Programmable controller, programmable controller system, access information sharing method, and program

Abstract

And the PLC (101) is connected with the PLC (102). A PLC (101) is provided with: a communication unit (11) that receives access from the outside via a network (NW) and performs communication; a storage unit (13) that stores access information relating to the access; a sharing unit (14) that provides access information to the PLC (102), acquires access information relating to access to the PLC (102) via the network (NW) from the PLC (102), and shares the access information with the PLC (102) in the form of a distributed ledger; and a processing unit (18) that, when the communication unit (11) newly receives an exceptional access that is more frequent than the other access among the accesses indicated by the access information, executes a process different from the other access with respect to the exceptional access.

Description

Technical Field

[0001] The present invention relates to a programmable controller, a programmable controller system, an access information sharing method and a program. Background Art

[0002] In recent years, a distributed ledger technology for sharing highly reliable data on a network without a specific management subject has attracted attention. It has been proposed to apply this distributed ledger technology to an FA (Factory Automation) system in which a plurality of devices are connected via a network (for example, see Patent Document 1).

[0003] Patent document 1 describes a control system that uses distributed ledger technology to determine whether a control program can be executed. In this control system, a control device generates inherent information representing the structure of the equipment constituting the control device, and stores the generated inherent information in the form of a distributed ledger between other control devices. In response to a request to start the execution of a control program, the control device compares the inherent information generated by the control device with the inherent information stored by other control devices, and allows or prohibits the execution of the control program based on the result of the comparison. According to such a control system with a control device, it is possible to prevent the control program from being started in an environment different from the original environment.

[0004] Patent Document 1: Japanese Patent Application Publication No. 2021-005231 Summary of the invention

[0005] In the technology of Patent Document 1, when illegal execution of a control program is requested, the execution of the control program is prohibited. However, if illegal requests are made repeatedly, it is necessary to check the inherent information at each request, and the processing load for checking in the entire control system becomes large. Therefore, there is a concern that the processing performance of the control system will decrease and its function will stop. That is, the availability of the operating state that enables the control system to fully exert its function may be reduced due to illegal access. Therefore, in the FA system, there is room for improving the availability when illegal access occurs.

[0006] The present invention has been made under the circumstances described above, and an object of the present invention is to improve the usability when unauthorized access occurs in the FA system.

[0007] In order to achieve the above, the programmable controller of the present invention is connected with other programmable controllers.

[0008] The programmable controller comprises: a communication unit, which receives a first access from the outside via a network to communicate; a storage unit, which stores first access information related to the first access; a sharing unit, which provides the first access information stored in the storage unit to other programmable controllers, obtains second access information related to a second access to other programmable controllers via the network from other programmable controllers, and shares the first access information and the second access information with other programmable controllers in the form of a distributed ledger; and a processing unit, which, when an exceptional access with a lower frequency than other accesses is newly received by the communication unit, performs different processing for the exceptional access from that for other accesses.

[0009] Effects of the Invention

[0010] According to the present invention, when an exception access is newly received, the processing unit performs a different process for the exception access than for other accesses. Therefore, it is possible to deal with an illegal access generated exceptionally by performing a different process than usual. Therefore, it is possible to improve the usability of the FA system when an illegal access occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a diagram showing the configuration of a PLC system according to the first embodiment.

[0012] Figure 2 This is a diagram showing the hardware configuration of the FA device according to the first embodiment.

[0013] Figure 3 This is a diagram showing an example of information stored in the storage unit according to the first embodiment.

[0014] Figure 4 This is a diagram showing blocks shared by a sharing unit according to the first embodiment.

[0015] Figure 5 FIG. 2 is a second diagram showing the structure of a block according to the first embodiment.

[0016] Figure 6 This is a diagram for explaining learning performed by the learning unit according to the first embodiment.

[0017] Figure 7 This is a flowchart showing the PLC processing involved in the first embodiment.

[0018] Figure 8 This is a flowchart showing the access information recording process involved in the first embodiment.

[0019] Fig. 9This is a flowchart showing the sharing process involved in the first embodiment.

[0020] Fig.10 This is a diagram showing communication between nodes involved in Implementation Example 1.

[0021] Fig.11 This is a flowchart showing temporary transaction generation processing according to the first embodiment.

[0022] Fig.12 This is a flowchart showing the delegation node processing involved in Implementation Example 1.

[0023] Fig.13 This is a flowchart showing the receiving node processing involved in Implementation Example 1.

[0024] Fig.14 This is a flowchart showing the management node processing involved in Implementation Example 1.

[0025] Fig.15 This is a flowchart showing the learning process involved in the first embodiment.

[0026] Fig.16 This is a flowchart showing the detection process involved in Implementation Example 1.

[0027] Fig.17 This is a diagram showing access information involved in Implementation Example 2.

[0028] Fig.18 This is a diagram showing access information involved in Implementation Example 3. DETAILED DESCRIPTION

[0029] Hereinafter, a data collection system according to an embodiment of the present invention will be described in detail with reference to the drawings.

[0030] Implementation Method 1

[0031] The PLC (Programmable Logic Controller) system 1000 involved in this embodiment is constructed as a control system for controlling instruments in a factory via a network. The PLC system 1000 is, for example, an FA system for implementing a manufacturing line, a processing line, an inspection line, or other processing procedures. In the PLC system 1000, each device records access from the outside and shares it in the form of a distributed ledger, and based on the shared records, a model for distinguishing exceptional access is learned (trained). Furthermore, if an exceptional access is detected using the trained model, processing for the access is performed.

[0032] like Figure 1As shown, the PLC system 1000 has PLCs connected to each other via a network NW.

[0033] 101, 102, 103 and an auxiliary device 20 that functions as a user interface terminal of the PLC 101. The network NW may be an industrial network or an information network. In the network NW, data packets are transmitted, for example, according to TCP (Transmission Control Protocol) / IP (Internet Protocol). The auxiliary device 20 and the PLC 101 are connected via a communication line such as a USB (Universal Serial Bus) cable or a network such as a LAN (Local Area Network). The PLC system 1000 is equivalent to an example of a programmable controller system.

[0034] PLCs 101, 102, and 103 each have the same structural elements and perform the same functions. Figure 1 , the structure of PLC 101 is shown in detail, and the structures of PLCs 102 and 103 are simplified. In the following, PLCs 101, 102, and 103 may be described as PLC 100 without being distinguished.

