Patent Description:
To control various facilities and various apparatuses arranged at each facility, control devices such as a PLC (programmable controller) are used. A control device can monitor an abnormality which may occur in a facility or an apparatus serving as a control target, and can also monitor an abnormality of the control device itself. When a certain abnormality is detected, a notification is provided from the control device to the outside by a certain method.

For example, <CIT> (PTL <NUM>) discloses a programmable controller that transmits an e-mail to a destination specified beforehand, when an abnormality history is registered or when a predetermined time is reached.

Further prior art documents are <CIT> and <CIT>.

For example, according to <CIT>, a security module is disclosed which may provide security to an automated control system (ACS). The security module comprises a processor module and at least one communication module. The at least one communication module may be connected with the ACS. The processor module may receive data from the ACS via the at least one communication module and detects information data and addresses within the received data. Then, the processor module may determine whether the received data results from unauthorized access to the ACS based on the detected information data and addresses.

Furthermore, according to <CIT>, discloses is a system for detecting a cyber-attack inflicted by an attacker seeking to cause physical damage to, or harm functionality of, a SCADA system managed plant, comprising passively connected to the SCADA system. Each of the industrial computerized devices comprises a processor that is configured with a data validation module to determine whether data flow outputted from a SCADA- connected controller, adapted to command operation of each electromechanical component of a corresponding controlled subsystem of the plant, is authentic, and with an alert issuing mechanism that is activated following detection that the outputted data flow is indicative of a cyber-attack perpetrated with respect to the controller. The at least one dedicated industrial computerized device is operable to passively monitor in parallel, by the one or more dedicated industrial computerized device, data communicated between each of the controllers and the SCADA system including the outputted data at the nearest points of each of the controllers; seek, by the one or more dedicated industrial computerized devices, mismatches between the plant state and the physical operation model; if a mismatch is detected, determine by the dedicated industrial computerized device whether the mismatch is indicative of a cyber-attack perpetrated with respect to one of the controllers or an operational malfunction; and upon detecting a cyber- attack, activate the alert issuing mechanism to issue a security alert.

With the progress of information and communication technology (ICT) in recent years, a control device is network-connected to various external devices, and processing performed in the control device also becomes sophisticated. With the advance of such networking or incorporation of intelligence, the types of assumed threats also increase.

In a conventional control device, only an abnormality which occurs in a facility or an apparatus, or an abnormality which occurs in the control device itself is detected, and a threat which may occur with the advance of networking or incorporation of intelligence is not assumed at all.

One object of the present invention is to solve a new problem of protection against a threat which may occur with the advance of networking of or incorporation of intelligence into a control device and a control system. The object is achieved by the subject matter of independent claim <NUM>. Further advantageous embodiments of the invention of the subject matter of the dependent claims.

According to an example aspect of the present disclosure, a control device that controls a control target is provided. The control device includes: a program execution module that executes a program created depending on the control target; a detection module that determines whether a security event occurs in access from outside to the control device; and a notification module that provides a notification, upon detection of occurrence of the security event, to a notification destination corresponding to the occurred security event. The security event includes an event that does not conform to a predetermined rule.

According to the disclosure, occurrence of a security event in the access from the outside to the control device can be monitored, and, when a certain security event occurs, a notification of occurrence, a notification required for handling the occurred event, and/or the like thereof is/are provided. This can solve a new problem of protection against a threat which may occur with the advance of networking of or incorporation of intelligence into the control device.

In the above disclosure, the security event may include any of: a behavior and an action that halt operation of the control device and/or degrade performance of the control device; a behavior and an action that halt processing for executing the program and/or degrade performance of the program in the control device; and a behavior and an action that halt operation of the control target and/or degrade performance of the control target.

According to the disclosure, a threat that processing provided by the control device that is inhibited can be monitored as a security event.

In the above disclosure, the security event may include that any of a network address, a physical address, and a port number of a data transmission destination and/or a data transmission source is not included in a predetermined list for permitted access, or is included in a predetermined list for prohibited access.

According to the disclosure, only data communication with a predetermined transmission destination or transmission source is permitted, and data communication other than that is detected as a security event. Accordingly, protection against a threat through a network can be achieved.

In the above disclosure, the control device includes a first unit including the program execution module, and a second unit including the detection module. The first unit has a port for network connection. The security event may include that, when the port of the first unit is disabled, the port is network-connected.

According to the disclosure, such a threat can be detected as a security event at a stage before an attack through the network or an improper measure through the network is performed on the control device.

In the above disclosure, the security event includes that user authentication required when accessing the control device from the outside fails.

According to the disclosure, since a failure in user authentication suggests unauthorized access, such a threat can be detected as a security event at a stage before such unauthorized access is made.

In the above disclosure, the security event includes that a support device capable of developing the program to be executed in the control device is connected to the control device.

According to the disclosure, although an attack with a certain evil intention may be performed on the program to be executed when the support device capable of changing the program itself of the control device is directly connected, such a threat can be detected as a security event at a prior stage.

In the above disclosure, the security event includes that any of addition and change of the program to be executed in the control device and change of setting in the control device occurs.

According to the disclosure, when modification to the program to be executed in the control device or modification to the setting required for the control device to operate is made, such modification can be detected as a security event. Although such modification to the program or the setting may cause execution of abnormal control operation in the control device, such a threat can be prevented in advance.

In the above disclosure, the notification module may provide an event notification about occurrence of the security event through a network.

According to the disclosure, an arbitrary device which is network-connected with the control device can be notified of occurrence of a security event indicating a threat against the control device.

In the above disclosure, an alert unit arranged on the network may start alert operation upon receiving the event notification from the notification module.

According to the disclosure, for example, when the alert module arranged in the vicinity of the control device starts alert operation, an administrator, a maintenance staff member, or the like in the vicinity of the control device notices occurrence of a security event, and can immediately start a required measure.

