Control device, recording method, and recording medium having program recorded thereon

Abstract

A control device, a recording method, and a recording medium having a program recorded thereon. The control device records information related to communication with a device, and records information associated with the control of the recorded action. The control device comprises: a first connector connected to a first network to which a controlled object belongs; a second connector connected to a second network to which the device belongs; a control operation unit that performs control operation processing; and a communication unit that exchanges data with the device through secure communication via the second network, and the control device records information associated with the secure communication, and records information associated with the control of the recorded action.

Description

Technical Field

[0001] The present disclosure relates to a control device for controlling an object, a recording method, and a recording medium having a program recorded thereon, and in particular to a control device for managing a communication log, a recording method, and a recording medium having a program recorded thereon. Background Art

[0002] In the manufacturing site of FA (Factory Automation), network-connected control devices such as PLC (Programmable Logic Controller) have the function of controlling objects such as production equipment and equipment, and the communication function of exchanging control-related data with external devices including other control devices via the network. The control device controls the object using the data exchanged with the external device.

[0003] For example, Japanese Patent Publication No. 2011-35664 discloses a function of a controller for FA connected to a network to monitor data communicated with devices via the network. In Japanese Patent Publication No. 2011-35664, the controller for FA determines whether there is an abnormality in the network, monitors data communicated with devices connected to the network, and when an abnormality is detected, keeps the previously monitored data in a ring buffer.

[0004] In order to safely use the equipment and machinery used at the manufacturing site, it is desirable to manage the security of the network that exchanges data with external devices. In such security management, information related to the communication between the control device connected to the network and the external device is recorded, and the recorded information is analyzed. At the manufacturing site, in order to more accurately support the analysis, there is a need to track the recording action while recording the communication-related information, and to obtain information associated with the control of the recording action. In this regard, Japanese Patent Gazette No. 2011-35664 is limited to monitoring the data communicated between the devices connected to the network and maintaining it in a ring buffer, and does not propose a structure for obtaining information associated with the control of the monitored action. Summary of the invention

[0005] An object of the present disclosure is to provide an environment in which it is possible to record information related to communication between a control device connected to a network and an external device, and also to record information related to control of the recording operation.

[0006] In an example of FA (factory automation) control device disclosed in the present invention, there is provided: a first connector, which is connected to a first network to which a controlled object belongs; a second connector, which is connected to a second network to which an external device belongs; a control operation unit, which uses data related to the control of the object to perform control operation processing; a communication unit, which exchanges data with the external device through secure communication via the second network; a first recording unit, which records information associated with the secure communication implemented by the communication unit; and a second recording unit, which records information associated with the control of the recording action of the first recording unit.

[0007] According to the present disclosure, it is possible to record information related to secure communication between a control device connected to a network and an external device, and it is also possible to record information related to control of the recording operation.

[0008] In the above disclosure, the control device further includes a storage medium interface to which an external storage medium is detachably mounted, and the first recording unit stores information related to the secure communication in the external storage medium mounted on the storage medium interface.

[0009] According to the present disclosure, information related to safety communication can be recorded via an external storage medium installed in a storage medium interface, and the control device can provide the information in the external storage medium for analysis without interrupting control operations.

[0010] In the above disclosure, the second recording unit stores information related to control of the recording operation in a storage medium different from the external storage medium.

[0011] According to the present disclosure, since information related to control can be recorded in a storage medium different from an external storage medium, information related to control can be recorded regardless of the state of the external storage medium.

[0012] In the above disclosure, the first recording unit records information related to safety communication, excluding control-related data exchanged in safety communication.

[0013] According to the present disclosure, it is possible to remove encrypted data of control-related data exchanged in secure communication, that is, information not suitable for analysis, from information recorded as information associated with secure communication.

[0014] In the above disclosure, the information associated with the safety communication includes information on errors that occurred in the safety communication.

[0015] According to the present disclosure, errors occurring in the safety communication can be included as the recorded information associated with the safety communication.

[0016] In the above disclosure, the information related to secure communication includes conditions for establishing secure communication via the second network.

[0017] According to the present disclosure, conditions for establishing secure communication can be included as recorded information associated with secure communication.

[0018] In the present disclosure, information associated with secure communication includes information associated with establishment of a secure communication connection via the second network.

[0019] According to the present disclosure, in secure communication, information associated with establishment of a connection can be included in information associated with secure communication.

[0020] In the above disclosure, the information associated with the secure communication includes information associated with the session establishment after the connection establishment is performed.

[0021] According to the present disclosure, information associated with secure communication can include information associated with session establishment performed after connection establishment.

[0022] In the above disclosure, the information related to the control of the recording operation includes at least one of the start of the recording operation, the stop of the recording operation, the failure of the recording operation, and the setting related to the recording operation.

[0023] According to the present disclosure, as information related to control of a recording operation, at least one of the start of the recording operation, the stop of the recording operation, the failure of the recording operation, and the setting related to the recording operation can be recorded.

[0024] In the above disclosure, the setting related to the recording operation includes a setting for enabling or disabling the recording operation.

[0025] According to the above disclosure, the information related to the control of the recording operation can include settings for enabling or disabling the recording operation.

[0026] In the above disclosure, the information related to the safety communication recorded by the first recording unit and the information related to the control of the recording operation recorded by the second recording unit are given a time stamp on the common time axis when they are recorded.

[0027] According to the above disclosure, even if information related to secure communication and information related to control of recording operations are recorded by different recording units, the two can be associated with each other by using time stamps on a common time axis.

[0028] According to an example of the present disclosure, a recording method performed by a control device of FA (factory automation) is provided. The control device has: a first connector, which is connected to a first network to which a controlled object belongs; a second connector, which is connected to a second network to which an external device belongs; a control operation unit, which uses data related to the control of the object to perform control operation processing; and a communication unit, which exchanges data with the external device through secure communication via the second network. The recording method has the following steps: recording information associated with secure communication implemented by the communication unit; and recording information associated with the control action of recording information associated with secure communication.