[0035] PLC 100 is a control device that controls an unillustrated instrument by executing a control program represented by a ladder diagram program. PLC 100 can also cooperate with other PLCs 100 to control an instrument. For example, PLC 101 obtains a sensing result obtained by a sensor, and outputs an action command based on the sensing result to an actuator by PLC 101 or PLC 102, thereby conveying a workpiece on a conveyor belt. PLC 100 is equivalent to an example of a programmable controller.

[0036] The support device 20 is an industrial PC (Personal Computer) having application software called an engineering tool for creating and editing a control program to be executed by the PLC 100 and writing the control program to the PLC 100 .

[0037] The PLC 100 and the auxiliary device 20 are each composed of hardware elements for functioning as a computer. Figure 2 As shown, the FA device 30 corresponding to the PLC 100 and the auxiliary device 20 respectively includes a processor 31, a main storage unit 32, an auxiliary storage unit 33, an input unit 34, an output unit 35, and a communication unit 36. The main storage unit 32, the auxiliary storage unit 33, the input unit 34, the output unit 35, and the communication unit 36 ​​are connected to the processor 31 via an internal bus 37.

[0038] The processor 31 includes a CPU (Central Processing Unit) as a processing circuit. The processor 31 realizes various functions by executing the program P1 stored in the auxiliary storage unit 33, and performs the processing described below. In addition, the program P1 of the auxiliary device 20 is equivalent to the above-mentioned engineering design tool. In addition, the processor 31 of the PLC 100 executes the above-mentioned control program in addition to executing the program P1.

[0039] The main storage unit 32 includes a RAM. The program P1 is loaded from the auxiliary storage unit 33 to the main storage unit 32. The main storage unit 32 is used as a work area for the processor 31.

[0040] The auxiliary storage unit 33 includes a nonvolatile memory represented by an EEPROM (Electrically Erasable Programmable Read-Only Memory) and an HDD (Hard Disk Drive). In addition to storing the program P1, the auxiliary storage unit 33 also stores various data used for processing by the processor 31. The auxiliary storage unit 33 supplies the data used by the processor 31 to the processor 31 according to the instruction of the processor 31. In addition, the auxiliary storage unit 33 stores the data supplied from the processor 31.

[0041] The input unit 34 includes input devices represented by hardware switches, input keys, a keyboard, and a pointing device. The input unit 34 acquires information input by a user of the FA device 30 and notifies the processor 31 of the acquired information.

[0042] The output unit 35 includes output devices represented by LED (Light Emitting Diode), LCD (Liquid Crystal Display) and speakers. The output unit 35 presents various information to the user according to the instructions of the processor 31.

[0043] The communication unit 36 ​​includes a communication interface circuit for communicating with an external device. The communication unit 36 ​​receives a signal from the outside and outputs the data represented by the signal to the processor 31. In addition, the communication unit 36 ​​sends a signal representing the data output from the processor 31 to the external device. Figure 2 1 represents one communication unit 36, but the FA device 30 may include a plurality of communication units 36. For example, the FA device 30 as the PLC 101 may independently include a communication unit 36 ​​for communicating with the auxiliary device 20 and a communication unit 36 ​​for communicating via the network NW.

[0044] Through the coordinated operation of the above hardware structure, the PLC 100 and the auxiliary device 20 can perform various functions. Figure 1 As shown, as its functions, PLC 101 has: a communication unit 11, which receives access from the outside via a network NW to communicate; a processing unit 12, which processes the data packet received by the communication unit 11 to generate access information related to the access; a storage unit 13, which accumulates and stores the access information; a sharing unit 14, which shares the access information with PLCs 102 and 103; a learning unit 15, which learns a model for distinguishing exceptional access based on the access information; a detection unit 16, which detects exceptional access based on the trained model; a notification unit 17, which notifies the user of the exceptional access; and a processing unit 18, which processes the exceptional access.

[0045] The communication unit 11 is mainly implemented by the cooperation of the processor 31 and the communication unit 36 ​​of the PLC 101. The reception of the access by the communication unit 11 means receiving a data packet designated as the destination by the PLC 101 itself via the network NW. Figure 1 In the figure, PLCs 102 and 103 are shown as devices for accessing the communication unit 11, but the communication unit 11 can also be accessed by a device not shown in the figure via the network NW. In addition, the communication unit 11 sends a data packet to the network NW as needed. The communication unit 11 is an example of a communication unit in the PLC 100 that receives a first access from the outside via the network.

[0046] The processing unit 12 is mainly implemented by the processor 31 of the PLC 101. The processing unit 12 receives a data packet provided from the communication unit 11, processes the data packet, and generates access information related to access to the communication unit 11.

[0047] The access information includes at least one of the time at which the access was made and a predetermined time period including the time, and identification information for identifying the communication device that made the access on the network NW. Figure 3 The record shown constitutes one line of the sending access information 131, which is associated with the date and time of packet reception as the time of access, the source IP address as identification information, the port number specified in the packet, the time period in seconds including the receiving date and time, and the speed equivalent to the frequency of access.

[0048] The length of the time period is Figure 3 In the example of , it is 1 second, but it is not limited to this and can be changed arbitrarily. Figure 3The "20220118-131310" in the example represents the 1-second interval from 13:13:10 to 11:00 on January 18, 2020. The speed is the size of the data packet received by the access that occurred during the time period, expressed in bps (bits per second). The length of the time period is 1 second, so the speed is Figure 3 Here, the size of the data packet received in one time period is equal to the total value of each bit value constituting the data packet received by the communication unit 11. That is, the speed can also be said to be equivalent to the frequency of access to each bit value in one time period. In addition, although there may be a situation where the reception of one data packet is not completed in one time period, it can also be regarded as that all the bit values ​​constituting the data packet are received at the reception date and time of the data packet.

[0049] The storage unit 13 is mainly implemented by at least one of the main storage unit 32 and the auxiliary storage unit 33 of the PLC 101. Figure 3 As shown, transmission access information 131 which is a set of access information generated by the processing unit 12 and reception access information 132 which is generated by the PLCs 102 and 103 and received from the PLCs 102 and 103 are stored as access histories.

[0050] For sharing between PLCs 100, the sending access information 131 is sent from PLC 101 to PLCs 102 and 103. The receiving access information 132 is information indicating access to PLCs 102 and 103 other than PLC 101, and is received by PLC 101 from PLCs 102 and 103 for sharing between PLCs 100. Figure 3 As shown, a number is assigned to the access information.

