WO2020039705A1

WO2020039705A1 - Communication relay device

Info

Publication number: WO2020039705A1
Application number: PCT/JP2019/023219
Authority: WO
Inventors: 寛岩澤; 遠藤　浩通
Original assignee: 株式会社日立製作所
Priority date: 2018-08-23
Filing date: 2019-06-12
Publication date: 2020-02-27
Also published as: JP2020031342A

Abstract

A communication relay device according to one aspect of the present invention includes: a plurality of buffer units 121, 122 which sequentially store and output a plurality of elements in a communication frame transmitted from a first communication device 2, and in which combinations of the number of elements of an operation unit and operation speeds are different; a plurality of comparison units 131, 132 which are respectively provided to the buffer units 121, 133, and compare elements corresponding to the number of elements of the buffer unit with a passing condition of the buffer unit; a changing unit 15 which sequentially transmits the plurality of elements, and, when the elements corresponding to the number of elements in either of the comparison units do not meet the passing condition, changes elements corresponding to a first area in the communication frame; and a transmission unit which sequentially transmits, to a second communication device, a plurality of elements transmitted from the changing unit.

Description

Communication relay device

<< The present invention relates to a communication relay device.

制御 A control system that controls facilities such as plants and assembly equipment must maintain safe and stable operation. On the other hand, there is a case where data with incorrect contents is transmitted via the control system network with the intention of inhibiting the operation of the control device or performing an erroneous operation. As a countermeasure, there is known a method of connecting a device to be protected to a control system network via a firewall or an IPS (Intrusion Protection System) having the ability to block such unauthorized communication.

Japanese Patent Application Laid-Open No. H11-163873 describes "a determination unit that determines a feature value indicating a feature of a received communication frame, determines whether the feature value satisfies a condition, and sequentially transmits a plurality of elements to be received. Is determined to not satisfy the condition, a change unit that changes a part of a plurality of elements to be transmitted ”is disclosed. This communication relay device has a configuration to detect unauthorized communication using a buffer, and when an unauthorized communication is received, a part of a plurality of elements of a communication frame is changed and sequentially transmitted to an external device. In addition, an unauthorized communication can be detected with a small delay time.

JP 2015-119386 A

However, the communication relay device described in Patent Literature 1 can suppress the delay due to the relay of the communication frame, while the internal buffer stores the communication speed of the input communication frame (for example, 100 MHz in the case of a 100 Mbps network). It is made to work with. Therefore, as described later, the power consumption of the relay process is not always optimized.

から Under the circumstances described above, there has been a demand for a communication relay device that can reduce power consumption while coping with various types of unauthorized communication.

A communication relay device according to an aspect of the present invention includes a receiving unit that sequentially receives a plurality of elements in a communication frame transmitted from a first communication device, and sequentially stores a plurality of elements in the communication frame received by the receiving unit. A plurality of buffer units having different combinations of the number of elements in the operation unit and the operation speed to be output, and a plurality of buffer units provided for each of the buffer units and comparing the elements corresponding to the number of elements of the buffer unit with the passage conditions of the buffer unit. And a comparing unit. In addition, the communication relay device transmits a plurality of elements in order, and changes the element corresponding to the first area in the communication frame when any of the comparison units does not satisfy the passing condition. The communication device includes a changing unit, and a transmitting unit that sequentially transmits a plurality of elements transmitted from the changing unit to the second communication device.

According to at least one embodiment of the present invention, power consumption can be reduced while coping with various types of unauthorized communication.
Problems, configurations, and effects other than those described above will be apparent from the following description of the embodiments.

FIG. 1 is a diagram illustrating a configuration example of an entire control system including a communication relay device according to a first embodiment of the present invention. FIG. 2 is a block diagram illustrating an example of an internal configuration of the communication relay device according to the first embodiment of the present invention. It is a figure showing the example of the format of a communication frame. FIG. 11 is a block diagram illustrating a schematic configuration example of a communication relay device according to a second embodiment of the present invention. FIG. 4 is a block diagram illustrating a hardware configuration example of a computer included in the communication relay device.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the specification and the accompanying drawings, components having substantially the same function or configuration are denoted by the same reference numerals, and redundant description will be omitted.

<First embodiment>
[Overall configuration of control system]
First, the configuration of the entire control system including the communication relay device according to the first embodiment will be described. FIG. 1 is a diagram illustrating a configuration example of an entire control system including a communication relay device 1 according to the first embodiment.

As illustrated in FIG. 1, the control system includes, as an example, a firewall 21, a terminal device 22, a production management server 23, an HMI (Human Machine Interface) device 24, a monitoring control server 25, the communication relay device 1, It comprises a control device 26 and a control target facility 27. These are communicably connected to each other to form a hierarchical network.

