Elevator system and communication packet analysis countermeasure method

Abstract

The present invention makes it difficult to interpret communication packets in multi-branch communication in an elevator system. An elevator system (100) includes an elevator and a plurality of control devices associated with operation control and maintenance of the elevator, the plurality of control devices being capable of communicating with each other. The control device comprises: a sequence generation unit (42a) for generating sequence data for changing the format of the communication packet sent to the other control device according to the operation state of the elevator; a protection data generation unit (43a) that, on the basis of the order data, encrypts the communication packet by changing the format of the communication packet; and a protection data recovery unit (45a) that recovers the communication packet received from the other control device.

Description

Technical Field

[0001] The invention relates to an elevator system and a communication grouping analysis countermeasure method. Background Art

[0002] In the past, a maintenance terminal for maintaining the elevator was connected to the elevator system. In the communication between the elevator system and the maintenance terminal, a communication packet storing communication data was generated according to a specified data structure. In addition, when sending a communication packet, only the payload portion storing the communication data was encrypted, and the header storing the address information for sending and receiving was sent without encryption. Such a communication packet has insufficient defense capability in communication and is easily speculated. Therefore, for example, in Patent Document 1, a technology for obfuscating communication packets is proposed.

[0003] Patent document 1 states that "the maintenance terminal and the elevator control system use the state of the elevator and the like as common information to prevent unauthorized reading of the data to be sent, and obfuscate the data to be sent by encoding the data to be sent." and "the obfuscation processing unit converts the payload portion of the communication packet." Prior art literature Patent Literature

[0004] Patent document 1: Japanese Patent Laid-Open No. 2022-066665 Summary of the invention Technical problem to be solved by the invention

[0005] As described above, conventionally, a technique has been proposed for encoding the transmission target data (payload portion) of the communication packet sent and received between the elevator system and the maintenance terminal, and changing the data structure of the payload portion of the communication packet. However, in the one-to-one communication between the elevator system and the maintenance terminal, it is easy to interpret the order of data exchange, that is, the communication sequence, by monitoring the data flowing through the communication path.

[0006] On the other hand, the elevator system is a distributed control system composed of multiple controllers, and sometimes uses a so-called multi-branch communication path that realizes 1-to-N or N-to-N communication. The multi-branch communication path includes, for example, RS (Recommended-Standards: Recommended Standards)-485 for serial communication and 10BASE5 for network communication as standard communication methods. When multiple terminals are connected to the multi-branch communication path, the possibility of communication packets being intercepted is high. By intercepting or collecting communication packets, it is possible to decipher the unencrypted header (the structural part that stores the address information sent and received), the communication sequence of the entire elevator system, and the control processing collaboration between controllers. If the deciphered communication sequence and communication data are misused, the normal operation of the elevator control may be hindered. Therefore, in the multi-branch communication in the elevator system, countermeasures are required to make the interpretation of communication packets difficult.

[0007] The present invention has been made in view of the above-mentioned situation, and an object of the present invention is to make it difficult to decipher communication packets in multi-branch communication of an elevator system. Technical means for solving technical problems

[0008] The present invention relates to an elevator system, comprising an elevator and a plurality of control devices associated with the operation control and maintenance of the elevator, wherein the plurality of control devices can communicate with each other. In the elevator system, the control devices comprise: a sequence generating unit, which generates sequence data for changing the format of a communication packet sent to other control devices according to the operation state of the elevator; a protection data generating unit, which changes the format of the communication packet and encrypts it according to the sequence data; and a protection data recovery unit, which recovers the communication packet received from other control devices. Effects of the Invention

[0009] According to the present invention having the above configuration, in multi-branch communication of an elevator system, it is possible to make it difficult to decipher communication packets. Problems, structures, and effects other than those described above will become more apparent through the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a diagram showing a configuration example of an elevator system according to one embodiment of the present invention. Figure 2 This is a block diagram showing a hardware configuration example of each control device of the elevator system according to one embodiment of the present invention. Figure 3 This is a block diagram showing a functional configuration example of each control device of the elevator system according to one embodiment of the present invention. Figure 4 This is a diagram for explaining a change in the format of a communication packet of the elevator system according to one embodiment of the present invention. Figure 5 This is a flowchart showing the procedure of communication packet transmission and reception processing in a control device on the transmission and reception side of an elevator system according to one embodiment of the present invention. Figure 6 This is a flowchart showing the procedure of data protection processing in a control device on the transmission side of an elevator system according to one embodiment of the present invention. Figure 7 This is a flowchart showing the procedure of data restoration processing in a control device on the receiving side of an elevator system according to one embodiment of the present invention. Figure 8This is a flowchart showing the procedure of a node ID change process in a transmission-side control device of an elevator system according to one embodiment of the present invention. Fig. 9 This is a flowchart showing the procedure of operation mode determination processing in a control device on the receiving side of an elevator system according to one embodiment of the present invention. Fig.10 It is a diagram showing a data example of a communication availability determination table of each control device of the elevator system according to one embodiment of the present invention. Fig.11 This is a flowchart showing the procedure of communication availability determination processing in a control device on the receiving side of an elevator system according to one embodiment of the present invention. Fig.12 It is a diagram showing a data example of a communication rejection completion table of each control device of the elevator system according to one embodiment of the present invention. Fig.13 This is a flowchart showing the procedure of a virtual transmission process in a control device on the receiving side of an elevator system according to one embodiment of the present invention. DETAILED DESCRIPTION

[0011] Hereinafter, a mode for implementing the present invention will be described with reference to the accompanying drawings. In this specification and the accompanying drawings, components having substantially the same function or structure are denoted by the same reference numerals to omit repeated description.