[0051] The storage unit 13 is an example of a storage unit. The transmission access information 131 is an example of first access information related to the first access, and the reception access information 132 is an example of second access information related to the second access. The access indicated by the reception access information 132 is an example of a second access to another programmable controller via the network NW.

[0052] return Figure 1 The sharing unit 14 is mainly realized by the coordinated action of the processor 31 and the communication unit 36 ​​of the PLC 101. The sharing unit 14 shares the sending access information 131 and the receiving access information 132 stored in the storage unit 13 with the PLCs 102 and 103 in the form of a distributed ledger. Figure 4As shown, the sharing unit 14 shares information in a form in which the blocks 40 including the block header 41 and the transaction unit 42 are sequentially generated so as to be linked to the previous block 40 .

[0053] like Figure 5 As shown, the block header 41 has a previous header hash value 411 equal to a header hash value 412 of the block header 41 of the previously generated block 40, a header hash value 412 which is a hash value of the data contained in the block header 41 itself, and generation date and time information 413 indicating the generation date and time of the block 40. In addition, the transaction unit 42 includes input access information 421, output access information 422, and signatures 423 of the input access information 421 and the output access information 422. The input access information 421 includes the output access information 422 of the transaction unit 42 of the previous block 40, and the output access information 422 stores the access information added to the block 40.

[0054] By adding a block 40 to be newly connected and shared between PLCs 100, access information is shared, and the block 40 to be newly connected includes the access information to be shared as output access information 422. Specifically, by adding a block 40 including the transmission access information 131 provided from PLC 101, PLCs 102 and 103 obtain the transmission access information 131 of PLC 101 and share the transmission access information 131 with PLCs 102 and 103. In addition, by adding a block including the access information provided from PLC 102 or PLC 103, PLC 101 obtains the access information recorded in PLC 102 or PLC 103, and the access information is shared by PLC 101 as reception access information 132.

[0055] In addition, the input access information 421 may also include information processed from the output access information 422 of the previous block 40. In addition, the input access information 421 may also be the ID (Identifier) ​​of the transaction unit 42 of the previous block 40 and information processed from the output access information 422 included in the transaction unit 42.

[0056] The shared unit 14 may function as a storage device different from the storage unit 13 through at least one of the main storage unit 32 and the auxiliary storage unit 33 of the PLC 101. That is, the shared unit 14 stores the sequentially connected blocks 40 and synchronizes the output access information 422 in the blocks 40 with the storage unit 13.

[0057] As a method of linking blocks of a distributed ledger, three types of private chains, regional chains, and public chains are known. Here, most users of PLC 100 do not want to disclose access information to external third parties. Since the PLC 100 participating in the distributed ledger can be independently set, a private chain or regional chain is preferably used. The sharing unit 14 in PLC 100 is equivalent to an example of a sharing unit that shares the sending access information 131 and the receiving access information 132 with other programmable controllers in the form of a distributed ledger.

[0058] return Figure 1 The learning unit 15 is mainly implemented by the processor 31 of the PLC 101. The learning unit 15 learns a model for distinguishing exceptional accesses with a lower frequency than other accesses based on the access information stored in the storage unit 13. For example, the learning unit 15 extracts feature quantities from each access information and fits the distribution of the feature quantities using a normal distribution. Figure 6 The learning of the model by fitting a normal distribution is schematically shown in FIG.

[0059] exist Figure 6 In the example, the sampling points specified by the first feature quantity and the second feature quantity extracted from each access information are shown with solid circles and hollow circles. The first feature quantity and the second feature quantity may be, for example, the source IP address or the group of the IP address and the port number or the group of the port number shown in the access information, or may be any other feature quantity calculated based on the access information. In addition, 3σ of the normal distribution obtained by fitting these sampling points is shown as area 50. Usually, a large number of observed accesses correspond to sampling points 51 shown with solid circles within area 50, and exceptional accesses correspond to sampling points 52 shown with hollow circles outside area 50. Here, if exceptional accesses are judged by whether they are included in area 50, area 50 is equivalent to a model for judging exceptional accesses. Figure 6 In the example, an exceptional access is an access having a feature quantity extracted at a lower frequency than other accesses, or an access having a feature quantity outside the range of feature quantities extracted at a high frequency from other accesses.

[0060] In addition, the learning method performed by the learning unit 15 can also be arbitrarily changed. However, among the three types of learning known as the classification of learning methods, namely, unsupervised learning, supervised learning, and reinforcement learning, it is preferred to adopt unsupervised learning that can distinguish exceptional accesses by adjusting parameters even when it is impossible to know whether each access corresponds to an exceptional access. In addition, usually, most accesses via the network NW are normal, and the number of illegal accesses is extremely small compared to normal accesses. From this point of view, unsupervised learning is also preferred. When there is a teacher who pre-assigns the correct label of whether it is an exceptional access to each access information, supervised learning can also be used. In addition, reinforcement learning can also be used in the case where the benefit of the result obtained by detecting exceptional access as an application model can be designed.

[0061] In addition, the learning unit 15 may also learn different models for each time period. For example, based on multiple accesses that occur in a longer time period such as 1 day or 1 month, the learning unit 15 may learn a model used in the time period, and use the model to detect exceptional accesses on the same date in the future or in the same month on the calendar. In addition, accesses that occur in a shorter time period such as 1 minute or 1 hour may be collected in 1 day or multiple days, and then, after the learning unit 15 has learned the model, the trained model corresponding to the time period in which the new access occurred is used to determine whether the new access is an exceptional access. The learning unit 15 is equivalent to an example of a learning unit in the PLC 100 that learns a model for distinguishing exceptional accesses.

[0062] return Figure 1 The detection unit 16 is mainly implemented by the processor 31 of the PLC 101. The detection unit 16 detects exceptional access from the access indicated by the access information stored in the storage unit 13 using the model trained by the learning unit 15.

[0063] For example, in Figure 6 When the region 50 shown in FIG. 1 is used to distinguish an exceptional access, since the sampling point 52 corresponding to the access generated in the past is located outside the region 50, the detection unit 16 detects the access as an exceptional access. In addition, when the same access as the sampling point 52 or an access similar to the sampling point 52 occurs in the future, the detection unit 16 detects the access as an exceptional access. Here, the past means before the model is learned, and the future means after the model is learned. The access similar to the sampling point 52 is in Figure 6 52 corresponds to a new point not shown in the figure located near the sampling point 52. In addition, the detection unit 16 detects the sampling point 53 which is not similar to any access generated in the past as an exceptional access using the area 50. In this way, the preferred model can also determine whether an unknown access is an exceptional access.