The control target equipment 27 is connected to the control device 26. The control device 26 is further connected to the communication relay device 1. The communication relay device 1 is further connected to the monitoring control server 25 via the control system network 3. The monitoring control server 25 is further connected to the HMI device 24 and the production management server 23 via a control system information network 33. The production management server 23 is further connected to the terminal device 22 and the firewall 21 via the information network 32. The firewall 21 is further connected to an external network 31 such as the Internet.

The firewall 21 relays communication between the information network 32 and the external network 31 and prevents unauthorized access from the external network 31 to the information network 32.

The production management server 23 determines plan values such as a plant production target and a production number instruction, and transmits the plan values to the monitoring control server 25. The terminal device 22 accesses the production management server 23 via the information network 32, thereby inputting information relating to the plan value to the production management server 23, and displaying information such as results output from the production management server 23. . Thus, the administrator of the terminal device 22 can monitor the performance of the control system.

The monitoring control server 25 determines the command value of the control target equipment 27 based on the plan value received from the production management server 23, and sends the command value to the control device 26 via the control system network 3 and the communication relay device 1. Send. The HMI device 24 accesses the monitoring control server 25 via the control information network 33 to input information relating to command values to the monitoring control server 25 and display information such as a state output from the monitoring control server 25. I do. Thereby, the administrator of the HMI device 24 can monitor the state of the control target facility 27.

The control device 26 controls the control target equipment 27 based on the command value received from the monitoring control server 25. The control target equipment 27 is a switch, a valve, a sensor, and the like. The command value is, for example, the opening / closing or opening of a switch or valve. The state is, for example, a pressure, a temperature, a rotation speed, or the like measured by a sensor.

[Differences between unauthorized communication types and detection methods]
The communication relay device 1 has not only a function of merely relaying communication, but also has a capability of detecting and blocking unauthorized communication transmitted from the control system network 3. There are various types of unauthorized communication, but from the viewpoint of an appropriate detection method, communication contents are roughly divided into two types. The first one has a characteristic pattern in an area divided by a fixed bit length such as an octet (8 bits) unit such as a communication destination address and a port number. The second one is a binary format, such as a communication including malware, which does not have a fixed bit string delimiter and has a characteristic pattern in a bit string at an arbitrary position. For the former and the latter, it is sufficient to check the pattern of, for example, 8 bits each in order to detect the former, whereas in order to detect the latter, it is necessary to check the pattern of the communication frame one bit at a time. There is a difference that you need to do.

[Configuration of communication relay device]
Next, details of the communication relay device 1 will be described. FIG. 2 is a block diagram illustrating an example of the internal configuration of the communication relay device 1.

The communication relay device 1 includes an upstream communication port 11 connected to the first communication device 2 via the control system network 3 and a downstream communication port 16 connected to the second communication device 4 to be protected. The communication relay device 1 may include a plurality of downstream communication ports 16 so that a plurality of second communication devices 4 can be connected to the communication relay device 1. The first communication device 2 is, for example, the monitoring control server 25. The second communication device 4 is, for example, the control device 26. The communication relay device 1 further includes a multi-bit width buffer 121, a multi-bit width feature value comparison unit 131, a single bit width buffer 122, a single bit width feature value comparison unit 132, a replacement unit 15, and a feature value setting interface. 17 and a feature value definition unit 18.

The upstream communication port 11 (an example of a receiving unit) receives a signal indicating a communication frame input from the first communication device 2 via the control system network 3, and converts the received signal into a data sequence (relay data sequence). And sequentially output them. This data string includes a plurality of continuous elements. The element is, for example, a bit. The data string is input to two types of buffers, that is, a multi-bit width buffer 121 and a single-bit width buffer 122.

In the present embodiment, a communication frame on the control system network 3 and a data string output from the upstream communication port 11 are based on the IEEE802.3 format. However, these may be based on any other communication standard. Good. The transmission medium of the control system network 3 may be light, radio waves, or any combination thereof in addition to electricity. The upstream communication port 11 may be a NIC (Network Interface Card).

