Data diode and pulse control method

Abstract

The invention relates to a data diode and a pulse control method, which can be used to ensure safety and remotely deal with bad situations. The present invention is provided with: a transmission-side device (11) that transmits data from an OT network; a reception-side device (13) that transmits the input data to the IT network; and a one-way communication unit (12) that transmits the data transmitted by the transmission-side device (11) to the reception-side device (13), the reception-side device (13) having a pulse generation unit (134) that is activated in response to an instruction from an IT network and generates a pulse signal, and the transmission-side device (11) having a pulse output unit (114) that outputs a pulse signal to the reception-side device (13), the pulse signal generating unit (134) being activated in response to an instruction from the IT network. And a pulse output unit (114) that outputs the pulse signal generated by the pulse generation unit (134) to an OT-side device (2) connected to the OT network.

Description

Technical Field

[0001] The present disclosure relates to a data diode for unidirectional communication and a pulse control method based on the data diode. Background Art

[0002] Operational Technology (OT) networks (control networks) used in factory automation are crucial for controlling various devices. If these networks are maliciously compromised, abnormal control of devices could lead to unexpected accidents.

[0003] Thus, very important control networks are generally not connected to other networks to ensure security.

[0004] On the other hand, there is also a desire to use information generated on the control network externally. In such cases, data diodes are effective. Data diodes enable only one-way communication and are effective as a method for physically improving network security (see, for example, Patent Document 1).

[0005] Thus, in the data diode, only one-way communication is physically possible, so even if a malicious person wants to steal it, there is no network for infiltration. In addition, in order to ensure this, in the data diode, no reverse information transmission path can be set up under any circumstances.

[0006] [Prior art literature]

[0007] [Patent Document]

[0008] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-133558 Summary of the Invention

[0009] [Problems to be solved by the invention]

[0010] In this way, the data diode can only carry out one-way communication, so generally the sending side cannot obtain information from the receiving side. Using the data diode can almost completely prevent illegal access.

[0011] On the other hand, if the information sent from the OT network to the Information Technology (IT) network (business network) shows an abnormality, or if the information that should have been sent is not sent for some reason, it is assumed that some kind of adverse situation has occurred on the OT network side.

[0012] In contrast, in a normal network, access can be made from the IT network side to the OT network side to confirm the status of the failure, and recovery can be achieved by executing controls to eliminate the failure.

[0013] However, in the case of a data diode, access to confirm the status of a failure cannot be performed from the IT network side to the OT network side, and recovery by executing control to eliminate the failure cannot be achieved.

[0014] Therefore, in the case of a data diode, even if information including the occurrence of an abnormality on the OT network side is obtained, there is nothing that can be done unless a visit is made to the site of the OT network side.

[0015] In factories and other places, efforts to reduce labor costs in order to improve productivity often make it difficult to quickly respond to problems at the scene. Delayed response to problems not only reduces productivity but also has the potential to lead to disasters.

[0016] In order to take such measures, there is a demand to ensure safety by data diodes and to take appropriate measures remotely and quickly when a malfunction occurs.

[0017] The present disclosure is made to solve the above-mentioned problems, and an object of the present disclosure is to provide a data diode capable of remotely handling a malfunction when it occurs while ensuring safety.

[0018] [Technical means to solve the problem]

[0019] The data diode disclosed in the present invention is characterized in that it includes: a sending side device that sends data from a control network; a receiving side device that sends the input data to a business network; and a one-way communication unit that sends the data sent by the sending side device to the receiving side device, the receiving side device having a pulse generating unit that is started according to an instruction from the business network and generates a pulse signal, and the sending side device having a pulse output unit that outputs the pulse signal generated by the pulse generating unit to the control side device connected to the control network.

[0020] [Effects of the Invention]

[0021] According to the present disclosure, since it is configured as described above, it is possible to remotely handle an emergency when it occurs while ensuring safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a diagram showing a structural example of a data diode according to the first embodiment.