[0064] In addition, a model for determining an exceptional access with a lower frequency than other accesses based on the distribution of sampling points corresponding to accesses is illustrated, but the invention is not limited to this. For example, the sampling points may be multiplied by the value corresponding to Figure 3 The weight corresponding to the speed shown. In addition, the frequency as the speed can also be used as a feature quantity, and the access with the feature quantity less than the threshold value can be judged as an exceptional access. The type of feature quantity can be 1 or more than 3. The detection unit 16 in the PLC 100 is equivalent to an example of a detection unit that detects an exceptional access from the first access received by the communication unit.

[0065] return Figure 1 The notification unit 17 is mainly implemented by the coordinated action of the processor 31 and the output unit 35 of the PLC 101. The notification unit 17 can also notify the user through the user interface by notifying the result of the detection obtained by the detection unit 16. Here, the user interface can be an output device constituting the output unit 35, or it can be an auxiliary device 20 as a user interface terminal. The notification unit 17 is equivalent to an example of a notification unit that notifies information through the user interface in the PLC 100.

[0066] The processing unit 18 is mainly implemented by the processor 31 of the PLC 101. The processing unit 18 processes the data packet received by the communication unit 36 ​​based on the detection result obtained by the detection unit 16. In detail, the processing unit 18 allows access that is not an exceptional access to pass and starts processing based on the access. For example, the processing unit 18 reads the data based on the access requesting to read the data stored in the PLC 101 and causes the communication unit 11 to respond. In addition, the processing unit 18 writes the data based on the access requesting to write data to the PLC 101 and causes the communication unit 11 to respond that the writing has been completed.

[0067] On the other hand, the processing unit 18 cuts off the exceptional access. Specifically, the processing unit 18 does not read or respond to the exceptional access requesting the reading of data, but discards the data packet. In addition, the data is not written, but the data packet is discarded for the exceptional access requesting the writing of data. Furthermore, the processing unit 18 can record the occurrence of the exceptional access, or can make the notification unit 17 notify. The processing unit 18 in the PLC 100 is equivalent to an example of a processing unit that performs a different process for the exceptional access than other accesses when the communication unit newly receives the exceptional access.

[0068] The support device 20 includes a setting unit 21 for setting parameters for learning by the learning unit 15 of the PLC 101 , and a display unit 22 for displaying information shared by the sharing unit 14 to the user.

[0069] The setting unit 21 is mainly implemented by the processor 31 and the communication unit 36 ​​of the support device 20. The setting unit 21 receives parameters related to the learning speed and the discrimination accuracy of exceptional access from the user and sets them in the learning unit 15. The display unit 22 is mainly implemented by the output unit 35 of the support device 20.

[0070] Next, use Figures 7 to 16 , describing the PLC processing performed by the PLC 100 having the above-mentioned functions.

[0071] Start by turning on the power of PLC 100 Figure 7 In order to make the relationship between the steps included in the PLC process clear, the figure shows a case where the steps are executed sequentially, but the present invention is not limited to this, and the steps may be executed in parallel.

[0072] In the PLC processing, the PLC 100 receives the parameters for the learning unit 15 from the auxiliary device 20 (step S1) and sets them to the learning unit 15. The parameters can be quantitative values, or qualitative values ​​classified as "fast" or "slow" for the learning speed or "loose" or "strict" for the discrimination accuracy. In addition, the following processing is repeatedly performed, namely, the access information recording processing (step S2) for recording the access information based on the access from the outside of the PLC 100, the sharing processing (step S3) for sharing the access information, the learning processing (step S4) for learning the model based on the access information, and the detection processing (step S5) for detecting the exceptional access using the model. The details of the processing of these steps S2 to S5 are described in turn below.

[0073] like Figure 8 As shown in FIG. 1 , in the access information recording process of step S2, the processor 31 determines whether the recording trigger stored in the PLC 100 is in the ON state (step S21). The recording trigger is a flag having a value of the ON state or the OFF state, and the value is set by the user or by external application software. When it is determined that the recording trigger is not in the ON state (step S21; No), the processing executed by the PLC 100 is changed from Figure 8 The access information record processing returns Figure 7 PLC processing.

[0074] On the other hand, when it is determined that the recording trigger is in the ON state (step S21; Yes), the processing unit 12 calculates the time period including the reception date and time based on the reception date and time of the data packet received by the communication unit 11 as communication data (step S22). Figure 3As shown, when the length of the time slot is 1 second, the processing unit 12 only needs to discard the decimal point of the second of the reception date and time. In addition, when the unit of the reception date and time is different from the unit of the time slot, the processing unit 12 also performs unit conversion.

[0075] Next, the processing unit 12 calculates the access speed (step S23). Figure 3 In the example of , the processing unit 12 obtains the size of the data packet as the speed. Then, the processing unit 12 adds the identification information and the port number of the communication object to the time period calculated in step S22 and the access speed calculated in step S23, thereby generating access information (step S24). Specifically, the processing unit 12 creates access information obtained by associating the IP address indicating the source of the data packet and the port number specified in the data packet with the time period and the access speed.

[0076] Next, the processing unit 12 records the access information generated in step S24 (step S25). Specifically, the processing unit 12 adds the generated access information as new row data of the transmission access information 131 of the storage unit 13. Then, the processing executed by the PLC 100 is changed from Figure 8 The access information record processing returns Figure 7 PLC processing shown.

[0077] In the sharing process of step S3, Fig. 9 As shown in FIG. 1 , the sharing unit 14 determines whether the shared trigger stored in the PLC 100 is in the ON state (step S31). The shared trigger is a flag having a value of the ON state or the OFF state, and the value is set by the user or by external application software. When it is determined that the shared trigger is not in the ON state (step S31; No), the processing executed by the PLC 100 is changed from Fig. 9 Shared processing returns Figure 7 PLC processing.

[0078] On the other hand, when it is determined that the sharing trigger is in the ON state (step S31; Yes), the sharing unit 14 performs the following processing: temporary transaction generation processing that generates a temporary temporary transaction including access information to be provided to other PLCs 100 (step S32); delegation node processing as a node that issues a delegation to agree on a consensus on a block including temporary transactions (step S33); receiving node processing as a node that receives a delegation to the consensus (step S34); management node processing as a node that manages the consensus (step S35). These processes follow, for example, an algorithm called PBFT (Practical Byzantine Fault Tolerance). In addition, temporary transaction generation processing and delegation node processing, receiving node processing, and management node processing may also be performed in parallel. Here, regarding the relationship between delegation nodes, receiving nodes, and management nodes, refer to Fig.10 The timing diagram is used to illustrate this.