The multi-bit width buffer 121 (an example of a buffer unit) sequentially stores and outputs a plurality of bits in a communication frame received by the upstream communication port 11. For example, the multi-bit width buffer 121 includes a shift register having a bit width of 8 bits (the number of bits of a shift operation unit) and a finite length (the number of shift stages is three in FIG. 2) as the number of elements. The bit width is the number of bits of a shift operation unit of the shift register. The 8-bit wide and 3-stage shift register stores a data string continuously input from the input terminal in 8 bits per stage, and shifts the data sequence to the next stage (right in the figure) in 8-bit units according to the drive clock signal. The output operation is performed from the output terminal to the replacement unit 15 in the order of input. By providing such a multi-bit width buffer 121, each bit in the data sequence is transmitted at a fixed time after being received by the communication relay device 1. As will be described later, using the multi-bit width buffer 121, matching of the matching pattern is performed on the communication frame in units of 8 bits.

Similarly, the single bit width buffer 122 (an example of a buffer unit) sequentially stores and outputs a plurality of bits in the communication frame received by the upstream communication port 11. For example, the single bit width buffer 122 includes a shift register having a bit width of 1 bit and a finite length (the number of shift stages is 12 in FIG. 2) as the number of elements. The 1-bit wide and 12-stage shift register stores a data string continuously input from the input terminal at one bit per stage, and shifts the data sequence to the next stage (right in the figure) in 1-bit units according to the drive clock signal. An operation of outputting (discarding) from the output end in the order of input is performed. As will be described later, using the single-bit width buffer 122, matching of the matching pattern is performed on the communication frame one bit at a time.

By these operations, the data string received by each buffer is held in each buffer for a certain period proportional to the product of the number of bits (bit width) and the operation speed (operation frequency) of the operation unit of each buffer. . That is, the multi-bit width buffer 121 and the single-bit width buffer 122 are configured to have the same or substantially the same product of the bit width and the operation speed, although the combination of the bit width and the operation speed is different.

For example, when the band (communication speed) of a signal input to the upstream communication port 11 is 100 Mbps (Mega bit per second), the shift operation speed in the 8-bit wide multi-bit buffer 121 is 12.5 MHz, The speed of the shift operation in the width buffer 122 is 100 MHz. The difference in the speed of the shift operation causes a difference in power consumption described later. Note that these buffers may be configured using a technique such as a dual port memory or a FIFO buffer in addition to the shift register.

[Feature value comparison unit]
Next, operations of the multi-bit width feature value comparison unit 131 and the single bit width feature value comparison unit 132 will be described. The multi-bit width feature value comparison unit 131 and the single bit width feature value comparison unit 132 are provided for each buffer, and perform a process of comparing a bit string corresponding to the bit width of the buffer with the passage condition of each buffer unit.

The multi-bit width feature value comparison unit 131 has an element for storing the multi-bit width matching pattern 141 therein. The single-bit width feature value comparison unit 132 has an element that stores the single-bit width matching pattern 142 therein.

The multi-bit width feature value comparison unit 131 collates, for example, the data string held in the second stage of the multi-bit width buffer 121 with the multi-bit width matching pattern 141. Output a match signal. The multi-bit width feature value comparison unit 131 uses the multi-bit width buffer 121 that shifts the data sequence by 8 bits, and checks the matching pattern of the communication frame by 8 bits.

Similarly, the single-bit width feature value comparison unit 132 compares the data string held in the third to tenth stages of the single-bit width buffer 122 with the single-bit width matching pattern 142, and when both match, for example. Outputs a match signal to the replacement unit 15. The single-bit width feature value comparison unit 132 uses the single-bit width buffer 122 that shifts the data string one bit at a time, and checks the matching pattern of the communication frame one bit at a time.

The replacing unit 15 (an example of a changing unit) receives the data string output from the multi-bit width buffer 121, transmits the data string to the downstream communication port 16, and, in accordance with the comparison result of each of the characteristic

value comparing units

131 and 132, Rewrite some elements of the data string to be transmitted to the specified values. Details of the operation of the replacement unit 15 will be described later.

The downstream communication port 16 (an example of a transmission unit) converts the data string transmitted from the replacement unit 15 into a signal suitable for communication with an external device or a network again, and transmits the signal to the second communication device 4. In the present embodiment, similarly to the upstream communication port 11, the data string to be transmitted and the data string output from the upstream communication port 11 are based on the IEEE802.3 format, but any communication standard may be used. The downstream communication port 16 may be a NIC.

[Details of communication frame and operation of replacement unit]
In the present embodiment, the communication frame on the control system network 3 is based on the IEEE802.3 format. Here, a communication frame based on the IEEE802.3 format will be described with reference to FIG.

