be applied to. In addition to the above, the control system 1 can be applied to any control system intended for real-time control or the like.

  The control device 3 controls the operation of the control target device 5. The control device 3 may include a processor 10, a communication I / F 12, a secondary storage device (storage unit) 14, a memory 16, and a ROM (Read Only Memory) 18, but is not limited thereto. Further, the control device 3 may receive various data from an external device (not shown) and determine the control content of the control target device 5 based on the various data.

  The processor 10 is, for example, a CPU (Central Processing Unit). The processor 10 starts an initial operation by the boot program, and expands (loads) the program stored in the secondary storage device 14 into the memory 16 and executes it.

  The communication unit I / F 12 is an interface device that transmits a control signal or the like for controlling the operation of the control target device 5 to the control target device 5.

  The secondary storage device 14 is a flash memory such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive), an EEPROM (Electrically Erasable Programmable ROM), or the like. The secondary storage device 14 stores an OS (Operating System), application programs, setting files, data, and the like of the control device 3. For example, the OS may include a valid / invalid processing program PG1, an abnormality detection program PG2, and the like, but is not limited thereto. Further, for example, the application program may include a control program PG3 for controlling the control target device 5, but is not limited thereto.

  The memory 16 is a volatile memory such as SRAM (Static Random Access Memory). The memory 16 is used as a working area by the processor 10 in addition to the OS and application program stored in the secondary storage device 14 being loaded by a DMA (Direct Memory Access) controller (not shown).

  The ROM 18 stores the above-described boot program, initial setting values of the processor 10, and the like.

  The control target device 5 executes various processes under the control of the control device 3. For example, when the control system 1 is an automatic ticket gate control system that manages entry / exit at a railway station, the control target device 5 is an actuator, a display device, or the like of an automatic ticket gate. When the control system 1 is a device control system for various devices such as boiler devices in a factory, the control target device 5 is various devices such as boiler devices.

  FIG. 2 is a functional block diagram of the control device 3 in the first embodiment. The control device 3 may include the OS execution unit 20 and the application execution unit 30, but is not limited thereto. The OS execution unit 20 is realized, for example, by loading an OS (valid / invalid processing program PG1, abnormality detection program PG2, etc.) stored in the secondary storage device 14 into the memory 16 and executing it by the processor 10. The The application execution unit 30 is realized by, for example, loading a control program PG3 stored in the secondary storage device 14 into the memory 16 and executing it by the processor 10.

  The OS execution unit 20 may include a valid / invalid processing unit 22 and an abnormality detection unit (detection unit) 24, but is not limited thereto.

  The valid / invalid processing unit 22 validates or invalidates each dummy process called a fake call included in the control program PG3 loaded from the secondary storage device 14 to the memory 16. In addition, the abnormality detection unit 24 monitors the execution state of the control program PG3 loaded from the secondary storage device 14 to the memory 16, and matches the result that the fake call is validated or invalidated by the valid / invalid processing unit 22. By determining whether or not to perform, alteration of the control program PG3 is detected. The operation of these functional units will be described later.

  The application execution unit 30 executes various processes for controlling the control target device 5.

[Control program]
In the control program PG3 in the present embodiment, a fake call is incorporated in advance when it is stored in the secondary storage device 14. The fake call is a system call for requesting various services to the OS or a function call for executing various processes, and performs a process that does not affect the original control process of the control program PG3. For example, this fake call may be an open call specifying a file that does not exist, or a process of overwriting an existing file with the same file.

FIG. 3 is a diagram illustrating an example of the control program PG3 in the first embodiment. In the control program PG3, one or more fake calls are incorporated at an arbitrary position in addition to a code for realizing the control process. In the example of FIG. 3, three fake calls (fake_call in the figure) are incorporated. For example, the control program PG3 includes: 1. Call (A) is called (call (A) in the figure). 2. Process code 1 (code1 in the figure); 3. Call the first fake call (R1) (fake_call (R1) in the figure). 4. Call (B) is called (call (B) in the figure). Execute code 2 processing (code2 in the figure); 6. Call the second fake call (R2) (fake_call (R2) in the figure); 7. Call the third fake call (R3) (fake_call (R3) in the figure); Codes are written in the order of calling a call (C) (call (C) in the figure). Note that the number and position of fake calls incorporated in the control program PG3 are not limited to this.
Each of the call (A), the call (B), and the call (C) is a system call for requesting various services to the OS or a function call for executing various processes. For example, each of call (A), call (B), and call (C) is “open ()” for opening a file, “read ()” for reading input, and “setreuid” for setting a user ID. () ”,“ Mmap () ”to map files to memory, etc.