[0079] exist Fig.10 In the example, the entrusting node 61, the management node 62 and the receiving node 63 are respectively equivalent to the PLC 100 connected to the network NW. When one of the multiple PLCs 100 determines that the timing (timing) of the data that should be newly agreed in the distributed ledger has occurred, it performs temporary transaction generation processing and entrusting node processing as the entrusting node 61. A specific one of the PLCs 100 other than the entrusting node 61 performs management node processing as the management node 62. The PLCs 100 other than the entrusting node 61 and the management node 62 perform receiving node processing as the receiving node 63. Therefore, the PLC 100 can correspond to either the entrusting node or the receiving node according to the timing.

[0080] The management node 62 may also be predetermined to be a specific PLC 100. For example, when PLC 101 is predetermined to be the management node 62 and PLC 101 becomes the delegate node 61, PLC 102 may also be predetermined to be the management node 62. In addition, a certain PLC 100 other than the delegate node 61 may be selected as the management node 62 each time according to a predetermined rule. For example, the delegate node 61 may also set the PLC 100 with the smallest IP address among the PLCs 100 that can communicate via the network NW as the management node 62, and issue a consensus delegation to the management node 62.

[0081] like Fig.10As shown, the entrusting node 61 performs temporary transaction generation processing (step S32), and sends the generated temporary transaction to the management node 62 (step S301). The management node 62 publishes the temporary transaction received from the entrusting node 61 to the receiving node 63 (step S302).

[0082] Next, the management node 62 and the receiving node 63 verify the signature contained in the temporary transaction respectively (step S303). If it is determined that the signature is correct, the management node 62 and the receiving node 63 respectively publish the signature verification result to the node other than the entrusting node 61 (step S304), and receive the signature verification result published from other nodes (step S305). By confirming that the number of nodes that have sent the correct signature verification result is greater than or equal to the threshold value by the management node 62 and the receiving node 63, the management node 62 and the receiving node 63 verify each other that the temporary transaction has not been changed by the management node 62.

[0083] Next, the management node 62 and the receiving node 63 respectively publish temporary transactions to nodes other than the entrusting node 61 (step S306), and receive temporary transactions published from other nodes as published transactions (step S307). Then, the management node 62 and the receiving node 63 respectively confirm that the number of published transactions consistent with the temporary transactions received in step S302 is greater than or equal to the threshold (step S308). Thus, the management node 62 and the receiving node 63 confirm that the received temporary transactions are consistent with each other.

[0084] Next, the management node 62 generates a block containing temporary transactions and agrees with the distributed ledger of the shared unit 14 of the management node 62 (step S309), and notifies the delegation node 61 of the agreed result (step S310). Similarly, the receiving nodes 63 each generate a block containing temporary transactions and agree with the distributed ledger of the shared unit 14 of the receiving node 63 (step S309), and notifies the delegation node 61 of the agreed result (step S310).

[0085] When the number of nodes notified of the agreed result is greater than or equal to the threshold, the entrusting node 61 determines that the management node 62 and the receiving node 63 have reached a consensus on agreeing on the block, generates a block containing a temporary transaction and agrees on the distributed ledger of the shared unit 14 of the entrusting node 61 (step S311). Thus, the entrusting node 61, the management node 62, and the receiving node 63 agree on the block in the distributed ledger after mutually verifying whether the block can be agreed.

[0086] Next, Fig. 9The details of each of the temporary transaction generation process (step S32), the delegation node process (step S33), the reception node process (step S34) and the management node process (step S35) shown are described.

[0087] Fig.11 The temporary transaction generation process (step S32) shown is mainly performed by the sharing unit 14 of the delegation node 61. In the temporary transaction generation process, the sharing unit 14 determines the access information that should be shared by sending it to other nodes (step S321). Specifically, when the access information that has not been agreed upon in the distributed ledger in the access information added to the access information sent 131 is greater than or equal to a certain number, the sharing unit 14 determines the access information as the access information that should be shared. In addition, the method for determining the access information that should be shared can also be arbitrarily changed. For example, the sharing unit 14 can start processing from the access information of the latest date and time stored at the beginning in descending order of the date and time of data packet reception, or it can sort in ascending or descending order according to the number assigned to the access information in the sent access information 131, and start processing from the access information stored at the beginning. The sharing unit 14 can also exclude the access information that meets the predetermined conditions in the sent access information 131 from the access information that should be shared. In addition, each time access information is generated based on one access to the communication unit 11 , the sharing unit 14 may determine the access information as the access information to be shared.

[0088] Next, the sharing unit 14 inserts the output access information 422 of the latest block 40 recorded in the distributed ledger as the input access information 421 of the temporary transaction to be generated (step S322). Then, the sharing unit 14 inserts the access information determined to be shared in step S321 as the output access information 422 of the temporary transaction (step S323). Then, the sharing unit 14 creates and inserts the signature for the input access information 421 inserted in step S322 and the output access information 422 inserted in step S323 (step S324). The signature is a hash value obtained by applying a hash function to the string after the input access information 421 and the output access information 422 are connected as strings, but information obtained by other methods can also be used as a signature. Thus, the sharing unit 14 generates a temporary transaction including the input access information 421 of step S322, the output access information 422 of step S323, and the signature of step S324 (step S325).

[0089] Fig.12The delegate node processing (step S33) shown is mainly performed by the shared unit 14 of the delegate node 61. In the delegate node processing, the shared unit 14 determines whether there is a temporary transaction to be delegated to reach a consensus (step S331). If it is determined that there is no temporary transaction (step S331; No), the delegate node processing ends and the processing executed by the PLC 100 returns to Fig. 9 of shared processing.

[0090] On the other hand, if it is determined that there is a temporary transaction (step S331; Yes), the sharing unit 14 sends the temporary transaction to the management node 62 (step S332). This step S332 corresponds to Fig.10 Step S301.

[0091] Next, the sharing unit 14 determines whether the temporary transaction sent in step S332 is approved (step S333). Specifically, the sharing unit 14 determines whether the number of nodes that approve the temporary transaction is greater than or equal to the threshold. This step S333 corresponds to Fig.10 Step S310.

