Illegal use prevention system and illegal use prevention method

Abstract

A control device which periodically performs a control process of a control target device provided with an RM insertion slot and an RM I / F accepts designation of a mode and sets the designated mode. The control device periodically performs a license check in which it is checked whether or not a license data storing a license indicating a protection target program is inserted into the insertion slot and connected to the RM I / F. When the result of the license check is not false, the control device runs the protection target program in the control process. When the set mode is a stop mode indicating stop of the license check, the control device stops performing the license check.

Description

Technical Field

[0001] This invention generally relates to preventing the unauthorized use of programs. Background Technology

[0002] There exist control devices (e.g., industrial controllers) that control controlled objects such as industrial equipment (e.g., industrial motors and compressors). The control device controls the controlled object by running a control application. The control application can invoke one or more program modules (e.g., one or more libraries such as one or more function blocks) to perform control during control processing.

[0003] The entity that implements control over the controlled device (typically an organization such as an enterprise), i.e., the implementing entity, may differ from the entity that provides the control application or at least one program module, i.e., the providing entity. For the providing entity, it is required to prevent the control application or program module from being illegally used by the implementing entity (e.g., browsing the source code of the control application or program module).

[0004] Regarding the prevention of unauthorized use of programs, for example, the technology disclosed in Patent Document 1 is known. According to Patent Document 1, the application stops running when a valid license corresponding to the application is not present in the portable storage device.

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2006-73002 Summary of the Invention

[0008] The technical problem that the invention aims to solve

[0009] According to the technology disclosed in Patent Document 1, for example, the unauthorized use of a control application or program module can be prevented as follows: The control device has an RM (removable media) insertion port, such as a portable storage device, and determines whether license data for the control application or program module exists in the RM connected to the insertion port. If such license data does not exist, the control device prohibits (e.g., stops) the use of the control application or program module.

[0010] However, according to this technology, during control implementation, the RM storing the license data of the control application or program module must always be plugged into the RM port. Therefore, during control implementation, the RM port is occupied by the RM storing the license data.

[0011] Technical solutions to the problem

[0012] A control device equipped with an RM slot and an RM I / F53, which periodically performs control processing on the controlled object device. The control device accepts a mode specification and sets the specified mode. The control device periodically performs a license check, in which it checks whether the RM containing license data representing the license of the protected object program is inserted into the slot and connected to the RM I / F53. If the license check result is not false, the control device runs the protected object program during control processing. When the set mode is a stop mode indicating that the license check is stopped, the control device stops performing the license check.

[0013] Invention Effects

[0014] Control can continue even if the RM storing license data is not inserted into the RM slot during control implementation. Technical issues, features, and effects other than those described above will become clear in the following description. Attached Figure Description

[0015] Figure 1 This illustrates an example of the overall physical structure of the system, including the control system of the implementation method.

[0016] Figure 2 An example of the logic structure of a control device.

[0017] Figure 3 This is an example of a mode setting screen.

[0018] Figure 4 This is an example of a process that illustrates license protection controls.

[0019] Figure 5 This represents an example of the flow of program execution control in normal mode.

[0020] Figure 6 This represents an example of the process flow for program execution control in log collection mode.

[0021] Figure 7 This is an example of the flow of program execution control during simulation.

[0022] Figure 8 This is an example of the flow of program execution control during debugging.

[0023] Figure 9 This represents an example of the process flow for program execution control during the construction / download of a program that is being protected. Detailed Implementation

[0024] In the following description, "interface device" can refer to one or more interface devices. These one or more interface devices can be one or more communication interface devices of the same type, or two or more communication interface devices of different types.

[0025] Additionally, in the following description, "memory" refers to one or more memory devices, typically main storage devices. At least one memory device in memory can be a volatile memory device or a non-volatile memory device.

[0026] Additionally, in the following description, "persistent storage device" refers to more than one persistent storage device. Persistent storage devices are typically non-volatile storage devices (such as secondary storage devices), specifically, for example, HDDs (Hard Disk Drives) or SSDs (Solid State Drives).

[0027] Additionally, in the following description, "storage device" can refer to at least memory in both memory and persistent storage devices.