According to an example of the present disclosure, a control system that controls a control target is provided. The control system includes: a first unit including a program execution module that executes a program created depending on the control target; and a second unit including a detection module that determines whether a security event occurs in access from outside to the first unit, and a notification module that provides a notification, upon detection of occurrence of the security event, to a notification destination corresponding to the occurred security event. The security event includes an event that does not conform to a predetermined rule.

According to the disclosure, occurrence of a security event in the access from the outside to the control system can be monitored, and, when a certain security event occurs, a notification of occurrence, a notification required for handling the occurred event, and/or the like thereof is/are provided. This can solve a new problem of protection against a threat which may occur with the advance of networking of or incorporation of intelligence into the control system.

According to the present invention, protection against a threat which may occur with the advance of networking of or incorporation of intelligence into a control device and a control system can be achieved.

An embodiment of the present invention will be described in detail with reference to the drawings. It should be noted that identical or corresponding parts in the drawings will be designated by the same reference numerals, and the description thereof will not be repeated.

First, an example of a scene to which the present invention is applied will be described.

In the present specification, a "security event" includes an event that does not conform to a rule predetermined by an operator or an administrator of a control device, or the like. More specifically, the "security event" can include (a) a behavior and an action that halt operation of the control device and/or degrade performance of the control device itself, (b) a behavior and an action that halt processing for executing a program and/or degrade performance of the program in the control device, (c) a behavior and an action that halt operation of a facility, an apparatus, a device, or the like and/or degrade performance of the facility, the apparatus, the device, or the like, which serves as a control target of the control device, and (d) a behavior and an action similar thereto.

The "security event" in the present specification is basically a concept that includes a behavior or an action provided through a network or electrical communication similar thereto.

<FIG> is a schematic diagram showing a schematic configuration of a control system <NUM> in accordance with the present embodiment. Referring to <FIG>, control system <NUM> in accordance with the present embodiment is intended to control a control target such as a facility, an apparatus, and the like, and includes a control device <NUM>, a remote input output (IO) device <NUM>, one or a plurality of display devices <NUM>, and one or a plurality of server devices <NUM>. Control device <NUM>, display devices <NUM>, and server device <NUM> are connected through a network <NUM>. Network <NUM> is connected to the Internet, which is an external network, through a gateway <NUM>. In addition, control device <NUM> and remote IO device <NUM> are connected through a field network <NUM>.

Control device <NUM> is mainly in charge of processing for controlling a control target. In the present embodiment, control device <NUM> monitors access from the Internet and access from other devices in network <NUM>, and when control device <NUM> detects occurrence of a certain security event, control device <NUM> provides a notification about the detected security event to the inside or the outside of control device <NUM>.

Control device <NUM> includes a CPU unit <NUM>, a security unit <NUM>, and one or a plurality of functional units <NUM>. CPU unit <NUM> has a program execution module that executes a program created depending on a control target. More specifically, CPU unit <NUM> corresponds to a computation processing portion that executes a system program and various user programs.

Security unit <NUM> has a detection module that determines whether a security event occurs in access from the outside to control device <NUM>. More specifically, security unit <NUM> constantly monitors whether a security event occurs, in accordance with predetermined security setting <NUM>. In the exemplary configuration shown in <FIG>, security unit <NUM> is arranged such that it can monitor data transmitted/received by control device <NUM> through network <NUM>. That is, security unit <NUM> is logically arranged between CPU unit <NUM> and network <NUM>, transfers data transmitted from CPU unit <NUM> to network <NUM>, and transfers data received through network <NUM> to CPU unit <NUM>. Security unit <NUM> monitors the data transmitted/received in such processing, and determines the presence or absence of a certain security event.

Upon detection of occurrence of a certain security event, security unit <NUM> provides a notification to the inside or the outside in accordance with a predetermined rule. That is, security unit <NUM> has a notification module that provides a notification, upon detection of occurrence of the security event, to a notification destination corresponding to the occurred security event.

Control system <NUM> in accordance with the present embodiment implements processing for constantly monitoring whether a predetermined security event occurs in access to CPU unit <NUM> or a device including CPU unit <NUM>. Then, when a certain security event occurs, a notification corresponding to the occurred security event is output to the inside or the outside of control device <NUM>. By adopting such a configuration, security resistance for CPU unit <NUM> or the device including CPU unit <NUM> can be increased.

It should be noted that, although an example of separate-type implementation using respectively independent CPU unit <NUM> and security unit <NUM> is shown for convenience of description, implementation is not limited thereto, and a unit including the both units integrated with each other may be adopted. Alternatively, processing provided by security unit <NUM> may be implemented as a separate device connected to CPU unit <NUM> via certain means, instead of taking the form of a "unit" connected to CPU unit <NUM>.

Continuously referring to <FIG>, an exemplary overall configuration of control system <NUM> will be described.

Functional units <NUM> included in control device <NUM> exchange signals with a facility and an apparatus serving as control targets, and various devices (such as a sensor, an actuator, and the like) arranged therein. Specifically, functional unit <NUM> outputs a command value calculated in CPU unit <NUM> to a field, or collects an input value from the field. Functional unit <NUM> has one or a plurality of modules, among a digital input (DI) module that receives a digital signal from a control target, a digital output (DO) module that outputs a digital signal to the control target, an analog input (AI) module that receives an analog signal from the control target, and an analog output (AO) module that outputs an analog signal to the control target, for example. Further, functional unit <NUM> can include a controller that implements a special function such as proportional integral derivative (PID) control and motion control.

As field network <NUM> that connects control device <NUM> and remote IO device <NUM>, it is preferable to adopt a bus or a network that performs fixed-cycle communication which ensures data arrival time. As the bus or the network that performs such fixed-cycle communication, EtherCAT (trademark) may be adopted. It should be noted that a communication path called a "field network" is also called a "field bus". In the present specification, the term "field network" is used as a concept that can include the "field bus", in addition to the "field network" in a narrow sense.