[0023] Figure 2This is a flowchart showing an example of a pulse output operation performed by the data diode in the first embodiment.

[0024] Figure 3 This is a diagram showing a structural example of a data diode according to the second embodiment.

[0025] [Explanation of Symbols]

[0026] 1: Data diode

[0027] 2: OT side equipment (control side equipment)

[0028] 11: Sending side device

[0029] 12: One-way communication department

[0030] 13: Receiving side equipment

[0031] 111: Receiving Department

[0032] 112: Buffer

[0033] 113: Sending Department

[0034] 114: Pulse output unit

[0035] 115: Check Timer

[0036] 131: Receiving Department

[0037] 132: Buffer

[0038] 133: Sending Department

[0039] 134: Pulse generation unit DETAILED DESCRIPTION

[0040] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

[0041] Implementation method 1.

[0042] Figure 1 This is a diagram showing a structural example of the data diode 1 according to the first embodiment.

[0043] The data diode 1 is a device that performs unidirectional communication from the OT network (control network) to the IT network (business network).

[0044] The purpose of the data diode 1 in the first embodiment is to achieve the necessary functions without creating a reverse information transmission path. Here, the necessary functions are functions that eliminate transmission-side problems when they occur. In other words, the purpose is to achieve the functions that are a given in normal communication, even in data diode 1, which cannot transmit information in the reverse direction.

[0045] For example, Figure 1 As shown, the data diode 1 includes a sending-side device 11 , a one-way communication unit 12 and a receiving-side device 13 .

[0046] In addition, if Figure 1 As shown, there are more than one OT side device (control side device) 2 connected to the OT network. Figure 1 In FIG, an OT side device 2 is shown.

[0047] The transmission-side device 11 transmits data from the OT network to the one-way communication unit 12 .

[0048] For example, Figure 1 As shown, the transmitting device 11 includes a receiving unit 111 , a buffer 112 , a transmitting unit 113 , and a pulse output unit 114 .

[0049] The receiving unit 111 receives data from the OT network.

[0050] The buffer 112 temporarily accumulates the data received by the receiving unit 111 .

[0051] The transmission unit 113 transmits the data accumulated in the buffer 112 to the one-way communication unit 12 .

[0052] The pulse output unit 114 outputs a pulse signal generated by a pulse generation unit 134 (described later) in the reception-side device 13 to the OT-side device 2 connected to the OT network.

[0053] That is, the output terminal of the pulse output unit 114 is connected to the pulse input terminal of the OT-side device 2, and the pulse signal output by the pulse output unit 114 is transmitted to the OT-side device 2. Then, the OT-side device 2 receives the pulse signal and uses it as a signal for resetting or restarting, etc., to resolve an abnormal state.

[0054] Furthermore, when there are multiple OT-side devices 2 connected to the OT network, one or more pulse output units 114 may be provided, and each pulse output unit 114 may be configured to output a pulse signal to each corresponding OT-side device 2 .

[0055] Furthermore, when there are a plurality of OT-side devices 2 connected to the OT network, a single pulse output unit 114 may be provided, and the pulse output unit 114 may be configured to output pulse signals to each of the plurality of OT-side devices 2 .

[0056] In addition, Figure 11 shows a configuration in which the sending device 11 includes a receiving unit 111, a buffer 112, and a sending unit 113 as a structure for sending data from the OT network to the one-way communication unit 12. However, the sending device 11 is not limited to the above configuration as long as it can send data from the OT network to the one-way communication unit 12.

[0057] The one-way communication unit 12 transmits data from the transmission-side device 11 to the reception-side device 13 .

[0058] The receiving-side device 13 transmits the data from the transmitting-side device 11 via the one-way communication unit 12 to the IT network.

[0059] For example, Figure 1 As shown, the receiving device 13 includes a receiving unit 131 , a buffer 132 , a transmitting unit 133 , and a pulse generating unit 134 .

[0060] The receiving unit 131 receives data from the transmitting-side device 11 via the one-way communication unit 12 .