[0029] By implementing the method of the present disclosure, it is possible to record information related to secure communication between a control device connected to a network and an external device, and also to record information related to control of the recording operation.

[0030] In another example of the present disclosure, there is provided a program for causing a computer to execute a recording method performed by a control device of FA (factory automation).

[0031] The control device comprises: a first connector connected to a first network to which a controlled object belongs; a second connector connected to a second network to which an external device belongs; a control operation unit that performs control operation processing using data related to control of the object; and a communication unit that exchanges data with the external device through secure communication via the second network. The recording method comprises the following steps: recording information associated with secure communication performed by the communication unit; and recording information associated with control of the recording action of the information associated with secure communication.

[0032] By executing the program of the present disclosure on a computer, it is possible to implement recording of information related to secure communication between a control device connected to a network and an external device, and also to implement recording of information related to control of the recording operation.

[0033] The foregoing and other objects, features, aspects and advantages of the present invention will become more apparent from the following detailed description of the present invention when read in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a diagram schematically showing the configuration of safety communication and recording in the control device according to the present embodiment.

[0035] Figure 2 Schematic diagram showing the system 1 according to the present embodiment.

[0036] Figure 3 It is a schematic diagram showing the hardware configuration of the processing unit 10 of the PLC according to the present embodiment.

[0037] Figure 4 It is a schematic diagram showing an example of the software structure installed in the processing unit 10 of the PLC according to this embodiment.

[0038] Figure 5 It is a diagram showing the model of the Pub / Sub communication according to this embodiment.

[0039] Figure 6 It is a diagram showing the module structure of the PLC according to this embodiment in association with peripheral devices.

[0040] Figure 7 It is a diagram schematically showing the communication sequence of the embodiment of the present invention.

[0041] Figure 8 It is a diagram showing an overview of the security communication log 151 according to this embodiment.

[0042] Fig. 9 It is a diagram showing an overview of the event log 152 according to this embodiment.

[0043] Fig.10 It is a diagram showing an example of the settings related to the security communication log 151 according to this embodiment.

[0044] Fig.11 It is a diagram schematically showing an example of the recording method of the security communication log 151 according to this embodiment.

[0045] Fig.12 It is a diagram schematically showing an example of the recording method of the event log 152 according to this embodiment.

[0046] Fig.13 It is a flowchart of the security communication process according to this embodiment.

[0047] Fig.14 It is a flowchart of the security communication process according to this embodiment.

[0048] Fig.15 It is a diagram showing an example of the information monitored in the security communication according to this embodiment. Detailed Embodiment

[0049] This embodiment will be described in detail with reference to the accompanying drawings. In addition, the same or corresponding parts in the drawings are denoted by the same reference numerals and their description will not be repeated.

[0050] <A. Application Example>

[0051] First, with reference to Figure 1 , an example of the scenario to which the present invention is applied will be described. Figure 1Schematically showing the configuration of secure communication and logging in the control device of this embodiment. In this embodiment, "secure communication" means secure socket communication using so-called socket communication that is realized by executing a socket (function or program).

[0052] In this embodiment, the control device is an industrial controller such as a PLC (Programmable Logic Controller). In the following description, as a typical example of a "control device", a PLC applicable to FA is described as a specific example, but it is not limited to PLC, and the technical ideas disclosed in this specification can be applied to any control device.

[0053] Reference Figure 1 The PLC 100 communicates with one or more field devices as any control object (e.g., manufacturing equipment or devices of FA) via a field network 411 such as Ethernet / IP (registered trademark). The one or more field devices respectively include: an actuator 7 that imparts a certain physical effect to a production line including a production process (hereinafter also collectively referred to as "field"); and an input / output device 6 that includes a sensor that exchanges information with the field. In addition, the field device may also include a robot controller that controls an industrial robot.

[0054] The PLC 100 communicates with external devices via a network 400. The external devices include a cloud-based external server 300 or an on-premises server 310 described later. In addition, the external devices may also include other PLCs 100.

[0055] The PLC 100 includes: a control operation unit 60 that performs control operation processing for controlling an object using control data 70 associated with the control; a communication module 61 and a secure socket communication module 71 that exchange control data 70 with an external device through secure communication via a network 400; and a log writer 117 that is provided in association with the secure socket communication module 71. These respective parts can be composed of a program module realized by the PLC 100 executing a program, a hardware circuit module, or a combination of a program module and a hardware circuit module.

[0056] More specifically, the control operation unit 60, the communication module 61 and the secure socket communication module 71 are implemented by executing the control program 171, the communication program 172 and the secure socket communication program, respectively. In the present embodiment, the secure socket communication program of the secure socket communication module 71 is implemented by combining the TCP (Transmission Control Protocol) socket and the OpenSSL (Secure Sockets Layer) program. When the secure socket communication program is executed, the secure socket communication module 71 implements TCP / IP (Internet Protocol) socket communication between the PLC 100 and the external device, and implements encrypted communication using OpenSSL in the socket communication. The secure socket communication module 71 implements encrypted communication by calling (executing) various functions for communication that complies with the SSL protocol and the TLS (Transport Layer Security) protocol from the library provided by OpenSSL. Hereinafter, the functions of the library provided by OpenSSL are also referred to as "library functions".

[0057] The secure socket communication module 71 includes a log detection unit 179. The log detection unit 179 detects information of a predetermined type in secure communication, and outputs the detected information together with a recording instruction to the first recording unit 118 of the log writer 117. The first recording unit 118 implements a secure communication record 118a, which is a process of saving information in a storage area of ​​the SD card 150 according to the recording instruction from the log detection unit 179. Therefore, the predetermined type of information detected in secure communication is recorded in the storage area of ​​the SD card 150, and the secure communication log 151 of the SD card 150 constitutes historical information associated with secure communication.

[0058] In the present embodiment, the predetermined types of information detected by the secure socket communication module 71 during secure communication include parameters of a TLS session indicating network connection conditions and a communication error output from an executed library function.