Remote IO device <NUM> includes a coupler unit <NUM> and one or a plurality of functional units <NUM>. Coupler unit <NUM> includes a first communication interface for exchanging data through field network <NUM>, and a second communication interface for internally exchanging data with functional units <NUM> included in remote IO device <NUM>.

Since functional units <NUM> are the same as functional units <NUM> included in control device <NUM>, the detailed description thereof will not be repeated.

As network <NUM> that connects control device <NUM> to display devices <NUM> and server device <NUM>, for example, Ethernet (trademark) or EtherNet/IP (trademark), which are common network protocols, may be adopted.

Display device <NUM> receives an operation from a user, outputs a command or the like in accordance with the user operation to control device <NUM>, and graphically displays a computation result or the like in control device <NUM>.

As server device <NUM>, a database system, a manufacturing execution system (MES), or the like is assumed. The manufacturing execution system is intended to acquire information from a manufacturing apparatus or facility serving as a control target, and monitor and manage entire production, and can also handle order information, quality information, shipment information, and the like. Server device <NUM> is not limited thereto, and a device that provides an information-related service (processing for acquiring a variety of information from a control target and conducting macroscopic or microscopic analysis or the like) may be connected to network <NUM>.

Gateway <NUM> performs processing as protocol conversion and a firewall between network <NUM> and the external network (the Internet).

Next, exemplary hardware configurations of main units included in control device <NUM> in accordance with the present embodiment will be described.

<FIG> is a block diagram showing an exemplary hardware configuration of CPU unit <NUM> included in control device <NUM> in accordance with the present embodiment. Referring to <FIG>, CPU unit <NUM> includes a processor <NUM>, a chipset <NUM>, a main memory <NUM>, a storage <NUM>, an inter-unit interface <NUM>, a universal serial bus (USB) interface <NUM>, a memory card interface <NUM>, a network interface <NUM>, an internal bus controller <NUM>, and a field network controller <NUM>.

Processor <NUM> is constituted by a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), or the like. As processor <NUM>, a configuration having a plurality of cores may be adopted, or a plurality of processors <NUM> may be arranged. Thus, CPU unit <NUM> has one or a plurality of processors <NUM>, and/or processor <NUM> having one or a plurality of cores. Chipset <NUM> controls processor <NUM> and peripheral elements, and thereby achieves processing as entire CPU unit <NUM>. Main memory <NUM> is constituted by a volatile storage device such as a dynamic random access memory (DRAM) or a static random access memory (SRAM), or the like. Storage <NUM> is constituted by a nonvolatile storage device such as a flash memory, for example.

Processor <NUM> reads various programs stored in storage <NUM>, deploys and executes them in main memory <NUM>, and thereby achieves control depending on a control target. Storage <NUM> stores a user program <NUM> created depending on a manufacturing apparatus or facility serving as a control target, in addition to a system program <NUM> for achieving basic processing.

Inter-unit interface <NUM> is a device for connecting to another unit to allow data communication. In the present embodiment, security unit <NUM> is connected through inter-unit interface <NUM> of CPU unit <NUM>. As inter-unit interface <NUM>, for example, a device conforming to a known data transmission standard (for example, PCI Express) or the like can be adopted.

USB interface <NUM> mediates data communication with an external device (for example, a support device that performs development of the user program and the like) through USB connection.

Memory card interface <NUM> is configured such that a memory card <NUM> is removably attached thereto, and can write data to memory card <NUM> and read various types of data (such as the user program, trace data, and the like) from memory card <NUM>.

Network interface <NUM> can mediate data communication through network <NUM>. However, in a state where security unit <NUM> is connected to CPU unit <NUM>, generally, operation of network interface <NUM> is disabled (specifically, use of a port is prohibited).

Internal bus controller <NUM> mediates data communication with functional unit <NUM> mounted on CPU unit <NUM>. Field network controller <NUM> mediates data communication with another unit through field network <NUM>.

Although <FIG> shows an exemplary configuration in which required processing is achieved by processor <NUM> executing a program, the provided processing may be partially or entirely implemented using a dedicated hardware circuit (such as an ASIC or an FPGA, for example).

<FIG> is a block diagram showing an exemplary hardware configuration of security unit <NUM> included in control device <NUM> in accordance with the present embodiment. Referring to <FIG>, security unit <NUM> includes a processor <NUM>, a chipset <NUM>, a main memory <NUM>, a storage <NUM>, an inter-unit interface <NUM>, and a network interface <NUM>.

Processor <NUM> is constituted by a CPU, an MPU, a GPU, or the like. As with CPU unit <NUM> described above, security unit <NUM> has one or a plurality of processors <NUM>, and/or processor <NUM> having one or a plurality of cores. Chipset <NUM> controls processor <NUM> and peripheral elements, and thereby achieves processing as entire security unit <NUM>. Main memory <NUM> is constituted by a volatile storage device such as a DRAM or an SRAM, or the like. Storage <NUM> is constituted by a nonvolatile storage device such as a flash memory, for example.

Processor <NUM> reads various programs stored in storage <NUM>, deploys and executes them in main memory <NUM>, and thereby achieves processing such as monitoring of a security event. Storage <NUM> stores security setting <NUM> that defines a rule or the like predetermined by an operator or an administrator of the control device, or the like, in addition to firmware <NUM> for achieving basic processing. The details of security monitoring processing based on security setting <NUM> will be described later.

Inter-unit interface <NUM> is a device for connecting to another unit to allow data communication, as with inter-unit interface <NUM> of CPU unit <NUM> described above. Through inter-unit interface <NUM>, security unit <NUM> is connected to CPU unit <NUM>.

Network interface <NUM> mediates data communication with another device through network <NUM>. Network interface <NUM> includes a transmission/reception portion <NUM>, a controller <NUM>, and a buffer <NUM>, as main components.

Transmission/reception portion <NUM> is an element in charge of the physical layer of the OSI reference model, and takes charge of reception of a signal through network <NUM> and decoding thereof, encoding of data to be transmitted, and transmission of an encoded signal through network <NUM>.