[0061] The buffer 132 temporarily accumulates the data received by the receiving unit 131 .

[0062] The transmission unit 133 transmits the data accumulated in the buffer 132 to the IT network.

[0063] The pulse generating unit 134 is activated in response to an instruction from the IT network and generates a pulse signal.

[0064] Specifically, when the IT network determines that the OT device 2 is in an abnormal state, the pulse generator 134 is activated by sending specific data from the IT network to a specific port of the Internet Protocol (IP) address of the receiving device 13. The pulse generator 134 then generates a pulse signal. The specific port and data are predetermined and can be designed and modified as appropriate.

[0065] Situations in which the IT network performs the above-mentioned instructions include, for example: a situation in which an abnormality occurs in the OT side device 2 and recovery is possible by resetting (restarting); a situation in which there are no (understandable) personnel on site or the OT side device 2 cannot be operated (for example, the facility cannot be entered); or a situation in which recovery is desired as soon as possible, etc.

[0066] In this case, for example, specific data is sent from the IT network side to a specific port (using an application as needed) based on instructions from an organization (such as a maintenance company) that manages the network based on the data diode 1, or the maintenance company, etc. remotely accesses the IT network to send specific data to a specific port.

[0067] also, Figure 1 1 shows a case where the receiving device 13 includes a receiving unit 131, a buffer 132, and a transmitting unit 133 as a configuration for transmitting data from the transmitting device 11 via the one-way communication unit 12 to the IT network. However, the receiving device 13 is not limited to the configuration described above as long as it can transmit data from the transmitting device 11 via the one-way communication unit 12 to the IT network.

[0068] Next, refer to Figure 2 Description by Figure 1 An example of a pulse control operation performed by the data diode 1 according to the first embodiment is shown.

[0069] In addition, in the data diode 1 of embodiment 1, the sending side device 11 sends data from the OT network to the one-way communication unit 12, the one-way communication unit 12 sends data from the sending side device 11 to the receiving side device 13, and the receiving side device 13 sends the data from the sending side device 11 via the one-way communication unit 12 to the IT network.

[0070] In by Figure 1 In the pulse control operation example of the data diode 1 in the embodiment 1 shown, first, for example, Figure 2 As shown, the pulse generator 134 in the receiving device 13 is activated in response to an instruction from the IT network and generates a pulse signal (step ST101). Specifically, the pulse generator 134 is activated by sending specific data from the IT network to a specific port of the IP address of the receiving device 13. The pulse generator 134 then generates a pulse signal.

[0071] Next, the pulse output unit 114 in the transmitting device 11 outputs the pulse signal generated by the pulse generation unit 134 to the OT device 2 connected to the OT network (step ST102). Specifically, the output terminal of the pulse output unit 114 is connected to the pulse input terminal of the OT device 2, and the pulse signal output by the pulse output unit 114 is transmitted to the OT device 2. The OT device 2 then receives the pulse signal and uses it as a signal for resetting or restarting, for example, to resolve an abnormality.

[0072] Furthermore, when there are multiple OT-side devices 2 connected to the OT network, one or more pulse output units 114 may be provided, and each pulse output unit 114 may be configured to output a pulse signal to each corresponding OT-side device 2 .

[0073] Furthermore, when there are a plurality of OT-side devices 2 connected to the OT network, a single pulse output unit 114 may be provided, and the pulse output unit 114 may be configured to output pulse signals to each of the plurality of OT-side devices 2 .

[0074] As described above, in the data diode 1 of the first embodiment, when specific data is transmitted from the IT network to the specific port of the IP address of the receiving device 13 , the pulse generator 134 of the receiving device 13 is activated and generates a pulse signal.

[0075] Then, the pulse output unit 114 of the transmitting device 11 outputs the pulse signal generated by the pulse generation unit 134 of the receiving device 13 to the OT device 2 via the OT network. That is, the output end of the pulse output unit 114 is connected to the pulse input terminal of the OT device 2, and the pulse signal is transmitted to the OT device 2.