[0059] The log detection unit 179 of the secure socket communication module 71 detects a predetermined type of event associated with the control of the recording operation of the first recording unit 118, and outputs the information of the detected event together with the recording instruction to the second recording unit 119 of the log writer 117. The second recording unit 119 implements event recording 119a according to the recording instruction from the recording detection unit 179, and the event recording 119a is a process of storing information in a storage medium different from the SD card 150, for example, in a storage area of ​​the non-volatile memory 106. Thus, the event information of the predetermined type detected in association with the operation of the recording process of the first recording unit 118 is recorded in the storage area of ​​the non-volatile memory 106 to form an event log 152. In addition, the non-volatile memory 106 that stores the event log 152 may also be composed of an external storage medium.

[0060] In this embodiment, a general-purpose protocol such as SSL / TLS is used as secure communication, but the present invention is not limited thereto. For example, any protocol for ensuring security implemented in OPC UA (OPC Unified Architecture), which is a communication standard for industrial IoT, may be used.

[0061] As described above, when the PLC 100 performs safety communication with an external device, the safety communication record 118a for recording information related to the safety communication is performed to obtain the safety communication log 151, and the event record 119a for recording information of an event detected in association with the control of the recorded action is performed to obtain the event log 152. Therefore, in the PLC 100, an environment is provided in which the recording of information related to the safety communication between the PLC 100 connected to the network and the external device, and the recording of information related to the control of the recorded action can be performed.

[0062] By providing the above-mentioned recording environment, when the user analyzes the secure communication log 151 of the SD card 150, the soundness of the secure communication can be evaluated. For example, by analyzing the secure communication log 151, the user can determine whether there is a fault based on the error that occurs in the secure communication, and can also obtain information on how to deal with the fault by analyzing the error. When using free software such as OpenSSL for secure communication, the operation of the library function cannot be guaranteed, so obtaining the secure communication log 151 has technical significance.

[0063] In addition, as information for assisting in the analysis of the security communication log 151, the user can utilize the event log 152, which represents information related to the control of the recording actions of the security communication log 151. For example, when analyzing, the user can track the occurrence status of the events shown in the event log 152 to determine the reliability of the recording actions themselves implemented to obtain the security communication log 151.

[0064] Hereinafter, as a more specific application example of the present invention, a more detailed structure and processing of the PLC 100 of the present embodiment will be described.

[0065] <B. System Structure>

[0066] First, a system including the PLC 100 of the present embodiment will be described.

[0067] Figure 2 is a schematic diagram showing the system 1 of the present embodiment. The system 1 of the present embodiment includes a plurality of PLCs 100 (PLC1, PLC2, PLC3) that are network-connected via the network 410. The plurality of PLCs communicate with the server 300 as an external device via the network 400. In Figure 1 this, three PLCs are provided in the system 1, but as long as there are multiple PLCs, it is not limited to three.

[0068] Figure 2 The system 1 of

[0069]

[0070] ​Each PLC includes a processing unit 10 that is the main body for executing programs, a power supply unit 12 that supplies power to the processing unit 10 and the like, and an IO (Input / Output) unit 14 that exchanges signals from the field. The IO unit 14 is connected to the processing unit 10 via a system bus 11. Typically, the IO unit 14 obtains input signals from an input / output device 6 that is a field device, and drives an actuator 7 that is a field device based on the execution result of the program in the processing unit 10. The input / output device 6 detects, for example, the control amount of the actuator. The input / output device 6 and the actuator 7 constitute the devices that are the "objects" controlled by the PLC.

[0071] The support device 200 provides an environment for developing application programs executed by the PLC, and has functions such as monitoring the operating state of the target PLC to be connected or the values of various data, or setting various information. The developed programs or various information can also be downloaded to the PLC 100 via a CD-ROM (Compact Disk-Read Only Memory) 301, or via a USB (Universal Serial Bus) network 13.

[0072] <C. Hardware Structure>

[0073] Next, the hardware structure of the PLC will be described. Figure 3 is a schematic diagram showing the hardware structure of the processing unit 10 of the PLC according to the present embodiment. Refer to Figure 3 , the processing unit 10 includes a processor 50, a chipset 102, a main memory 104, a non-volatile memory 106, a system timer 108, an optical reader / writer 90 for reading and writing data of a CD-ROM (Compact Disk-Read Only Memory) 91, a system bus controller 120, a network connector 145, a network controller 149, a USB connector 110, and an R / W (Reader Writer) 101. The chipset 102 is combined with other components via various buses respectively. The R / W 101 constitutes a storage medium interface circuit for detachably mounting an SD card 150, and reads and writes data to the mounted SD card 150.

[0074] The processor 50 and the chipset 102 are typically configured based on a general computer architecture. That is, the processor 50 interprets and executes command codes sequentially supplied from the chipset 102 according to an internal clock. The chipset 102 exchanges internal data with various connected components, and generates command codes required by the processor 50. In addition, the chipset 102 has a function of caching data obtained as the execution result of arithmetic processing in the processor 50 and the like.

[0075] The processing unit 10 has a main memory 104 and a nonvolatile memory 106 as memories.

[0076] The main memory 104 is a volatile storage area, and stores various programs to be executed by the processor 50 after the processing unit 10 is powered on. The main memory 104 is also used as a work memory when the processor 50 executes various programs. As such a main memory 104, a device such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory) is used.

[0077] The nonvolatile memory 106 stores a real-time OS (Operating System), a system program, an application program installed from the support device 200 , and various information in a nonvolatile manner.

[0078] These programs and data are copied to the main memory 104 in a manner that allows the processor 50 to access them as needed.

[0079] The processing unit 10 has a system bus controller 120 and a network controller 149 as communication interfaces. These communication interfaces transmit output data and receive input data.

