JP6598288B2 - Dynamic zoning plant system - Google Patents

Description

The present invention relates to a technique for improving security and safety by changing a network and connection configuration of a plant system even during a production process, that is, by enabling dynamic switching.
Specifically, a general plant system that is currently connected to the mainstream Internet includes an IT system and a control system, and the control system includes a field controller and a supervisory system that monitors local controller information. Prepare. The present invention is a dynamic zoning plant system having switching means that enables change of network and connection configuration of a plant system by intercepting communication flowing through a control system system and monitoring those systems and grasping their states. About. Changing the system configuration means changing or blocking the connection of a local controller or field device.

There is already a technology for switching networks, and there is a technology for switching network settings by software and a device for physically switching network LAN connections. These technologies are used to improve security and effectively use network resources. Patent Document 1 is an example of a system utilizing this technology.

Patent Document 1 includes a host connected to a network, a channel switch device provided with a control switch, and a library device storing a plurality of recording media and a robot device. The library control system describes a dynamic zoning plant system in which a switching device switches a combination of connection between a host and a drive, and a robot device switches a connection between a recording medium and a drive. This makes it possible to change the connection between the host and the drive device. By dynamically changing the connection between the host and the drive device when necessary, data loss occurs when the library device is shared by multiple hosts. The purpose is to improve security such as preventing damage.
In short, there is a device that uses a library device shared by a plurality of hosts from the beginning, and it becomes a connection switching device for the purpose of improving security.

The technique described in Patent Literature 1 is not a technique for switching networks, but a technique for dynamically switching the configuration of system devices. The system covered by this patented technology is a library device. The effect of this patented technology is also in security improvement and convenience.

  A system using a control system such as a current plant is configured in combination with an IT system. In recent years, plant systems have been connected to external networks from the viewpoint of convenience and production efficiency. However, the control system is not designed in consideration of security, and security measures are not sufficiently taken. As a result, there have been cases where systems are controlled by cyber attacks from hackers. There is a technology called zone division as a security improvement measure against cyber attacks from hackers. This is to divide and arrange the control system devices into a plurality of zones to reduce the probability of a serious accident caused by an attack from a hacker, and to detect information concealment work due to cyber attacks.

The block diagram of the dynamic zoning plant system of the conventional general plant system of FIG. 7 is shown, This figure is demonstrated. As shown in FIG. 7, the plant system can be roughly divided into an IT system 3a and a control system 4a, and the IT system is connected to the external Internet 2a through a first gateway 32a.
The IT system 3a includes an external network 31a connected to the Internet 2a, a network 33a connected to the demilitarized zone and a first gateway 32a connected to the internal network 34a, an external service server 35a, a workstation 36a, and an OPC data server 37a. There is a second gateway 39A for connecting the database server 38a, the internal network 34a and the control system 4a.
Further, the control system 4a includes an engineering workstation 51a, a SCADA 52a, an OPC server 53a, and a local controller 54a. These are the local controller group 5a in the present invention. A field device 61a is connected to the lower level of the local controller 54a via a field bus 62a, and these are defined as a field device group 6a.

FIG. 8 shows a flowchart of the operation of a conventional general plant system at normal time. The operation of the general plant system will be described with reference to FIG.
In S100, the operator operates the engineering workstation to define the production process. In S101, the operator activates the plant system. In S102, the operator operates SCADA and inputs setting values of field devices via the OPC server. In S103, the operator executes the production process defined above, and the plant system performs production according to the production process. In S104, the plant system completes the production process and obtains a product.

  The control system is used in infrastructure and factories, and if an incident occurs, there is a possibility that the total damage amount and damage scale will be large. In the past, plant systems equipped with a control system were not connected to the network, so it was thought that they would not receive cyber attacks. As a result, sufficient security measures have not been taken, and in control systems, the highest priority is always to continue operations, so existing security measures for IT systems that may impede the operations remain unchanged. There is also a problem that it cannot be applied. For example, a plant system or the like that is representative of a control system system has a problem that the system cannot be stopped suddenly just because an incident occurs from the viewpoint of production efficiency and safety. For this reason, there is a current situation in which security measures are required in consideration of characteristics on the control system side as well as the IT system side.