Controller <NUM> is an element mainly in charge of the data link layer, the network layer, and the transport layer of the OSI reference model, and takes charge of routing, error correction, retransmission processing, and the like.

Buffer <NUM> is a storage portion that temporarily stores data to be transmitted, received data, and the like.

Although <FIG> shows an exemplary configuration in which required processing is provided by processor <NUM> executing a program, the provided processing may be partially or entirely implemented using a dedicated hardware circuit (such as an ASIC or an FPGA, for example).

Since functional units <NUM> included in control device <NUM> and remote IO device <NUM> and coupler unit <NUM> included in remote IO device <NUM> in accordance with the present embodiment have known configurations, the detailed description thereof will not be repeated herein.

Next, an example of a functional configuration of security unit <NUM> included in control system <NUM> in accordance with the present embodiment will be described. <FIG> is a block diagram showing an exemplary functional configuration of security unit <NUM> included in control device <NUM> in accordance with the present embodiment.

Referring to <FIG>, security unit <NUM> includes a frame extraction module <NUM>, an analysis module <NUM>, a state acquisition module <NUM>, a detection module <NUM>, a notification module <NUM>, and a user authentication module <NUM>, as a functional configuration related to monitoring of a security event.

Frame extraction module <NUM> extracts, from network interface <NUM>, data (a frame or a packet) to be exchanged with an external device through network <NUM>. Frame extraction module <NUM> outputs the extracted frame or packet to analysis module <NUM>.

Analysis module <NUM> analyzes the frame or packet from frame extraction module <NUM>, and outputs an analysis result thereof to detection module <NUM>. The content of the analysis in analysis module <NUM> can be set arbitrarily. In the exemplary configuration shown in <FIG>, analysis module <NUM> can perform content analysis processing <NUM>, feature extraction processing <NUM>, and statistical processing <NUM>.

Content analysis processing <NUM> includes processing for acquiring information such as a network address (for example, an Internet Protocol (IP) address), a physical address (for example, a Media Access Control (MAC) address), a port number, or a transmission protocol of a transmission destination and a transmission source, with reference to header information in the frame or packet to be processed, or the like.

Feature extraction processing <NUM> includes processing for extracting a feature amount from the content of data included in the frame or packet to be processed.

Statistical processing <NUM> includes processing for calculating statistical information, such as transmission/reception timing and frequency of the frame or packet to be processed.

Information calculated by each processing is output, as the analysis result, to detection module <NUM>.

State acquisition module <NUM> acquires the state in CPU unit <NUM>, and outputs the acquired CPU unit state information to detection module <NUM>. The CPU unit state information indicates, for example, a certain change operation performed on CPU unit <NUM> (both an operation on software and an operation on hardware can be included).

Detection module <NUM> refers to security setting <NUM>, and determines whether the analysis result from analysis module <NUM> and/or the CPU unit state information from state acquisition module <NUM> match(es) a condition(s) for a predetermined security event. It should be noted that a specific example of the security event will be described later.

When the analysis result or the CPU unit state information matches any condition, detection module <NUM> determines that a security event of the type corresponding to the matched condition occurs, and outputs, to notification module <NUM>, a detection result indicating occurrence of the detected security event.

Detection module <NUM> registers information indicating the detected security event as history information <NUM>.

In response to the detection result from detection module <NUM>, notification module <NUM> provides a notification including a content corresponding to the occurred security event, to a notification destination corresponding to the occurred security event. Specific examples of the content of the notification and the notification destination will be described later.

User authentication module <NUM> performs authentication processing on a user who accesses security unit <NUM> through network <NUM>. User authentication module <NUM> outputs a user authentication result indicating the result of user authentication to detection module <NUM>.

By adopting the functional configuration as described above, security monitoring processing in accordance with the present embodiment can be achieved.

Next, some examples of the security event set in control system <NUM> in accordance with the present embodiment will be described.

First, a description will be given of an example of utilizing access control that limits transmission destinations and/or transmitting sources, as security setting <NUM>.

As an example of access control, a network address (for example, an IP address), a physical address (for example, an MAC address), a port number, or the like of a transmission destination and/or a transmission source can be used.

<FIG> is a diagram showing an example of an access control list (ACL) included in security setting <NUM>. <FIG> shows a white list that defines conditions for permitting access explicitly, and a black list that defines conditions for prohibiting access explicitly, as the access control list for achieving access control. However, it is not necessary to use these two types of lists, and only one of these may be used in accordance with the required security level or the like.

<FIG> shows an example using network addresses (IP addresses) of communication destinations. The white list in <FIG> defines IP addresses that are permitted to access CPU unit <NUM>, and the black list in <FIG> defines IP addresses that are prohibited to access CPU unit <NUM>.

<FIG> shows an example using physical addresses (MAC addresses) of communication destinations. The white list in <FIG> defines MAC addresses that are permitted to access CPU unit <NUM>, and the black list in <FIG> defines MAC addresses that are prohibited to access CPU unit <NUM>.

<FIG> shows an example using port numbers used for data communication with communication destinations. The white list in <FIG> defines port numbers that are permitted to access CPU unit <NUM>, and the black list in <FIG> defines port numbers that are prohibited to access CPU unit <NUM>.

When there is access from a device not defined in the white lists and there is access from a device defined in the black lists in <FIG>, it may be determined that a security event occurs. Monitoring of a security event using such an access control list is typically achieved by comparing the access control list with the analysis result output by content analysis processing <NUM> of analysis module <NUM> shown in <FIG>.

Some of the network address, the physical address, and the port number described above may be combined. For example, only a communication destination whose physical address and port number are both permitted to have access may be permitted to have access.

Thus, the security event in accordance with the present embodiment may include that any of a network address, a physical address, and a port number of a data transmission destination and/or a data transmission source is not included in a predetermined white list for permitted access, or is included in a predetermined black list for prohibited access.