[0080] The system bus controller 120 controls data exchange via the system bus 11. More specifically, the system bus controller 120 includes a DMA (Dynamic Memory Access) control circuit 122, a system bus control circuit 124, and a buffer memory 126. The system bus controller 120 is connected to the inside of the system bus 11 via a system bus connector 127. The system bus connector 127 constitutes a physical communication port for the PLC 100 to connect to a field network 411 to which the input / output device 6 and the actuator 7 such as a drive device belong.

[0081] The network controller 149 includes a DMA (Dynamic Memory Access) control circuit 148, a network control circuit 147, and a buffer memory 146 in order to control data exchange between external devices (other PLCs or server 300) via the network connector 145 and the network 410. The network connector 145 constitutes a physical communication port for the PLC 100 to connect to the network to which the external devices belong.

[0082] The network control circuit 147 performs a process of transmitting output data of the buffer memory 146 to an external device connected to the network 410 and a process of receiving input data and storing the data in the buffer memory 146 .

[0083] The USB connector 110 is a communication interface for connecting the support device 200 and the processing unit 10. Typically, programs, various data, settings, etc. that can be executed by the processor 50 of the processing unit 10 and are transmitted from the support device 200 are taken into the PLC 100 via the USB connector 110.

[0084] <D. Software Structure>

[0085] Next, the software structure of the PLC (processing unit 10) for providing various functions will be described.

[0086] Figure 4 It is a schematic diagram showing an example of the software structure installed in the processing unit 10 of the PLC of the present embodiment. Figure 4 The command codes included in the shown software are read out at appropriate timings and provided to the processor 50 of the processing unit 10 for execution.

[0087] Refer to Figure 4 , in the processing unit 10, programs required for the processing in the PLC 100 are installed on the real-time OS 190.

[0088] The real-time OS 190 is designed according to the computer architecture of the processing unit 10 and provides a basic execution environment for the processor 50 to execute the programs required for the processing in the PLC 100. More specifically, the real-time OS 190 cooperates with the scheduler 160 to implement the multitasking execution unit 191. The multitasking execution unit 191 provides an environment for switching the execution of tasks implemented by multiple programs over time. The scheduler 160 switches the tasks assigned to the processor 50 according to the priorities or periods of the tasks shown in the task control information 275. Thus, the processor 50 executes tasks according to the priorities or periods of the tasks shown in the task control information 275.

[0089] More specifically, a scheduler 160, a user program 170, an input processing module 173, an output processing module 174, a communication processing module 176, other system modules 178 that provide various services, a command execution module 180, and a memory manager 184 are installed in the processing unit 10. The memory manager 184 manages the data stored in the main memory 104. More specifically, for the variable data that defines various variables used in the user program 170 including the control program 171 and the communication program 172, it manages the reading and writing of the user program 170.

[0090] The scheduler 160, in association with multitasking control, controls the execution start timing and processing interrupts of the user program 170, the input processing module 173, the output processing module 174, and the communication processing module 176 according to the task control information 275.

[0091] The user program 170 is created by the user according to their control purpose. That is, it is a program arbitrarily designed according to the object production line (process), etc. controlled by the use system 1. The user program 170 corresponds to an executable form of program module generated by the support device 200, and includes a control program 171 and a communication program 172. The control program 171 may include programs for various control operation processes such as sequential processing and motion operation.

[0092] The communication program 172 communicates with other devices between network-connected external devices (server 300 or multiple PLCs 100), for example, in accordance with the publish / subscribe type of communication method. As a communication protocol for realizing data distribution of the publish / subscribe type communication model, in the present embodiment, the MQTT (Message Queuing Telemetry Transport) communication protocol that enables the server 300 to undertake the function of a broker is utilized. Hereinafter, the publish / subscribe type of communication is simply referred to as Pub / Sub communication. In addition, the communication method for exchanging data between network-connected external devices (server 300 or multiple PLCs 100) is not limited to Pub / Sub communication, and the utilized protocol is not limited to the MQTT communication protocol.

[0093] The input processing module 173 reconfigures the input data received by the system bus controller 120 into a form suitable for use by the user program 170. The output processing module 174 reconfigures the output data generated by the execution of the user program 170 into a form suitable for transmission to the system bus controller 120.

[0094] The communication processing module 176 controls the communication processing between the network controller 149 and other PLCs or the communication with the support device 200. The communication processing between other PLCs is achieved in cooperation with the execution of the communication program 172. The communication processing module 176 includes a secure socket communication module 71 that utilizes the library function 175.

[0095] The other system module 178 is a module that collectively represents one or more modules for realizing various functions of the PLC 1. The log writer 117 is provided in the system module 178 and is regarded as a module that cooperates with the communication processing module 176.

[0096] <An example of the model of Pub / Sub communication>

[0097] Figure 5 It is a diagram showing the model of Pub / Sub communication of the present embodiment. Refer to Figure 5 and, with Figure 2Taking the connection between PLC1 and PLC2 as an object, the model of Pub / Sub communication is described. In Figure 5 In it, the data published by PLC1 as the publisher is provided to PLC2 as the subscriber via Server 300 which is responsible for message distribution as the MQTT broker. In the TLS session, PLC1 and PLC2 use the IP address and port number of MQTT Server 300 as the parameters of the network connection conditions.

[0098] The publisher sends data with the topic of Server 300 as the sending destination. The publisher defines the topic as the sending destination in the form of a message with control-related data and sends the topic to Server 300.

[0099] The subscriber applies for the information of the topic distributed by Server 300 and receives the distribution of the message registered in the topic applied for distribution from Server 300. The subscriber can, for example, execute the user program 170 including the control program 171 using the control data 70 sent from the publisher.

[0100] Server 300 mediates the data exchange between the publisher and the subscriber. The subscriber makes a request to Server 300 to register the topic data. In addition, the publisher sends a message including the topic and data to Server 300.

[0101] Server 300 manages the topics applied for distribution by the subscriber. For example, when receiving a message including the topic and data from the publisher, Server 300 saves the message of the topic and then distributes the data of the topic to the requested subscriber.