[0028] Additionally, in the following description, "processor" can refer to more than one processor device. At least one processor device can typically be a microprocessor device such as a CPU (Central Processing Unit), but can also be other types of processor devices such as a GPU (Graphics Processing Unit). At least one processor device can be single-core or multi-core. At least one processor device can also be a processor core. At least one processor device can also be a processor device in a broader sense, such as a portion or all of the hardware circuitry performing the processing (e.g., FPGA (Field-Programmable Gate Array), CPLD (Complex Programmable Logic Device), or ASIC (Application Specific Integrated Circuit)).

[0029] Furthermore, in the following description, the subject of processing is sometimes "program," but since the program performs the specified processing by being run by a processor and appropriately using storage devices and / or interface devices, the subject of processing can also be changed to the processor (or a device such as a controller having that processor). A program can be installed from a program source onto a device such as a computer. The program source can be, for example, a program distribution server or a computer-readable (e.g., non-transitory) recording medium. Additionally, in the following description, two or more programs can be implemented as one program, and one program can be implemented as two or more programs.

[0030] Furthermore, in the following description, the term "yyy part" is sometimes used to describe functions, but a function can be implemented by the processor running more than one program. When a function is implemented by the processor running a program, since the specified processing is performed using appropriate storage devices and / or interface devices, the function can be considered to be at least a part of the processor. The processing described with a function as the subject can be considered to be processing performed by the processor or a device having that processor. The descriptions of each function are just examples; multiple functions can be combined into one function, or one function can be divided into multiple functions.

[0031] Furthermore, in the following description, the term "xxx table" is used to describe the information obtained from the input, but this information can be data of any structure (e.g., structured or unstructured data), or it can be a learning model that generates the output corresponding to the input, such as neural networks, genetic algorithms, and random forests. Therefore, "xxx table" can also be referred to as "xxx information." Additionally, the structure of each table in the following description is an example; a table can be divided into two or more tables, and all or part of two or more tables can also be a single table.

[0032] In addition, in the following description, any one of ID, name, and number is used as an example of identification information, but identification information may also replace at least one of ID, name, and number or additionally include other types of elements.

[0033] In addition, in the following descriptions, when describing the same type of element without distinguishing them, the common part of the reference mark is used; when describing the same type of element separately, the reference mark is sometimes used.

[0034] Additionally, in the following description, an example of a control program is a control application, and an example of an information program is an information application. "Application" is short for application program, and is an example of a computer program.

[0035] Figure 1 This illustrates an example of the overall physical structure of the system, including the control system of the implementation method.

[0036] The control system 109 is installed in the factory 10, which has a controlled device 12. The controlled device 12 is, for example, industrial equipment such as an industrial motor and a compressor. The factory 10 is an example of a field where the controlled device 12 is located.

[0037] The management system 101 and control system 109 are connected to a communication network 108 (e.g., the Internet or a WAN). The control system 109 is connected, for example, to a communication network 19 within the plant 10 (e.g., a LAN). The control system 109 is able to communicate with the management system 101 via communication networks 19 and 108. Communication networks 108 and 19 are examples of communication networks used when information applications perform information communication processing (communication processing different from the control processing performed by control applications).

[0038] The control system 109 and one or more I / O modules 119 (an example of an I / O port) are connected to a communication network 118 (e.g., Ethernet (registered trademark)). The communication network 118 is an example of a communication network used in control processing performed in a control application to send control data to the controlled device 12.

[0039] Communication networks 19, 108, and 118 can be different networks, and two or more of communication networks 19, 108, and 118 can also be the same network.

[0040] One or more I / O modules 119 are connected to one or more peripheral devices 120. Peripheral devices 120 can be devices such as sensors or media drives (e.g., HDDs and SSDs). I / O modules 119 function as bus slots for removably mounting peripheral devices 120 as needed. Controlled objects 12 are connected to I / O modules 119 via or without peripheral devices 120. The relationship between controlled objects 12 and I / O modules 119 can be any of one-to-one, one-to-many, many-to-one, and many-to-many. Furthermore, some I / O modules 119 may be connected not only to communication network 118 but also to communication network 108; that is, these I / O modules 119 may be devices shared by control applications and information applications. Additionally, at least some I / O modules 119 may be at least a portion of a network I / F device and an I / O control device of at least one computing device 40.

[0041] The management system 101 is an example of a higher-level system than the control system 109. The management system 101 includes a non-volatile storage device 201, a CPU 202, memory 203, peripheral control devices 205, a user interface (UI) device 206, and a network I / F device 207. The management system 101 is connected to a communication network 108 via the network I / F device 207. The UI device 206 includes input devices (e.g., a keyboard and pointing devices) and a display device.

