JP2017215788A - Control apparatus and control system - Google Patents

Abstract

[PROBLEMS] To achieve both security and functional safety, and maintain availability as a control system even when subjected to a denial of service attack. As a security function part of a control device having a security function and a safety function based on black channel diagnosis, the presence or absence of a denial-of-service attack is determined, and when a denial-of-service attack is detected, it is received by the communication interface unit of the control device In accordance with the instruction from the determination unit and the determination unit for instructing the security treatment unit to attach the blocking information data indicating that the reception restriction is performed and the transmission from the safety processing unit at the time of transmission A security processing unit is provided that includes a security processing unit that replaces the return data for feedback diagnosis that is included in the data received from the external device and is sent back to the external device with respect to the data. [Selection] Figure 2

Description

  Embodiments described herein relate generally to a control device and a control system.

  In recent years, a control system that controls a plant or the like is required to have a system that has both security for an attack from the outside via a network and functional safety for a failure. Regarding functional safety, as a conventional technique, there is known a technique based on feedback diagnosis for confirming communication integrity by sending back data transmitted to a communication partner device from the partner device and confirming correct arrival of data. . As for security, the number of received packets is monitored against a DoS (Denial of Service) attack, which is a typical denial of service attack technique for control systems, and if the number of packets exceeds a certain value. A DoS attack countermeasure is known in which a DoS attack is considered to be received and reception is restricted during that time.

JP2013-196058A JP 2015-231131 A

  However, in conventional control systems that have both functional safety and security, when a DoS attack countermeasure that detects DoS attacks and restricts reception is used, feedback control using received data in the control device on the return transmission side Therefore, normal return transmission cannot be performed. At this time, the behavior of the loopback transmission side is due to spontaneous communication restrictions, but for loopback reception side control devices that perform feedback diagnosis, loopback data failure due to spontaneous reception restrictions on the loopback transmission side and loopback data due to failure Since it cannot be distinguished from a failure, the return data failure in either case has to be detected as a failure on the return transmission side, and there is a problem that the availability of the control system is impaired.

  The problem to be solved by the present invention is to provide a control device and a control system capable of achieving both security and functional safety and maintaining the availability as a control system even when subjected to a denial of service attack. That is.

  The control device of the embodiment includes a communication interface unit, a security processing unit, and a safety processing unit. The communication interface unit performs communication processing with an external device. The security processing unit determines whether or not there is a denial of service attack. If a denial of service attack is detected, the security processing unit causes the communication interface unit to perform reception restriction and the security processing unit indicates that blocking information data indicating that reception restriction is performed. In accordance with the instruction from the determination unit that instructs attachment to the transmission data and the determination unit, the transmission data from the safety processing unit during transmission is blocked from the return data that is included in the received data from the external device and sent back to the external device And a security treatment section for changing to information data. The safety processing unit wraps back the black channel diagnosis unit that performs black channel diagnosis for checking the integrity of the received data based on predetermined data included in the received data and the transmission data to the external device. A black channel sending unit that attaches predetermined data for black channel diagnosis including data and passes the data to the security processing unit;

FIG. 1 is a system configuration diagram of a control system according to the first embodiment. FIG. 2 is a block diagram showing a basic configuration of the return transmission side control device according to the embodiment. FIG. 3 is a block diagram showing a basic configuration of a loopback receiving control apparatus according to the embodiment. FIG. 4 is a diagram showing an example of a data format used in the embodiment. FIG. 5 is a flowchart for explaining a transmission flow of the control device on the return reception side in the embodiment. FIG. 6 is a diagram illustrating an example of a data structure of data stored in the return data storage unit in the embodiment. FIG. 7 is a flowchart for explaining a reception flow of the control device on the return reception side in the embodiment. FIG. 8 is an example of a processing flow of the determination unit included in the security processing unit of the control device on the return transmission side in the embodiment. FIG. 9 is a flowchart for explaining a reception flow in the control device on the return transmission side in the embodiment. FIG. 10 is a diagram illustrating a return transmission flow of the return transmission side control device in the embodiment. FIG. 11 is a diagram illustrating a system configuration of a control system according to the second embodiment. FIG. 12 is a block diagram showing a basic configuration of a loopback reception / transmission control apparatus according to the embodiment. FIG. 13 is a diagram illustrating a system configuration of a control system according to the third embodiment. FIG. 14 is a block diagram illustrating a basic configuration of a loopback reception side control device when configured using a loopback transmission side control device and a loopback reception side control device in the embodiment. FIG. 15 is a block diagram showing a basic configuration of a control device in the case where the control device is configured using a loopback reception / transmission control device. FIG. 16 is a diagram illustrating a data structure example of data stored in the client DB unit of the return data storage unit in the embodiment.