  FIG. 4 shows an example of the setting file C1 indicating the contents (“Fake call” column in the figure) and the position (“Address” column in the figure) of the fake call included in the control program PG3 in the first embodiment. FIG. The setting file C1 is stored in the secondary storage device 14 together with the control program PG3 shown in FIG. The setting file C1 may be stored in the secondary storage device 14 as an independent file, or may be embedded as a part of the OS. The setting file C1 illustrated in FIG. 4 indicates that each of the fake calls R1, R2, and R3 exists at addresses 3, 6, and 7 in the control program PG3.

(Operation of control device)
With reference to FIG. 5 and FIG. 6, the operation of the control device 3 of the first embodiment will be described. FIG. 5 is a flowchart illustrating an example of a processing flow of the control device 3 in the first embodiment. FIG. 6 is a diagram illustrating an example of a situation in which a fake call included in a control program is validated or invalidated in the first embodiment.

  First, the control program PG3, valid / invalid processing program PG1, abnormality detection program PG2, and setting file C1 stored in the secondary storage device 14 are loaded into the memory 16 (step S101). As shown in FIG. 6, for example, the control program PG3 is loaded into the application area A1 in the memory 16, and the valid / invalid processing program PG1, the abnormality detection program PG2, and the setting file C1 are stored in the OS area A2 in the memory 16. To be loaded.

  Next, the valid / invalid processing unit 22 validates each fake call included in the control program PG3 loaded in the application area A1 in the memory 16 before the execution of the control program PG3 (ON in FIG. 6). Or invalidation (OFF in FIG. 6) (step S103).

  In the example shown in FIG. 6, the valid / invalid processing unit 22 performs the fake call at address 3 among the three fake calls described in the control program PG3 based on the setting file C1 loaded in the OS area A2. (R1) and the fake call (R2) at address 6 are validated (ON flag is set), and the fake call (R3) at address 7 is invalidated (OFF flag is set).

  At this time, the valid / invalid processing unit 22 writes a flag indicating which fake call is validated or invalidated in the setting file C1 (step S105). In the example of FIG. 6, the valid / invalid processing unit 22 writes information indicating ON or OFF in the “Flag” column. The valid / invalid processing unit 22 may store information indicating which fake call is validated or invalidated in a setting file other than the setting file C1.

  The valid / invalid processing unit 22 validates at least one fake call, for example. It may be determined randomly which fake call is enabled or disabled. Further, the valid / invalid processing unit 22 may invalidate all the fake calls.

  Further, the control program PG3 in which all the fake calls are validated is stored in the secondary storage device 14, and the valid / invalid processing unit 22 is included in the control program PG3 loaded in the application area A1 in the memory 16. The fake call to be invalidated may be set in the fake call to be made. Further, when each of the fake calls is validated or invalidated, the fake call to be invalidated is not set to a call (NOP instruction) that does not execute processing, instead of setting the ON flag and the OFF flag in the control program PG3. You may perform the process to rewrite.

  Next, the valid / invalid processing unit 22 starts execution of the control program PG3 loaded in the application area A1 in the memory 16 and in which each fake call is validated or invalidated (step S107).

  Next, the abnormality detection unit 24 determines whether or not the execution state of the control program PG3 is appropriate (step S109). For example, the abnormality detection unit 24 determines whether or not the content and execution order of the fake call validated in the fake call included in the control program PG3 matches the content and execution order defined in the configuration file C1. judge. When the content and execution order of the activated fake call matches the content and execution order defined in the configuration file C1, the abnormality detection unit 24 executes the activated fake call in order. It is determined that the execution state of the control program PG3 is appropriate. When it is determined that the execution state of the control program is appropriate, the abnormality detection unit 24 determines that the control program PG3 has not been tampered with (step S111). In this case, the control of the control target device 5 by the application execution unit 30 is continued, and the abnormality detection unit 24 again determines whether or not the execution state of the control program PG3 is appropriate (step S109). Further, the abnormality detection unit 24 may add that the invalidated fake call is not executed in the fake call described in the control program PG3 to the determination condition in step S109.

  On the other hand, if it is determined that the execution state of the control program is not appropriate, the abnormality detection unit 24 determines that the control program PG3 has been tampered with (step S113). For example, if the fake call (R2) at address 6 is not executed after the fake call (R1) at address 3 is executed, the abnormality detection unit 24 executes the fake call (R1) at address 3 If the fake call (R2) at address 6 is executed, it is determined that the control program PG3 has been tampered with.