[0042] The control system 109 has one or more computing devices 40. Each computing device 40 has an interface device, a storage device, and a processor connected to it. The hardware structure of all computing devices 40 may be the same or different. Any computing device 40 can be used as a configuration destination for control applications or as a configuration destination for information applications. In this embodiment, computing device 40M is the main computing device, which is the configuration destination for control applications and may also be used as a configuration destination for information applications. Computing devices 40E1 and 40E2 are additional computing devices that cannot be used as configuration destinations for control applications but may be used as configuration destinations for information applications. Computing device 40E may also be omitted. In other words, computing device 40M can be used as the control system 109 on its own. Hereinafter, computing device 40M will be referred to as "control device 40M", and computing device 40E will be referred to as "extension device 40E". At least the control device 40M in the computing device 40 may also be referred to as a sequential control device, a motion control device, an industrial controller, or a programmable logic controller (PLC). Control-specific programming languages ​​such as ladder logic (LD language), sequential function chart (SFC language), function block (FBD language), structured text (ST language), and instruction list (IL language) can be used to describe control content. Alternatively, ladder logic language descriptions can be used to partially or completely replace descriptions in general-purpose programming languages ​​such as C.

[0043] The system architecture of the control system 109 depends on the presence of the expansion device 40E, the type of communication medium to which the expansion device 40E is connected, and the computing device 40 in which the information application communicating with the control application is configured. That is, the system architecture depends on the presence of the expansion device 40E, the types of communication media to which the control device 40M and the expansion device 40E are respectively connected, and the computing device 40 to which each application is configured. Figure 1In this example, expansion device 40E1 is connected to communication network 118. Expansion device 40E2 is connected to PIO bus 28 (an example of a bus) ("PIO" is short for Programmed I / O). PIO bus 28 can be a bus printed on the substrate, or it can connect control device 40M and expansion device 40E2 to the substrate, thereby allowing control applications running on control device 40M and information applications running on expansion device 40E2 to transmit (share) data via PIO bus 28.

[0044] Furthermore, the system architecture depends on the control application, which can be configured in an implementation of the expansion device 40E, or in an implementation where any computing device 40 can be expanded or reduced, and any computing device 40 can be the configuration destination of the control application.

[0045] As described above, the control system 109 includes at least one control device 40M. The control device 40M is a computing device configured with at least one control application. The function of the control device 40M is to control the controlled object device 12 without delay by periodically running the control application.

[0046] The control application performs periodic scanning processes. "Scanning processes" can include reading information from devices connected to I / O (Input / Output) ports, performing calculations on the read information, and writing the calculated information. Scanning processes are an example of control processes.

[0047] The hardware structure of the computing device 40 is illustrated below, taking the control device 40M as an example. Specifically, the control device 40M includes a memory 169, a peripheral control device 212, an I / O control device 214, a non-volatile storage device 215, a network I / F 213, an RM I / F 53, and a CPU 209 connected to them. The I / O control device 214, network I / F 213, and RM I / F 53 are examples of interface devices. The memory 169 and non-volatile storage device 215 are examples of storage devices. The CPU 209 is an example of a processor. "I / F" is short for interface device. "RM" is short for removable medium. The control device 40M has an RM insertion port 51 for inserting an RM 52, and the RM 52 inserted into the RM insertion port 51 is connected to the RM I / F 53. The RM52 can be a removable storage device such as an SD card or USB (Universal Serial Bus) memory, a dongle, or an HSM (Hardware Security Module). Specifically, in this embodiment, there is an RM that stores license data, namely RM-L52L, and a regular RM that does not store license data, namely RM-N52N (see reference). Figure 8 ).

[0048] Peripheral control device 212 is connected to network I / O 213, I / O control device 214, non-volatile storage device 215, and bus 211. In addition, memory 169 and CPU 209 are connected to bus 211. Memory 169 may include EPROM and main memory. EPROM (or non-volatile storage device 215) may pre-store at least one of the control application and information application, or it may store programs downloaded from a program source such as a program distribution server (not shown). The control system 109 does not have only one control application and one information application; rather, the resources available to the control system 109 are configured according to each program, thereby enabling the installation of multiple control applications and / or multiple information applications.