[0012] <One embodiment> [Configuration example of elevator system] First, the configuration of an elevator system 100 according to an embodiment of the present invention will be described. The elevator system 100 includes an elevator and a plurality of control devices associated with operation control and maintenance of the elevator, and the plurality of control devices can communicate with each other. Figure 1 1 is a diagram showing a configuration example of an elevator system 100 according to the present embodiment. Figure 1 As shown, the elevator system 100 includes a central device 1, a communication controller 3, a management terminal 20, an elevator group 18a and an elevator group 18b, and a maintenance terminal 50. The central device 1 and the communication controller 3 are connected via a communication line 2 such as a mobile closed circuit network such as a dedicated line or a public line such as the Internet. In addition, the communication controller 3 and the management terminal 20 are connected to a plurality of elevator groups (elevator group 18a and elevator group 18b) via a communication path 17. The communication path 17 is a communication path using a communication device using a multi-branch method. Figure 1 An example in which the elevator system 100 includes two elevator groups is shown, but the present invention is not limited thereto, and the elevator system 100 may include only one or more than three elevator groups.

[0013] The central device 1 is a computer device disposed in a remote center and performs remote maintenance and remote operation of each elevator group. The central device 1 instructs the group management controller 4 of each elevator group to perform remote maintenance or remote operation via the communication path 2 and the communication controller 3.

[0014] The communication controller 3 is an example of a control device, and is a computer device that transmits and receives data between the central device 1 and the group control controller 4 of each elevator group via the communication path 17. Figure 2 The hardware structure of the communication controller 3 is described in detail in FIG.

[0015] The management terminal 20 is an example of a control device and is a computer device used by the manager of the elevator system 100 to perform various settings for the elevators of each elevator group, monitor the operating status, etc. The various settings performed in the management terminal 20 are sent to the elevator controller 5 described later via the communication path 17 and the group management controller 4 described later for each elevator group. Figure 2 The hardware structure of the management terminal 20 is described in detail in FIG.

[0016] The maintenance terminal 50 is an example of a control device, and is a computer device for performing maintenance operations on each controller and each communication path of the elevator system 100. The maintenance terminal 50 is, for example, a maintenance port installed on the substrate of each controller, a terminal device for performing maintenance operations connected to each communication path, etc. Here, each controller includes a communication controller 3, a group management controller 4, an elevator controller 5, a car controller 10, and a floor controller 11. In addition, each communication path includes a communication path 12, a communication path 16, and a communication path 17. In the following Figure 2 The hardware structure of the maintenance terminal 50 is described in detail.

[0017] The elevator group 18a and the elevator group 18b have the same structure. In the following description, the elevator group 18a is used as an example and the description of the elevator group 18b is omitted. Figure 1 As shown, the elevator group 18a includes a group control controller 4 and a plurality of elevators (elevator 15a and elevator 15b). The group control controller 4 is connected to the elevator controllers 5 of the elevators 15a and 15b via a communication path 16. The communication path 16 is a communication path using a communication device using a multi-branch method, similar to the communication path 17. Figure 1 An example in which the elevator group includes two elevators is shown, but the present invention is not limited thereto, and the elevator group may include more than three elevators.

[0018] The group management controller 4 is an example of a control device, and is a computer device that performs operation management of each elevator group. Figure 2 The hardware structure of the group management controller 4 is described in detail.

[0019] The elevator 15a and the elevator 15b have the same structure. In the following description, the elevator 15a is used as an example and the description of the elevator 15b is omitted. Figure 1 As shown, the elevator 15a has an elevator controller 5, a motor 6, a car 7, a counterweight 8, a car controller 10, a floor controller 11, and an up / down button 14. The car 7 and the counterweight 8 are wound on a traction machine (not shown) having a built-in motor 6 by a rope 9 and are suspended on a hoistway (not shown). The counterweight 8 is a heavy object for obtaining balance.

[0020] The elevator controller 5 is an example of a control device, and is a computer device that controls the up and down movement of the car 7 driven by the motor 6 by controlling the motor 6. The elevator controller 5 and the group management controller 4 can be installed in the hoistway or in the machine room (not shown) above the hoistway. Figure 2 The hardware structure of the elevator controller 5 is described in detail.

[0021] The car controller 10 is an example of a control device, which is installed on the ceiling of the car 7 and is connected to the operating panel 13 that manages the target floor buttons and door opening and closing buttons (not shown) in the car 7. The car controller 10 is a computer device that monitors the user's operating status of the operating panel 13 and sends the monitored operating status to the elevator controller 5 via the communication path 12. The communication path 12, like the communication path 16 and the communication path 17, is a communication path of a communication device that applies a multi-branch method. The car controller 10 is not limited to being installed on the ceiling of the car 7, but can also be installed at any position in the car 7. In addition, the car controller 10 can also replace the operating panel 13 and send the target floor registered in the target floor reservation system (not shown) that can communicate with the elevator system 100 to the elevator controller 5 via the communication path 12. In the later described Figure 2 The hardware structure of the car controller 10 is described in detail.

[0022] The floor controller 11 is an example of a control device, and is a computer device that is connected to the up / down button 14, monitors the operation status of the up / down button 14 by the user, and transmits the monitored operation status to the elevator controller 5 via the communication path 12. In addition, the floor controller 11 may also transmit the boarding floor and the target floor registered in the target floor reservation system (not shown) that can communicate with the elevator system 100 to the elevator controller 5 via the communication path 12 instead of the up / down button 14. Figure 2 The hardware structure of the floor controller 11 is described in detail.

[0023] [Hardware Configuration Example of Each Control Device] Next, a hardware configuration example of each control device of the elevator system 100 will be described. Figure 2This is a block diagram showing a hardware configuration example of each control device of the elevator system 100 according to the present embodiment. Figure 2 The computer 30 shown is an example of hardware that can be used as a computer that can operate as each control device of the elevator system 100.

[0024] The computer 30 includes an MPU (Micro Processing Unit) 31 , a ROM (Read Only Memory) 32 , a RAM (Random Access Memory) 33 , and a communication IF (Interface) 34 , which are respectively connected to a bus 35 .

[0025] The MPU 31 reads the program code of the software for realizing the functions of each control device involved in the present embodiment from the ROM 32, loads it into the RAM 33 and executes it. Variables or parameters generated in the middle of the operation processing of the MPU 31 are temporarily written in the RAM 33, and these variables or parameters are appropriately read by the MPU 31. Instead of the MPU 31, an MCU (Micro Control Unit), a CPU (Central Processing Unit), etc. may be used. In addition, the computer 30 may also include a non-volatile memory such as NVRAM (Non-Volatile Random Access Memory), HDD (Hard Disk Drive), SSD (Solid State Drive). In this case, the program, data, etc. required for the MPU 31 to operate can be recorded in the non-volatile memory. That is, the ROM 32 or the non-volatile memory is used as an example of a computer-readable non-temporary recording medium that stores the program executed by the computer.