  Hereinafter, embodiments for carrying out the invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 is a system configuration diagram of a control system according to the first embodiment.

  The control system according to the present embodiment transmits specific data (loopback data) transmitted from one control apparatus to a communication partner control apparatus from a transmission destination control apparatus (control apparatus 1 on the loopback transmission side in the figure). This is a system for performing feedback diagnosis to confirm the integrity of communication by sending back to the control device (in the figure, the control device 2 on the return reception side) and confirming the correct arrival of data. As shown in the figure, the control system according to the present embodiment employs a configuration in which a loopback transmission side control device 1 and a loopback reception side control device 2 are connected to each other via a network. Note that transmission / reception between the control devices (1, 2) is performed at regular intervals, for example.

  FIG. 2 is a block diagram illustrating the basic configuration of the control device 1 on the return transmission side according to the present embodiment.

  The control device 1 on the return transmission side shown in FIG. 2 includes four blocks: a communication I / F unit (communication interface unit) 11, a security processing unit 12A, a safety processing unit 13, and a control processing unit 14. These may be configured on the same hardware component or may be configured on separate hardware components.

  The communication I / F unit 11 receives data (frame) from the outside of its own device via a network such as Ethernet (registered trademark), and receives the received data to the security processing unit 12A. The security processing unit 12A The transmission processing unit 112 transmits the transmission data from the device to the device outside the device itself (the control device 2 on the return reception side here). The reception processing unit 111 discards the received data (frame) when there is a reception restriction instruction from the determination unit 121 described below.

  The security processing unit 12A is a functional unit that implements a security function, monitors the reception state of the reception processing unit 111 of the communication I / F unit 11, and performs a denial-of-service attack such as a DoS attack (hereinafter described as a DoS attack). If detected, the determination unit 121 that gives an instruction to restrict reception to the reception processing unit 111 and attaches the blocking information data to the safety data to the security processing unit 123, the encryption passed from the communication I / F unit 11, etc. The security data received by the security processing unit 13 is released, and the security release unit 122 passed to the safety processing unit 13 is added to the transmission data from the safety processing unit 13 during transmission. And a security processing unit 123 to be transferred to the communication I / F unit 11. The blocking information data is data indicating that reception control is performed in order to cope with an attack from the outside in the control device 1 on the return transmission side, and when the DoS attack is detected, the return reception side This data is set in place of the loopback data in the safety data received from the controller 2. In addition, the determination unit 121 monitors the number of received packets at regular intervals after detecting the DoS attack, determines that the attack has converged when the number of packets falls below a predetermined threshold, and restricts reception to the reception processing unit 111. Instruct to cancel.

  The safety processing unit 13 is a functional unit that implements a safety function, and includes a black channel diagnosis unit 131 that performs black channel diagnosis for checking the integrity of data received from the security processing unit 12A, and a security processing unit 12A. And a black channel sending unit 132 that generates and attaches safety confirmation data for performing black channel diagnosis on the receiving side (the other side) for the transmission data to be passed.

  FIG. 3 is a block diagram illustrating a basic configuration of the loopback receiving control device 2 according to the present embodiment. Here, the same reference numerals are given to the same components as the components of the control device 1 on the return transmission side shown in FIG. 2, and the description of the overlapping portions will be omitted. As shown in the figure, the communication I / F unit 11, the safety processing unit 13, and the control processing unit 14 are the same as those of the control device 1 on the return transmission side described above.

  The security processing unit 12B of the control device 2 on the return reception side illustrated in FIG. 3 includes a security release unit 122, a security processing unit 123, a data replacement unit 124, and a return data storage unit 125. The security release unit 122 and the security processing unit 123 in the security processing unit 12B are the same as those in the security processing unit 12A of the control device 1 on the return transmission side.

  When the return data portion in the safety data obtained from the received data from the control device 1 on the return transmission side received by the reception processing unit 111 is blocking information data, the data replacement unit 124 receives the black channel diagnosis unit 131. In order to ensure consistent data so that a failure is not diagnosed in the feedback diagnosis, the replacement is performed by replacing the part of the return data that is the cutoff information data with the return data stored in the return data storage unit 125. The subsequent safety data is passed to the safety processing unit 13.

  The loopback data storage unit 125 stores loopback data in the transmission data received from the black channel transmission unit 132 and can be used when the data replacement unit 124 replaces the loopback data portion (described above). Have

  Here, FIG. 4 shows an example of the data format used in the present embodiment, and the configuration will be described.