JP 2006-92166 A

Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems 2011/8 / 29Eric D. Knapp, Joel Thomas Langill

In a conventional dynamic zoning plant system, a plant system having a control system has security vulnerabilities, and it is necessary to take measures against this. The solution is to propose a security countermeasure method based on the characteristics of the control system, not the existing IT security countermeasures. Furthermore, even if an incident occurs in the control system, it is an issue to be solved by the present invention to enable early recovery and countermeasures.
An object of the present invention is to respond to an incident by changing the configuration even when a plant that is a dynamic zoning plant system is executing a production process.

Invention 1 is a dynamic system comprising an IT system (3) connected to the Internet, and a control system (4) having a local controller group (5) and a field device group (6) connected to the IT system (3). In the zoning plant system (1), control is performed between the IT system (3) and the local controller group (5) to dynamically change the network for changing the network configuration of the local controller group (5). A LAN switching device (71), a local controller group monitoring device (72) for monitoring communication of the local controller group (5), and a LAN branching device (73) for intercepting communication of the local controller group (5), LAN switching system for dynamically changing the configuration of the network of the local controller group (5) (7) , And a dynamic control of the network for changing the network configuration of the field device group (6) on the field bus (62) between the local controller group (5) and the field device group (6). Fieldbus switching device (81), field device monitoring device (82) for monitoring communication of field device group (6), and fieldbus branching device (83) for intercepting communication of field device group (6). And a fieldbus switching system (8) for dynamically changing the configuration of the network connecting the local controller group (5) and the field device group (6), and the network configuration of the plant even during the operation of the plant LAN switching system (7) that can be changed manually or automatically, or fieldbus switching system ( A dynamic zoning plant system (1), characterized by comprising either).
In the second aspect of the present invention, the LAN switching device (71) includes a LAN switching means (711) for connecting the local controller group (5) and a network configuration change having an automatic change program (7122) for automatically configuring the network. Means (712), and the local controller group monitoring device (72) monitors the state of the local controller group (5) from the communication intercepted by the LAN branch device (73), and when an abnormality occurs, the network configuration changing means ( 712), the dynamic zoning plant system (1) according to the first aspect of the invention is characterized in that an instruction to change the network configuration is issued.
In the invention 3, the fieldbus switching device (81) includes a fieldbus switching means (811) for connecting the local controller group (5) and the field device group (6),
A network configuration change means (812) having an automatic change program (8122) for automatically configuring the network is provided, and the field device monitoring device (82) detects the field device from the communication intercepted by the fieldbus branch device (83). The dynamic zoning plant according to claim 1 or 2, wherein the state of the group (6) is monitored, and a network configuration change means (812) is instructed to change the network configuration when an abnormality occurs. System (1).
The invention 4 is any one of the inventions 1 to 3, wherein the local controller group monitoring device (72) and the field device monitoring device (82) have a normal state transition table and make an abnormality determination. It is a dynamic zoning plant system (1) described in 1).

The invention 1 provides the dynamic zoning plant system with an incident on the plant system by providing the dynamic zoning plant system (1) having either the LAN switching system (7) or the fieldbus switching system (8). For example, when an attack from a hacker or a computer virus infection occurs, it is possible to take measures such as changing the configuration of the plant system. Therefore, even when the plant system is in operation, it is possible to take measures without stopping production.
In the invention 2, the LAN switching device (71) of the LAN switching system (7) monitors the state of the local controller group (5), and when an abnormality occurs, the network configuration is changed with respect to the network configuration changing means (712). Order change. This means that the configuration of the local controller group (5) can be changed automatically by the automatic change program, and the incident response can be handled by changing the network configuration according to the state of the local control group (5) when an incident occurs. enable. Therefore, it is possible to make the system less susceptible to attack by changing the network connection configuration of the control system in accordance with the change in the state of the plant accompanying the execution of the production process of the plant system.
In the invention 3, the fieldbus switching device (81) of the fieldbus switching system (8) monitors the state of the field device group (6), and when an abnormality occurs, the network configuration changing means (812) is informed of the network. Command to change the configuration. This is because the configuration of the field device group (6) can be automatically changed by the automatic change program, and the incident can be handled by changing the network configuration according to the state of the field device group (6) when an incident occurs. enable. Therefore, it is possible to make the system less susceptible to attack by changing the network connection configuration of the control system in accordance with the change in the state of the plant accompanying the execution of the production process of the plant system.
In the invention 4, the local controller group monitoring device (72) and the field device monitoring device (82) have the normal state transition table (9) and make an abnormality determination. The normal state transition table (9) represents the state change of the local controller and the field device in time series because the state of the local controller and the field device also changes due to the execution of the production process. The local controller group monitoring device (72) and the field device monitoring device (82) are compared with the state of the local controller and the field device ascertained from the intercepted information. If they match, it is normal, and if they do not match, it is abnormal. Judge that there is. As a result, it is possible to appropriately determine an abnormality in the state of the local controller and the field device.
As described above, the application of the dynamic zoning plant system (1) of the present invention has the effect of improving the resilience when an incident occurs on the plant system and improving the safety and security of the plant system.
Specifically, when the plant system is in operation, if any incident occurs, irregular information flows, so this is monitored and discovered, and the damage is expanded by changing the network configuration according to the situation. It becomes possible to stop.