(Communication frame)
FIG. 3 shows an example of the format of a communication frame. A communication frame based on the IEEE802.3 format includes a preamble section, a header section, a payload section, and each field (area) of an FCS (Frame Check Sequence) section. The end of the preamble part is SFD (Start Frame Delimiter), which indicates the start of the header. When detecting the SFD from the received signal, the upstream communication port 11 outputs a frame start signal indicating the reception timing. The frame start signal is a reference for the timing (position in the communication frame) at which the replacement unit 15 changes the information of the FCS unit in the communication frame. The upstream communication port 11 may directly supply the frame start signal to the replacement unit 15 or may supply the frame start signal to the replacement unit 15 via the feature

value comparison units

131 and 132.

The header section contains the destination address, source address, and type / length subfields, and is used to correctly deliver the packet to the destination. The payload portion is the content (body) of the data to be transmitted. The FCS section (an example of the first area) is an area for error detection in which an error check code for checking whether or not the IEEE 802.3 frame has a transmission error in the receiving device is stored. The FCS value is calculated by CRC (Cyclic Redundancy Check) from the contents of the header and the payload, and is, for example, 32 bits.

(4) The upstream communication port 11 recognizes the start timing of the header by detecting the SFD from the communication frame. The replacement unit 15 recognizes the length of the payload by detecting the type / length, and recognizes the timing (the position in the communication frame) of the FCS unit. Note that the upstream communication port 11 or each of the characteristic

value comparison units

131 and 132 may perform a process of detecting the type / length.

(4) The device receiving the communication frame checks the FCS value included in the communication frame, and discards the communication frame if the value does not match the expected value. With this mechanism, when the content of the communication frame changes due to unauthorized communication, noise, or the like, it is possible to prevent the incorrect value from being used for control or the like.

[Replacement part]
The operation of the replacement unit 15 will be described based on the above contents. The replacement unit 15 sequentially receives the 8-bit data string output from the multi-bit width buffer 121 and sequentially transmits the 8-bit data string to the downstream communication port 16 as it is in normal times. However, if the data string having the predetermined bit width does not satisfy the passing condition in any of the characteristic

value comparing units

131 and 132, the replacing unit 15 changes the information of the FCS unit in the communication frame. That is, when the match signal is received from either the multi-bit width feature value comparison unit 131 or the single bit width feature value comparison unit 132 (hereinafter, referred to as “when the feature value matches”), the replacement unit 15 The value of the FCS part in is inverted or rewritten to an invalid value. The invalid value is, for example, 0. For fields other than the FCS section, the input values are output as they are.

The second communication device 4 receives the communication frame through the downstream communication port 16 of the communication relay device 1, and checks the FCS from the contents of the header and the payload. At this time, when the feature value matches, the value of the FCS part has been rewritten to an invalid value, so the received FCS value and the verified FCS value are different, and the communication frame is discarded. With this operation, when the second communication device 4 is the control device 26, an influence that the control device 26 is infected with malware by an unauthorized communication frame or causes an abnormal operation due to communication through an unauthorized port. Can be prevented. Therefore, even if the communication frame is harmful to the control device 26, it is possible to prevent the control capability of the control device 26 from being impaired.

(4) In the communication frame, the replacement target by the replacement unit 15 may be a part other than the FCS part, such as data of a specific area in the payload part. Even when the format of the communication frame is other than IEEE802.3, it is expected that a field holding an error detection code of the communication frame or a specific value in the format of the communication frame is set. By making fields and the like to be rewritten, the same effect as FCS can be expected.

において In the communication frame, the bit string to be rewritten is preferably located after the bit string to be compared with the matching pattern. Thus, the bit string to be rewritten can be rewritten after the bit string to be collated has passed through each buffer. In addition, as a method of changing the information of the FCS unit, the replacement unit 15 may output a predetermined addition value and add the addition value to the FCS unit.

[Feature value setting and updating]
Next, operations of the feature value setting interface 17 and the feature value definition unit 18 will be described.
The feature value setting interface 17 is configured to receive feature value information related to communication contents to be cut off by communication from an external device such as a personal computer, and write the feature value information to the feature value definition unit 18.

The feature value definition unit 18 is configured by a storage element such as a RAM, and has a function of transferring feature value information to the multi-bit width matching pattern 141 and the single bit width matching pattern 142. By this operation, the setting (matching pattern) of the communication content to be cut off by the communication relay device 1 can be updated, and the latest threat can be dealt with.

The specific implementation of the feature value setting interface 17 may be an independent format such as a serial port, or may be integrated with the upstream communication port 11 and update the feature value via the control system network 3. Is also good.