[0076] The OT-side device 2 receives the pulse signal and uses the pulse signal as a signal for resolving an abnormal state, such as resetting or restarting.

[0077] Thus, in the first embodiment, data diode 1 generates a pulse signal in response to instructions from the IT network and transmits this pulse signal to the OT network. However, in this case, the pulse signal is not transmitted, but only the pulse signal. Furthermore, this pulse signal is used to restore the abnormal OT device 2 to normal operation.

[0078] Furthermore, in the OT-side device 2 , if reset or restart is unconditionally caused by input of a pulse signal, normal operation cannot be expected when pulses are frequently generated.

[0079] If this becomes a problem, the OT device 2 can simply implement a mechanism that ignores the input of pulse signals during normal operation, validating the input of pulse signals only when an abnormality occurs. This mechanism can be easily implemented by providing a watchdog timer in the OT device 2.

[0080] As described above, according to the first embodiment, the data diode 1 includes: a sending-side device 11 that sends data from the OT network; a receiving-side device 13 that sends the input data to the IT network; and a one-way communication unit 12 that sends the data sent by the sending-side device 11 to the receiving-side device 13. The receiving-side device 13 has a pulse generating unit 134, which starts and generates a pulse signal according to an instruction from the IT network. The sending-side device 11 has a pulse output unit 114, which outputs the pulse signal generated by the pulse generating unit 134 to the OT-side device 2 connected to the OT network.

[0081] As a result, the data diode 1 according to the first embodiment can ensure safety and, when a malfunction occurs, can be handled remotely.

[0082] According to the first embodiment, there are a plurality of OT-side devices 2 , and one or more pulse output units 114 are provided to output pulse signals to the corresponding OT-side devices 2 .

[0083] According to the first embodiment, there are a plurality of OT-side devices 2 , and a single pulse output unit 114 is provided to output pulse signals to each of the plurality of OT-side devices 2 .

[0084] Thus, the data diode 1 of the first embodiment can remotely handle a malfunction while ensuring safety even when a plurality of OT-side devices 2 are connected to the OT network.

[0085] In addition, according to the embodiment 1, the pulse control method is a pulse control method in the data diode 1, and the data diode 1 includes: a sending side device 11, which sends data from the OT network; a receiving side device 13, which sends the input data to the IT network; and a one-way communication unit 12, which sends the data sent by the sending side device 11 to the receiving side device 13, in the receiving side device 13, the pulse generating unit 134 starts according to the instruction from the IT network and generates a pulse signal, and in the sending side device 11, the pulse output unit 114 outputs the pulse signal generated by the pulse generating unit 134 to the OT side device 2 connected to the OT network.

[0086] As a result, the pulse control method of the first embodiment can ensure safety and, when a malfunction occurs, can be handled remotely.

[0087] Implementation method 2.

[0088] In the second embodiment, a configuration example is shown in which the pulse disabling function by the watchdog timer is provided in the data diode 1 instead of the OT-side device 2 .

[0089] Figure 3 This is a diagram showing a structural example of the data diode 1 in accordance with the second embodiment. Figure 3 In the data diode 1 of the second embodiment shown, Figure 1 In the data diode 1 of the illustrated first embodiment, a watchdog timer (WDT) 115 is added to the transmitting-side device 11 . Figure 3 The rest of the configuration example of the data diode 1 in the second embodiment is the same as that of the data diode 1 in the first embodiment, and is denoted by the same reference numerals, and only the different parts will be described.

[0090] The watchdog timer 115 monitors the status of the OT-side device 2 by receiving data from the OT-side device 2 via the OT network.

[0091] When the watchdog timer 115 determines that the reception of data from the OT device 2 has been interrupted for a certain period, it determines that the state of the OT device 2 is abnormal, and outputs a signal indicating this to the pulse output unit 114 .