  When data is transmitted between the control device 1 on the return transmission side and the control device 2 on the return reception side, the data is in the state of the security countermeasure data 301 subjected to protection processing such as encryption (see FIG. 4). The security data 302 is a state where the security countermeasure data 301 is received by the control device (1 or 2) and the protection cancellation processing (decryption or the like) is performed by the security cancellation unit 122. The security countermeasure data 301 is included in a data portion such as an Ethernet frame. In addition to the security countermeasure data 301, information such as a destination address, a transmission source address, and a type is included in the data (frame) transmitted and received. Is added.

  The safety data 302 includes control data 303, loopback data 304, and safety check code 305.

  The control data 303 is the main body of control data to be transmitted safely and securely.

  The loopback data 304 is data attached for feedback diagnosis by the transmission source control device (in this case, the loopback reception-side control device 2), and the transmission source control device 2 performs control using the loopback data 304. Delivery confirmation of the data 303 is performed (feedback diagnosis). The return data 304 attached by the transmission source control device 2 is attached again to the return transmission data from the transmission destination control device (in this case, the control device 1 on the return transmission side) and returned to the transmission source. The transmission source can confirm that the previous transmission is correctly received by the control device 1 of the communication partner by returning the return data 304 sent by itself from the communication partner.

  The safety check code 305 is a check code for performing a diagnosis other than the feedback diagnosis as an abnormality diagnosis function related to the functional safety of the control devices (1, 2). The safety check code 305 can include a communication sequence number, a transmission source and transmission destination address, a time stamp, an error detection code, and the like. The receiving side control devices (1, 2) check the safety check code 305 by the black channel diagnosis unit 131 of the safety processing unit 13 to confirm that the control data 303 has been correctly received. Hereinafter, the return data 304 and the safety check code 305 are collectively referred to as safety confirmation data 306.

  Next, the operations of the loopback reception side and loopback transmission side control devices (1, 2) in the control system of the present embodiment having the above-described configuration will be described with reference to FIGS. In the control system of the present embodiment, (a) transmission at the loop-back receiving side control device 2, (b) reception at the loop-back transmission side control device 1, and (c) loop-back transmission at the loop-back transmission side control device 1. (D) Transmission / reception is executed in the order of reception by the control device 2 on the return reception side.

  FIG. 5 is a flowchart for explaining the transmission flow of the control device 2 on the return reception side.

  In the control device 2 on the return reception side, the control data 303 is generated in the control processing unit 14 (S101), and the safety confirmation data 306 is attached to the control data 303 generated in S101 in the safety processing unit 13 so that safety data is obtained. 302 is completed (S102).

  In the return data storage unit 125 of the security processing unit 12B, the return data 304 in the safety confirmation data 306 included in the completed safety data 302 is used to replace the return data 304 described later with reference to FIG. (S103). Here, for example, as illustrated in FIG. 6, safety data identification information such as a communication sequence number and return data 304 in the safety confirmation data 306 are stored in association with each other.

  The security processing unit 123 generates security countermeasure data 301 by adding a protection process such as encryption to the safety data 302 (S104). The generated security countermeasure data 301 is transmitted from the transmission processing unit 112 of the communication I / F unit 11 (S105), and the control device 2 on the return reception side waits for reception (FIG. 7: S106).

  FIG. 7 is a flowchart for explaining the reception flow of the control device 2 on the return reception side.

  The control device 2 on the return reception side receives the security countermeasure data 301 transmitted from the control device 1 on the return transmission side (S106) while waiting for reception (S106), and then releases the security release unit 122 of the security processing unit 12B. In step S108, the security countermeasure data 301 is subjected to protection cancellation processing such as decryption to generate safety data 302 (S108).

  If the safety data 302 after the protection cancellation process does not maintain the prescribed format (Yes in S109), the protection cancellation process is treated as a failure, and the received safety data 302 is not used. In this case, the safety data 302 is discarded and recorded in the abnormality log (S110).

  On the other hand, when the safety data 302 after the protection release processing maintains the prescribed format, it is determined that the safety data 302 is normal (No in S109), and the content of the return data 304 is returned on the return transmission side in the data replacement unit 124. It is determined whether or not the blocking information data 307 is attached by the control device 1 (S111).

  Here, when the return data 304 is the blocking information data 307 (Yes in S111), the control device 1 on the return transmission side intentionally limits reception due to a DoS attack or the like, and the reception limitation is performed. This means that the interruption information data 307 shown is attached to the return data 304. In this case, the data replacement unit 124 of the loopback receiving control device 2 returns the blocking information data 307 included in the loopback data 304 portion of the safety data 302 to the loopback data previously stored in the loopback data storage unit 125. (S112), the safety check code 305 is corrected in accordance with the changed return data 304 (S113), and the corrected safety data 302 is sent to the black channel diagnosis unit 131. Note that if the loopback data 304 portion of the safety data 302 is not the blocking information data 307 (that is, the loopback data 304 itself) (No in S111), the data replacement unit 124 does not perform the replacement process and stores the safety data 302. This is sent to the black channel diagnosis unit 131.