[0102] In addition, Figure 5 The description can also be applied to the case where the data published by PLC2 is provided to PLC1 as the subscriber via Server 300.

[0103] <F. Module Structure of PLC Associated with Peripheral Devices>

[0104] Figure 6 It is a diagram showing the module structure of the PLC of this embodiment in association with peripheral devices. Refer to Figure 6The communication function module 9 possessed by the PLC 100 is composed of modules and data used by the PLC 100 to communicate with the server 300 constituting the MQTT proxy. The modules and data of the communication function module 9 include an executable communication program 172 and a secure socket communication module 71 developed (generated) by a program development tool 201 possessed by the support device 200, a CGI (Common Gateway Interface) 104 that accepts requests from the support device 200, a secure socket setting file 103, and a private key and certificate 203. The PLC 100 has a log writer 117, an OpenSSL module 138, and a TCP / IP module 139 in association with the communication function module 9. The secure socket setting file 103 and the private key and certificate 203 are stored in, for example, a non-volatile storage area of ​​the PLC 100.

[0105] The program development tool 201 of the user operation support device 200 generates a communication program 172 and transmits it to the PLC 100. The communication program 172 includes an MQTT-FB 204 and a secure socket communication command 205. The MQTT-FB 204 includes a plurality of FBs (Function Blocks) for implementing Pub / Sub communications that comply with the MQTT communication protocol. FBs are unit programs that constitute the communication program 172, and include, for example, functions having input parameters and output parameters. When the PLC 100 executes the communication program 172, based on the output of the FB from the publisher or subscriber of the MQTT-FB 204, the secure socket communication command 205 is called and executed. When the secure socket communication command 205 is executed, secure communication is implemented using the secure socket communication module 71.

[0106] The user operates the secure socket setting tool 202 of the support device 200. Based on the user operation, the support device 200 accepts a transmission setting instruction for transmitting and setting the private key and certificate 203 for secure communication in the PLC 100, and accepts an operation instruction for the secure socket communication module 71 and the log writer 117. The CGI 104 receives the above-mentioned transmission setting instruction and operation instruction transmitted from the secure socket setting tool 202 of the support device 200, and saves the settings related to the secure socket communication of the secure socket setting file 103 according to the received instructions, and sets the private key and certificate 203 in the PLC 100. In addition, the CGI 104 starts (or stops) the secure socket communication module 71 according to the operation instruction, and sets a log instruction based on the operation instruction of the log writer 117 in the secure socket communication module 71. The log instruction includes, for example, a start instruction for causing the log writer 117 to start recording or a stop instruction for stopping the recording in progress. The log writer 117 (more specifically, the first recording unit 118 ) starts or stops the recording operation in response to an instruction from the secure socket communication module 71 .

[0107] The data (including the control data 70) output from the communication program 172 is exchanged with the external device via the secure socket communication module 71. More specifically, the data output from the communication program 172 is output to the OpenSSL module 138 via the secure socket communication module 71. The OpenSSL module 138 implements encrypted communication using the private key and the certificate 203 via the TCP / IP module 139. The encrypted data 33 is transmitted to the server 300 via the firewall / router 32. The encrypted data 33 can also be transmitted to the on-premises server 310 as an MQTT proxy.

[0108] When the PLC 100 exchanges the encrypted data 33 with an external device such as the server 300 or the on-premises server 310, the log detection unit 179 of the secure socket communication module 71 monitors the information output by the library function of the OpenSSL module 138, detects information of a predetermined type indicated by the secure socket setting file 103 from the monitored information, and outputs the information of the secure communication log based on the detected information to the log writer 117 together with a recording instruction. The first recording unit 118 of the log writer 117 performs a process of saving the information from the log detection unit 179 to the secure communication record 118a in the SD card 150 according to the recording instruction. In addition, the log detection unit 179 of the secure socket communication module 71 monitors events related to the control of the recording operation of the first recording unit 118, detects the occurrence of a predetermined type of event indicated by the secure socket setting file 103 from the monitored events, and outputs the information of the detected event log to the log writer 117 together with a recording instruction. The second recording unit 119 of the log writer 117 performs a process of event recording 119a of saving the event log 152 in the non-volatile memory 106 according to the recording instruction from the log detection unit 179. A user can set the information or events of the above-mentioned predetermined type in the secure socket setting file 103 of the PLC 100 via the secure socket setting tool 202 or the CGI 104.

[0109] <G. Secure Communication Sequence>

[0110] Refer to Figure 7 , and describe the communication sequence of the secure communication. Figure 7 is a diagram schematically showing the communication sequence of the embodiment of the present invention. In Figure 7 , the communication sequence of the secure communication among the communication module 61 composed of the communication program 172, the secure socket communication module 71, and the server 300 is shown. In Figure 7 , the double-line arrow indicates encrypted communication. The secure socket communication module 71 performs the process of event recording 119a together with the process of Figure 7 .

[0111] Refer to Figure 7, the PLC 100 executes the communication establishment command 80 (TCPConnect) included in the secure socket communication command 205, generates a TCP socket through an open process via the secure socket communication module 71, then executes the communication termination command 84 (TCPClose) included in the secure socket communication command 205, and closes the TCP socket via the secure socket communication module 71. During the period from generating the TCP socket by executing the command 80 (TCPConnect) to executing the command 84 (TCPClose), TLS communication 73 is implemented.

[0112] In the TLS communication 73, the PLC 100 executes the command 731 (TLSConnect) for establishing a TLS session included in the secure socket communication command 205, and opens a secure session with the socket generated by the command 80 (TCPConnect) and the session ID as arguments.

[0113] Using the opened secure session, communications 74, 75, and 76 for mutually authenticating by exchanging keys and certificates between the PLC 100 and the server 300 are implemented. After implementing this authentication, using the opened secure session, encrypted data communication is implemented between the communication module 61 of the PLC 100 and the server application 320 of the server 300 via the secure socket communication module 71.