[0092] When the watchdog timer 115 determines that the OT-side device 2 is in an abnormal state, the pulse output unit 114 in the second embodiment outputs the pulse signal generated by the pulse generation unit 134. Specifically, the pulse output unit 114 outputs the pulse signal depending on whether a signal from the watchdog timer 115 is present. More specifically, the pulse output unit 114 does not output the pulse signal if there is no signal from the watchdog timer 115, and outputs the pulse signal if there is a signal from the watchdog timer 115.

[0093] Thus, in the data diode 1 of Embodiment 2, the transmitting device 11 is equipped with a pulse suppression function for the pulse output unit 114. Furthermore, the OT device 2 suppresses the output of pulse signals for a certain period of time by sending specific data to a specific port at the IP address of the transmitting device 11 via the OT network. The specific port and data are predetermined and can be designed and modified as appropriate.

[0094] Furthermore, if an abnormality occurs in the OT-side device 2, the communication to suppress the output of the pulse signal is no longer performed. Therefore, in the transmitting-side device 11 of the data diode 1, the output of the pulse signal from the pulse output unit 114 cannot be suppressed, and the pulse signal is transmitted to the pulse input terminal of the OT-side device 2.

[0095] Furthermore, in the OT-side device 2 , the abnormal state can be resolved by restarting or the like using the input of a pulse signal, thereby returning to normal operation.

[0096] Furthermore, when the OT-side device 2 is in an abnormal state, only a pulse signal for returning to normal is generated, and unauthorized access is impossible.

[0097] Furthermore, when the OT-side device 2 is normal, the pulse signal is not transmitted from the transmission-side device 11 to the OT-side device 2 due to pulse suppression. Therefore, the function of the data diode 1 is ensured.

[0098] As described above, according to the second embodiment, the sending side device 11 has a gatekeeper timer 115, and the gatekeeper timer 115 monitors the status of the OT side device 2 by receiving data from the OT side device 2. When the gatekeeper timer 115 determines that the OT side device 2 is in an abnormal state, the pulse output unit 114 outputs the pulse signal generated by the pulse generating unit 134.

[0099] Therefore, the data diode 1 according to the second embodiment can be expected to operate normally in the OT-side device 2 .

[0100] Furthermore, the various embodiments may be freely combined, arbitrary components of the various embodiments may be modified, or arbitrary components of the various embodiments may be omitted.

Claims

1. A data diode, characterized in that: include: The sending side device sends data from the control network; The receiving device sends the input data to the service network; as well as a one-way communication unit for transmitting data sent by the transmitting device to the receiving device; The receiving-side device includes a pulse generating unit. The pulse generating unit is activated according to an instruction from the service network and generates a pulse signal. The transmitting side device has a pulse output unit, The pulse output unit outputs the pulse signal generated by the pulse generation unit to a control-side device connected to the control network.

2. The data diode according to claim 1, wherein: The sending side device has a gatekeeper timer, The gatekeeper timer monitors the status of the control side device by receiving data from the control side device. When the watchdog timer determines that the control-side device is in an abnormal state, the pulse output unit outputs the pulse signal generated by the pulse generation unit.

3. The data diode according to claim 1 or 2, characterized in that: There are multiple control side devices. At least one pulse output unit is provided, and each of the pulse output units outputs a pulse signal to a corresponding one of the control-side devices.

4. The data diode according to claim 1 or 2, characterized in that: There are multiple control side devices. The pulse output unit is provided in one piece and outputs pulse signals to the plurality of control-side devices respectively.

5. A pulse control method for a data diode, the data diode comprising: The sending side device sends data from the control network; The receiving device sends the input data to the service network; as well as a one-way communication unit for transmitting data sent by the transmitting device to the receiving device; The pulse control method is characterized in that: In the receiving side device, The pulse generating unit is activated according to an instruction from the service network and generates a pulse signal. In the sending side device, The pulse output unit outputs the pulse signal generated by the pulse generation unit to a control-side device connected to the control network.

Images