[0049] CPU 209, for example, reads control applications (and information applications) stored in EPROM into main memory and runs them, controlling the actions of the control applications (and information applications). For instance, CPU 209 controls multiple peripheral devices 120 via peripheral control device 212, I / O control device 214, and multiple I / O modules 119 by running the control applications. Peripheral devices 120 and I / O modules 119 can correspond one-to-one. Furthermore, CPU 209 can be single-core or multi-core. One core can run at least one of more control applications and more than one of more information applications. Typically, one core can run one control application, one control application and more than one information application, or more than one information application.

[0050] Information processing terminals, such as development environment terminal 71 and emulation terminal 72, are connected to control system 109 (e.g., control device 40M) via communication network 19 (or not via communication network 19). Terminals 71 and 72 are, for example, computers (e.g., desktop, laptop, or tablet personal computers, or smartphones) with input devices, display devices, interface devices, storage devices, and processors connected to them. Development environment terminal 71 is an information processing terminal used for developing programs that run on control device 40M (or expansion device 40E). Emulation terminal 72 is an information processing terminal that emulates programs running on control device 40M (or expansion device 40E). Development environment terminal 71 can also function as emulation terminal 72. At least one of terminals 71 and 72 can be connected to RM52.

[0051] Figure 2 An example of the logic structure of the control device 40M.

[0052] The control device 40M includes a program execution unit 251, a web server 252, a mode setting unit 253, an RM connection unit 254, and a license verification unit 255. At least some of these functions 251 to 255 can be implemented by the CPU 209 running control applications and information applications, or by the CPU 209 running programs different from the control applications and information applications.

[0053] The program execution unit 251 runs the protected object program 260. The protected object program 260 can be an application such as a control application and an information application, or it can be modified or appended as a library, such as an FB (function block), as an example of a program module called by an application (e.g., a control application).

[0054] Web server 252 communicates with browser 251 in management system 101. Information provided by web server 252 is displayed on UI device 206 by browser 251. Alternatively, information can be displayed on a remote information processing terminal connected to management system 101 instead of UI device 206.

[0055] The mode setting unit 253 displays a mode setting screen, which is an example of a UI (User Interface), on a browser 251 via a web server 252. The mode setting screen accepts the user's mode selection and sets the selected mode.

[0056] The RM connection unit 254 communicates with the connected RM52. For example, the RM52 has a memory 275 (e.g., flash memory) and an internal controller 271 (e.g., memory controller) connected to the memory 275, and the RM connection unit 254 communicates with the internal controller 271.

[0057] The license verification unit 255 verifies whether the license data 272 of the protected object program 260 is stored in the connected RM52. If the RM52 has the license data 272 stored in its memory 275, it retrieves the license data 272 from the RM-L52LX, thus confirming that the license data 272 of the protected object program 260 is stored.

[0058] Figure 3 This is an example of a mode setting screen (300).

[0059] It is possible to select one of several modes. These modes include, for example, a normal mode and a log collection mode. The mode setting screen 300, as described above, is displayed by the mode setting unit 253 using a browser 251 provided via a web server 252.

[0060] The mode setting screen 300 has radio buttons 301 and a setting button 302 as GUI components. Each mode setting radio button 301 is selected as an option. When either the radio button 301A for normal mode or the radio button 301B for log collection mode is selected and the setting button 302 is pressed, the mode setting unit 253 sets the mode corresponding to the selected radio button 301 in the memory 169, for example.

[0061] Here, "Normal Mode" indicates the mode in which license data verification is performed. "Log Collection Mode" indicates the mode in which license data verification is stopped and log collection is performed. Log collection mode is an example of a mode in which license checks are stopped.

[0062] Figure 4 This illustrates an example of a license protection control process. License protection control can be performed when setting a mode via the mode setting screen 300, or it can be performed periodically. Furthermore, if S403 (Stop License Check) is executed (described later), license protection control can be performed after the license check's stop time has elapsed.

[0063] The license confirmation unit 255 confirms the mode set by the mode setting unit 253 (S401).