Next, a description will be given of an example of monitoring a data reception pattern as security setting <NUM>. For example, security setting <NUM> for detecting a DoS (Denial of Service) attack that transmits a lot of request data and the like to make a service unavailable, or the like, may be adopted.

Considering a SYN flood attack or the like as an example of the DoS attack, such a case where SYN packets having a short reception interval (or packets having a size of a predetermined value or less) are continuously received over a predetermined period may be determined as a case where a security event occurs.

Monitoring of a security event using a data reception pattern is typically achieved by comparing the access control list with the feature amount output by feature extraction processing <NUM> of analysis module <NUM> shown in <FIG>. Thus, a data reception pattern defined by the type and the reception interval of received packets and the like may be defined as security setting <NUM>.

Thus, the security event in accordance with the present embodiment may include that the data reception pattern defined by the type and the reception interval of received packets and the like matches a predefined pattern.

Next, a description will be given of an example of monitoring a specific access pattern as security setting <NUM>.

For example, for known computer viruses, specific access patterns are often clarified. In such a case, the specific access patterns may be defined as security setting <NUM>. Then, when access corresponding to an access pattern defined in security setting <NUM> is received, it may be determined that a security event occurs.

Monitoring of a security event using such an access pattern is typically achieved by comparing the access control list with the feature amount output by feature extraction processing <NUM> of analysis module <NUM> shown in <FIG>. Thus, monitoring of a specific access pattern may be defined as security setting <NUM>.

Thus, the security event in accordance with the present embodiment may include that the pattern of access to control device <NUM> matches a predefined pattern.

Next, a description will be given of an example of monitoring a node change in the network as security setting <NUM>.

Generally, to the network to which control device <NUM> is connected, only predetermined devices (nodes) are connected, and a new device (node) is less likely to be added. Accordingly, a node change in the network can also be considered as a security event.

<FIG> is a schematic diagram showing an example of a node change in the network. Referring to <FIG>, a state where, in addition to control device <NUM>, display devices <NUM> and server device <NUM> are connected to network <NUM> is assumed as a standard node configuration. It is assumed that, to such a standard node configuration, a new device <NUM> is added, as shown in <FIG>.

When such addition of device <NUM> causes a change in the nodes in network <NUM>, it may be determined that a security event occurs.

Specifically, for example, a network address of each node in the standard node configuration is acquired beforehand as security setting <NUM>. Then, when a network address different from those of the nodes acquired beforehand is detected in network <NUM>, it can be determined that a node change in network <NUM> occurs. Alternatively, a node change may be detected based on a change in the number of nodes existing in network <NUM>, or the like.

It should be noted that, as the node change in network <NUM>, not only addition of a node but also removal of a node and the like may be detected. Further, as the node change in network <NUM>, not only a change in the number of nodes but also a change in topology may be detected.

When such a node change in the network occurs, it may be determined that a security event occurs.

Thus, the security event in accordance with the present embodiment may include that a node change in the network occurs.

Next, a description will be given of an example of monitoring connection to a network port of CPU unit <NUM> as security setting <NUM>.

In a configuration in which security unit <NUM> is connected to CPU unit <NUM>, CPU unit <NUM> is connected to network <NUM> through security unit <NUM>. Accordingly, use of the network port provided to CPU unit <NUM> itself is prohibited (network interface <NUM> shown in <FIG> is disabled).

When a certain network is connected to the network port of CPU unit <NUM> in such a state, it is assumed as an action with a certain intention. Accordingly, when network connection to such a disabled network port occurs, it may be determined that a security event occurs.

<FIG> is a schematic diagram illustrating monitoring of connection to the network port. Referring to <FIG>, on the surface of CPU unit <NUM>, a USB port 112P, a memory card slot 114P, a network port 118P, and field network ports 130P1 and 130P2 are arranged. Network port 118P is a port for network-connecting CPU unit <NUM>.

According to the invention, it is assumed that unused network port 118P is disabled during operation of control device <NUM>. When a cable is connected to network port 118P in such a state, it is determined that a security event occurs. It should be noted that, since network connection may be established during a halt or maintenance of control device <NUM>, the state that control device <NUM> is in operation may be added as a condition for determining that a security event occurs.

Such monitoring of connection to the network port is typically achieved by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment includes that, when network port 118P of CPU unit <NUM> is disabled, network port 118P is network-connected.

Next, a description will be given of an example of monitoring connection to the USB port of CPU unit <NUM> as security setting <NUM>.

For example, a support device is connected through the USB port of CPU unit <NUM> or the like. Such connection of the support device is assumed as an action with a certain intention. Accordingly, when network connection to such a disabled network port occurs, it may be determined that a security event occurs.

<FIG> is a schematic diagram illustrating monitoring of connection to the USB port. Referring to <FIG>, on the surface of CPU unit <NUM>, USB port 112P, memory card slot 114P, network port 118P, and field network ports 130P1 and 130P2 are arranged.

For example, when a certain device is connected through USB port 112P during operation of control device <NUM>, it may be determined that a security event occurs. It should be noted that, since the support device may be connected during a halt or maintenance of control device <NUM>, the state that control device <NUM> is in operation may be added as a condition for determining that a security event occurs.

Such monitoring of connection to the USB port is typically achieved by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment may include that an arbitrary device is connected to USB port 112P. It should be noted that connection of an arbitrary device such as the support device through arbitrary communication means, instead of the USB port, may be considered as a security event. Accordingly, the security event typically includes that the support device capable of developing the program (user program <NUM>) to be executed in control device <NUM> is connected to the control device.

Next, a description will be given of an example of monitoring a power supply state of control device <NUM> as security setting <NUM>.

For example, when supplying power is turned on/off during operation of control device <NUM>, it is assumed as an action with a certain intention. Accordingly, when supply power to control device <NUM> is turned on/off, it may be determined that a security event occurs.

It is also assumed that, in control device <NUM>, power is supplied from a common power source to CPU unit <NUM> and security unit <NUM>. In such a configuration, it is assumed that, when the power source is shut off, power supply to security unit <NUM> is also shut off.