[0092] Next, the sharing unit 14 generates a block header 41 to be assigned to the temporary transaction (step S334), and generates a block 40 including the generated block header 41 and the temporary transaction as the transaction unit 42 (step S335). Then, the sharing unit 14 commits the generated block 40 to the distributed ledger (step S336). Steps S334 to S336 correspond to Fig.10 Step S311.

[0093] Fig.13 The receiving node processing (step S34) shown in FIG. 1 is mainly executed by the shared unit 14 of the receiving node 63. In the receiving node processing, the shared unit 14 determines whether a temporary transaction has been received (step S341). Fig.10 In the case where a temporary transaction is issued from the management node 62 in step S302, the determination in step S341 is yes.

[0094] When it is determined that a temporary transaction has been received (step S341; Yes), the sharing unit 14 determines whether the signature of the received temporary transaction is correct (step S342). Specifically, the sharing unit 14 determines whether the signature included in the temporary transaction is consistent with the signature generated based on the input access information 421 and the output access information 422 included in the temporary transaction. If they are consistent, the sharing unit 14 notifies the nodes other than the delegation node 61 that the signature is correct. Then, the sharing unit 14 determines whether the number of other nodes notified of the correct signature is greater than or equal to the threshold. Step S342 corresponds to Fig.10Steps S303 to S305.

[0095] When it is determined that the signature of the temporary transaction is correct (step S342; Yes), the sharing unit 14 publishes the temporary transaction to nodes other than the delegate node 61 (step S343). This step S343 corresponds to Fig.10 Step S306.

[0096] Next, as a result of the temporary transaction being issued by the issuing target and performing the same steps as step S343, the sharing unit 14 receives the temporary transaction issued from the issuing target as a issued transaction (step S344). This step S344 corresponds to Fig.10 Step S307.

[0097] Next, the sharing unit 14 determines whether the temporary transaction received in step S341 is consistent with the published transaction received in step S344 (step S345). Specifically, the sharing unit 14 compares the published transactions received from multiple publishing targets in step S344 with the temporary transactions respectively, and determines whether the number of published transactions consistent with the temporary transactions exceeds a threshold. This step S345 corresponds to Fig.10 Step S308.

[0098] If it is determined that the temporary transaction is consistent with the published transaction (step S345; Yes), the sharing unit 14 generates a block header 41 and generates a block 40 matching the temporary transaction (step S346). Then, the sharing unit 14 commits the generated block 40 to the distributed ledger of the sharing unit 14 (step S347). These steps S346 and S347 correspond to Fig.10 Step S309.

[0099] Next, the sharing unit 14 sends the agreed content to the delegation node 61 (step S348). The sending of the agreed content may be the sending of the block 40 agreed in step S347, or may be a notification of the approval of the temporary transaction. This step S348 corresponds to Fig.10 Then, the processing executed by PLC 100 returns to step S310. Fig. 9 If the judgment of steps S341, S342, and S345 is negative (step S341: No, step S342: No, step S345: No), the sharing unit 14 does not approve the temporary transaction, and the processing executed by the PLC 100 returns to Fig. 9 The shared processing shown.

[0100] Fig.14The management node processing (step S35) shown in FIG. 1 is mainly performed by the shared unit 14 of the management node 62. In the management node processing, the shared unit 14 determines whether the PLC 100 having the shared unit 14 is a management node (step S351). If it is determined to be a management node (step S351; Yes), the shared unit 14 determines whether a temporary transaction has been received (step S352). Fig.10 In the case of step S301, the determination of step S352 is yes.

[0101] When it is determined that a temporary transaction has been received (step S352; Yes), the sharing unit 14 issues the temporary transaction to the receiving node 63 (step S353). This step S353 corresponds to Fig.10 Step S302.

[0102] After step S353, the sharing unit 14 executes steps S354 to S3510 which are the same as steps S342 to S348 in the receiving node processing. In addition, if the judgment of steps S351 and S352 is negative (step S351; No, S352; No), the sharing unit 14 does not approve the temporary transaction, and the processing executed by the PLC 100 returns to Fig. 9 The shared processing shown.

[0103] like Fig. 9 As shown, if the management node processing is completed, the processing executed by PLC 100 returns to Figure 7 PLC processing is performed, and then learning processing is performed (step S4).

[0104] like Fig.15 As shown in FIG. 1 , in the learning process of step S4, the learning unit 15 determines whether the learning trigger stored in the PLC 100 is in the ON state (step S41). The learning trigger is a flag having a value of the ON state or the OFF state, and the value is set by the user or by external application software. When it is determined that the learning trigger is not in the ON state (step S41; No), the processing executed by the PLC 100 is changed from Fig.15 The learning process returns Figure 7 PLC processing.

[0105] On the other hand, when it is determined that the learning trigger is in the ON state (step S41; Yes), the learning unit 15 reads out the unlearned access information from the storage unit 13 (step S42). Specifically, the learning unit 15 extracts the access information that was not previously learned from the transmitted access information 131 and the received access information 132.

[0106] Next, the learning unit 15 performs a conversion process to convert the access information into a format suitable for learning (step S43). The conversion process may also be Figure 6 The feature quantity shown is extracted. In addition, since the value ranges of the elements included in the access information are different, normalization or standardization of the elements may be performed as a transformation process. For example, both the value range of the IP address and the value range that can be taken as the speed may be normalized and transformed into a range from zero to 1. In addition, if the learning data increases, the amount of calculation when updating the learning model may increase exponentially. Therefore, a transformation for suppressing the amount of calculation when updating the learning model may be implemented.

[0107] Next, the learning unit 15 updates the model based on the access information whose format has been converted in step S43 (step S44). Then, the processing executed by the PLC 100 is changed from Fig.15 The learning process returns Figure 7 PLC processing.

[0108] like Fig.16 As shown in FIG. 1 , in the detection process of step S5, the detection unit 16 determines whether the detection trigger stored in the PLC 100 is in the ON state (step S51). The detection trigger is a flag having a value of the ON state or the OFF state, and the value is set by the user or by external application software. When it is determined that the detection trigger is not in the ON state (step S51; No), the processing executed by the PLC 100 is changed from Fig.16 The detection process returns Figure 7 PLC processing.