  The black channel diagnosis unit 131 checks the safety confirmation data 306 of the passed safety data 302 (S114). Here, when the safety check code 305 of the safety data 302 is provided with a communication sequence number, the black channel diagnosis unit 131 determines whether or not the security countermeasure data 301 arrives at the control device 2 on the receiving side in an appropriate order. Can be confirmed. When the safety check code 305 is provided with a transmission source and a transmission destination address, the black channel diagnosis unit 131 can confirm that the received data is transmitted from the correct transmission source. In this case, the control device 2 on the return reception side causes the black channel diagnosis unit 131 to hold the correct transmission source address and the own device address. Further, when the safety check code 305 is provided with a time stamp, the black channel diagnosis unit 131 may confirm whether or not the security countermeasure data 301 has arrived at the control device 2 on the return reception side at an appropriate timing. it can. When the safety check code 305 is provided with an error detection code, the black channel diagnosis unit 131 can confirm the presence or absence of a bit error.

  If the check result of the safety confirmation data 306 in S114 is normal (Yes in S115), the control data 303 is regarded as correct data, and the control data 303 received by the control processing unit 14 is used for control processing. (S116). On the other hand, if the check result of the safety confirmation data 306 is abnormal (No in S115), the safety data 302 is discarded (S117).

  Next, the operation at the time of transmission / reception in the control device 1 on the return transmission side will be described.

  FIG. 8 is an example of a processing flow of the determination unit 121 provided in the security processing unit 12A of the control device 1 on the return transmission side.

  The role of the determination unit 121 is to determine whether or not there is a DoS attack and to control reception when there is an attack in order to prevent the processing capability when the control device 1 on the return transmission side receives a DoS attack. It is to be. The determination unit 121 monitors the reception processing unit 111 of the control device 1 on the return transmission side, and periodically acquires the reception number information managed by the reception processing unit 111. The received data is stored in a queue of the reception processing unit 111, and the reception processing unit 111 manages information on the number of data as reception number information. The determination unit 121 calculates the difference between the previous acquisition value and the current value from the acquired reception number information, and calculates the number of data (reception number) received within the monitoring period (fixed time) (S121).

  When the calculated value is equal to or greater than the predetermined threshold (Yes in S122), the determination unit 121 considers that the communication I / F unit 11 is under a DoS attack and instructs the reception processing unit 111 to restrict reception. Send (S123).

  Even during this reception restriction, the determination unit 121 monitors the number of receptions at a constant cycle (monitoring cycle), and when the calculated value falls below the threshold (No in S122), the determination unit 121 determines that the communication I / F unit 11 Is determined to have converged, and a command for permitting reception by the reception processing unit 111 is issued (S124).

  As a method for determining the presence or absence of a DoS attack in the determination unit 121, the processing load in the reception processing unit 111 or the security release unit 122 is acquired in addition to the method using the number of receptions and the threshold as illustrated in FIG. A method of determining the presence or absence of a DoS attack by providing a threshold value for the value and performing the same determination may be adopted.

  FIG. 9 is a flowchart for explaining a reception flow in the control device 1 on the return transmission side.

  First, when the reception is not restricted (No in S201), the control device 1 on the return transmission side is in a reception waiting state (S202). When the security countermeasure data 301 is received from the loopback receiving control device 2, the security processing unit 12A of the loopback transmitting control device 1 sends the security countermeasure data 301 transmitted from the loopback receiving control device 2. Is received from the reception processing unit 111 (S203).

  Then, the security release unit 122 adds a protection release process such as decryption to the security countermeasure data 301 to generate the safety data 302 (S204).

  At this time, when the safety data 302 after the protection cancellation processing does not maintain the prescribed format, that is, when the safety data 302 is not normal (No in S205), the security cancellation unit 122 performs security abnormality on the safety data 302. Alternatively, the safety data 302 is discarded as a failure handling of the protection release processing, and the result is recorded in the abnormality log (S207).

  On the other hand, when the safety data 302 maintains the prescribed format, that is, when the safety data 302 is normal (Yes in S205), the security release unit 122 sends the safety data 302 to the safety processing unit 13.