In such a case, a battery or the like may be arranged inside security unit <NUM>, and even when external power source is shut off, security monitoring may be continued using electric power from the battery.

Monitoring of the power supply state of control device <NUM> is typically achieved by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment may include that the power supply state of control device <NUM> changes.

Next, a description will be given of an example of monitoring the state of a hard switch provided to control device <NUM> as security setting <NUM>.

For example, when a DIP switch (generally used to set an operation mode of CPU unit <NUM> or the like) provided to CPU unit <NUM> is operated during operation of control device <NUM>, it is assumed as an action with a certain intention. Accordingly, when the hard switch (for example, the DIP switch) of CPU unit <NUM> is operated, it may be determined that a security event occurs.

It should be noted that examples of the hard switch of CPU unit <NUM> include not only the DIP switch, but also a rotary switch, a toggle switch, and the like.

Such monitoring of the state of the hard switch provided to control device <NUM> is typically achieved by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment may include that the state of the hard switch provided to control device <NUM> changes.

Next, a description will be given of an example of monitoring an ambient environment of control device <NUM> as security setting <NUM>.

Generally, control device <NUM> is accommodated in a control board or the like to have a temperature which is equal to or less than a predetermined upper limit temperature. However, when a suspicious person performs an action such as stopping a cooling fan for the control board, the temperature in the control board may increase. When such a change occurs in the ambient environment during operation of the control device, it may be determined that a security event occurs. As a specific example, if the maximum rating temperature is <NUM>, when a temperature lower than that, for example <NUM>, is reached, it may be determined that a security event occurs.

Such monitoring of the ambient environment of control device <NUM> is typically achieved by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment may include that the ambient environment of control device <NUM> satisfies a predetermined condition.

Next, a description will be given of an example of monitoring an authentication result of user authentication performed when accessing CPU unit <NUM> from the support device, as security setting <NUM>.

<FIG> is a schematic diagram for illustrating processing when accessing CPU unit <NUM> from a support device <NUM>. Referring to <FIG>, when accessing CPU unit <NUM> from support device <NUM>, they are connected, and then the user inputs authentication information (typically, a user name and a password), utilizing support device <NUM>. CPU unit <NUM> performs authentication processing based on the authentication information from the user. Then, CPU unit <NUM> returns an authentication result to support device <NUM>. When authentication processing succeeds, CPU unit <NUM> permits access from support device <NUM>.

On the other hand, when authentication processing fails, there is a possibility of unauthorized access, so it may be determined that a security event occurs. That is, it may be determined that a security event occurs, using a failure in authentication processing when accessing CPU unit <NUM> from support device <NUM> as a trigger.

It should be noted that, since a failure in authentication processing may be due to a simple input error, it may be determined that a security event occurs, only when authentication processing when accessing CPU unit <NUM> from support device <NUM> continuously fails a plurality of times.

Such monitoring of the authentication result of user authentication when accessing CPU unit <NUM> from support device <NUM> is typically achieved by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment may include that user authentication required when accessing control device <NUM> or CPU unit <NUM> from the outside fails.

Next, a description will be given of an example of monitoring an authentication result of user authentication performed when accessing security unit <NUM> from the network, as security setting <NUM>.

As shown in <FIG> described above, security unit <NUM> has user authentication module <NUM>, and user authentication is performed when accessing security unit <NUM> through network <NUM>.

Also when this user authentication fails, it may be determined that a security event occurs, using a failure in authentication processing as a trigger, as in the processing described above. That is, the security event in accordance with the present embodiment may include that user authentication required when accessing control device <NUM> or CPU unit <NUM> from the outside fails.

Next, a description will be given of an example of monitoring addition and update of a program to be executed in CPU unit <NUM> and/or change of setting, as security setting <NUM>.

<FIG> is a schematic view for illustrating processing for changing a program and/or setting stored in CPU unit <NUM>, from support device <NUM>. Referring to <FIG>, the user creates or modifies an arbitrary user program on support device <NUM>, and then transfers the created or modified user program to CPU unit <NUM>. Thereby, the user program is newly installed in CPU unit <NUM>, or the already stored user program is updated.

Alternatively, the user can also change setting held in CPU unit <NUM> by operating support device <NUM>.

Since such addition of a program to CPU unit <NUM>, update of a program to be executed in CPU unit <NUM>, change of setting in CPU unit <NUM>, and the like change the behavior of CPU unit <NUM>, it may be determined that a security event occurs, using execution of such an operation as a trigger.

Further, support device <NUM> can clear all working data held in main memory <NUM> of CPU unit <NUM>. By such all clearing, the program in CPU unit <NUM> starts to be executed in an initial state. Since such execution from the initial state may exhibit a behavior different from a previous behavior, it may be determined that a security event occurs.

An event such as addition and update of a program and/or change of setting in CPU unit <NUM> is typically detected by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>. Similarly, an event such as all clearing of main memory <NUM> of CPU unit <NUM> is also detected by monitoring the CPU unit state information output by state acquisition module <NUM> shown in <FIG>.

Thus, the security event in accordance with the present embodiment may include that any of addition and change of the program to be executed in control device <NUM> and change of setting in control device <NUM> occurs. Further, the security event in accordance with the present embodiment may include that an operation such as all clearing of main memory <NUM> of CPU unit <NUM> is executed.

Next, some examples of the notification in response to detection of occurrence of a security event will be described.

First, a description will be given of a configuration in which occurrence of a security event is notified using an e-mail from security unit <NUM>.

<FIG> is a schematic diagram for illustrating an example of an e-mail transmitted from security unit <NUM> in accordance with the present embodiment. Referring to <FIG>, a display screen <NUM> of the e-mail includes a subject display column <NUM>, a transmission source display column <NUM>, a reception date and time column <NUM>, and a body text column <NUM>, included in the e-mail from security unit <NUM>.