  In this case, the abnormality detection unit 24 performs an error process such as notifying an external monitoring terminal of the abnormality (step S115), and ends the process of this flowchart. In this case, the abnormality detection unit 24 may stop the execution of the application execution program PG3.

  In addition to the execution state of the fake call included in the control program PG3, the abnormality detecting unit 24 performs calls (call (A), call (B), call (C) for performing normal processing included in the control program PG3. ) May be monitored together. Further, the abnormality detection unit 24 may monitor the contents of parameters (for example, the contents of parameters delivered to the OS) used when a fake call included in the control program PG3 is processed.

  According to the control device 3 of the first embodiment described above, the secondary storage device 14 storing the program including at least one dummy process, the memory 16, and the secondary storage device 14 loaded into the memory 16. The valid / invalid processing unit 22 that validates or invalidates each dummy process included in the program PG3 and the execution state of the program PG3 are monitored, and the dummy process is validated or invalidated by the valid / invalid process unit 22. By determining whether or not the result matches, the abnormality detection unit 24 that detects falsification of the program PG3 can be provided, thereby enhancing the protection function against the security attack.

  In the control device 3 according to the first embodiment, the fake call included in the control program PG3 is randomly enabled or disabled before the execution of the control program PG3. The contents, number, and order of the fake call are different for each execution of the control program PG3. For this reason, for example, even if the attacker can grasp the contents of the normal operation related to the control processing of the attack target device (the contents of the code of the control program), the attacker cannot grasp the contents of the fake call that differs for each execution . Even if the contents and execution order of the fake call are analyzed, the contents and execution order of the fake call change in the next execution scene, so that the attack can be expected to fail. As described above, according to the control device 3 of the first embodiment, it is possible to detect falsification of the program by monitoring the execution state of the randomly activated fake call. It should be noted that each time (every time the control program PG3 is loaded into the memory 16), the setting for enabling or disabling the fake call is not performed at random, but may be performed at a frequency of once every multiple times. It may be performed more frequently than when the program PG3 is loaded.

(Second Embodiment)
Hereinafter, the second embodiment will be described. The control system 1 according to the second embodiment is different from the first embodiment in that the contents of the fake call are dynamically changed at an arbitrary timing after the execution of the control program PG3 is started. In the following description, the same reference numerals are assigned to the same parts as those in the first embodiment, and the description is omitted or simplified.

[Operation of control device]
With reference to FIG. 7 and FIG. 8, operation | movement of the control apparatus 3 of 2nd Embodiment is demonstrated. FIG. 7 is a flowchart illustrating an example of a processing flow of the control device 3 in the second embodiment. FIG. 8 is a diagram illustrating an example of a situation in which the fake call included in the control program is validated or invalidated in the second embodiment.

  First, the control program PG3, valid / invalid processing program PG1, abnormality detection program PG2, and setting file C1 stored in the secondary storage device 14 are loaded into the memory 16 (step S201).

  Next, the valid / invalid processing unit 22 starts executing the control program PG3 loaded in the application area A1 in the memory 16 (step S203). Here, for example, all the fake calls included in the control program PG3 are validated.

  Next, the valid / invalid processing unit 22 determines whether or not a fake call change trigger for changing a fake call execution condition included in the control program PG3 has occurred (step S205). The fake call change trigger is based on, for example, an interrupt signal that is randomly generated by another process (not shown).

  If it is determined that a fake call change trigger has occurred, the valid / invalid processing unit 22 validates or invalidates each fake call included in the control program PG3 being executed (step S207).

  In the example shown in FIG. 8, the valid / invalid processing unit 22 performs the fake call at address 7 among the three fake calls described in the control program PG3 based on the setting file C1 loaded in the OS area A2. (R3) is invalidated. For example, the valid / invalid processing unit 22 performs a process of rewriting the fake call (R3) at address 7 into a call (NOP instruction) that does not execute the process. The valid / invalid processing unit 22 may randomly determine which fake call is to be validated or invalidated.

  At this time, the valid / invalid processing unit 22 writes a flag indicating which fake call is invalidated in the setting file C1 (writes information indicating OFF in the “Flag” column in the figure) (step S209). .

  The valid / invalid processing unit 22 replaces the fake call (R3) at address 7 with a call (NOP instruction) that does not execute the process, as in the first embodiment, in the control program PG3. A flag indicating validation or invalidation may be set. In addition, the valid / invalid processing unit 22 may store information indicating which fake call is validated or invalidated in a setting file other than the setting file C1.

  When it is determined that the fake call change trigger has not occurred, the valid / invalid processing unit 22 does not perform the fake call execution condition change process (step S207) and the setting file C1 rewrite process (step S209). .