  The black channel diagnosis unit 131 of the safety processing unit 13 checks the safety confirmation data 306 in the safety data 302 received from the security release unit 122 (S206). Here, when the safety check code 305 of the safety data 302 is provided with a communication sequence number, the black channel diagnosis unit 131 determines whether the security countermeasure data 301 arrives at the control device 1 on the return transmission side in an appropriate order. Can be confirmed. When the safety check code 305 is provided with a transmission source and a transmission destination address, the black channel diagnosis unit 131 can confirm that the received data is transmitted from the correct transmission source. In this case, the control device 1 on the return transmission side uses the black channel diagnosis unit 131 to hold the correct transmission source address and the own device address. Further, when the safety check code 305 is provided with a time stamp, the black channel diagnosis unit 131 may confirm whether or not the security countermeasure data 301 has arrived at the control device 1 on the return transmission side at an appropriate timing. it can. When the safety check code 305 is provided with an error detection code, the black channel diagnosis unit 131 can confirm the presence or absence of a bit error.

  If the check result of the safety confirmation data 306 in S206 is normal (Yes in S208), the black channel diagnosis unit 131 considers the control data 303 as correct data, and uses the control data 303 included in the safety data 302. It transmits to the control processing unit 14. In the control processing unit 14, the received control data 303 is used for control processing (S209). Further, the black channel diagnosis unit 131 uses the loopback data 304 included in the received safety data 302 and enters preparation for loopback transmission. On the other hand, if the check result is abnormal (No in S208), the black channel diagnosis unit 131 discards the safety data 302 (S210). In a situation where the control data 303 cannot be used, the control processing unit 14 controls to use the previous value of the control data 303 or to safely stop the control target.

  If reception is being restricted (Yes in S201), the process proceeds to S211 in FIG.

  FIG. 10 is a diagram for explaining a return transmission flow of the control device 1 on the return transmission side.

  First, the control processing unit 14 generates (return) control data 303 for transmission (S211), and the latest valid (outbound) safety confirmation data received by the black channel transmission unit 132 from the security processing unit 12A. Return data 304 is extracted from 306 (S212). Then, the black channel transmission unit 132 generates a safety check code 305 from the control data 303 generated by the control processing unit 14 and the extracted return data 304 (S213). The control data 303, the return data 304, and the safety check are generated. The code 305 is used to complete the safety data 302 for return transmission (return).

  At this time, if the return-transmission-side control device 1 is receiving restriction (Yes in S214), the return data 304 is not an appropriate value. Therefore, in this case, the security processing unit 123 replaces the contents of the return data 304 in the previously completed safety data 302 with the blocking information data 307 (S215), and performs a safety check from the control data 303 and the blocking information data 307. The code 305 is regenerated (S216), and the safety data 302 for return transmission is completed. On the other hand, when the return transmission side control device 1 is not receiving restriction (No in S214), since the return data 304 is an appropriate value, the previously completed safety data 302 is used.

  Then, the security processing unit 123 generates the security countermeasure data 301 by adding a protection process such as encryption to the completed safety data 302 (S217).

  The generated (returned) security countermeasure data 301 is transmitted to the transmission processing unit 112 of the communication I / F unit 11, and is transmitted from the transmission processing unit 112 to the control device 2 on the return reception side (S218).

  As described above, the control device 1 on the return transmission side and the control device 2 on the return reception side operate. Hereinafter, an operation between the control device 1 on the return transmission side and the control device 2 on the return reception side when the control device 1 on the return transmission side is subjected to the DoS attack will be described.

  When the control device 1 on the return transmission side is subjected to a DoS attack, the reception processing unit 111 is in a state where a large amount of received data other than the regular security countermeasure data 301 is received by a DoS attack attack packet. At this time, in the control device 1 on the return transmission side, the number of receptions is equal to or greater than the threshold value, and the control device 1 on the return transmission side restricts reception by the reception processing unit 111 by the processing shown in the processing flow of the determination unit 121 in FIG. Start.

  During reception restriction, the control device 1 on the return transmission side does not receive the security countermeasure data 301 and replaces the contents of the return data 304 with the blocking information data 307 by the process shown in the transmission flow of FIG. 10 (return). The security countermeasure data 301 is generated and transmitted to the control device 2 on the return reception side.

  The control device 2 on the return reception side confirms that the return data 304 portion of the safety data 302 is the blocking information data 307 by the processing shown in the reception flow of FIG. 7, that is, the control device 1 on the return transmission side When recognizing that the reception is being restricted, the data replacement unit 124 sets the blocking information data 307 included in the received safety data 302 so that the black channel diagnosis unit 131 of the safety processing unit 13 does not detect the failure. Then, the return data stored in the return data storage unit 125 is replaced. Further, the data replacement unit 124 corrects the safety check code 305 in accordance with the replaced folded data 304. As a result, the control device 2 on the return reception side can detect the black channel of the safety processing unit 13 that conventionally detects a failure on the control device 1 side even when the control device 1 on the return transmission side is under a DoS attack. Failure detection by the diagnosis unit 131 can be avoided.