[0064] If the confirmed mode is the normal mode (S401: normal mode), the license confirmation unit 255 continues the license check (S402). Specifically, as follows... Figure 5 As shown, the license verification unit 255 periodically performs license checks, that is, it checks the RM52 via the RM connection unit 254 to see if there is license data 272 representing the license of the protected program 260 (S501). S501 can be performed periodically in S402. Figure 4 The license protection control cycle shown can be the same as or different from the license inspection cycle in S501. Because the scanning process cycle is relatively short, it is not necessary to perform a license inspection for each scanning process, so the license protection control cycle and the license inspection cycle can be longer than the scanning process cycle. On the other hand, to enhance the strictness of preventing unauthorized use, the license protection control cycle and the license inspection cycle can also be the same as or shorter than the scanning process cycle.

[0065] If license data 272 exists (S501: Yes), that is, RM52 is RM-L52LX, and license data 272 is read from RM-L52LX, the license verification unit 255 allows the execution of the protected object program 260 (S502). When S502 is performed, the protected object program 260 can be executed during the scanning process.

[0066] On the other hand, if such license data 272 does not exist (S501: No), for example, if such license data 272 is not read, or if the read data is not license data 272 representing the license of the protected object program 260, the license verification unit 255 prohibits the operation of the protected object program 260 (S503). When S503 is performed, the protected object program 260 cannot be run during the scanning process, and the license verification unit 255 can output an illegal use warning, for example, via the web server 252 to the management system 101.

[0067] When the confirmed mode is log collection mode (S401: Log Collection Mode), the license verification unit 255 stops the license check (S402). The license check can be stopped for a certain period of time, or it can stop for a period of time set via the mode setting screen 300 (or other methods). This "time" can be defined by a start time and an end time, or it can be defined by a duration. When the duration is set as the time, the license check can be stopped for that duration starting from the setting of the log collection mode.

[0068] In log collection mode, perform Figure 6 The program operation control shown is as follows. That is, the license verification unit 255 determines whether RM52 is RM-L52LX, that is, whether license data 272 exists in RM52, through the RM connection unit 254 (S601).

[0069] If the RM52 is an RM-L52LX (S601: Yes), the license verification unit 255 prohibits log collection (S602). If S602 is performed, the log regarding the protected object program 260 cannot be written to the RM52 via the RM connection unit 254.

[0070] If RM52 is not RM-L52LX (S601: No), the license verification unit 255 allows log collection (S603). When S603 is performed, a log about the protected object program 260 can be written to RM52 via RM connection unit 254. In this case, RM-N52NX is inserted into RM insertion port 51 instead of RM-L52LX, and during the license check stop time, the license verification unit 255 writes a log about the protected object program 260 to RM-N52NX via RM connection unit 254.

[0071] The above description illustrates one embodiment, but it is merely an example for illustrating the invention and does not limit the scope of the invention to this embodiment. The invention can also be implemented in various other forms.

[0072] For example, the above explanation can be summarized as follows. The following summary may include supplements and variations of the above explanation.

[0073] The control device 40M, which periodically performs control processing on the controlled object device 12 and is equipped with an insertion port 51 (RM52) and an RM I / F 53, includes a mode setting unit 253, a license verification unit 255, and a program execution unit 251. The illegal use prevention system may include at least the mode setting unit 253, the license verification unit 255, and the program execution unit 251.

[0074] The mode setting unit 253 accepts the specification of a mode and sets the specified mode. The license verification unit 255 periodically performs a license check, in which it checks whether the RM-L52LX, which stores the license data 272 representing the license of the protected object program 260, is inserted into the insertion port 51 and connected to the RM I / F53. When the license check result is not false, the program execution unit 251 runs the protected object program 260 in the control processing. When the set mode is the stop mode indicating that the license check is stopped, the license verification unit 255 stops performing the license check.

[0075] During the period when the license check is stopped, even if the RM-L52LX is removed from the insertion port 51 and the RM-N52NX (used for purposes other than license checking) is inserted into the insertion port 51 and connected to the RM I / F53, the program execution unit 251 will still run the protected object program 260 in the control processing because the license check result is not false (negative result). Therefore, during the control implementation period, control can continue even if the RM-L52LX containing the license data 272 is not inserted into the insertion port 51.

[0076] The protected application 260 can be a control application, an information application, or one or more function blocks (FBs) that replace or add control applications and / or information applications. License data 272 can reside in each FB, or it can be data representing the respective licenses of more than one LB. An FB is an example of a library, and a library is an example of a program module.