Reference numerals in parentheses in the above and the claims indicate the correspondence between the terms described in the claims and specifics or the like that exemplify the terms described in the following embodiments.

The schematic diagram of the dynamic zoning plant system 1 concerning a 1st embodiment of the present invention is shown. The block diagram of LAN switching system 7 is shown. The block diagram of the fieldbus switching system 8 is shown. The flowchart at the time of the incident generation based on the structure of the dynamic zoning plant system 1 is shown. The normal state transition table 9 of the local controller group 5 or the field device group 6 is shown. The flowchart at the time of normal of the dynamic zoning plant system 1 which concerns on 2nd Embodiment is shown. The schematic diagram of the conventional plant system is shown. The flowchart of operation | movement of the conventional common plant system at the normal time is shown.

Embodiments of the present invention will be described below with reference to the drawings. The present invention is not limited to the following embodiments, and changes, modifications, and improvements can be added without departing from the scope of the invention.

(First embodiment)
FIG. 1 shows a configuration diagram of a dynamic zoning plant system 1 according to a first embodiment of the present invention. As shown in FIG. 1, the dynamic zoning plant system can be broadly divided into an IT system 3 and a control system 4, and the IT system is connected to the external Internet through a first gateway. The configuration of this figure is almost the same as that of FIG. 8 extracted from the reference patent document.
The IT system 3 includes a first gateway 32 connected to an external network 31, a demilitarized zone 33 and an internal network 34, an external service server 35, a workstation 36, an OPC data server 37, a database server 38, an internal network 34 and a control system. It has the 2nd gateway 39 which connects a network.
Further, the control system 4 includes an engineering workstation 51, a SCADA 52, an OPC server 53, a local controller 54, a field device 61, and a field bus 62 as in a general control system.
Further, a LAN switching system 7 is provided above the local controller group 5. The local controller group 5 includes a LAN switching device 71, a local controller group monitoring device 72, and a LAN branching device 73.
A field device monitoring system 8 is provided on the field bus 62 between the local controller group 5 and the field device group 6, and a field device monitoring device 82 and a field bus branching device 83 are provided inside the field device monitoring system 8.

  FIG. 2 is a diagram showing details of the LAN switching system 7 of the first embodiment. The LAN switching device 71 includes a network configuration changing unit 712 including a manual change program 7121 and an automatic change program 7122, and a LAN switching unit 711. By this LAN switching means 711, the LAN switching device 71 is connected to the second gateway 36, the engineering workstation 51, the SCADA 52, the OPC server 53, and a plurality of local controllers 54. The local controller group monitoring device 72 connected to the LAN switching device 71 includes monitoring means 721, normal time switching means 722, and abnormal time switching determination means 723. The local controller group monitoring device 72 receives a signal from the LAN branch device 73. The LAN branch device 73 exists between the LAN switching device 71 and the local controller group 5.

  FIG. 3 is a diagram showing details of the fieldbus switching system 8 of the first embodiment. The fieldbus switching device 81 includes a network configuration changing unit 812 having a manual change program 813 and an automatic change program 814, and a fieldbus switching unit 811. By this fieldbus switching means 811, the fieldbus switching device 81 is connected to a plurality of local controllers 52 and a plurality of field devices 61. The field device monitoring device 82 connected to the fieldbus switching device 81 includes monitoring means 821, normal time switching means 822, and abnormal time switching determination means 823. The field device monitoring device 82 receives a signal from the fieldbus branching device 63. The field bus branching device 63 exists between the local controller 54 and the field device 61.