  Accordingly, the control device 1 on the return transmission side can control the control device on the return reception side even if the control device 1 on the return transmission side cannot receive the security countermeasure data 301 sent from the control device 2 on the return reception side due to the DoS attack. The security countermeasure data 301 for avoiding failure detection by the second black channel diagnosis unit 131 can be transmitted to the control device 2 on the return reception side.

  If the communication path between the loopback transmission side control device 1 or the loopback transmission side control device 1 and the loopback reception side control device 2 becomes physically and electrically abnormal, the reception flow of FIG. By detecting the security abnormality or the safety abnormality by the process shown in FIG. 8, it is possible to avoid using the control processing unit 14 with the incorrect or incorrect control data 303.

  As described above, conventionally, when the safety function and the security function coexist in the control device as in the present embodiment, the failure of the return data 304 returned by the protection function from the DoS attack is regarded as a failure on the communication partner side. There is a problem that the availability of the control system is impaired by the detection. In response to this problem, the control system according to the present embodiment has a processing function for avoiding the detection that causes the above problem, although the control device (1, 2) has a security processing unit (12A, 12B). The security function is not required to be changed in order to ensure safety, and it is not necessary to change the configuration on the safety processing unit 13 side. Both safety functions can be realized.

(Second Embodiment)
Next, a control system according to a second embodiment will be described with reference to the drawings. In addition, the same code | symbol is used about the part which is common in the structure demonstrated in the above-mentioned 1st Embodiment, and the description is abbreviate | omitted.

  FIG. 11 is a diagram illustrating a system configuration of a control system according to the present embodiment.

  The control system according to the first embodiment described above is configured by the control device 1 on the return transmission side and the control device 2 on the return reception side, but in this embodiment, as shown in FIG. A configuration is adopted in which control devices 3 for both reception and transmission are connected to each other. That is, the control system according to the present embodiment is configured using one type of control device for the loopback reception / transmission control device 3.

  FIG. 12 is a block diagram showing a basic configuration of the loopback reception / transmission control apparatus 3 according to the present embodiment.

  The loopback reception / transmission control device 3 shown in FIG. 12 includes a determination unit 121, a security release unit 122, a security treatment unit 123, a data replacement unit 124, and a loopback data storage unit 125 in the security processing unit 12C. Thus, all the components included in the control device 1 on the return transmission side and the control device 2 on the return reception side are included. Functions and individual operations of each component of the control device 3 are the same as those indicated by the same reference numerals in the first embodiment.

  In the first embodiment, transmission of the loop receiving side control device 2, reception of the loop back transmission side control device 1, loop back transmission of the loop back transmission side control device 1, and loop back reception of the loop back reception side control device 2 are performed. These transmissions and receptions are executed in order. On the other hand, in this embodiment, each of the two loopback reception / transmission control devices 3 has the transmission, reception, loopback transmission, and loopback reception capabilities. In this embodiment, by adopting this configuration, transmission of the first loopback reception / transmission control device 3 is received, reception of the second loopback reception / transmission control device 3 is received, and second loopback is performed. The series of transmission / reception flows described above in the first embodiment are executed in the order of loopback transmission of the control device 3 for both reception and transmission and reception of the first loopback reception / transmission control device 3. Since the first and second loopback reception / transmission control devices 3 can exchange the transmission / reception roles with each other, the transmission of the first loopback reception / transmission control device 3 within a certain period of time. The transmission / reception flow starting from the transmission and the transmission / reception flow starting from the transmission of the second loopback reception / transmission control device 3 can be executed.

  Here, the operation between the two control devices 3 when the loop reception / transmission control device 3 receives a DoS attack will be described.

  Regardless of which loopback reception / transmission control device 3 is subjected to a DoS attack, the loopback reception / transmission control device 3 on the side that has received this attack is the loopback transmission side of the first embodiment. Similar to the control device 1, the contents of the return data 304 are replaced with the blocking information data 307, and the security countermeasure data 301 is transmitted to the other control device 3 for return reception / transmission. In the other loopback reception / transmission control apparatus 3, the loopback data 304 included in the received data is the blocking information data 307, as in the loopback reception-side control apparatus 2 of the first embodiment. Is recognized, the control device 3 for returning reception / transmission of the communication partner voluntarily restricts reception due to the DoS attack, and the failure detection by the black channel diagnosis unit 131 is performed by replacing the return data 304. To avoid.