[Effect of First Embodiment]
In the first embodiment configured as described above, each buffer and feature are determined according to the granularity of the matching pattern (unit of comparison processing), as compared with the case where the buffer and the feature value comparison unit are configured with only a single bit width. The operating speed (operating frequency) of the value comparing unit can be optimized. For example, detection of a binary signature (a pattern characteristic of malware) requires bit-by-bit matching. On the other hand, in detecting a pattern (for example, a word) that can specify an appearance position on a communication frame in multi-bit units such as a port number, it is sufficient to perform matching in the multi-bit unit, which is suitable for detecting illegal communication. Implementation format is different. Therefore, the first embodiment can reduce power consumption while coping with various types of unauthorized communication.

For example, when the input signal is 100 Mbps, in the conventional method, it is necessary to operate all the buffers and the feature value comparison unit at 100 MHz. In contrast, in the communication relay device 1 of the present embodiment, as described above, the single-bit width buffer 122 and the single-bit width feature value comparison unit 132 need to operate at 100 MHz, The corresponding multi-bit width buffer 121 and multi-bit width feature value comparison unit 131 need only operate at an operating frequency of 12.5 MHz, which is 1/8 of that. For example, when the collation bit position of the communication frame is a multiple of 4 or 8, the collation is performed by the multi-bit width buffer 121 and the multi-bit width feature value comparison unit 131.

(4) Since power consumption of a circuit is generally proportional to the operating frequency, when a circuit having an operating frequency of 1/8 is included, power consumption can be reduced as compared to operating all circuits at 100 MHz. Reduction of power consumption leads to simplification of a heat dissipation structure and the like, which also contributes to cost reduction of the communication relay device 1. That is, by providing the multi-bit width buffer 121, the operating frequency can be lower than that of the single-bit width buffer 122, so that a low-cost communication relay device with low power consumption and small circuit size can be realized.

とする Assume that there are 10 matching patterns to be determined for a certain communication frame, of which 5 are 8-bit width matching patterns and 5 are 1-bit width matching patterns. Conventionally, since the determination of 10 patterns including the 8-bit width and the 1-bit width is all performed by the single-bit width buffer 122 and the single-bit width feature value comparison unit 132, power consumption increases. However, in the present embodiment, the multi-bit width buffer 121 and the multi-bit width feature value comparison unit 131 for 8-bit width compare five 8-bit width matching patterns and perform the single-bit width buffer for 1-bit width. The comparison processing of the remaining five 1-bit width matching patterns is performed by the 122 and the single bit width feature value comparison unit 132. As described above, by optimizing the buffer for performing the comparison process and the feature value comparison unit according to the bit width of the matching pattern to be determined, it is possible to significantly reduce power consumption.

Further, in the present embodiment, the single-bit width buffer 122 only notifies the comparison result from the single-bit width feature value comparison unit 132 to the replacement unit 15, and the multi-bit width buffer 121 is input from the upstream communication port 11. The data sequence in the communication frame is output to the replacing unit 15 in order. As described above, by using the multi-bit width buffer 121 having a larger bit width for relaying the bit string of the communication frame, the power consumption required for relaying the bit string can be reduced as compared with the case where the single bit width buffer 122 is used.

According to the present embodiment, it is possible to provide a security measure capability with low power consumption at least after the existing control system. Therefore, it is possible to meet the demand for security measures accompanying extension and improvement of the life of an existing plant.

When the second communication device 4 is the control device 26, a function of calculating and determining the characteristic value of the communication frame is added to the control device 26, and the function is realized using the limited processing capability of the control device 26. It is difficult. By adding the communication relay device 1 of the present embodiment to the outside of the control device 26, it is possible to prevent attacks on the control device 26 without changing the control device 26 and without increasing the load on the control device 26. Can be.

A person who intends to attack the control device 26 may continuously search for design or implementation deficiencies (vulnerabilities) in the control device 26 to be attacked, and apply a new attack method that exploits them. There is. In a control system such as an infrastructure that is required to operate for a long period of time, it is desirable that a defense measure against a new attack method can be continuously added during the operation period. Since it is difficult to stop the control device 26 while the control system is operating, it is difficult to modify the program of the control device 26 or apply a patch (modification program). According to the present embodiment, by setting the feature value extraction rule and the passage condition in the communication relay device 1, it is possible to cope with a new attack technique without stopping the operation of the control system.

By the way, the relay device using the store-and-forward scheme receives and stores all communication frames, determines whether to pass or discard the communication frame, and transmits only the communication frame determined to be passed. That is, the relay device does not start transmitting the communication frame until the determination is completed. Therefore, the relay delay time varies depending on the length of the communication frame and the like.

On the other hand, the communication relay device 1 receives each bit of the communication frame, inputs the bit to each buffer, passes each buffer, determines whether or not the communication frame is normal based on the partial data being passed. Some bits of the communication frame are rewritten, and each bit is transmitted in the order of reception. That is, the communication relay device 1 relays a plurality of communication frames received continuously to the second communication device 4 with a fixed delay time regardless of the length of the communication frame and the determination result of the communication frame. In the control system, since the communication frame is transmitted in a short cycle, the relay delay time is preferably constant.