[0114] In this encrypted data communication, the PLC 100 executes the data sending command 732 (TLSWrite) and the data receiving command 733 (TLSRead) included in the secure socket communication command 205 to communicate with the server 300. When such data communication ends, the PLC 100 executes the session termination command 734 (TLSDisconnect) included in the secure socket communication command 205. Thereby, the TLS session ends, and then the PLC 100 executes the command 84 (TCPClose) to close the TCP socket.

[0115] <Overview of Secure Communication Logs>

[0116] Figure 8 It is a diagram showing an overview of the secure communication log 151 of the present embodiment. The secure communication log 151 includes a log category 801, a log code 802 for identifying the log, a log name 803, a log description 804, and log details 805.

[0117] The category 801 includes the category 800 indicating the network connection conditions of the TLS session (represented by INFO in the figure) and the errors in the secure communication of the TLS session (represented by ERROR in the figure) 810.

[0118] Regarding the connection conditions indicated by the logs corresponding to category 800, the logs with log code 802 of "1000" contain the hostname, IP address, and port number of the connection destination server 300. As Figure 5 shown, the IP address and port number are associated with the server 300, and the secure socket communication module 71 obtains the IP address and port number from the secure socket settings file 103 or the communication of the server 300, for example, when establishing a TLS session.

[0119] In addition, the logs with log codes 802 of "1001", "1002", and "1003" represent the file name of the certificate of the server 300, the file name of the client (PLC 100) certificate, and the file name of the private key of the client (PLC 100), respectively. These parameters are obtained when the secure socket communication module 71 exchanges keys and certificates with the server 300. Log codes 802 "1010" and "1011" represent the logs of the establishment and termination of the TLS session, that is, the logs indicating that the secure socket communication module 71 has established or terminated the TLS session.

[0120] The category 810 for classifying the errors output by the library functions of OpenSSL is assigned log codes 802 after "5000". The log with log code 802 "5000" represents the name of the library function that output the TLS session error and the error code output by the library function. The log with log code 802 "5001" represents the error of timeout in secure communication. The log with log code 802 "5002" represents the error information that occurred in the secure socket settings file, for example, representing the file name and line number of the secure socket settings file. The log with log code 802 "5101" represents the error information that occurred in the secure socket settings file, for example, representing the section, entry, setting value, etc. where the error was detected.

[0121] <I. List of Event Logs>

[0122] Fig. 9 is a diagram showing a list of the event logs 152 of the present embodiment. Refer to Fig. 9 , the event logs 152 are represented by the numbers 130 of No. 1, No. 2, and No. 3. The event logs 152 contain information on the event type 131 for identifying the log, the matters to be recorded for the event 132, the event category 133, the event code 134, the importance 135, and the importance change 136.

[0123] The event category 133 includes "system" and "access". The event category 133 is equivalent to the event type 131 of the log of "system", including the event of starting (starting recording) or stopping (stopping recording) the recording action of the safety communication log 151 performed by the first recording unit 118 of the log writer 117, and the failure of the recording action of the safety communication log 151. The failure of the recording action of the safety communication log 151 indicates, for example, that the SD card 150 as the storage destination medium of the safety communication log 151 is not installed in the PLC 100, etc., but it is not limited to this.

[0124] The PLC 100 can detect whether the SD card 150 is installed or not installed in the R / W 101 based on the output from the R / W 101. For example, in the case where the event of not installing is detected, the secure socket communication module 71 may record the secure communication log 151 in the non-volatile memory 106 instead of in the SD card 150. More specifically, the secure socket communication module 71 may be controlled so that the second recording unit 119 of the log writer 117 performs the recording of the secure communication log 151. Alternatively, in the case where the second recording unit 119 performs the recording action of the secure communication log 151, only the secure communication log 151 corresponding to the change point from the state where the secure communication log 151 is recorded in the SD card 150 to the state where it can no longer be recorded may be recorded in the non-volatile memory 106.

[0125] The event type 131 of the log whose event type 133 corresponds to “access” includes an event in which the secure socket configuration tool 202 accessed the secure socket configuration file 103 .

[0126] Types of access to the secure socket configuration file 103 include access to settings related to secure socket communication and access to settings related to the secure communication log 151. Settings related to secure socket communication include a session ID, and access to the settings includes reading, changing, and deleting the settings.

[0127] Access to the settings related to the secure communication log 151 includes reading and changing the settings. Fig.10 151 is a diagram showing an example of the settings related to the secure communication log 151 of this embodiment. The secure socket communication log settings included in the secure socket settings file 103 include options and values ​​written (set) to the options. An example of the relationship between the options and the values ​​is as follows: Fig.10 See Fig.10 , the option is set to either disable or enable. Enable indicates an option to enable the recording operation of the secure communication log 151 of the first recording unit 118, and disable indicates an option to disable it. Fig.10 In this case, there are two types of options that can be set to control the recording operation, but it is not limited to these types.

[0128] <Recording Form of Communication Log and Event Log>

[0129] Fig.11 It is a diagram schematically showing an example of the recording method of the secure communication log 151 of the present embodiment. Refer to Fig.11 , in the SD card 150, each log of the secure communication log 151 is saved in association with the data 153 indicating the date and time when the network connection condition or error is detected by the secure socket communication module 71. In addition, Fig.12 It is a diagram schematically showing an example of the recording method of the event log 152 of the present embodiment. Refer to Fig.12 , in the non-volatile memory 106, the Fig. 9 The log of the event shown is saved in association with the data 154 indicating the date and time when the event is detected by the secure socket communication module 71. The log detection unit 179 converts the information (including errors) of a predetermined type output by the library function into a log code 802 according to a rule, and retrieves the Figure 8 table. Based on the retrieval result, the log detection unit 179 retrieves the information corresponding to the log code 802 from the Figure 8 , obtains the secure communication log 151 from the retrieved information, and outputs it to the first recording unit 118 of the log writer 117 together with the recording instruction. In addition, the log detection unit 179 retrieves the Fig. 9 table based on the type of event (predetermined type) detected in association with the recording operation of the first recording unit 118. Based on the retrieval result, the log detection unit 179 retrieves the information (recording item 132, event category 133, event code 134, importance 135, and importance change 136) corresponding to the event type 131 corresponding to the type of the event from the Fig. 9 table, and outputs the event log based on the retrieved information to the second recording unit 119 of the log writer 117 together with the recording instruction. In the present embodiment, in order to set the type of information or event to be recorded in the PLC 100, Figure 8 or Fig. 9 The information in the table (form) may be included in the secure socket setting file 103.