Subject display column <NUM> displays a message notifying occurrence of a security event, and information for specifying control device <NUM> in which the security event occurs. Transmission source display column <NUM> displays information indicating a service of security unit <NUM> which is a transmission source of the e-mail. Reception date and time column <NUM> displays a reception date and time of the e-mail from security unit <NUM>.

Body text column <NUM> displays information such as a code for specifying the content of the occurred security event, and an occurrence time, an occurrence location, and urgency thereof.

Further, link information <NUM> for checking the details of the occurred security event may be embedded in body text column <NUM>. The user can acquire detailed information of the occurred security event by selecting link information <NUM> and thereby accessing security unit <NUM> which is the transmission source of the e-mail, or an arbitrary server device collecting information from security unit <NUM>.

The content of the e-mail shown in <FIG> is exemplary, and an arbitrary content may be notified using an e-mail.

It should be noted that the notified e-mail can be viewed by an arbitrary device. Examples of the arbitrary device include a personal computer, a smart phone, a tablet, and the like.

Thus, when security unit <NUM> in accordance with the present embodiment detects occurrence of a certain security event, security unit <NUM> provides a notification about the detected security event to the outside, using means such as an e-mail.

Next, a description will be given of a configuration in which occurrence of a security event is notified from security unit <NUM> to display device <NUM>.

<FIG> is a schematic diagram for illustrating an example of a notification about a security event from security unit <NUM> to display device <NUM> in accordance with the present embodiment. Referring to <FIG>, screen display for operation is provided on a display of display device <NUM>. In the screen display, in addition to an object <NUM> indicating a control target, an object <NUM> indicating the control board accommodating control device <NUM> may be displayed.

When occurrence of a certain security event is detected in a state where such a user interface screen is displayed, an object <NUM> indicating the content of the notification may be popped up for display at a position corresponding to the control board accommodating control device <NUM> where the security event occurs.

Object <NUM> may display a message indicating occurrence of the security event, as well as an occurrence date and time of the security event, urgency thereof, and the like. The display is not limited to the exemplary display in <FIG>, and more information may be displayed, or conversely, a simpler display content may be provided.

Further, notification sound <NUM> for notifying occurrence of a security event may be provided from display device <NUM>.

It should be noted that display device <NUM> as a notification destination is not limited to a display device connected to the same network as that to which security unit <NUM> is connected. Display device <NUM> connected to any network may be used as a notification destination, as long as security unit <NUM> can communicate therewith.

Thus, when security unit <NUM> in accordance with the present embodiment detects occurrence of a certain security event, security unit <NUM> provides a notification about the detected security event to a network-connected display device.

Next, a description will be given of a configuration in which occurrence of a security event is notified from security unit <NUM> to a database or a cloud service.

<FIG> is a schematic diagram for illustrating an example of providing a notification about a security event from security unit <NUM> to a database in accordance with the present embodiment. Referring to <FIG>, for example, processing as a database is implemented in server device <NUM> connected to network <NUM>, and when security unit <NUM> detects occurrence of a certain security event, security unit <NUM> provides a notification about the content thereof to server device <NUM>.

Server device <NUM> sequentially collects the contents of notifications from security unit <NUM>. Then, in response to a request (query) from the outside, server device <NUM> may return the content of a specified security event.

Although <FIG> shows an example where server device <NUM> connected to network <NUM> serves as a notification destination, the notification destination is not limited to such server device <NUM>, and a notification about a security event may be provided to an arbitrary server device on the Internet (that is, to a cloud service).

Utilizing the cloud service eliminates the need to prepare server device <NUM> solely for the purpose of monitoring a security event.

Thus, when security unit <NUM> in accordance with the present embodiment detects occurrence of a certain security event, security unit <NUM> provides a notification about the detected security event to a network-connected database/cloud service.

Next, a description will be given of a configuration in which occurrence of a security event is notified from security unit <NUM> to another control device.

<FIG> is a schematic diagram for illustrating an example of providing a notification about a security event from security unit <NUM> to another control device in accordance with the present embodiment. Referring to <FIG>, for example, there is assumed a configuration in which a plurality of control devices <NUM> are connected to the same network <NUM> and each control device <NUM> has security unit <NUM>.

When one security unit <NUM> detects occurrence of a certain security event, that security unit <NUM> provides a notification about the content of the detected security event to security unit <NUM> of another control device <NUM>. Security unit <NUM> receiving notifications from the other security unit <NUM> sequentially collects the contents of the notifications.

By adopting such a configuration, mutual detection of a security event between security units <NUM> can be performed.

Further, the other control device <NUM> receiving the notification about the security event may provide a certain physical alert (such as sound, light, or vibration) in accordance with the urgency of the notification or the like, using a connected field device.

Thus, when security unit <NUM> in accordance with the present embodiment detects occurrence of a certain security event, security unit <NUM> provides a notification about the detected security event to the other control device <NUM> which is network-connected.

Next, a description will be given of a configuration in which an event notification about occurrence of a security event is provided from security unit <NUM> through the network.

<FIG> is a schematic diagram for illustrating an example of providing an event notification from security unit <NUM> through the network in accordance with the present embodiment. Referring to <FIG>, there is assumed a configuration in which an alert unit <NUM> for providing an alert about occurrence of a security event is arranged on network <NUM>.

When security unit <NUM> detects occurrence of a certain security event, security unit <NUM> sends a notification packet to alert unit <NUM> through network <NUM>. When alert unit <NUM> receives the notification packet from security unit <NUM>, alert unit <NUM> starts a physical alert (such as sound, light, or vibration) in accordance with the content of the notification packet.

As the notification packet, for example, a simple network management protocol (SNMP) trap or the like can be utilized. In addition to an SNMP trap, any protocol may be adopted, as long as it can provide an event notification.

By adopting such a configuration, the alert unit arranged at any position on the network can be notified of occurrence of a security event.