[0026] The communication IF 35 uses, for example, a NIC (Network Interface Card) and can send and receive various data between devices via a multi-branch serial communication device, a LAN (Local Area Network) connected to the NIC terminal, a WAN (Wide Area Network), a wireless communication path, i.e., a RAN (Radio Area Network), a dedicated line, and the like.

[0027] [Functional configuration example of each control device] Next, a hardware configuration example of each controller of the elevator system 100 will be described. Figure 3 It is a block diagram showing a functional configuration example of each control device of the elevator system 100 according to the present embodiment. Figure 3 The example of a communication structure in which the control device 40a on the transmission side and the control device 40b on the reception side are connected to the communication path 60 is shown. The control device 40a on the transmission side and the control device 40b on the reception side are each any one of the control devices that can communicate in the elevator system 100. The communication path 60 is any one of the communication path 12, the communication path 16, and the communication path 17 described above, depending on the connected control device.

[0028] The control device 40a on the transmission side includes an elevator state confirmation unit 41a, a sequence generation unit 42a, a protection data generation unit 43a, a communication unit 44a, and a protection data restoration unit 45a. Each functional component of the control device 40a on the transmission side operates under the control of the MPU 31 described above.

[0029] The elevator state confirmation unit 41a confirms the operation state of the elevator of the elevator system 100 at a predetermined period, and outputs the operation state data to the sequence generation unit 42a. Here, the elevator operation state data includes state data such as the stop state of the car, the stop floor of the car, the speed of the car, or state data generated by combining these state data. In addition, the operation state data of the elevator system 100 can also be generated based on data indicating the operation mode state inside the control device 40a on the transmission side.

[0030] The sequence generating unit 42a generates sequence data (see the following description) for changing the format of the communication packet sent to another control device (the control device 40b on the receiving side) based on the elevator operation status data. Figure 4 ). The format of the communication packet has a header and a payload. The header includes sending side identification information, receiving side identification information and data size information, and the payload includes communication data. The sequence generation unit 42a divides the payload into multiple parts, and generates sequence data for changing the arrangement order of the sending side identification information, receiving side identification information, data size information, and multiple parts of the divided payload contained in the format of the communication packet according to the operating status of the elevator. In addition, the sequence generation unit 42a outputs the generated sequence data to the protection data generation unit 43a. The sequence generation unit 42a generates sequence data, for example, based on pre-registered information indicating the order associated with each operating status data. In addition, the sequence generation unit 42a can also generate sequence data using, for example, pre-prepared logic for generating sequence data corresponding to each operating status data.

[0031] The protection data generation unit 43a changes the format of the communication packet based on the sequence data input from the sequence generation unit 42a, encrypts the header and payload of the communication packet, and generates protection data. The protection data generation unit 43a outputs the generated protection data to the communication unit 44a.

[0032] The communication unit 44a performs data transmission and reception (transmission and reception of protection data) with another control device (control device 40b on the receiving side).

[0033] The protection data recovery unit 45a recovers the communication packets received from other control devices. Each control device can be a receiving side or a sending side. When the control device is a receiving side, the protection data recovery unit 45 operates. On the other hand, when the control device is a sending side ( Figure 2 In the case of the control device 40a on the sending side shown in FIG. 1 , the protection data recovery unit 45a does not operate.

[0034] The control device 40b on the receiving side includes an elevator state confirmation unit 41b, a sequence generation unit 42b, a protection data generation unit 43b, a communication unit 44b, and a protection data restoration unit 45b. Each functional component of the control device 40b on the receiving side operates under the control of the MPU 31 described above.

[0035] The communication unit 44b receives the protected communication format (protected data) from the communication unit 44a of the control device 40a on the transmission side via the communication path 60, and outputs it to the elevator state confirmation unit 41b and the protected data restoration unit 45b.

[0036] The elevator state confirmation unit 41b confirms the operation state of the elevator at a predetermined period, and outputs the operation state data to the sequence generation unit 42b.

[0037] The sequence generation unit 42b generates sequence data (restored sequence data) for restoring the format of the received communication packet based on the elevator operation status data, and outputs it to the protection data restoration unit 45b. The sequence generation unit 42b generates the restored sequence data based on, for example, pre-registered information indicating the sequence associated with each operation status data. In addition, the sequence generation unit 42a may generate the restored sequence data using, for example, pre-prepared logic for generating restored sequence data corresponding to each operation status data.

[0038] The protection data restoration unit 45b decodes the received communication packet (protection data), and restores the communication packet based on the restoration sequence data input from the sequence generation unit 42b.

[0039] When the control device is the transmitting side, the protection data generating unit 43b operates. On the other hand, when the control device is the receiving side ( Figure 2In the case of the control device 40b on the receiving side shown in FIG. 1 , the protection data generating unit 43b does not operate.

[0040] Next, a change in the format of the communication packet in the control device 40a on the transmission side of the elevator system 100 will be described. Figure 4 It is a figure for demonstrating the format change of the communication packet of the elevator system 100 which concerns on this embodiment. Figure 4 A is a diagram showing the original (before change) communication packet. Figure 4 B is a diagram showing sequence data generated by the sequence generating unit 42a of the control device 40a on the transmission side. Figure 4 C is a diagram showing a communication packet after the format is changed. Figure 4 D is a diagram showing an encrypted communication packet (protected data).

[0041] For example, Figure 4 As shown in FIG. 1A , the original communication packet F10 has a field F11 of “Magic No.”, a field F12 of “Send ID”, a field F13 of “Receive ID”, and a field F14 of “Data Size”. In addition, the original communication packet F10 has a field F15 of “Data Area” and a field F16 of “Check Data”. The field F12 of “Send ID”, the field F13 of “Receive ID”, and the field F14 of “Data Size” are included in the header of the communication format. The field F15 of “Data Area” is included in the payload of the communication format.