(function)
The function of the dynamic zoning plant system 1 of 1st Embodiment is demonstrated using FIG. The control system existing under the second gateway 36 of the IT system 3 in the dynamic zoning plant system 1 uses the SCADA 52 in the same manner as the function of a general plant system, and the information is transferred to the local controller via the OPC server 53. To 54. The local controller 54 performs a process set based on the information.
The engineering workstation 51 has a function of constructing a production process, and is used before starting the production process.
The server group existing in the IT system is used for receiving orders for production management and production planning. Therefore, it is necessary to exchange information with the outside and is connected to the Internet.
The local controller 54 controls the field device 61 and is connected to the field device 61 via the field bus.
The local controller 54 controls the field device 61 according to a given command and executes a production process.
The LAN switching system and the fieldbus switching system will be described later.

The function of the LAN switching system 7 of the first embodiment will be described with reference to FIG.
In the LAN switching system 7, a gateway and a plurality of local controllers 54, an OPC server 53, a SCADA 52, and an engineering workstation 51 are connected by a LAN switching unit 711. Addresses are given to the local controller 54, the OPC server 53, the SCADA 52, and the engineering workstation 51, so that information can be transferred to a designated place. The network configuration can be changed by the network configuration changing means 712 of the LAN switching device 71. The change at this time can be performed manually or automatically by the manual change program 7121 and the automatic change program 7122, and the switching is performed in a short time so as not to disturb the production process of the plant system. In order to make the change automatically, the local controller group monitoring device 72 monitors the communication that the local controller group 5 exchanges with the LAN branching device 73 and the monitoring unit 721 to grasp the state of the local controller and the field device.
The monitoring unit 721 determines whether the local control group 5 is normal or abnormal from the monitored communication. At the normal time, the normal time switching means 722 operates and issues a command for changing the configuration to the network configuration changing means 712.
The normal-time switching means 722 has registered a plant configuration according to the state of the controller group 5, and a network configuration changing means is configured to change an instruction to change to the registered plant configuration when the controller group 5 is in a specific state at the normal time. Send to 712.
When an incident occurs, the monitoring unit 721 finds an abnormality based on the monitored communication, and if necessary, the abnormal time switching determination unit 723 operates and issues a command to change the configuration to the network configuration changing unit 712.
A plant configuration corresponding to the abnormal state of the local controller group 5 is registered in the abnormal time switching determination means 723, and when the local controller group 5 enters the registered abnormal state, the plant configuration corresponding to this is changed. The command is sent to the network configuration changing means 712.
The LAN branching device 73 exists between the local controller 54 and the LAN switching device 71 and does not have an address so that it cannot be detected by network analysis from hackers. Information is sent to the local controller group monitoring device 72.

The function of the fieldbus switching system 8 will be described with reference to FIG. In the fieldbus switching system 8, a plurality of local controllers 54 and a plurality of field devices 61 are connected by fieldbus switching means 811. As a result, information can be transferred from the local controller 54 to the designated field device 61. The connection destination of the field device 61 can be changed by the network configuration changing means 812 of the fieldbus switching device 81. The change at this time can be performed manually or automatically by the manual change program 8121 and the automatic change program 8122, and the switching is performed in a short time so as not to disturb the production process of the plant system. In order to perform the change automatically, the field device monitoring device 82 monitors the communication exchanged between the local controller 54 and the field device 61 by the field bus branching device 83 and the monitoring means 821, and grasps the state of each field device. An instruction is issued to the automatic change program 8122 at the changed timing.
The monitoring unit 821 determines whether the field device group 6 is normal or abnormal from the monitored communication. At the normal time, the normal time switching means 822 operates and issues a command to change the configuration to the network configuration changing means 812.
In the normal time switching means 822, a plant configuration corresponding to the state of the field device group 6 is registered, and an instruction to change to the registered plant configuration when the field device group 6 is in a specific state at the normal time is a network configuration. Send to change means 812.
When an incident occurs, the monitoring unit 821 finds an abnormality based on the monitored communication, and if necessary, the abnormal time switching determination unit 823 operates to issue a command to change the configuration to the network configuration changing unit 712.
A plant configuration corresponding to the abnormal state of the controller group 5 is registered in the abnormal time switching determination means 823. When the field device group 6 enters the abnormal state registered, a command to change the plant configuration according to the registered abnormal state. Is sent to the network configuration changing means 812.
The field bus branching device 83 exists in the field bus 62 between the local controller 54 and the field device 61. Since the field bus branching device 83 does not have an address, the field bus branching device 83 does not detect itself by network analysis from a hacker or the like. Is intercepted and sent to the field device monitoring device 82.