[0109] On the other hand, when it is determined that the detection trigger is in the ON state (step S51 ; Yes), the processing unit 12 processes the data packet, which is the communication data newly received by the communication unit 11 , into access information (step S52 ) and stores it in the storage unit 13 .

[0110] Then, the detection unit 16 performs the same operation as that performed in step S52 on the access information generated in step S52. Fig.15 On the basis of the same transformation processing as step S43 (step S53), the model trained by the learning unit 15 is applied (step S54), thereby determining whether the access represented by the access information is an exceptional access (step S55).

[0111] If it is determined that the access is not an exceptional access (step S55; No), the processing unit 18 performs normal access processing on the access (step S56). For example, the processing unit 18 reads or writes the data requested by the access. Then, the processing executed by the PLC 100 is changed from Fig.16 The detection process returns Figure 7 PLC processing.

[0112] On the other hand, if it is determined to be an exceptional access (step S55; Yes), the processing unit 18 cuts off the exceptional access (step S57), and causes the notification unit 17 to notify the user interface of the existence of the exceptional access (step S58). Then, the processing executed by the PLC 100 is changed from Fig.16 The detection process returns Figure 7 PLC processing.

[0113] As described above, when an exception access is newly received, the processing unit 18 performs the cutoff of the exception access and the notification to the user interface as a process different from the normal access. Therefore, by performing a process different from the normal process for the illegal access occurring exceptionally, it is possible to deal with it with a small processing load. Therefore, it is possible to improve the availability when an illegal access occurs in the PLC system 1000.

[0114] For example, there is an existing method of pre-registering a trusted device on the network NW in a whitelist and treating access from the device as normal access IP filtering. However, it is difficult for such an existing method to fully protect the PLC 100 from accesses such as hijacking or using the device as a springboard or impersonation of the IP. In contrast, the PLC 100 can be protected from illegal accesses by focusing on the frequency of accesses and responding to exceptional accesses.

[0115] In the conventional method described above, access is filtered according to the initially set content. In contrast, according to the PLC 100 of this embodiment, since the learning unit 15 repeatedly performs the learning of the model, it is possible to detect exceptional access in accordance with the access occurring on the network NW.

[0116] In addition, an example is described in which consensus between PLCs is reached according to an algorithm called PBFT. If PBFT is used, the distributed ledger is tolerant to the following failures: a node participating in the distributed ledger fails and the node is unable to update the distributed ledger; and a transaction is rewritten by an external attacker. In addition, the number of fault-tolerant nodes can be set in advance, and the number of nodes participating in the distributed ledger can be set by reverse calculation based on the number of nodes. If the number of fault-tolerant nodes is set to f, the number of nodes participating in the distributed ledger needs to be 3f+1. For example, if f is 1, then Fig.10 As shown, 4 nodes are required to participate.

[0117] Furthermore, the example in which the PLC 100 is constituted by the storage unit 13 storing the access information has been described, but the access information may be stored in a storage device external to the PLC 100 such as a NAS (Network Attached Storage) or a memory card that can be inserted and removed from the PLC 100 .

[0118] In addition, as a learning method performed by the learning unit 15, a method different from the above method may be used. For example, a one-class SVM (Support Vector Machine) may be used to detect anomalies with a small amount of computation. In the future, when computing resources are not limited, methods such as the k-nearest neighbor method or the k-means method may also be used. In addition, a deep neural network, a convolutional neural network, or a recurrent neural network may also be used as a learning method.

[0119] Implementation Method 2

[0120] Next, Embodiment 2 will be described with a focus on differences from Embodiment 1. The same reference numerals are used for the same or equivalent configurations as those in Embodiment 1. This embodiment differs from Embodiment 1 in that the results of detection by detection unit 16 are shared by sharing unit 14.

[0121] The access information involved in this implementation is as follows: Fig.17 As shown, the header hash value 412 of the block 40 for sharing the access information and a flag indicating whether the access indicated by the access information is detected as an exceptional access by the detection unit 16. Fig.17 In the received access information 132, the flag of "0" indicates a normal access, and the flag of "1" indicates an exceptional access. In addition, the PLC 100 notifies the user interface of the fact that there is an access determined as an exceptional access in other PLCs 100. In detail, when there is access information with a flag of "1" in the received access information 132, the notification unit 17 notifies the exceptional access represented by the access information.

[0122] As described above, if the detection result of the exceptional access in the other PLC 100 is notified, the user can refer to the detection result of the exceptional access even when a failure occurs in the other PLC 100 .

[0123] Implementation 3

[0124] Next, Embodiment 3 will be described with a focus on the differences from Embodiment 1. In addition, the same reference numerals are used for the same or equivalent structures as those in Embodiment 1. Fig.18As shown, the present embodiment is different from the above-mentioned embodiment 1 in that the access information includes information related to the device data.

[0125] PLC 100 usually shares data called device data with other devices, and controls the equipment by operating the device data. For example, a sensor device shares device data representing a sensing result with PLC 100, so that the sensing result is notified to PLC 100, and PLC 100 shares device data representing an action instruction with an actuator, thereby giving the actuator an action instruction.

[0126] like Fig.18 As shown, when the processing unit 12 of the PLC 100 requests the communication unit 11 to read or write device data, the processing unit 12 shows whether the request is to read or write, the address of the device data, the data type of the device data, and the starting point and number of points. Fig.18 In the example, a request with “R” indicates a read request, and a request with “W” indicates a write request.

[0127] The sharing unit 14 also shares access information including information related to such device data with respect to access to other PLCs 100. Furthermore, the learning unit 15 updates the model based on the access information.

[0128] As described above, if a model is learned based on information related to device data, it is expected that exceptional access can be determined more accurately.

[0129] As mentioned above, although embodiment of this invention was described, this invention is not limited to the said embodiment.

[0130] For example, the number of PLCs 100 constituting the PLC system 1000 may be arbitrarily changed.

[0131] In addition, as a consensus algorithm, when a public chain is used, the block header 41 may include a Merkle Root, which is a hashed value of a list of nodes participating in the distributed ledger, the difficulty of mining, and a random number (nonce) when mining is successful.

[0132] In addition, the above-mentioned embodiments 2 and 3 may be combined. Furthermore, in the above-mentioned embodiments 2 and 3, elements are added to the access information involved in the above-mentioned embodiment 1, but the added elements are not limited to the elements described in the above-mentioned embodiments 2 and 3. For example, the access information may include one or more of a file sent from a communication partner via the network NW, remote operation information such as remote RUN for remotely starting the PLC 100 and remote STOP for remotely stopping the PLC 100, information indicating changes in network-related settings such as an IP address, and information indicating changes in clock data.