[0042] In the field F11 of "Magic No.", identification information of the original communication packet F10 is stored. In the field F12 of "transmission ID", identification information (transmission side identification information) of the control device 40a on the transmission side, for example, identification ID (Identification) is stored. In the field F13 of "receiving ID", identification information of the control device 40b on the receiving side (receiving side identification information), for example, identification ID, is stored. The field F14 of “data size” stores the size of communication data, that is, the size of data stored in the field F14 of “data area”. The communication data is stored in the field F15 of the "data area". In the field F16 of “check data”, data for confirming mismatch of the communication packets, for example, “1” indicating mismatch or “0” indicating match is stored.

[0043] Figure 4The sequence data F20 shown in B is an example of sequence data generated by the sequence generation unit 42a. In order to confuse the communication data, the sequence generation unit 42a divides the payload part into multiple parts. Then, the sequence generation unit 42a generates the transmission side identification information, the reception side identification information, the data size information, and the sequence data for changing the arrangement order of the multiple parts of the divided payload part according to the operation state. Figure 4 In the example shown in B, the data (payload part) stored in the field F15 of the "data area" is divided into two parts (data A and data B). Data A and data B are, for example, the first half and the second half of the payload part, respectively. The payload part is not limited to being divided into the first half and the second half, but can also be divided into any number of parts, and the sizes of the divided parts can also be different. In addition, the sequence generation unit 42a is, for example, Figure 4 As shown in FIG. 1B , the sequence data F20 is generated in the order of “data A”, “transmission ID”, “size”, “data B”, and “reception ID”. Here, the size of each field (F21 to F25) of the sequence data F20 is assumed to be a predetermined fixed size, but it can also be a variable size. In addition, the arrangement order defined by the sequence data F20 is not limited to Figure 4 The sequence shown in B changes dynamically according to the operating status.

[0044] according to Figure 4 The sequential data F20 shown in B, the communication packet F30 after the format change is as follows Figure 4 C. The communication packet F30 is generated in the order of field F11, field F151, field F12, field F14, field F152, field F13, and field F16. The divided data A and data B are stored in the field F151 and the field F152, respectively.

[0045] In order to make the analysis of the communication packet more difficult, the protection data generating unit 43a generates the communication packet F30 after the format is changed. Figure 4 D. The sequence generation unit 42a encrypts the fields F151, F12, F14, F152, and F13, that is, the header and the payload. The field F11 of "Magic No." and the field F16 of "Check Data" are not the objects of sequence generation and encryption. In addition, in the case of 1-to-N communication, the "Send ID" may also be set as not the object of sequence generation and encryption.

[0046] [Communication Packet Transmission and Reception Processing] Next, the transmission and reception processing of the communication packet in the control device on the transmission and reception side of the elevator system 100 will be described. Figure 5This is a flowchart showing the steps of the communication packet transmission and reception processing in the control device on the transmission and reception side of the elevator system 100 involved in this embodiment. Since there is a control cycle in the control of the elevator system 100, the elevator state confirmation unit of each control device confirms the operating state of the elevator in each control cycle. The processing described below is performed in each control cycle.

[0047] First, the elevator state confirmation unit 41a of the transmission-side control device 40a confirms the operation state of the elevator, and outputs the confirmed operation state data to the sequence generation unit 42a (step S10).

[0048] Next, the sequence generating unit 42a generates sequence data based on the operation status data input from the elevator status confirming unit 41a (step S20). Figure 4 B) Output to the protection data generating unit 43a.

[0049] Next, the protection data generating unit 43a performs data protection processing according to the sequence data input from the sequence generating unit 42a (step S30). In addition, the protection data generating unit 43a outputs the protected communication packet (protected data) to the communication unit 44a. Figure 6 The data protection process is described in detail in the.

[0050] Next, the communication unit 44a transmits the protection data input from the protection data generation unit 43a and information indicating the control cycle for generating the protection data to the receiving control device 40b (step S40). After the processing of step S40, the transmission processing of the communication packet in the transmitting control device 40a is completed.

[0051] On the other hand, in the control device 40b on the receiving side, the communication unit 44b receives information indicating the protection data and the control cycle for generating the protection data from the communication unit 44a of the control device 40a on the sending side (step S50). In addition, the communication unit 44b outputs the received protection data to the protection data recovery unit 45b, and outputs information indicating the control cycle for generating the protection data to the elevator state confirmation unit 41b.

[0052] Next, the elevator state confirmation unit 41b extracts the elevator operation state data confirmed in the control cycle based on the received information indicating the control cycle, and outputs the data to the sequence generation unit 42b (step S60).

[0053] Next, the sequence generating unit 42b generates restoration sequence data based on the data for generating sequence data associated with the operating state data extracted by the elevator state confirming unit 41b (step S70). Here, the restoration sequence data is sequence data whose sequence is opposite to the sequence data corresponding to the operating state data extracted by the elevator state confirming unit 41b.

[0054] Next, the protection data recovery unit 45b performs data recovery processing on the received protection data (step S80). Figure 7 The data restoration process is described in detail in . After the process of step S80, the reception process of the communication packet in the control device 40b on the receiving side ends.

[0055] [Data protection processing] Next, the data protection processing in the protection data generating unit 43a of the control device 40a on the transmission side will be described. Figure 6 1 is a flowchart showing the procedure of data protection processing in the control device 40a on the transmission side of the elevator system 100 according to the present embodiment. Figure 5 In step S30 of the communication packet transmission and reception process shown in FIG. 1 , the process described below is called as a subroutine and executed.

[0056] First, the protection data generating unit 43a of the control device 40a on the transmission side determines whether or not there is unread sequential data (step S31).

[0057] In the process of step S31 , when the protection data generating unit 43 a determines that there is no unread sequential data (in the case of “No” in step S31 ), the protection data generating unit 43 a performs the process of step S35 described later.

[0058] On the other hand, in the process of step S31, when the protection data generating unit 43a determines that there is unread sequential data (if step S31 is "Yes"), it reads each field constituting the sequential data in sequence (refer to Figure 4 B) information stored in (step S32).