A method of determining whether the monitoring unit 721 of the local controller group monitoring device 72 and the monitoring unit 821 of the field device monitoring device 82 are normal or abnormal will be described. As an example, FIG. 5 shows state transitions of the local controller group 5 and the field device group 6 of the plant system in a normal state (hereinafter, a normal state transition table 9). The leftmost column of the normal state transition table 9 is the step number that changes due to the execution of the production process, and the top row is the local controller group 5 and the field device group 6 constituting the plant system. That is, in the normal state transition table 9, since the state of the local controller group 5 and the field device group 6 also changes due to execution of the production process, the state change of the local controller group 5 and the field device group 6 in time series order can be understood. It has become. 0 and 1 described in the cell of FIG. 5 of the normal state transition table 9 indicate the states of the local controller group 5 and the field device group 6. Thus, the normal state transition table 9 defines the normal operating state of the plant system numerically. Although the first embodiment is represented by 0 and 1, since there are more states depending on the production process of the plant and the mechanism of the equipment, the normal state transition table 9 describes numerical values other than 0 and 1. It can happen.
The monitoring means 721 and 821 have the information of the normal state transition table 9 as shown in this figure in advance, and compare them with the states of the local controller group 5 and the field device group 6 ascertained from the intercepted information. If it can be confirmed that they match, it is determined to be normal. Further, when it is confirmed that even a part does not match, it is determined that there is an abnormality. The normal state transition table 9 is different between the monitoring units 721 and 821.

(Operation)
The operation of the dynamic zoning plant system 1 when an incident occurs will be described with reference to FIG.
In S200, the operator activates the dynamic zoning plant system 1. In S201, the operator operates the engineering workstation to define a production process. In S202, the operator operates SCADA to input setting values of field devices via the OPC server. In S203, the operator executes the production process defined earlier, and the dynamic zoning plant system 1 performs production according to the production process.
In S204, an incident due to a cyber attack such as a hacker occurs. In S205, the process branches depending on whether or not a communication abnormality has been detected by the monitoring unit 721 of the local controller group monitoring device 72. If detected, the process proceeds to S206 (S205: YES), and if not detected, the process proceeds to S214 (S205: NO). . The monitoring means 721 has information on the normal state transition table 9 corresponding to the local controller group 5 and compares it with the state of the local controller group 5 ascertained from the intercepted information. If it can be confirmed that they are completely matched, it is determined to be normal. In S206, the warning display means informs the operator of the abnormality detected by the monitoring means. In S207, the process branches depending on whether or not the abnormal state detected by the local controller group monitoring device 72 is a switching condition defined in the abnormal time switching determination unit 723. If the defined condition is met, the process proceeds to S208 (S207: YES). If they do not match, the process proceeds to S211 (S207: NO). In step S208, the abnormal time switching determination unit 723 of the local controller group monitoring device 72 sends a command to move the automatic change program 7122 of the LAN switching device. In step S209, the LAN switching device automatic change program 7122 is executed in response to the incident, and the LAN switching unit 711 is used to change the connection of the local controller to change the configuration. In step S210, the warning display unit 724 detects an abnormality and displays and notifies the operator that the configuration has been changed by the automatic change program 7122. In S211, the warning display means 724 displays and notifies the operator that an abnormality has been detected but the configuration has not been changed. Even if the switching device does not automatically operate in S212, if the operator again determines whether or not it is necessary to change the configuration of the dynamic zoning plant system, the process proceeds to S213 (YES in S212). Otherwise, the process proceeds to S214 (S212: NO). In S213, since the operator determines that the configuration needs to be changed, the operator executes the LAN switching device manual change program 7121 to change the connection 5 of the local controller using the LAN switching means 711 to change the configuration. In S214, the plant system continues the defined production process regardless of whether there is a configuration change.
Next, in S214, the process branches depending on whether or not a communication abnormality has been detected by the monitoring unit 821 of the field device monitoring device 82. If detected, the process proceeds to S215 (S214: YES), and if not detected, the process proceeds to S223 (S214: NO). The monitoring means 821 has information on the normal state transition table 9 corresponding to the field device group 6 and compares it with the state of the field device group 6 ascertained from the intercepted information. If it can be confirmed that they are completely matched, it is determined to be normal. In S215, the warning display unit 824 notifies the operator of the abnormality detected by the monitoring unit 821. In S216, the process branches depending on whether or not the abnormal state detected by the monitoring device 82 is the switching condition defined in the abnormal time switching determination unit 823. If the defined condition is met, the process proceeds to S217 (S216: YES). If not, the process proceeds to S220 (S216: NO). In S 217, the abnormal time switching determination unit 823 of the monitoring device 82 sends a command to move the automatic change program 8122 of the fieldbus switching device 81. In S218, the automatic change program 8122 of the fieldbus switching device 81 is executed in response to the incident, and the fieldbus switching means 811 is used to change the connection of the field device and change the configuration. In step S219, the warning display unit 824 detects an abnormality and notifies the operator that the configuration has been changed by the automatic change program 8122. In S220, the warning display means 824 displays and notifies the operator that an abnormality has been detected but the configuration has not been changed. Even if the switching device does not automatically operate in S221, if the operator again determines whether or not it is necessary to change the configuration of the dynamic zoning plant system, the process proceeds to S222 (S221: YES). Otherwise, the process proceeds to S223 (S221: NO). In S222, the operator determines that the configuration needs to be changed, so the fieldbus switching device manual change program 8121 is executed, and the fieldbus switching means 811 is used to change the connection of the field device group 6 to change the configuration. In S223, the plant system continues the defined production process regardless of whether there is a configuration change.