(4) Further, by calculating a part of the data string while the communication frame passes through each buffer and comparing the calculated data stream with a predetermined passing condition, it is possible to determine whether the relay of the communication frame is valid or invalid. As a result of the determination, when the relay of the communication frame is determined to be invalid, even if the transmission of the head of the communication frame is started by the downstream communication port 16, the FCS part at the end of the communication frame is rewritten. The second communication device 4 can invalidate the reception of the communication frame and discard it. As a result, the communication frame can be cut off without increasing the relay delay time.

<Modification of First Embodiment>
In the first embodiment, in order to simplify the description, the case where the applied feature value (bit string pattern) is one for each of the multi-bit width and the single-bit width has been described. The quantities may be adapted for each bit width. Generally, illegal patterns to be blocked are diversifying, and it is necessary to be able to cope with various patterns.

Further, in the present embodiment, the case where one set of the multi-bit width buffer and the multi-bit width feature value comparison unit and one set of the single bit width buffer and the single bit width feature value comparison unit are provided is described. Not limited to A plurality of circuits each corresponding to a multi-bit width and a single-bit width may be provided. According to the present invention, the bit width of at least one of the buffers and the feature value comparison units is one, and the bit width of the at least one of the buffers and the feature value comparison units is one. It suffices if it is 2 or more. For example, when a 4-bit width buffer is used as the multi-bit width buffer 121, the power consumption is reduced to about 1/4 as compared with a single-bit width buffer, and a 4-bit standard MII (media-independent interface) is used. Since it is compatible with the interface, a conversion circuit is not required. In the case of a configuration corresponding to a 4-bit width, the operating frequency is 25 MHz.

Also, in the present embodiment, the so-called blacklist system in which a communication frame including the feature value is cut off when the feature value matches any of the held feature values has been described, but the present invention is not limited to this example. The communication relay device 1 is implemented in a so-called whitelist method, that is, a method in which a communication frame including the feature value is passed only when all of the retained feature values are matched, and all other frames are blocked. Is also good.

In the case of the blacklist method, the passing condition is a matching pattern (a first pattern) in which an element corresponding to the number of elements in the buffer (a bit string corresponding to the bit width of the buffer) represents an unauthorized communication composed of elements having the number of elements. ). The feature value comparison unit outputs a match signal when a data string that matches the first pattern exists in the communication pattern. Then, upon receiving the match signal from any of the feature value comparison units, the replacement unit 15 rewrites the value of the FCS unit in the communication frame. In the case of such a configuration, it is possible to perform good matching on a communication frame that is appropriate to perform matching using the blacklist method.

In the case of the whitelist method, the pass condition is a matching pattern (bit string corresponding to the bit width of the buffer) indicating that the element corresponding to the number of elements of the buffer is not an unauthorized communication composed of the elements of the number of elements. 2 pattern). The feature value comparison unit determines whether or not all data strings to be matched in the communication pattern match the second pattern, and notifies the replacement unit 15 of the determination result. When any of the feature value comparison units determines that there is a data string that does not match the second pattern, the replacement unit 15 replaces the value of the FCS unit in the communication frame with the data string. rewrite. In the case of such a configuration, it is possible to perform good matching on a communication frame that is appropriate to be matched by the whitelist method.

The control system network 3 is characterized in that communication frames having the same format and the same length are transmitted at a constant period. The communication frame in such a case is, for example, one in which only the value of the fixed length in the payload changes, or one which indicates ON or OFF of the switch. In such a case, the passage condition may use the reception time of the communication frame. When the frame reception interval, which is the difference between the frame reception times of two consecutive communication frames, is used as the feature value, the passing condition is that the frame reception interval is within a predetermined time range. Each of the modifications described above is also applicable to the second embodiment.

<Second embodiment>
In the first embodiment, the second communication device 4 can be protected from unauthorized communication coming from the control system network 3. However, actually, a case is considered in which the second communication device 4 is attacked by malware infection or the like on a route other than the control system network 3 and sends out unauthorized communication from the second communication device 4 to the control system network 3. Can be For example, as the unauthorized communication from inside the control system network 3, it is conceivable that the unauthorized communication is transmitted to the control system network 3 via the USB memory attached to the control device 26. As a countermeasure against such a case, it is required to extend the communication transmission direction in both directions so as to prevent illegal communication from propagating in the opposite direction to the first embodiment. In the second embodiment, a communication relay device that prevents illegal communication from propagating in the opposite direction to the first embodiment will be described.