[0059] Next, the protection data generating unit 43a generates the protection data from the original communication packet (see Figure 4 A) Reading data (step S33). For example, the protection data generation unit 43a reads the data stored in Figure 4 In the case of "data A" in the field F21 of the sequential data F20 shown in B, Figure 4 The data corresponding to data A (the first half of the data area) is read from the field F15 of the original communication packet F10 indicated by A.

[0060] Next, the protection data generator 43a adds the data read from the original communication packet to the protection data (step S34). After step S34, the data protection process returns to step S31, and steps S31 to S34 are repeatedly executed until the sequential data is read.

[0061] Next, if the answer of step S31 is "No", the protection data generation unit 43a performs a node ID change process (step S35). Figure 8 The node ID change process is described in detail.

[0062] Next, the protection data generating unit 43a encrypts the header and payload of the communication packet (see Figure 4 D) (step S36). After the processing of step S36, the data protection processing ends.

[0063] [Data recovery process] Figure 7 1 is a flowchart showing the procedure of data restoration processing in the control device 40b on the receiving side of the elevator system 100 according to the present embodiment. Figure 5 In step S80 of the communication packet transmission and reception process shown in FIG. 1 , the process described below is called as a subroutine and executed.

[0064] First, the protection data restoration unit 45b of the control device 40b on the receiving side decodes the received communication packet (step S81).

[0065] Next, the protection data restoration unit 45b performs an operation mode determination process (step S82). Fig. 9 The operation mode determination process is described in detail.

[0066] Next, the protected data restoration unit 45b performs communication availability determination processing (step S83). Fig.11 The communication availability determination process is described in detail.

[0067] Next, the protected data restoration unit 45b determines whether the determination result of the communication permission determination process is that communication is permitted (step S84).

[0068] In the process of step S84, when it is determined that the determination result of the communication permission determination process is not communication permission (if the determination of step S84 is "No"), the protected data restoration unit 45b rejects communication (step S85).

[0069] On the other hand, in the process of step S84, if it is determined that the result of the communication permission determination process is that communication is permitted (in the case of a "yes" determination in step S84), the protected data restoration unit 45b performs the process of step S86. In the process of step S86, the protected data restoration unit 45b determines whether there is unread restoration sequence data for the sequence data for restoration data (restoration sequence data) input from the sequence generation unit 42b.

[0070] In the process of step S86 , when the protected data restoring unit 45 b determines that there is unread restoration sequence data (if “Yes” in step S86 ), it reads the restoration sequence data in sequence (step S87 ).

[0071] Next, the protection data restoration unit 45b restores the received communication packet, that is, the protection data (see Figure 4 C) Read data (step S88).

[0072] Next, the protection data recovery unit 45b adds the data read from the received communication packet to the recovery data (step S89). After the processing of step S89, the data recovery process returns to the processing of step S86, and the processing of steps S86 to S89 is repeatedly executed until the reading of the recovery sequence data is completed.

[0073] On the other hand, when the protection data generating unit 43a determines in the process of step S86 that there is no unread restoration order data (if step S86 is No), or after the process of step S85, the data restoration process is terminated.

[0074] In this embodiment, when each control device has a plurality of operation modes, the protection data generating unit 43a in the transmitting control device 40a changes the transmitting identification information according to the operation mode of the device itself and the operation mode of the designated receiving control device 40b.

[0075] Here, it is assumed that the plurality of operation modes of each control device of the elevator system 100 are a safety mode and a non-safety mode. When communication occurs between the control devices, there are four communication modes according to the operation modes of the control device 40a on the transmission side and the control device 40b on the reception side. The four communication modes are safety / safety, safety / non-safety, non-safety / safety, and non-safety / non-safety.

[0076] In the elevator system 100, in order to change the transmission side identification information (transmission ID), the node ID and the operation mode mask are set. The node ID is the transmission side identification information (transmission ID) set corresponding to the operation mode of the control device 40a on the transmission side. When the control device 40a on the transmission side operates in the safety mode, the protection data generation unit 43a applies the pre-registered operation mode mask to the node ID corresponding to the safety mode and changes the transmission side identification information. When the control device 40a on the transmission side operates in the non-safety mode, the protection data generation unit 43a does not apply the operation mode mask and does not change the transmission side identification information.

[0077] On the other hand, in the control device 40b on the receiving side, the protection data restoration unit 45b decodes the received communication packet, confirms the action mode mask applied to the transmission side identification information of the decoded communication packet, and determines the action mode of the device based on the confirmed action mode mask. For example, in the elevator system 100, it is assumed that the mask M1 is registered as the action mode mask corresponding to the safety mode of the control device 40a on the sending side and the non-safety mode of the control device 40b on the receiving side. In addition, it is assumed that the mask M2 is registered as the action mode mask corresponding to the safety mode of the control device 40a on the sending side and the safety mode of the control device 40b on the receiving side. In this case, in the control device 40b on the receiving side, when the protection data restoration unit 45b confirms that the action mode mask applied to the transmission ID of the communication packet is the mask M1, the action mode of the device is determined to be the non-safety mode. In addition, when the protection data restoration unit 45b confirms that the action mode mask applied to the transmission ID of the communication packet is the mask M2, the action mode of the device is determined to be the safety mode. In addition, the protection data restoration unit 45b generates a communication data based on the operation mode of the control device 40a on the transmission side, the determined operation mode of the own device, and the communication availability determination table registered in advance (see the following description). Fig.10 ) to determine whether communication is possible.

[0078] As described above, in the control device 40a on the sending side, the action mode of the control device 40b on the receiving side can be specified by applying the action mode mask to the node ID. In addition, the control device 40b on the receiving side only performs communications determined as permitted based on the action mode of the control device 40a on the sending side, the action mode specified by itself, and the communication permission determination table registered in advance, thereby excluding improper action mode communications.

[0079] [Node ID change processing] Figure 8 1 is a flowchart showing the steps of the node ID change process in the control device 40a on the transmission side of the elevator system 100 according to the present embodiment. Figure 6In step S35 shown, it is called and executed as a subroutine.