Thus, when security unit <NUM> in accordance with the present embodiment detects occurrence of a certain security event, security unit <NUM> may provide an event notification about the detected security event through the network. Upon receiving such an event notification, alert unit <NUM> arranged on the network may start alert operation.

As described above, in control system <NUM> in accordance with the present embodiment, one or a plurality of state values or events is/are monitored to determine whether a security event occurs. Generally, each security event has urgency and/or priority in accordance with each event, and the security events do not necessarily have the same urgency and/or priority.

Thus, urgency and/or priority may be set beforehand for each security event to be monitored, and when occurrence of a certain security event is detected, the urgency and/or priority of the detected security event may also be notified.

As a method for notifying such urgency and/or priority, text information as shown in <FIG> and <FIG> described above may be used. Alternatively, when alert unit <NUM> as shown in <FIG> is used, urgency and/or priority may be notified by changing a color, a lighting pattern, a sound tone, a sound volume, or the like provided by alert unit <NUM>.

By providing a notification about the urgency and/or priority of the detected security event, the user who receives the notification can immediately understand with what degree of urgency and/or priority the user should handle the detected security event.

Next, a description will be given of an example of a processing procedure for monitoring a security event in security unit <NUM> in accordance with the present embodiment.

<FIG> is a flowchart showing a processing procedure for monitoring a security event in security unit <NUM> in accordance with the present embodiment. Each step shown in <FIG> is typically achieved by processor <NUM> of security unit <NUM> executing firmware <NUM>. The processing procedure shown in <FIG> is repeatedly performed for each predetermined cycle, or is performed each time a predetermined event occurs.

Referring to <FIG>, security unit <NUM> determines whether data transmission/reception through network <NUM> occurs (step S100). When data transmission/reception through network <NUM> does not occur (NO in step S100), processing in steps S102 to S106 is skipped.

When data transmission/reception through network <NUM> occurs (YES in step S100), security unit <NUM> determines whether a data transmission destination and/or a data transmission source are/is limited by access control (step S102). When the data transmission destination and/or the data transmission source are/is limited by access control (YES in step S102), security unit <NUM> determines that a security event occurs (step S104). Then, notification processing defined in step S120 is performed.

When the data transmission destination and/or the data transmission source are/is not limited by access control (NO in step S102), security unit <NUM> determines whether a pattern of data transmission or reception matches a pattern from which it is determined that a predetermined security event occurs (step S106). When the pattern of data transmission or reception matches the pattern from which it is determined that a predetermined security event occurs (YES in step S106), security unit <NUM> determines that a security event occurs (step S104). Then, notification processing defined in step S120 is performed.

Subsequently, security unit <NUM> acquires the CPU unit state information from CPU unit <NUM> (step S108), and determines whether the acquired CPU unit state information matches a condition for any security event defined in security setting <NUM> (step S110). When the acquired CPU unit state information matches the condition for any security event (YES in step S110), security unit <NUM> determines that a security event occurs (step S104). Then, notification processing defined in step S120 is performed.

When the acquired CPU unit state information does not match the condition for any security event (NO in step S110), processing ends.

In step S120, security unit <NUM> performs notification processing in accordance with the detected security event. Then, processing ends.

In control system <NUM> in accordance with the present embodiment described above, the configuration of connecting security unit <NUM> to CPU unit <NUM> is illustrated. However, instead of such a separate-type configuration, a configuration in which the both units are integrated with each other may be adopted. In this case, a configuration of software implementation and/or hardware implementation for achieving processing provided by security unit <NUM> is arranged within CPU unit <NUM>.

By adopting such an integral-type configuration, space-saving of the entire control system can be achieved.

In control system <NUM> in accordance with the present embodiment described above, the configuration of establishing network connection utilizing a network port of security unit <NUM> instead of the network port of CPU unit <NUM> is illustrated. However, when the processing for monitoring a security event in accordance with the present embodiment is applied to an existing control device, an externally attached-type security unit may be adopted.

<FIG> is a schematic diagram showing a schematic configuration of a control system 1A in accordance with a variation of the present embodiment. Referring to <FIG>, in control system 1A, a control device 2A includes CPU unit <NUM> and one or a plurality of functional units <NUM>. A security unit 200A is arranged to mediate between network <NUM> and control device 2A.

More specifically, security unit 200A has two network ports, one network port being connected to network <NUM>, and the other network port being connected to network port 118P of CPU unit <NUM> included in control device 2A. In such a configuration, CPU unit <NUM> performs data communication with devices connected to network <NUM>, through security unit 200A.

Security unit 200A can constantly monitor whether a security event occurs, by monitoring data sent from CPU unit <NUM> and data received by CPU unit <NUM>.

Security unit 200A may further be connected to CPU unit <NUM> through another data transmission means. By adopting such other data transmission means, security unit 200A can acquire the CPU unit state information of CPU unit <NUM>. Based on such CPU unit state information, security unit 200A can also constantly monitor occurrence of a security event caused by direct access to CPU unit <NUM>.

The security unit in accordance with the present embodiment may be implemented in any configuration, as long as it can monitor occurrence of a security event in CPU unit <NUM> and control device <NUM> including CPU unit <NUM>.

The control device and the control system in accordance with the present embodiment can solve a new problem of protection against a threat which may occur with the advance of networking of or incorporation of intelligence into the control device and the control system.

Claim 1:
A control device (<NUM>) configured to control a control target, the control device (<NUM>) comprising:
a first unit (<NUM>) including
a program execution module (<NUM>) configured to execute a program created depending on the control target and
a port (118P) for network connection;
a second unit (<NUM>) including a detection module (<NUM>) configured to determine whether a security event occurs in access from outside to the control device;
a state acquisition module (<NUM>) configured to monitor connection to the port (118P); and
a notification module (<NUM>) configured to provide a notification, upon detection of occurrence of the security event, to a notification destination corresponding to the occurred security event, wherein
the notification module (<NUM>) is configured to provide the notification when the security event occurs including connecting a network cable to said port (118P) while said port (118P) is a disabled port.