[0133] Furthermore, an example has been described in which the access information indicates both the time at which the access was made and the time period including the time. However, the access information may indicate either the time or the time period.

[0134] The functions of the PLC 100 according to the above-described embodiment can be realized by dedicated hardware, and can also be realized by a general computer system.

[0135] For example, the program P1 may be stored in a computer-readable recording medium such as a floppy disk, CD-ROM (Compact Disk Read-Only Memory), DVD (Digital Versatile Disk), or MO (Magneto-Optical Disk) and distributed, and installed in a computer, thereby forming a device that executes the above-mentioned processing.

[0136] Alternatively, the program P1 may be stored in a disk device of a server device on a communication network such as the Internet, and may be superimposed on a carrier wave and downloaded to a computer, for example.

[0137] Furthermore, the above-described processing can also be realized by starting and executing the program P1 while transmitting it via a network represented by the Internet.

[0138] Furthermore, the above-described processing can also be realized by causing all or part of the program P1 to be executed on a server device, and causing a computer to execute the program P1 while transmitting and receiving information related to the processing via a communication network.

[0139] Furthermore, when the above functions are realized by sharing the responsibility of the OS (Operating System) or by cooperation between the OS and the application, only the portion other than the OS may be stored in a medium and distributed, or may be downloaded to a computer.

[0140] In addition, the means for realizing the functions of the PLC 100 is not limited to software, and a part or all of the functions may be realized by dedicated hardware or circuits.

[0141] The present invention can realize various embodiments and variations without departing from the broad spirit and scope of the present invention. In addition, the above-mentioned embodiments are used to illustrate the present invention and are not intended to limit the scope of the present invention. That is, the scope of the present invention is not shown by the embodiments but by the claims. Furthermore, various variations implemented within the scope of the claims and within the scope of the meaning of the invention equivalent thereto are deemed to be included within the scope of the present invention.

[0142] Industrial Applicability

[0143] The present invention is suitable for improving the safety performance of a system used in FA sites.

[0144] Description of the label

[0145] 11 communication unit, 12 processing unit, 13 storage unit, 14 sharing unit, 15 learning unit, 16 detection unit, 17 notification unit, 18 processing unit, 20 auxiliary device, 21 setting unit, 22 display unit, 30 FA device, 31 processor, 32 main storage unit, 33 auxiliary storage unit, 34 input unit, 35 output unit, 36 communication unit, 37 internal bus, 40 block, 41 block header, 42 transaction unit, 50 area, 51-53 sampling point, 61 delegation node, 62 management node, 63 receiving node, 100-103 PLC, 131 sending access information, 132 receiving access information, 411 previous header hash value, 412 header hash value, 413 generating date and time information, 421 input access information, 422 output access information, 423 signature, 1000 PLC system, NW network, P1 program.

Claims

1. A programmable controller connected to other programmable controllers, in, The programmable controller has: a communication unit that receives a first access from the outside via a network to communicate; a storage unit configured to store first access information related to the first access; a sharing unit that provides the first access information stored in the storage unit to the other programmable controller, obtains second access information related to a second access to the other programmable controller via the network from the other programmable controller, and thereby shares the first access information and the second access information with the other programmable controller in the form of a distributed ledger; as well as A processing unit that, when the communication unit newly receives an exceptional access having a lower frequency than other accesses among the first access indicated by the first access information and the second access indicated by the second access information, performs a different process on the exceptional access from that on the other accesses.

2. The programmable controller according to claim 1, wherein: The first access information includes information for identifying a communication device that has performed the first access on the network.

3. The programmable controller according to claim 1 or 2, wherein: The first access information indicates at least one of a time when the first access was performed and a predetermined time period including the time.

4. The programmable controller according to any one of claims 1 to 3, further comprising: a detection unit configured to detect the exceptional access from the first access received by the communication unit; and a notification unit for notifying information via a user interface, The first access information indicates a detection result obtained by the detection unit. The second access information indicates a result of detecting the exceptional access obtained from the second access by the other programmable controller. The notification unit notifies a result of detection of the exceptional access indicated by the second access information.

5. The programmable controller according to any one of claims 1 to 3, further comprising: a learning unit that learns a model for distinguishing the exceptional access based on the first access indicated by the first access information and the second access indicated by the second access information; and a detection unit that detects the exceptional access from the first access received by the communication unit using the model trained by the learning unit, The processing unit cuts off the exceptional access detected by the detection unit.

6. A programmable controller system comprising a plurality of programmable controllers connected to each other, in, The programmable controllers respectively have: a communication unit that receives a first access from the outside via a network to communicate; a storage unit configured to store first access information related to the first access; a sharing unit that provides the first access information stored in the storage unit to other programmable controllers, obtains second access information related to a second access to the other programmable controllers via the network from the other programmable controllers, and thereby shares the first access information and the second access information with the other programmable controllers in the form of a distributed ledger; as well as A processing unit that, when the communication unit newly receives an exceptional access having a lower frequency than other accesses among the first access indicated by the first access information and the second access indicated by the second access information, performs a different process on the exceptional access from that on the other accesses.

7. A method for sharing access information, which is performed by a programmable controller connected to other programmable controllers, in, The access information sharing method comprises the following steps: The communication unit receives a first access from the outside via the network, The sharing unit provides first access information related to the first access to the other programmable controller, obtains second access information related to a second access to the other programmable controller via the network from the other programmable controller, and shares the first access information and the second access information with the other programmable controller in the form of a distributed ledger. When the communication unit newly receives an exceptional access having a lower frequency than other accesses among the first access indicated by the first access information and the second access indicated by the second access information, the processing unit performs a different process for the exceptional access from that for the other accesses.

8. A program for causing a programmable controller connected to another programmable controller to function as the following unit: a communication unit that receives a first access from the outside via a network to communicate; a storage unit configured to store first access information related to the first access; a sharing unit that provides the first access information stored in the storage unit to the other programmable controller, obtains second access information related to a second access to the other programmable controller via the network from the other programmable controller, and thereby shares the first access information and the second access information with the other programmable controller in the form of a distributed ledger; as well as A processing unit that, when the communication unit newly receives an exceptional access having a lower frequency than other accesses among the first access indicated by the first access information and the second access indicated by the second access information, performs a different process on the exceptional access from that on the other accesses.

Images