FIG. 4 is a block diagram illustrating a schematic configuration example of a communication relay device 1A according to the second embodiment. The communication relay device 1A includes two relay units, a first relay unit 40a and a second relay unit 40b. The path of the communication frame transmitted from the control system network 3 to the second communication device 4 (referred to as “down” for convenience) and the path of the communication frame transmitted from the second communication device 4 to the control system network 3 ( For convenience, the first relay unit 40a and the second relay unit 40b are inserted into “up”. The first relay unit 40a relays a downstream communication frame, and the second relay unit 40b relays an upstream communication frame. Each of the first relay unit 40a and the second relay unit 40b has the same configuration as the communication relay device 1 described in the first embodiment.

As in the first embodiment, of the communication frames transmitted in the downstream direction from the first communication device 2, the communication frames in which the value of the FCS field is replaced with an invalid value by the first relay unit 40 a are the second communication devices 4. Discarded by Similarly, among the communication frames transmitted in the upward direction from the second communication device 4, the communication frame in which the value of the FCS field is replaced with an invalid value by the second relay unit 40 b has, for example, a destination of the first communication device 2. If there is, it is discarded by the first communication device 2. Accordingly, in addition to the function of protecting the second communication device 4 from the downlink, that is, the unauthorized communication coming from the control system network 3, the function of protecting the second communication device 4 from the uplink, that is, the unauthorized communication sent from the second communication device 4 A function of protecting the device connected to the third device can be realized.

At this time, the first relay unit 40a and the second relay unit 40b can set different matching patterns respectively. That is, the multi-bit width matching pattern 141 may be different between the first relay unit 40a and the second relay unit 40b. Similarly, the single bit width matching pattern 142 may be different patterns in the first relay unit 40a and the second relay unit 40b. Thereby, different matching patterns (passing conditions) can be defined for the up route and the down route. In this case, flexible measures can be taken according to the tendency of the threat on each of the up route and the down route.

Note that the upstream communication port 11 in the first relay unit 40a and the downstream communication port 16 in the second relay unit 40b may be one communication port, and the upstream communication port 11 in the second relay unit 40b and the The downstream communication port 16 in one relay section 40a may be one communication port. Further, the first relay section 40a and the second relay section 40b may be provided in different housings.

The feature value setting interface 17 and the feature value definition unit 18 (see FIG. 2) may be shared by the first relay unit 40a and the second relay unit 40b. That is, the first relay unit 40a and the second relay unit 40b do not include the feature value setting interface 17 and the feature value definition unit 18. The administrator transfers the feature values (multi-bit width matching pattern, single bit width matching pattern) via the feature value setting interface 17 and the feature value definition unit 18 of the communication relay device 1A to the first relay unit 40a and the second relay unit. 40b is set individually or all at once. In the communication relay device 1A, by using a common feature value for the downstream route and the upstream route, the number of steps for setting the feature value can be reduced as compared with a case where different feature values are used for the downstream route and the upstream route.

The operations of the

communication relay apparatuses

1 and 1A according to the first and second embodiments described above may be performed by hardware or may be performed by software. FIG. 5 is a block diagram illustrating an example of a hardware configuration of a computer 50 included in the

communication relay apparatuses

1 and 1A when the communication is performed by software. The hardware configuration of the computer 50 of the first relay unit 40a and the second relay unit 40b of the communication relay device 1A can be the same as that of the communication relay device 1.

The computer 50 includes a CPU (Central Processing Unit) 51, a ROM (Read Only Memory) 52, a RAM (Random Access Memory) 53, a nonvolatile storage 55, a first communication interface 56, and a second communication interface 57. Each unit in the communication relay device 1 is connected to each other via a system bus 54 so as to be able to transmit and receive data to and from each other.

(4) The CPU 51, the ROM 52, and the RAM 53 form a control unit. This control unit controls the operation of the entire communication relay device 1 or each unit in the communication relay device 1A. The CPU 51 reads out a program code of software for realizing each function according to each of the above-described embodiments from the ROM 52, executes the program code, and controls each unit and performs various calculations. Note that, instead of the CPU 51, another arithmetic processing device such as an MPU (Micro Processing Unit) may be used.

The ROM 52 is used as an example of a non-volatile memory (recording medium). The ROM 52 stores programs, data, and the like necessary for the operation of the CPU 51. The RAM 53 is used as an example of a volatile memory, and temporarily stores variables, parameters, and the like generated during the arithmetic processing by the CPU 51.