  Next, the abnormality detection unit 24 determines whether or not the execution state of the control program PG3 is appropriate (step 211). For example, the abnormality detection unit 24 determines whether or not the content and execution order of the fake call validated in the fake call described in the control program PG3 matches the content and execution order defined in the configuration file C1. Determine. When the content and execution order of the activated fake call matches the content and execution order defined in the configuration file C1, the abnormality detection unit 24 executes the activated fake call in order. It is determined that the execution state of the control program PG3 is appropriate. When it is determined that the execution state of the control program is appropriate, the abnormality detection unit 24 determines that the control program PG3 has not been tampered with (step S213). In this case, control of the control target device 5 by the application execution unit 30 is continued, and the abnormality detection unit 24 performs again the process of determining whether or not a fake call change trigger has occurred (step S205).

  On the other hand, when it is determined that the execution state of the control program is not appropriate, the abnormality detection unit 24 determines that the control program PG3 has been tampered with (step S215). For example, if the fake call (R2) at address 6 is not executed after the fake call (R1) at address 3 is executed, the abnormality detection unit 24 executes the fake call (R1) at address 3 If the fake call (R2) at address 6 is executed, it is determined that the control program PG3 has been tampered with.

  In this case, the abnormality detection unit 24 performs an error process such as notifying an external monitoring terminal of the abnormality (step S217), and ends the process of this flowchart.

  According to the control device 3 of the second embodiment described above, since the fake call included in the control program PG3 is randomly enabled or disabled during the execution of the control program PG3, it is included in the control program PG3. The contents, number, and order of the activated fake can be changed during the execution of the control program PG3. For this reason, for example, even if the attacker can grasp the content of the operation related to the control processing of the attack target device (the content of the code of the control program PG3 including the fake call execution condition), the tampering of the control program PG3 is detected. be able to.

  In the control device 3 of the second embodiment described above, the example in which the fake call included in the control program PG3 is randomly enabled or disabled during the execution of the control program PG3 has been described. However, in addition to the execution of the control program PG3, a process for validating or invalidating the fake call may be performed before the execution of the control program PG3, as in the control device 3 of the first embodiment.

  According to at least one embodiment described above, the secondary storage device 14 storing a program including at least one dummy process, the memory 16, and the program PG3 loaded from the secondary storage device 14 to the memory 16 are included. The execution / execution state of the program PG3 is monitored, and the execution / execution state of the program PG3 is monitored and coincides with the result of enabling / disabling the dummy processing by the enabling / disabling processing unit 22. By determining whether or not, it is possible to enhance the protection function of the control device against the security attack by including the abnormality detection unit 24 that detects falsification of the program PG3.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 1 ... Control system, 3 ... Control apparatus, 5 ... Control object apparatus, 10 ... Processor, 12 ... Communication I / F, 14 ... Secondary storage device, 16 ... Memory, 18 ... ROM, 20 ... OS execution part, 22 ... Validity / invalidity processing unit, 24 ... anomaly detection unit, 30 ... application execution unit, A1 ... application area, A2 ... OS area, C1 ... setting file, PG1 ... validity / invalidity processing program, PG2 ... abnormality detection program, PG3 ... control program

Claims (4)

A storage unit storing a program including at least one dummy process;
Memory,
Each of the dummy processes included in the program loaded from the storage unit to the memory is enabled / disabled so as to be executable or disabled so as to be executable;
The execution state of the program is monitored, and whether or not the contents and execution order of the executed dummy processes match the contents and execution order of the dummy processes that are validated among the dummy processes included in the program. A detection unit that detects falsification of the program by determining, and
The valid / invalid processing unit invalidates the dummy process by rewriting the dummy process included in the program loaded in the memory into a NOP instruction.
Control device. The valid / invalid processing unit validates or invalidates each of the dummy processes included in the program before the execution of the program loaded from the storage unit into the memory is started.
The control device according to claim 1. The valid / invalid processing unit validates or invalidates each of the dummy processes included in the program during execution of the program loaded from the storage unit into the memory.
The control device according to claim 1. On the computer,
Each of at least one dummy process included in the control program loaded in the memory is enabled so that it can be executed or disabled so that it cannot be executed.
Whether or not the execution state of the control program is monitored and the contents and execution order of the executed dummy processes coincide with the contents and execution order of the dummy processes that are validated among the dummy processes included in the control program. A program for detecting falsification of the control program by determining whether or not
Rewriting the dummy process included in the control program loaded in the memory to a NOP instruction, thereby invalidating the dummy process;
program.

Images