As described above, when an incident occurs and an abnormality is detected and the automatic change programs 7122 and 8122 are not executed, the operator changes the plant with the manual change programs 7121 and 8121. However, even if the operator cannot execute the manual change programs 7121 and 8121, if the production process of the plant has already been executed, the production process cannot be stopped suddenly, so the production process is continued.

(effect)
With the dynamic zoning plant system 1 of the first embodiment, when an incident occurs, the network connection of the plant equipment is changed to prevent the damage from spreading and to make an early recovery.

  If the connection of the local controller 54 is changed by the network configuration changing means 712 of the LAN switching device 71, it becomes more difficult for a hacker to succeed in the cyber attack. In addition, the scope of the attack can be limited by separating from the network, and control can be performed in an isolated state. Establish safety by separating SCADA and OPC servers from the network when they become aware of hackers' cyber attacks at an early stage (for example, only SCADA is infected by malware and only OPC servers are compromised by hackers) And early malware response and hackers can be shut out. Since these switching operations can be performed during the production process of the plant, incident response can be performed without stopping the production process.

  The LAN branch device 73 and the field bus branch device 83 intercept the information flowing in the network in which the LAN branch device 73 and the field bus branch device 83 exist and pass the information to the local controller group monitoring device 72 or the field device monitoring device 82. As a result, hackers can monitor the local controller group 5 and field device group 6 of the plant system without knowing that the LAN branch device 73 and the fieldbus branch device 83 are attacked. It is possible to continue to intercept without fail.

  The local controller group monitoring device 72 and the field device monitoring device 82 have monitoring means 721 and 821 and an abnormal time switching determination means 723 and 823, respectively, and monitor the communication intercepted by the LAN branch device 73 and the fieldbus branch device 83. It is possible to find an abnormality by comparing with the state of information defined in 721 and 821. Further, it is possible to send an appropriate command in accordance with the abnormality found by the abnormality switching determination means 723 and 823 to the network switching means.

(Second Embodiment)
In the conventional plant system, when it is operating normally, it is necessary to completely stop the plant once for safety when changing the components. Therefore, in order to change the plant configuration, there is a problem that the time from the stop to the restart and the cost due to the decrease in production efficiency due to the stop. The second embodiment is intended to change the configuration of a plant without stopping the plant, and to prevent operator mistakes and cyber attacks from hackers.