  As described above, in this embodiment, the mutually connected loopback reception / transmission control devices 3 perform the transmission, reception, loopback transmission, and loopback reception described in the first embodiment, respectively. The return data 304 can be replaced (returned reception side / transmission side of the return reception side / transmission control device 3 on the return transmission side, and the return reception side / transmission side return side can also be used. (Replacement to original loopback data 304) in the control device 3 and a function of recognizing reception restrictions on the communication partner side. As a result, regardless of which loopback reception / transmission control device 3 is subjected to a DoS attack, the other loopback reception / transmission control device 3 recognizes the reception restriction of the attacked device, and the black channel diagnosis unit 131. Failure detection due to can be avoided. In other words, when the conventional safety function and security function coexist in the control device, the loopback data failure due to the protection function from the DoS attack is detected as a failure, and the system availability is impaired. In addition to the effects of the first embodiment, the embodiment realizes both security and safety functions without impairing the availability of the system even if any loopback reception / transmission control device 3 is subjected to a DoS attack. It has the effect that becomes possible.

(Third embodiment)
Next, a control system according to a third embodiment will be described with reference to the drawings. In addition, the same code | symbol is used about the part which is common in the structure demonstrated in the above-mentioned 1st Embodiment and 2nd Embodiment, The description is abbreviate | omitted.

  FIG. 13 is a diagram illustrating a system configuration of a control system according to the present embodiment.

  In the present embodiment, the control device 1 on the return transmission side and the control device 2 on the return reception side are connected in a one-to-many or many-to-many relationship. Further, instead of the loopback transmission side control device 1 and the loopback reception side control device 2 shown in FIG. 13, it is possible to adopt a configuration using the loopback reception / transmission control device 3 in the second embodiment. is there.

  FIG. 14 is a block diagram illustrating a basic configuration of the loopback reception side control device 2 in the present embodiment when configured using the loopback transmission side control device 1 and the loopback reception side control device 2.

  In the configuration illustrated in FIG. 14, the control device 2 on the return reception side includes a client DB unit 126 inside the return data storage unit 125 in addition to the configuration in the first embodiment described above.

  FIG. 15 is a block diagram showing a basic configuration of the control device 3 in the case where the control device 3 is configured to be used for loopback reception / transmission in the present embodiment.

  In the configuration shown in FIG. 15, the loopback reception / transmission control device 3 stores loopback data in the same manner as the loopback reception side control device 2 in the present embodiment, in addition to the configuration in the second embodiment described above. It is assumed that the client DB unit 126 is provided inside the unit 125.

  Here, functions and operations of the control device (2 or 3) on the return reception side in the present embodiment will be described.

  The basic operation is the same as the transmission flow described above with reference to FIG. 5 and the reception flow described above with reference to FIG. However, in the present embodiment, the control device (1 or 3) serving as the return transmission side of the control device (2 or 3) serving as the return reception side is not a single but a plurality of control devices (1 or 3). Therefore, in this embodiment, the loopback data 304 in the safety confirmation data 306 is not common data to all the transmission partner control devices (1 or 3), but is the transmission partner control device (1 or 3). ) To prepare separate return data 304 (of course, common data can be used as the return data 304). Then, when the return data storage unit 125 of the security processing unit (12B, 12C) stores the return data 304 in the safety confirmation data 306 in association with the safety data 302 in S103 of FIG. 5, the return is performed in S112 of FIG. In order to replace the data 304, each transmission partner is further associated with the safety data 302 and stored in the client DB unit 126 provided in the return data storage unit 125. Here, as illustrated in FIG. 16, transmission destination identification information such as an IP address, safety data identification information such as a communication sequence number, and loopback data 304 in the safety confirmation data 306 are stored in association with each other. . It should be noted that transmission of transmission data attached with separate loopback data 304 for each control device (1 or 3) on the loopback transmission side that is the transmission partner is peer-to-peer transmission (in the case of using common loopback data 304). Broadcast is also possible).

  The return data 304 stored in the client DB unit 126 is the data received by the data replacement unit 124 in step S112 of the reception flow shown in FIG. This is used when replacing the return data stored in the client DB unit 126 of the return data storage unit 125. At the time of this replacement, the data replacement unit 124 replaces the return data for each transmission partner stored in the client DB unit 126 corresponding to the transmission partner that has transmitted the return by replacing the blocking information data 307 with the return data. Use.

  As described above, the control device 1 on the return transmission side and the control device 2 on the return reception side, or the control device 3 for return reception / transmission in the present embodiment have different return data for each control device of the communication partner. 304 is held, and for each control device that is a communication partner, it is possible to give separate return data as necessary to the transmission data to be transmitted. Therefore, in the present embodiment, it is possible to diagnose abnormality and failure related to individual functional safety for each control device of the communication partner in a one-to-many or many-to-many connection configuration. In addition, in a one-to-many or many-to-many connection configuration, it can be easily applied to various uses as a control system, and it is possible to prevent deterioration in accuracy of abnormality and failure diagnosis functions due to an increase in system scale. Become. Needless to say, the control system according to the present embodiment has the effects of the control systems according to the first and second embodiments.