[0080] First, the protection data generation unit 43a confirms the current operation mode of the control device 40a on the transmission side (step S350). In each control device, a special register is generally prepared to maintain the state of the operation mode such as the safety mode and the non-safety mode. In addition, the state of the operation mode can also be maintained by software installed in each control device.

[0081] In the process of step S350 , when the protection data generating unit 43 a confirms that the current operation mode of the control device 40 a on the transmission side is the non-safe mode (if the step S350 is determined as non-safe), it performs the process of step S352 described later.

[0082] On the other hand, in the process of step S350, when the protection data generating unit 43a confirms that the current operation mode of the control device 40a on the transmission side is the safety mode (when step S350 is a safety determination), the operation mode mask is applied (step S351). In this process, the protection data generating unit 43a changes the transmission ID by, for example, performing an OR operation on the operation mode mask corresponding to the operation mode of the device itself and the operation mode of the control device 40b on the receiving side specified in advance and the transmission ID (node ​​ID). In addition, the operation mode of the control device 40b on the receiving side specified in advance is input (specified) by, for example, the manager of the elevator system 100 via the input device of the management terminal 20. In addition, the method of applying the operation mode mask is not limited to the OR operation, and other operation methods may also be used.

[0083] Next, the protection data generation unit 43a determines the transmission ID to which the operation mode mask is applied (step S352). After the process of step S352, the node ID change process ends.

[0084] [Operation mode determination process] Fig. 9 1 is a flowchart showing the steps of the operation mode determination process in the control device 40b on the receiving side of the elevator system 100 according to the present embodiment. Figure 7 In step S82 shown, it is called and executed as a subroutine.

[0085] First, the protection data restoration unit 45b of the control device 40b on the receiving side confirms the action mode mask applied to the transmission ID of the received communication packet (step S820). In this process, when the protection data generation unit 43a of the control device 40a on the sending side applies the action mode mask by an OR operation, the protection data restoration unit 45b can obtain the action mode mask applied to the transmission ID by performing an AND operation on the transmission ID of the received communication packet.

[0086] Next, the protection data restoration unit 45b confirms the operation mode of the control device 40b on the receiving side corresponding to the operation mode mask (step S821).

[0087] In the process of step S821, when confirming that the operation mode corresponding to the operation mode mask is the safe mode (if step S821 is a safe determination), the protected data restoration unit 45b determines the safe mode as the operation mode (step S822).

[0088] On the other hand, in the process of step S821, when the protection data restoration unit 45b confirms that the action mode corresponding to the action mode mask is the non-safe mode (in the case of non-safe determination in step S821), the non-safe mode is determined as the action mode (step S823). After the process of step S822 or S823, the action mode determination process ends.

[0089] In addition, in the elevator system 100, along with the execution of the node ID change process and the operation mode determination process, a process for eliminating improper operation mode communication is also executed. In each control device of the elevator system 100, a communication availability determination table T1 (see below) for determining whether communication is available is pre-registered according to the operation mode of each of the control device 40a on the transmission side and the control device 40b on the reception side. Fig.10 The protection data restoration unit 45b of the control device 40b on the receiving side performs communication availability determination processing based on the communication availability determination table T1 (refer to the following description). Fig.11 ).

[0090] Fig.10 The communication determination table T1 of each control device of the elevator system 100 according to the present embodiment stores information indicating communication availability corresponding to the operation mode of the control device 40a on the transmission side and the operation mode of the control device 40b on the reception side.

[0091] like Fig.10As shown, the communication determination table T1 has a column T11 of "group control controller" corresponding to the transmission side, a column T12 of "elevator controller", a column T13 of "car controller", and a column T14 of "floor controller". Columns T11 to T14 include a column of "NS (non-safe)" and a column of "S (safe)". In addition, the communication determination table T1 has a column T15 of "group control controller" corresponding to the reception side, a column T16 of "elevator controller", a column T17 of "car controller", and a column T18 of "floor controller". Columns T15 to T18 include a row of "S (safe)" and a row of "NS (non-safe)". In each cell of the communication determination table T1, information indicating whether communication is possible is stored, corresponding to the operation state ("NS" or "S") of the control device 40a on the transmission side corresponding to the column where the cell is located, and the operation state of the control device 40b on the reception side corresponding to the row where the cell is located. The information indicating whether communication is possible includes, for example, "×" indicating that communication is not possible, "0" indicating that communication is possible, and "-" indicating that there is no communication between controllers as shown in the figure. The display method of the information indicating whether communication is possible is not limited to "×", "0", "-", etc., and can also be any display method.

[0092] As a specific example of the determination of whether or not communication is permitted, for example, regarding communication from the car controller on the transmission side to the elevator controller on the reception side, communication from the car controller's two operation modes "NS" and "S" (column T13) to the elevator controller's "NS" (column T16) is permitted. On the other hand, regarding communication from the floor controller on the transmission side to the elevator controller on the reception side, communication from the floor controller's "NS" (column T14) mode to the elevator controller's "NS" (column T16) mode is permitted. Furthermore, communication from the floor controller's "S" mode to the elevator controller's "S" mode is permitted. That is, regarding communication from the floor controller to the elevator controller, only communication within the same mode is permitted. This is because, for example, communication from a floor controller that operates in a safe ("S") mode during maintenance work to an elevator controller that operates in a non-safe ("NS") mode during normal operation is not permitted. On the other hand, regarding communication from the floor controller to the elevator controller, only communication within the same mode is permitted because the floor controller that manages input devices such as up and down buttons does not need to operate in a mode different from that of the elevator controller.

[0093] [Communication availability determination process] Next, the communication availability determination process in the control device 40b on the receiving side will be described. Fig.11 1 is a flowchart showing the steps of the communication availability determination process in the control device 40b on the receiving side of the elevator system 100 according to the present embodiment. Figure 7In step S83 shown, it is called and executed as a subroutine.

[0094] First, the protection data recovery unit 45b of the control device 40b on the receiving side obtains Figure 7 The operation mode determined in the operation mode determination process of step S82 shown in the figure and the operation mode of the control device 40a on the transmission side (step S830).