According to the invention 1, a dynamic zoning plant system (1) for performing this can be provided.
In the invention 5, the LAN switching device (71) includes a LAN switching means (711) for connecting the local controller group (5) and an automatic change program (7122) for automatically configuring the network. The local controller group monitoring device (72) is provided with a configuration change means (712), and monitors the state of the local controller group (5) from the communication intercepted by the LAN branch device (73) and monitors it in a normal state. The timing of changing the connection of the local controller group (5) is determined from the information, and the network configuration changing means (712) is instructed to change the network configuration. Dynamic zoning plant system (1).
In the invention 5, the LAN switching device (71) of the LAN switching system (7) monitors the state of the local controller group (5), and changes the network configuration to the network configuration changing means (712) when normal. Order. This is because the configuration of the local controller group (5) can be automatically changed by the automatic change program, and no incident has occurred and the production process has been executed without any problem in the normal control group (5). It is possible to change the network configuration according to the state. Therefore, there is a function of changing a less necessary device such as disconnecting an unused device by changing the network connection configuration of the control system in accordance with a change in the state of the plant accompanying the execution of the production process of the plant system. Therefore, it has the effect of minimizing exposure to cyber attacks on the plant system and preventing human operations.
In the invention 6, the field bus switching device (81) includes a field bus switching means (811) for connecting the local controller group (5) and the field device group (6),
A network configuration change means (812) having an automatic change program (8122) for automatically configuring the network is provided, and the field device monitoring device (82) detects the field device from the communication intercepted by the fieldbus branch device (83). The status of the group (6) is monitored, the timing for changing the connection of the field device group (6) is determined from the information monitored at the normal time, and the network configuration is changed to the network configuration changing means (812). The dynamic zoning plant system (1) according to the invention 1 or 5, characterized in that a change instruction is issued.
According to the sixth aspect of the present invention, the fieldbus switching device (81) of the fieldbus switching system (8) monitors the state of the field device group (6), and no incident has occurred and the production process has been successfully performed. At this time, the network configuration changing means (812) is instructed to change the network configuration. This allows the configuration of the field device group (6) to be automatically changed by the automatic change program, and allows the network configuration to be changed in accordance with the state of the field device group (6) in a normal state. Therefore, there is a function of changing a less necessary device such as disconnecting an unused device by changing the network connection configuration of the control system in accordance with a change in the state of the plant accompanying the execution of the production process of the plant system. Therefore, it has the effect of minimizing exposure to cyber attacks on the plant system and preventing human operations.

FIG. 6 shows a flowchart when the dynamic zoning plant system 1 according to the second embodiment is normal.
First, in S500, the operator activates the dynamic zoning plant system 1. In S501, the operator operates the engineering workstation to define a production process. In S502, the operator operates SCADA and inputs the set value of the field device group 6 via the OPC server. In S503, the operator executes the production process defined earlier, and the dynamic zoning plant system 1 performs production according to the production process. In step S504, the monitoring unit 721 of the local controller group monitoring device 72 monitors the communication and determines that it is in a normal state. In step S505, the normal state switching determination unit 722 of the local controller group monitoring device 72 determines whether or not the network configuration has been changed against the switching condition. If it is determined that it is necessary, a change command is sent to the automatic change program 7122. The process proceeds to S506 (S505: YES), and if not required, the process proceeds to S507 (S505: NO). In S506, the automatic change program 7122 of the LAN switching device 71 changes the connection of the local controller group 5 using the LAN switching means 711 in accordance with the command. In S507, the plant system continues the defined production process regardless of whether the configuration has been changed.
In step S508, the monitoring unit 821 of the field device monitoring apparatus 82 monitors the communication and determines that it is in a normal state. In step S509, the normal state switching determination unit 822 of the field device monitoring apparatus 82 determines whether or not the network configuration has been changed by checking the switching conditions. If it is determined to be necessary, a change command is issued to the automatic change program 8122. The process proceeds to S510 (S509: YES), and if not necessary, the process proceeds to S511 (S509: NO).
In S510, the automatic change program 8122 of the fieldbus switching device 81 changes the connection of the field device group 6 using the fieldbus switching means 811 according to the instruction. In S511, the plant system continues the defined production process regardless of whether the configuration has been changed.