[0130] According to Fig.11 and Fig.12In the form of records, it is possible to correlate both the secure communication log 151 and the event log 152 using timestamps based on the time measured by the system timer 108, i.e., the timestamps on the common timeline, such as data 153 and 154. Therefore, when the user analyzes the secure communication log 151, it is possible to trace the event log 152 based on this correlation. In the present embodiment, the support device 200 provides tools for analyzing the secure communication log 151 and the event log 152. In the present embodiment, for example, the log detection unit 179 or the log writer 117 attaches a timestamp to the log.

[0131] <K. Flowchart of Secure Communication Processing>

[0132] Fig.13 and Fig.14 are the flowcharts of the secure communication processing in the present embodiment. In Fig.13 and Fig.14 the processing of communications 74, 75, and 76 for exchanging keys and certificates between the PLC 100 and the server 300 for mutual authentication, which was described in Figure 7 is omitted.

[0133] Referring to Figure 7 when secure communication starts (step S1), the PLC 100 executes the communication establishment command 80 (TCPConnect) included in the secure socket communication command 205 to perform the opening process of the TCP socket (step S3). The PLC 100, as the secure socket communication module 71, determines whether the command 80 ends normally or abnormally based on the output of the function of the TCP socket indicated by the command 80 (step S5).

[0134] When it is determined that the command 80 ends abnormally ("abnormal end" in step S5), the secure socket communication module 71 saves (records) the information including the error code indicated by the function output of the command 80 as the secure communication log 151 to the SD card 150 via the log writer 117 (step S7).

[0135] On the other hand, when it is determined that the command 80 ends normally ("normal end" in step S5), the PLC 100 executes the communication process R20 of the TLS communication 73.

[0136] First, in the TLS communication 73, the PLC 100 executes the command 731 (TLSConnect) for establishing a TLS session included in the secure socket communication command 205 (step S9). The PLC 100, as the secure socket communication module 71, determines whether the command 731 ends normally or abnormally based on the output of the function of the secure socket indicated by the command 731 (step S11).

[0137] When it is determined that command 731 ends abnormally ("abnormal end" in step S11), the secure socket communication module 71 generates information including an error code represented by the function output of command 731 as a secure communication log 151, which is saved (recorded) in the SD card 150 via the log writer 117 (step S13).

[0138] On the other hand, when it is determined that command 731 ends normally ("ends normally" in step S11), PLC 100 executes command 732 (TLSWrite) of data transmission processing included in secure socket communication command 205 (step S15) and executes command 733 (TLSRead) of data reception processing (step S21) in order to perform data communication. PLC 100, as secure socket communication module 71, determines whether command 732 ends normally or abnormally based on the output of the secure socket function shown in command 732 (step S17), and determines whether command 733 ends normally or abnormally based on the output of the secure socket function shown in command 733 (step S23).

[0139] When it is determined that command 732 or command 733 ends abnormally ("abnormal end" in step S17 or "abnormal end" in step S23), the secure socket communication module 71 generates information including an error code represented by the function output of command 732 or command 733 as a secure communication log 151, which is saved (recorded) in the SD card 150 via the log writer 117 (step S19, step S25).

[0140] When it is determined that the command 732 and the command 733 have been completed normally ("normal completion" in step S17 and "normal completion" in step S23), the PLC 100 executes the session completion command 734 (TLSDisconnect) included in the secure socket communication command 205 to close the TCP socket (step S27). The PLC 100, as the secure socket communication module 71, determines whether the command 734 has been completed normally or abnormally based on the output of the secure socket function indicated by the command 734 (step S29).

[0141] When it is determined that command 734 ends abnormally ("abnormal end" in step S29), the secure socket communication module 71 saves (records) the information containing the error code represented by the function output of command 734 as the secure communication log 151 to the SD card 150 via the log writer 117 (step S31).

[0142] On the other hand, when it is determined that command 734 ends normally ("ends normally" in step S29), PLC 100 executes command 84 (TCPClose) to close the TCP socket (step S33). PLC 100, as the secure socket communication module 71, determines whether command 84 ends normally or abnormally based on the output of the socket function shown in command 84 (step S35).

[0143] When it is determined that command 84 ends abnormally ("abnormal end" in step S35), the secure socket communication module 71 saves (records) the information containing the error code represented by the function output of command 84 as the secure communication log 151 to the SD card 150 via the log writer 117 (step S37).

[0144] On the other hand, when it is determined that the command 84 has been normally completed, the secure communication in the TLS communication 73 is completed (step S39).

[0145] exist Fig.13 as well as Fig.14 While processing the secure communication, the PLC 100, as a secure socket communication module 71, monitors whether an event log occurs to control the recording action of the secure communication log 151. If the occurrence of an event is detected, the event log 152 containing a code representing the event is saved (recorded) in the non-volatile memory 106 via the log writer 117.

[0146] The situations in which the TCPConnect output of command 80 described above is incorrect include, for example, the Ethernet cable is not connected, the TCP socket is not opened, the IP address of the connection destination is incorrect, the HOST name of the connection destination is incorrect, the port number of the connection destination is incorrect, the IP address setting of PLC 100 is incorrect, the firewall blocks the communication, etc.

[0147] In addition, the TLSConnect output of command 731 may include situations where an error occurs, such as an incorrect certificate or private key, or an expiration or invalidation of the validity period associated with the certificate.