[0077] When the set mode is stop mode, the license verification unit 255 can determine whether the RM52 connected to RM I / F 53 stores license data 272 in the RM-L52LX (e.g., the determination in S601). If the result of this determination is false, the license verification unit 255 can write data to the RM-N52NX connected to RM I / F 53. Thus, the storage space in the RM-L52LX that stores license data 272 can be a logical storage space that is a physical storage space with a limit based on the number of writes or deletions (e.g., flash memory). That is, if the space in such logical storage space other than the space storing license data is used as a freely usable user space, the number of writes or deletions to the physical storage space may reach the limit depending on the frequency of writing and deleting data to the user space, making the physical storage space unusable, and thus posing a risk that the RM-L52LX will become unusable. However, because the data is written to the RM-N52NX, the possibility of the RM-L52LX becoming unusable can be reduced.

[0078] When the set mode is a stop mode (e.g., log collection mode), during debugging of periodic control processing, the license verification unit 255 can write a log of the control processing in each cycle to the RM52 connected to the RM I / F53. During debugging of the control processing, the cycle of the control processing is fixed, therefore the frequency of log writing is also fixed. The control processing cycle is generally short, therefore the log output frequency is high. Furthermore, the amount of information (included in the log) output as log in each cycle is relatively large. A method could be considered to accumulate the log in a temporary space such as a cache in memory 169 and output it to external storage such as network storage via communication network 19, but in this case, the accumulation speed in the temporary space is likely to be greater than the output speed to external storage. Additionally, if it is not necessary to accumulate the log in the temporary space, the processing can be simplified compared to the case where it is necessary to accumulate the log in the temporary space. Therefore, as described above, during debugging, the log is written to the RM52 in each cycle of the control processing.

[0079] Furthermore, during debugging, the control device 40M can communicatively connect to the development environment terminal 71 (an example of a first information processing terminal) of the protected object program 260. The development environment terminal 71 can determine whether license data representing a license for the protected object program 260 exists. When the result of this determination is true, the development environment terminal 71 can send a running instruction for the test object in the protected object program 260 to the control device 40M. When the control device 40M receives the running instruction from the development environment terminal 71, the program running unit 251 can run the protected object program 260 without license checking by the license verification unit 255, and the license verification unit 255 writes a log about the protected object program 260 to the RM52 (preferably RM-N52NX) connected to the RM I / F53.

[0080] Reference Figure 8 This illustrates an example of the program execution control flow during debugging. (See reference...) Figure 8 The description breaks down the license of the protected program 260 into separate licenses: one for building or downloading and another for running. The debug control unit is implemented by running the program in the development environment terminal 71, and the debug control unit can perform... Figure 8 The example shown is the processing of the development environment terminal 71.

[0081] The control device 40M and the development environment terminal 71 are communicatively connected and are in debug running state (S801). The source code of the protected object program 260 exists in the development environment terminal 71, and the entity of the protected object program 260 exists in the control device 40M.

[0082] The development environment terminal 71 begins debugging (S802). The development environment terminal 71 determines whether license data indicating a license for the build or download of the protected object program 260 exists (S803). Specifically, for example, the development environment terminal 71 determines that RM-L52LY (refer to...) stores license data indicating a license for the build or download of the protected object program 260. Figure 1 Whether it is inserted into the RM insertion port of the development environment terminal 71 and connected to the RM-I / F of the development environment terminal 71.

[0083] If the RM-L52LY is not connected to the development environment terminal 71, or if the license data indicates that the license is not the license for the build or download of the protected object program 260, the result of S803 is false. In this case (S803: No), the development environment terminal 71 stops debugging (S804).

[0084] If the result of S803 is true (S803: Yes), and if the test object still exists in the source code of the protected object program 260 (S804: Yes), the development environment terminal 71 continues debugging. That is, the development environment terminal 71 instructs the control device 40M to run the test object (S805X), and the program execution unit 251 in the control device 40M runs the test object indicated in the protected object program 260 (S805Y). Since the license for the construction or download of the protected object program 260 has been checked (S803), S805Y can be performed without the license verification unit 255 performing a license check (i.e., without checking whether the license for running the protected object program 260 exists). In addition, when the program is run during debugging, a log about the running results is output, and the license verification unit 255 writes the output log to RM-N52NX. That is, during debugging, it is not necessary to insert RM-L52LX into the insertion port 51, so RM-N52NX can be inserted into the insertion port 51 as the writing location for the debugging log during debugging.