[0095] Next, the protection data restoration unit 45b determines whether communication is possible based on the communication possibility determination table T1, the acquired operation mode of the receiving-side control device 40b, and the operation mode of the transmitting-side control device 40a (step S831).

[0096] In the process of step S831, when the protected data restoration unit 45b determines that communication is permitted (when the determination in step S831 is “permitted”), the communication is permitted (step S832).

[0097] On the other hand, in the process of step S831, when the protection data restoration unit 45b determines that the communication is rejected (if the step S831 is "No"), it records the operation mode (step S833). In this process, the protection data restoration unit 45b records the transmission ID and reception ID of the communication packet, the operation mode of the control device 40a on the transmission side, and the operation mode of the control device 40b on the reception side in the communication rejection completion table T2 described later (refer to Fig.12 )middle.

[0098] Next, the protection data restoration unit 45b rejects the communication from the control device 40a on the transmission side (step S834). After the processing of step S832 or S834, the communication availability determination processing ends.

[0099] Fig.12 The data example of the communication rejection completion table T2 in each controller of the elevator system 100 involved in this embodiment is shown. Fig.12 As shown, the communication rejection completion table T2 has a column T21 of "transmission ID", a column T22 of "operation mode" corresponding to the column T21, a column T23 of "reception ID", and a column T24 of "operation mode" corresponding to the column T23.

[0100] In the column T21 of “transmission ID”, the transmission ID of the communication packet of the rejected communication is stored. In the column T22 of “operation mode”, information indicating the operation mode of the control device 40 a on the transmission side of the rejected communication at that time is stored. In the column T23 of “reception ID”, the reception ID of the communication packet of the rejected communication is stored. In the column T24 of “operation mode”, information indicating the operation mode of the control device 40b at the receiving end of the rejected communication at that time is stored.

[0101] [Virtual sending process] In this embodiment, in order to further make analysis of communication packets difficult, in the control device 40b on the receiving side, the communication unit 44b sends dummy data when it is determined that the receiving destination is not this device based on the receiving side identification information (receiving ID) of the received communication packet. Fig.13 4 is a flowchart showing the steps of the virtual transmission process in the control device 40b on the receiving side of the elevator system 100 according to the present embodiment. Figure 5 The process is performed after the step S50 shown, or it can be performed as the process of step S50.

[0102] First, the communication unit 44b of the control device 40b on the receiving side receives a communication packet (step S500).

[0103] Next, the communication unit 44b determines whether the destination of the received communication packet is itself (the own device) (step S501).

[0104] In the process of step S501, when the communication unit 44b determines that the destination of the received communication packet is itself (when the determination in step S501 is "self"), it executes the normal process. Figure 5 The process of steps S60 to S80 is shown.

[0105] On the other hand, in the process of step S501, when the communication unit 44b determines that the receiving destination of the received communication packet is not itself (this device) (when step S501 is determined as "other"), it determines whether to perform virtual transmission (step S502). In this process, the communication unit 44b determines to perform virtual transmission when, for example, the frequency of data reception per unit time using random numbers exceeds a prescribed threshold, and step S502 determines to be "yes". On the other hand, when the frequency of data reception per unit time using random numbers is less than a prescribed threshold, the communication unit 44b determines not to perform virtual transmission, and step S502 determines to be "no". In addition, the determination criterion for whether to perform virtual transmission can also be determined based on the operating state of the elevator system 100, for example. At this time, when the operating state of the elevator system 100 is the operating state of virtual transmission specified in advance, the communication unit 44b determines to perform virtual transmission, and step S502 determines to be "yes". On the other hand, when the operation state of the elevator system 100 is not the operation state of the pre-specified virtual transmission, the communication unit 44b determines that the virtual transmission is not to be performed, and the step S502 is determined as "No". Here, the pre-specified operation state of the virtual transmission includes, for example, the car stop state, the car acceleration / deceleration state, etc.

[0106] In the process of step S502 , when the communication unit 44 b determines not to execute dummy transmission (in the case of a “No” determination in step S502 ), the communication unit 44 b executes normal processing.

[0107] On the other hand, in the process of step S502 , when the communication unit 44 b determines to execute virtual transmission (if the determination of step S502 is “Yes”), it stores the transmission ID and reception ID of the received communication packet (step S503 ).

[0108] Next, the communication unit 44b continues receiving the communication packet (step S504).

[0109] Next, the communication unit 44b determines whether the transmission ID and reception ID of the communication packet that is subsequently received match the stored transmission ID and reception ID (step S505).

[0110] In the process of step S505, when the communication unit 44b determines that the sending ID and receiving ID of the communication packet to be continuously received are consistent with the stored sending ID and receiving ID (when step S505 is determined to be "yes"), it executes the sending of virtual data (step S506). Virtual data is a communication packet using the stored sending ID and receiving ID, and the data area (payload part) can be any data (for example, a random number). There is a sending mode in which the stored receiving ID is used as the sending ID of the virtual data and the stored sending ID is used as the receiving ID of the virtual data. In addition, in the sending of virtual data, there is also a sending mode in which the ID of the control device 40b on the receiving side (the ID of this device) is used as the sending ID of the virtual data and the stored sending ID is used as the receiving ID of the virtual data.

[0111] On the other hand, in the process of step S505, when the communication unit 44b determines that the transmission ID and reception ID of the communication packet that is continuously received do not match the stored transmission ID and reception ID (in the case of "No" determination in step S505), the process of step S507 is performed. In the process of step S507, the communication unit 44b determines whether the number of confirmations of whether the transmission and reception IDs are consistent is greater than the predetermined number of times registered in advance.

[0112] In the process of step S507, when the communication unit 44b determines that the number of confirmations of whether the transmission and reception IDs match is less than the predetermined number registered in advance (if the determination of step S507 is "NO"), it returns to the process of step S504.

[0113] On the other hand, in the processing of step S507, when the communication unit 44b determines that the number of confirmations of whether the sending and receiving IDs are consistent is greater than the pre-registered specified number (if step S507 is determined to be "yes"), or after the processing of step S506, the virtual sending processing is ended.