[0148] In addition, situations where TLSWrite or TLSRead outputs errors as commands 732 and 733 include, for example, inability to perform secure communication (for example, the secure socket session is disconnected, the TCP socket is disconnected, etc.), authentication failure of server 300, etc.

[0149] according to Fig.13 and Fig.14, when the communication program 172 and the secure socket communication module 71 perform secure communication, errors can be detected, and the secure communication log 151, which is historical information related to secure communication and includes the detected errors, is recorded by the log writer 117. During secure communication, the secure socket communication module 71 includes the error information output by the library function of OpenSSL in the secure communication log 151. Thus, the PLC 100 can provide the secure communication log 151 as information for evaluating or analyzing the soundness of secure communication.

[0150] <Example of communication data>

[0151] Fig.15 This is a diagram showing an example of the information monitored during the secure communication of the present embodiment. Refer to Fig.15 , Frame 9 represents the process of establishing a TCP connection, Frame 13 represents the process of establishing a TLS session (the start process of secure communication using OpenSSL), the frames starting from Frame 24 represent the data 241 exchanged between the PLC 100 and the server 300, Frame 32 represents the process of ending the TLS session (the end process of secure communication using OpenSSL), and Frame 48 represents the process of ending the TCP connection.

[0152] As Fig.15 shown, in the frames starting from Frame 24, the data 241 exchanged between the PLC 100 and the server 300 is encrypted. Even if the encrypted data 241 is recorded, it is difficult to analyze. In the present embodiment, the first recording unit 118 excludes the control-related data (i.e., encrypted data) exchanged during secure communication and records the information related to secure communication. By not recording the encrypted data 241 in this way, the storage area of the SD card 150 can be effectively utilized.

[0153] In the present embodiment, the information recorded by the first recording unit 118 can record, in addition to the network connection conditions or errors as Figure 8 shown, the information of the frames involved in the connection establishment process and the session establishment process of secure communication shown in Frame 9, Frame 13, Frame 24, Frame 32, and Frame 48.

[0154] <M. Program and recording medium>

[0155] The user program 170 including the communication program 172, the program of the secure socket communication module 71, and the program of the log writer 117 shown in this embodiment can also be recorded in a computer-readable recording medium including a recording medium such as a floppy disk, CD-ROM 91, ROM (Read Only Memory), RAM (Random Access Memory), HDD (Hard Disc Drive) attached to the PLC 100, and provided as a program product. The recording medium is a medium that stores information such as the program by electrical, magnetic, optical, mechanical or chemical action in a manner that a computer and other devices, machinery, etc. can read the recorded information such as the program.

[0156] In addition, the above-mentioned program can also be provided to PLC 100 by downloading it from a network via a communication interface.

[0157] Although the embodiments of the present invention have been described, the embodiments disclosed this time should be considered to be illustrative in all aspects and not restrictive. The scope of the present invention is indicated by the claims, and it is intended to include all modifications within the meaning and scope equivalent to the claims.

Claims

1. A control device, which is a control device for FA (factory automation), wherein: The control device has: A first connector, which is connected to a first network to which an object of control belongs; a second connector connected to a second network to which the external device belongs; a control operation unit that performs control operation processing using data related to control of the object; a communication unit for exchanging the data with the external device through secure socket communication using socket communication via the second network; a first recording unit for recording information related to the secure socket communication performed by the communication unit; as well as The second recording unit records information related to control of a recording operation of the first recording unit for recording information related to the secure socket communication.

2. The control device according to claim 1, wherein: The control device also has a storage medium interface for detachably installing an external storage medium. The first recording unit stores information related to the secure socket communication in the external storage medium attached to a storage medium interface.

3. The control device according to claim 2, wherein: The second recording unit stores information related to control of the recording operation in a storage medium different from the external storage medium.

4. The control device according to claim 1 or 2, wherein: The first recording unit records information related to the secure socket communication excluding data related to the control exchanged in the secure socket communication.

5. The control device according to claim 1 or 2, wherein: The information associated with the secure socket communication includes information on an error that occurred in the secure socket communication.

6. The control device according to claim 1 or 2, wherein: The information associated with the secure socket communication includes conditions for establishing the secure socket communication via the second network.

7. The control device according to claim 1 or 2, wherein: The information associated with the secure socket communication includes information associated with the connection of the secure socket communication via the second network.

8. The control device according to claim 7, wherein: The information associated with the secure socket communication includes information associated with a session established after the connection establishment is performed.

9. The control device according to claim 1 or 2, wherein: The information related to the control of the recording operation includes at least one of the start of the recording operation, the stop of the recording operation, the failure of the recording operation, and the setting related to the recording operation.

10. The control device according to claim 9, wherein: The setting related to the recording operation includes a setting for enabling or disabling the recording operation.

11. The control device according to claim 1 or 2, wherein: The information related to the secure socket communication recorded by the first recording unit and the information related to the control of the recording operation recorded by the second recording unit are given a time stamp on a common time axis when they are recorded.

12. A recording method, which is a recording method performed by a control device of FA (factory automation), wherein: The control device has: A first connector, which is connected to a first network to which an object of control belongs; a second connector connected to a second network to which the external device belongs; a control operation unit that performs control operation processing using data related to control of the object; as well as a communication unit that exchanges the data with the external device through secure socket communication using socket communication via the second network, The recording method comprises the following steps: recording information associated with the secure socket communication performed by the communication unit; and Information associated with the recording and control action of recording information associated with the secure socket communication.

13. A computer storage medium storing a program for causing a computer to execute a recording method executed by a control device of FA (factory automation), wherein: The control device has: A first connector, which is connected to a first network to which an object of control belongs; a second connector connected to a second network to which the external device belongs; a control operation unit that performs control operation processing using data related to control of the object; as well as a communication unit that exchanges the data with the external device through secure socket communication using socket communication via the second network, The recording method comprises the following steps: recording information associated with the secure socket communication performed by the communication unit; and Information associated with the recording and control action of recording information associated with the secure socket communication.

Images