(Example 1 when used)
Hackers dive into the department of the IT system 3 of the dynamic zoning plant system 1 and uploaded malware that destroyed the plant system to the OPC data server. Malware is an example of use in the case where further network information is acquired based on a communication log or the like, and the vulnerability is exploited to invade SCADA inside the control system. The malware sent an irregular command from SCADA to the local controller 54 using the OPC server as a springboard. An irregular command intercepted by the LAN branching device 73 is sent to the local controller group monitoring device 72 and an abnormality is found using the monitoring means. Based on this abnormality, the abnormality switching determination unit 723 uses the network configuration changing unit of the LAN switching device 71 to quickly make the local controller 54 independent of the network. As a result, the spread of the influence of malware can be suppressed.
(Example 2 when using)
This is the case assuming a situation in which many attacks against the plant system have been reported. When such news comes to the ears of the people involved in the dynamic zoning plant system 1, the address and configuration of the engineering workstation, SCADA, OPC server, local controller 54, zone, The connection configuration of the field device group 6 has been changed using the network configuration change means. Because this attack was a type of attack that succeeded by acquiring internal information in advance, changing the address and zone lost sight of the attack target, and the hacker's speculation was lost. This can prevent an attack in advance.
(Example 3 when using)
This is a case where the operator operates SCADA to send a set value to the field device 61 in a normal time. Since the field device 61 does not need to be operated in the subsequent production process, it is disconnected from the network by the automatic change program. As a result, the operator can be prevented from performing the wrong operation, and the possibility of being the target of a hacker attack can be reduced.

1 Plant System 2 Internet 3 IT System 4 Control System 5 Local Controller Group 6 Field Device Group 7 LAN Switching System 8 Fieldbus Switching System 9 Normal State Transition Table 31 External Network 32 First Gateway 33 Demilitarized Zone 34 Internal Network 35 External service server 36 Workstation 37 OPC data server 38 Database server 39 Second gateway 51 Engineering workstation 52 SCADA
53 OPC server 54 Local controller 61 Field device 62 Field bus 71 LAN switching device 72 Local controller group monitoring device 73 LAN branch device 81 Field bus switching device 82 Field device monitoring device 83 Field bus branch device 711 LAN switching means 712 Network configuration changing means 7121 Manual change program 7122 Automatic change program 721 Monitoring means 722 Normal time determination means 723 Abnormal time determination means 724 Warning display means 811 Fieldbus switching means 812 Network configuration change means 8121 Manual change program 8122 Automatic change program 821 Monitoring means 822 Normal time determination Means 823 Abnormal determination means 824 Warning display means

Claims (4)

IT system (3) connected to the Internet,
A control system (4) having a local controller group (5) and a field device group (6) connected to the IT system (3);
In a dynamic zoning plant system (1) having
Between the IT system (3) and the local controller group (5),
A LAN switching device (71) for performing control to dynamically change the network for changing the network configuration of the local controller group (5);
A local controller group monitoring device (72) for monitoring communication of the local controller group (5);
A LAN branching device (73) for intercepting communication of the local controller group (5);
A LAN switching system (7) for dynamically changing the network configuration of the local controller group (5),
In the field bus (62) between the local controller group (5) and the field device group (6),
A fieldbus switching device (81) for performing dynamic network change for changing the network configuration of the field device group (6);
A field device monitoring device (82) for monitoring communication of the field device group (6);
A fieldbus branching device (83) for intercepting communication of the field device group (6);
A fieldbus switching system (8) that dynamically changes a network configuration connecting the local controller group (5) and the field device group (6),
Dynamic zoning comprising either the LAN switching system (7) or the fieldbus switching system (8) capable of changing the network configuration of the plant manually or automatically even during operation of the plant Plant system (1). The LAN switching device (71)
LAN switching means (711) for connecting the local controller group (5);
Network configuration change means (712) having an automatic change program (7122) for automatically performing network configuration,
The local controller group monitoring device (72)
From the communication intercepted by the LAN branching device (73),
Monitoring the state of the local controller group (5);
When an abnormality occurs,
For the network configuration changing means (712),
The dynamic zoning plant system (1) according to claim 1, characterized in that an instruction to change the network configuration is issued. The fieldbus switching device (81)
Field bus switching means (811) for connecting the local controller group (5) and the field device group (6);
Network configuration change means (812) having an automatic change program (8122) for automatically configuring the network;
The field device monitoring device (82)
From the communication intercepted by the fieldbus branch device (83),
Monitoring the state of the field device group (6),
When an abnormality occurs,
For the network configuration changing means (812),
The dynamic zoning plant system (1) according to claim 1 or 2, characterized in that an instruction to change the network configuration is issued. The local controller group monitoring device (72) and the field device monitoring device (82) each have a normal state transition table (9) and make an abnormality determination. The dynamic zoning plant system (1) described in any one.