[0114] [Effect] As described above, in the elevator system 100 according to the present embodiment, in the communication between the control devices including the 1-to-N and N-to-N multi-branch communication, the control device 40a on the sending side dynamically generates sequence data according to the operation state of the elevator system 100. In addition, the control device 40a on the sending side changes the format of the communication packet according to the dynamic sequence data corresponding to the operation state of the elevator system 100, and encrypts the payload and header of the communication packet. In addition, the control device 40a on the sending side specifies the operation mode of the control device 40b on the receiving side by applying the operation mode mask to the node ID. Therefore, according to the elevator system 100 according to the present embodiment, even if the communication packet is illegally intercepted in the multi-branch communication, it is possible to make it difficult to interpret the communication packet. In addition, according to the elevator system 100 according to the present embodiment, the operation mode of the control device 40b on the receiving side can also be specified.

[0115] On the other hand, the control device 40b on the receiving side of the elevator system 100 performs only the communication determined as permitted communication based on the operation mode of the control device 40a on the sending side, the specified operation mode of the control device 40a, and the communication permission determination table T1 registered in advance. Therefore, the elevator system 100 involved in this embodiment can exclude improper operation mode communication. In addition, the control device 40b on the receiving side performs virtual communication when it is determined that the receiving destination of the received communication packet is not the own device, thereby making it difficult to analyze the control sequence between the control devices.

[0116] The present invention is not limited to the above-described embodiment, and various other application examples and modified examples can of course be adopted without departing from the gist of the present invention described in the claims. For example, the above-mentioned embodiment describes the structure of the elevator system in detail and specifically in order to explain the present invention in an easy-to-understand manner, but it is not necessarily limited to having all the structures described. In addition, part of the structure of the embodiment described here can be replaced with the structure of other embodiments, and the structure of other embodiments can be added to the structure of a certain embodiment. In addition, with respect to part of the structure of the embodiment, other structures can be added, deleted, or replaced. In addition, although control lines and information lines necessary for explanation are shown, this does not limit the display to all control lines and information lines necessary for the product. In fact, it can be considered that almost all structures are connected to each other.

[0117] In addition, in the above-mentioned embodiment, an example is described in which the operation mode of each control device has a non-safe mode and a safe mode, but the present invention is not limited to this, and the operation mode of each control device may be a mode other than the non-safe mode and the safe mode. For example, when the control device is the management terminal 20 or the maintenance terminal 50, the operation mode is the administrator mode, the operator mode, etc. Description of symbols

[0118] 1…central device, 3…communication controller, 4…group management controller, 5…elevator controller, 6…motor, 8…counterweight, 9…rope, 10…car controller, 11…floor controller, 13…operating panel, 14…up and down buttons, 15a, 15b…elevator, 18a, 18b…elevator group, 20…management terminal, 40a, 40b…control device, 41a, 41b…elevator status confirmation unit, 42a, 42b…sequence generation unit, 43a, 43b…protection data generation unit, 44a, 44b…communication unit, 45a, 45b…protection data recovery unit, 50…maintenance terminal, 100…elevator system.

Claims

1. An elevator system, comprising an elevator and a plurality of control devices associated with operation control and maintenance of the elevator, wherein the plurality of control devices can communicate with each other, and the elevator system is characterized in that the control devices include: a sequence generating unit for generating sequence data for changing the format of a communication packet sent to other control devices according to the operation state of the elevator; a protection data generating unit, which changes the format of the communication packet according to the sequence data and performs encryption; as well as A protection data restoration unit is provided to restore a communication packet received from another control device.

2. The elevator system according to claim 1, characterized in that The control device includes an elevator state confirmation unit that confirms the operating state at a predetermined period, and a communication unit that transmits and receives data with other control devices.

3. The elevator system according to claim 1, characterized in that The protection data generating unit encrypts a header portion and a payload portion of the format of the communication packet.

4. The elevator system according to claim 3, characterized in that The header contains the transmission side identification information, the reception side identification information and the data size information, and the payload contains the communication data. In the control device on the sending side, the sequence generation unit divides the payload part into multiple parts, and generates sequence data for changing the sending side identification information, the receiving side identification information, the data size information and the arrangement order of the multiple parts of the divided payload part included in the format of the communication packet according to the operating status.

5. The elevator system according to claim 4, characterized in that The control device has multiple action modes. In the control device on the transmission side, the protection data generation unit changes the transmission side identification information by applying an operation mode mask for changing the transmission side identification information according to the operation mode of the own device and the operation mode of the designated control device on the reception side.

6. The elevator system according to claim 5, characterized in that In the control device on the receiving side, the protection data recovery unit decodes the received communication packet, confirms the action mode mask applied to the sending side identification information of the decoded communication packet, and determines the action mode of the own device based on the confirmed action mode mask.

7. The elevator system according to claim 6, characterized in that In the control device on the receiving side, the protection data restoration unit determines whether communication is possible based on the operation mode of the control device on the sending side, the determined operation mode of the own device, and a communication possibility determination table registered in advance.

8. The elevator system according to claim 5, characterized in that The plurality of operation modes are a non-safe mode and a safe mode.

9. The elevator system according to claim 8, characterized in that In the control device on the transmission side, the protection data generation unit performs the following operations: When the action mode of the device is the non-secure mode, the action mode mask is not applied. When the operation mode of the present device is the security mode, the transmission side identification information is changed by applying the operation mode mask.

10. The elevator system according to claim 2, characterized in that In the control device on the receiving side, the communication unit transmits the dummy data when determining that the reception destination is not the own device based on the reception side identification information of the received communication packet.

11. A communication group analysis countermeasure method, which is a communication group analysis countermeasure method in an elevator system, wherein the elevator system includes an elevator and a plurality of control devices associated with the operation control and maintenance of the elevator, wherein the plurality of control devices can communicate with each other, and the communication group analysis countermeasure method is characterized in that it includes: A step of generating sequence data for changing the format of a communication packet sent to other control devices according to the operating state of the elevator; The steps include: changing the format of the communication packet and encrypting the communication packet according to the sequence data; and restoring the communication packet received from another control device.

Images