[0085] If the test object does not exist in the source code of the protected object program 260 (S804: No), then debugging ends. That is, the control device 40M and the development environment terminal 71 respectively de-de-debug (S806).

[0086] Furthermore, the control device 40M may be able to run the protected object program 260 without license checks only during debugging. The development environment terminal 71 can determine whether license data indicating a license for the protected object program 260 exists. If the result of this determination is true, the development environment terminal 71 can send information indicating that a license exists, i.e., license information, to the control device 40M. When the mode set in the control device 40M is the normal mode (an example of a license mode indicating license checks), if the control device 40M receives license information from the development environment terminal 71, the program execution unit 251 can run the protected object program 260 without license checks by the license verification unit 255. See reference. Figure 9 A specific example is provided. The build / download control unit is implemented by running a program in the development environment terminal 71. The build / download control unit can perform... Figure 9 The example shown illustrates the processing of the development environment terminal 71. Additionally, Figure 9 (and Figure 8 , Figure 1 In this context, the development environment terminal 71 and the management system 101 can be integrated.

[0087] The control device 40M is communicatively connected to the development environment terminal 71. The development environment terminal 71 can determine whether the specified conditions are met (S901). The "specified conditions" referred to in this paragraph may mean that the number of control devices 40Ms performing the construction / download (build or download) of the protected object program 260 is greater than a specified number. That is, there may be use cases where the protected object program 260 is run separately by multiple control devices 40Ms; instead of all control devices 40Ms performing the license check, the license check can be performed by the development environment terminal 71. Therefore, it is not necessary for each development environment terminal 71 to have an RM-L52LX.

[0088] If the judgment result of S901 is true (S901: Yes), or if the judgment of S901 is not required, the development environment terminal 71 determines whether there is license data indicating a license for the protected object program 260 (S902). If the judgment result of S902 is true (S902: Yes), the development environment terminal 71 outputs license information indicating that a license exists (S903). The development environment terminal 71 constructs or downloads the protected object program 260 to the control device 40M (S904). If license information exists, in S904, the development environment terminal 71 also sends license information to the control device 40M.

[0089] The control device 40M receives the protected object program 260 (and license information) (S911) and installs the protected object program 260 (S912).

[0090] The license verification unit 255 verifies the mode set by the mode setting unit 253 (S913). When the verified mode is log collection mode (S913: log collection mode), the license verification unit 255 stops the license check (S915).

[0091] When the confirmed mode is the normal mode (S401: normal mode), the license confirmation unit 255 determines whether the license information has been received (S914).

[0092] When the judgment result of S914 is true (S914: Yes), the license confirmation unit 255 allows the protected object program 260 to run (S916). When S916 is performed, the protected object program 260 can run.

[0093] When the judgment result of S914 is false (S914: No), the license confirmation unit 255 prohibits the operation of the protected object program 260 (S917).

[0094] The control device 40M can be communicatively connected to the simulation terminal 72 (as an example of a second information processing terminal in the simulation operating environment). When the license check result is true, the simulation terminal 72 can perform the simulation of the protected program 260 without needing to determine whether license data representing the license of the protected program 260 exists. Thus, when the license check result in the control device 40M is true, it is not necessary to make RM-L52LZ (refer to...) Figure 1 The emulation terminal 72 is connected to the emulation terminal 72 for license checks, thereby maintaining the emulation in a way that prevents unauthorized use. (See reference...) Figure 7 A specific example is given. The simulation control unit is implemented by running a program in the simulation terminal 72. The simulation control unit can perform... Figure 7 The processing is illustrated in the example.

[0095] The simulation terminal 72 determines whether the license check result of the protected object program 260 in the control device 40M is true, and receives the true result (i.e., there is a license) from the license confirmation unit 255 of the control device 40M (S701).

[0096] If the result of S701 is false (S701: No), the emulation terminal 72 determines whether license data representing the license of the protected program 260 exists (S702). Specifically, for example, the emulation terminal 72 determines whether RM-L52LZ (refer to) stores license data representing the license of the protected program 260. Figure 1 Whether it is inserted into the RM insertion port of the emulation terminal 72 and connected to the RM-I / F of the emulation terminal 72.