The non-volatile storage 55 is an example of a recording medium, and can store information such as programs executed by the CPU 51, programs such as an OS (Operating System), tables, and files. For the non-volatile storage 55, for example, a recording device such as a semiconductor memory, a hard disk, a solid state drive (SSD), or a magnetism or light can be used. Note that the program may be provided via a wired or wireless transmission medium such as a local area network (LAN), the Internet, or digital satellite broadcasting.

For example, an NIC or a modem is used as the first communication interface 56, and various data can be transmitted and received to and from an external device via a network such as a LAN to which terminals are connected or a dedicated line. It is configured. For example, the first communication interface 56 corresponds to the upstream communication port 11.

For example, an NIC or a modem is used as the second communication interface 57, and various data can be transmitted / received to / from an external device via a network such as a LAN to which a terminal is connected or a dedicated line. It is configured. For example, the second communication interface 57 corresponds to the downstream communication port 16.

The computer 50 may be provided with a display unit and an operation unit so that the observer can check the content displayed on the display unit and input necessary information through the operation unit. The display unit is, for example, a liquid crystal display monitor, and displays a GUI screen, a result of processing performed by the CPU 51, and the like. For the operation unit, for example, a pointing device such as a mouse or a touch panel, a keyboard, or the like is used. The observer can perform a predetermined operation on the operation unit and input an instruction. The operation unit generates an input signal according to the operation of the monitor and supplies the input signal to the CPU 51.

Further, the present invention is not limited to the above-described embodiments, and it goes without saying that various other applied examples and modified examples can be adopted without departing from the gist of the present invention described in the claims. .

For example, in the above-described embodiment, the configuration of the communication relay device is described in detail and specifically in order to easily explain the present invention, and is not necessarily limited to a configuration including all the described components. Further, a part of the configuration of one embodiment can be replaced with the component of another embodiment. It is also possible to add components of another embodiment to the configuration of one embodiment. Further, it is also possible to add, delete, or replace other components with respect to a part of the configuration of each embodiment.

The components, functions, processing units, and the like described above may be partially or entirely realized by hardware, for example, by designing an integrated circuit. Further, the processing performed by a certain processing unit may be realized by one piece of hardware, or may be realized by distributed processing by a plurality of pieces of hardware.

In addition, in the above-described embodiment, the control lines and the information lines are considered to be necessary for the explanation, and do not necessarily indicate all the control lines and the information lines on the product. In fact, it can be considered that almost all components are connected to each other.

1, 1A: communication relay device, # 2: first communication device, # 3: control system network, # 4: second communication device, # 11: upstream communication port, # 15: replacement unit, # 16: downstream communication port, # 18: feature value definition , # 40a: first relay unit, # 40b: second relay unit, # 121: multi-bit width buffer, # 122: single bit width buffer, # 131: multi-bit width feature value comparison unit, # 132: single bit width feature value comparison unit 141: Multi-bit width matching pattern, # 142: Single-bit width matching pattern

Claims

A receiving unit that sequentially receives a plurality of elements in a communication frame transmitted from the first communication device;
A plurality of buffer units that sequentially store and output a plurality of elements in the communication frame received by the receiving unit, and a combination of the number of elements of an operation unit and an operation speed are different,
A plurality of comparing units provided for each of the buffer units, and comparing an element corresponding to the number of elements of the buffer unit with a passage condition of the buffer unit;
A transmitting unit that sequentially transmits the plurality of elements, and a changing unit that changes an element corresponding to a first area in the communication frame when an element corresponding to the number of elements does not satisfy the passage condition in any of the comparing units. ,
A transmission unit that sequentially transmits the plurality of elements transmitted from the change unit to the second communication device.
The communication relay device according to claim 1, wherein a product of the number of elements of each of the operation units and the operation speed in the plurality of buffer units has the same or substantially the same value.
The communication relay device according to claim 2, wherein the number of elements of at least one buffer unit among the plurality of buffer units is one, and the number of elements of at least one buffer unit is two or more.
The communication relay device according to claim 2, wherein a buffer unit having a larger number of elements among the plurality of buffer units sequentially outputs a plurality of elements in the communication frame input from the receiving unit to the change unit.
The communication relay device according to claim 2, wherein each of the buffer units includes a shift register.
The communication relay device according to claim 2, wherein an element corresponding to the first area in the communication frame is an error check code.
The passing condition is that an element corresponding to the number of elements of the buffer unit matches a matching pattern indicating that the communication is not an unauthorized communication composed of the number of elements. 7. If the element corresponding to the number of elements does not match the matching pattern, the changing unit changes the element corresponding to the first area in the communication frame. A communication relay device according to claim 1.