  As described above, according to the first to third embodiments, when intentional reception restriction is performed in order to cope with a DoS attack, failure detection by feedback diagnosis is not performed, so that an attack is not performed. However, while maintaining the availability as a control system, both a diagnostic function including a feedback diagnosis for functional safety and a DoS attack countermeasure function for security can be made compatible.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. For example, in the first embodiment described above, the control device 1 on the return transmission side can be replaced with the control device 3 for both return reception and transmission in the second embodiment. It is also possible to replace the control device 3 for both loopback reception and transmission in the second embodiment. In the second embodiment described above, the loopback reception / transmission control device 3 serving as the loopback transmission side can be replaced with the loopback transmission side control device 1 in the first embodiment. It is also possible to replace the loopback reception / transmission control device 3 with the control device 2 on the loopback reception side in the first embodiment. In each embodiment, the communication I / F unit 11 and the security processing unit (12A, 12B, 12C) are described as separate functional units, but may be configured as the same functional unit. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 1 (Return transmission side) Control apparatus 2 (Return reception side) Control apparatus 3 (Return reception / transmission combined use) Control apparatus 11 Communication I / F part 12A, 12B, 12C Security processing part 13 Safety processing part 14 Control processing part 111 Reception Processing unit 112 Transmission processing unit 121 Judgment unit 122 Security cancellation unit 123 Security treatment unit 124 Data replacement unit 125 Returned data storage unit 126 Client DB unit 131 Black channel diagnosis unit 132 Black channel transmission unit

Claims (8)

A communication interface unit that performs communication processing with an external device,
When a denial of service attack is determined and a denial of service attack is detected, the communication interface unit performs reception restriction, and the security treatment unit performs reception restriction. A determination unit for instructing attachment;
In accordance with an instruction from the determination unit, a security processing unit that replaces return data that is included in received data from the external device and sent back to the external device with respect to transmission data from the safety processing unit at the time of transmission,
A security processing unit, and
A black channel diagnosis unit that performs black channel diagnosis for checking the integrity of the received data based on predetermined data included in the received data;
A black channel sending unit that attaches predetermined data for black channel diagnosis, including the loopback data, to the transmission data to the external device, and passes it to the security treatment unit,
A safety processing section,
A control device comprising: A communication interface unit that performs communication processing with an external device,
A black channel diagnosis unit that performs black channel diagnosis for checking the integrity of the received data based on predetermined data included in the received data;
A black channel sending unit that attaches predetermined data for black channel diagnosis, including return data to be sent back to the external device, with respect to transmission data to the external device,
A safety processing unit having, and
A loopback data storage unit that stores loopback data in transmission data passed from the black channel transmission unit during transmission to the external device;
When the loopback data portion in the received data from the external device on the loopback transmission side is blocking information data indicating that reception is restricted, this blocking is performed on the data to be passed to the black channel diagnostic unit. A data replacement unit that replaces the information data with the loopback data stored in the loopback data storage unit, and uses the data after the replacement to correct predetermined data used in the black channel diagnosis;
A security processing unit,
A control device comprising: The security processing unit
A loopback data storage unit that stores loopback data in transmission data passed from the black channel transmission unit during transmission to the external device;
When the loopback data portion in the received data from the external device that is the loopback transmission side is the blocking information data, the blocking information data is replaced with the loopback data stored in the loopback data storage unit, A data replacement unit for correcting the predetermined data used in the black channel diagnosis unit;
The control device according to claim 1, further comprising:   The determination unit monitors the number of received data in the communication interface unit, and when the number of received data exceeds a predetermined threshold value within a predetermined time, instructs the communication interface unit to limit reception, 4. The control device according to claim 1, wherein when the number of received data is equal to or less than the threshold value, the control device instructs the communication interface unit to release the reception restriction. The return data storage unit stores separate return data for each of a plurality of transmission partners on the return reception side,
The data replacement unit uses the loopback data for each transmission partner stored in the loopback data storage unit corresponding to the transmission partner that transmitted the loopback when replacing the blocking information data with loopback data.
The control device according to claim 2 or claim 3. The security processing unit further includes a security release unit that releases the protection from received data subjected to security protection processing;
The security treatment unit
Apply security protection processing to the transmitted data during transmission.
The control device according to any one of claims 1 to 5.   The control according to any one of claims 1 to 6, wherein the predetermined data includes any one of a communication sequence number, a transmission source and transmission destination address, a time stamp, an error detection code, or a plurality of types of information. apparatus.   A control system comprising: the control device according to claim 1 or 3 as one or a plurality of return transmission sides; and the control device according to claim 2 or 3 as a return reception side.

Images