[0097] When the judgment result of S702 is true (S702: Yes), the simulation terminal 72 runs the simulation of the protected object program 260 (S703). In addition, when the judgment result of S701 is true (S701: Yes), S703 is performed without S702.

[0098] When the judgment result of S702 is false (S702: No), the simulation terminal 72 does not run the simulation of the protected object program 260.

[0099] The control device 40M may have a retaining mechanism (e.g., a latching mechanism). The retaining mechanism may be a mechanism that locks an RM52 inserted into the insertion port 51 and connected to the RM I / F 53, and releases the lock upon a predetermined unlocking operation. The RM52 locked by the retaining mechanism may be, for example, an SD card or an HSM. In the environment where the control device 40M is installed (e.g., factory 10), vibrations of the controlled object device 12 can have an impact; without a retaining mechanism, there is a possibility that the RM52 may fall off the control device 40M. Furthermore, increasing the number of insertion ports with retaining mechanisms using a machine such as a hub is not straightforward. Therefore, depending on the environment of the environment where the control device 40M is installed, it is technically more meaningful to use it for multiple purposes without occupying a limited number of insertion ports 51.

[0100] Explanation of reference numerals in the attached figures

[0101] 109... Control system.

Claims

1. An unauthorized use prevention system, characterized in that: The control device includes a mode setting unit, a license confirmation unit, and a program execution unit, which periodically performs control processing on the controlled object device. The control device is provided with an RM (removable medium) insertion port and an RM I / F (removable medium interface device). The mode setting unit accepts the specification of a mode and sets the specified mode. The license verification unit periodically performs license checks, during which it checks whether the RM storing license data representing the license of the protected program is inserted into the insertion port and connected to the RM I / F. If the license check result is not false, the program execution unit runs the protected object program in the control process. The license verification unit stops performing the license check when the set mode is a stop mode that indicates the license check is to be stopped.

2. The illegal use prevention system as described in claim 1, characterized in that: When the set mode is the stop mode, the license verification unit determines whether the RM connected to the RM I / F is an RM that stores license data, and if the result of the determination is false, writes data to the RM connected to the RM I / F.

3. The illegal use prevention system as described in claim 1, characterized in that: When the set mode is the stop mode, during the debugging of the periodic control process, the license verification unit writes a log of the control process in each cycle of the control process to the RM connected to the RM I / F.

4. The illegal use prevention system as described in claim 3, characterized in that: During the debugging process, The control device is communicatively connected to a first information processing terminal, which serves as the development environment for the program being protected. The first information processing terminal determines whether license data representing the license of the protected program exists. When the result of the judgment is true, the first information processing terminal sends the running instruction of the test object in the protected object program to the control device. When the control device receives the operation instruction from the first information processing terminal, the program execution unit can run the protected object program without the license verification unit performing the license check, and the license verification unit can write a log about the protected object program to the RM connected to the RM I / F.

5. The illegal use prevention system as described in claim 1, characterized in that: Multiple control devices, including the aforementioned control unit, are communicatively connected to the first information processing terminal. The first information processing terminal determines whether license data representing the license of the protected program exists. When the result of the determination is true, the first information processing terminal sends license information to the control device as information indicating the existence of a license. When the set mode is the license mode representing the license check, if the control device receives the license information from the first information processing terminal, the license verification unit does not need to perform the license check based on the license verification unit, and the program execution unit can run the protected object program.

6. The illegal use prevention system as described in claim 1, characterized in that: The control device is communicatively connected to a second information processing terminal, which serves as the simulation operating environment. When the license check result is true, the second information processing terminal can perform the simulation of the protected object program without needing to determine whether license data representing the license of the protected object program exists.

7. The illegal use prevention system as described in claim 1, characterized in that: The control device has a holding mechanism. The retaining mechanism is a mechanism that locks the RM inserted into the insertion port and connected to the RM I / F, and releases the lock when a specified unlocking operation is performed.

8. A method for preventing illegal use, characterized in that: The following steps are performed by a control device equipped with an RM (removable media) port and an RM I / F (removable media interface device) that periodically performs control processing on the controlled object: Accepts the specification of a pattern and sets the specified pattern. A periodic license check is performed, in which the RM storing license data representing the protected program is checked to see if it is inserted into the insertion port and connected to the RM I / F. If the license check result is not false, the protected object program is run in the control process. When the set mode is the stop mode, which indicates that the license check is to be stopped, the license check will be stopped.

Images