Field apparatus authorization learning system, field apparatus authorization deduction system, field apparatus authorization learning method, and field apparatus authorization deduction method, and program

Abstract

To authorize a field apparatus, and prevent replacement with a fraudulent apparatus, impersonation through fraudulent remodeling of an apparatus, and data forgery.SOLUTION: A field apparatus authorization learning system learns authorization of a field apparatus 2 in a control system 1, where the field apparatus 2 is connected to an input / output terminal of an input / output unit 5, and includes a data acquisition unit that acquires as learning data a time-series signal originated by the field apparatus 2, and a model generation unit that uses the learning data to generate a learned model, which deduces a result of determination on whether the field apparatus 2 connected to the control system 1 is an authentic apparatus or fraudulent apparatus, from the time-series signal.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a field device authentication learning device, a field device authentication inference device, a field device authentication learning method, a field device authentication inference method, and a program. [Background technology]

[0002] In the field of factory automation, various controls have been performed in the past by connecting a large number of devices, such as field devices such as flow meters and thermometers, various sensors, and controllers, via control networks and control IO wiring. In the control network and control IO wiring, various types of signals, including wired LAN (Local Area Network), wireless LAN, digital contacts, and analog signals, are transmitted and received between field devices and controllers via Ethernet (registered trademark), hard wires, etc. In recent years, in the field of factory automation, production stoppage, information leakage, and internal data fabrication due to unauthorized access from the outside have become problems, and the need for security measures for control networks has increased. Measures such as installing a firewall and separating the control network from the external network can be applied to prevent unauthorized access from the outside. In addition, within the control network, there are cases where data is fabricated by replacing a legitimate field device with another unauthorized device or by illegally modifying a legitimate device. In order to prevent such data fabrication, measures have been proposed that prevent unauthorized devices from connecting to the control network by device authentication.

[0003] For example, Patent Document 1 discloses a provisioning device that performs a provisioning operation of setting security information and network information in advance in a field device in order for the device to join a wireless network. The provisioning device stores in advance a list that associates unique information (device tag, device identification information, vendor ID, model) of a field device that is to newly join a wireless network with setting information (security information, network information) for provisioning the field device. The provisioning device acquires the unique information of the field device from the field device via wireless communication, extracts setting information associated with the unique information acquired from the field device from the list, and transmits the extracted setting information to the field device via wireless communication, thereby executing provisioning of the field device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 5170585 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the technology disclosed in the above Patent Document 1 is premised on the premise that the field device has built-in unique information for identifying the field device and is capable of outputting the unique information, and cannot prevent replacement with an unauthorized device or spoofing and data fabrication by unauthorized modification of the device for a field device with a simple structure that does not have a communication function and can only output signals such as contacts, analog currents and voltages, and resistance values. In order to replace the field device with a field device with built-in unique information for identifying the field device and capable of outputting data, not only does it incur the cost of replacing the field device, but it is also necessary to verify again whether the accuracy of the control using the field device is problem-free. In addition, since a field device that has unique information for identifying a field device transmits and receives data by communication such as Ethernet and a control network, the response speed is slower than that of output of contact signals, analog signals, etc., and therefore the accuracy of the control may not be ensured. Therefore, there are cases in which it is not practical to replace a field device that does not have unique information for identifying a field device with a field device that has the unique information.

[0006] This disclosure has been made in consideration of the above circumstances, and aims to authenticate field devices and prevent replacement with unauthorized devices and spoofing and data fabrication through unauthorized modification of devices, even if the field devices cannot incorporate or output unique information for identifying them, or if the field devices do not have communication functions. [Means for solving the problem]

[0007] In order to achieve the above-mentioned objective, the field device authentication learning device disclosed herein is a field device authentication learning device that learns authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, and includes a data acquisition unit that acquires a time series signal emitted by the field device as learning data, and a model generation unit that uses the learning data to generate a learned model that infers the result of determining whether a field device connected to the control system is a legitimate device or an unauthorized device from the time series signal. Effect of the Invention

[0008] According to the present disclosure, by inferring the result of determining whether a field device connected to a control system is a legitimate device or an illegitimate device from a time-series signal transmitted by the field device, even if the field device cannot incorporate or output unique information for identifying the field device or does not have a communication function, the field device is authenticated and replacement with an illegitimate device and spoofing and data fabrication due to illicit device modification are prevented. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an outline of a control system according to a first embodiment of the present disclosure. [Diagram 2] FIG. 1 is a diagram showing a hardware configuration of a device authentication device according to a first embodiment of the present disclosure. [Diagram 3] FIG. 1 is a diagram illustrating a functional block diagram of a device authentication device according to a first embodiment of the present disclosure as a learning device. [Figure 4] A flowchart showing the learning process of the learning device. [Diagram 5] FIG. 1 is a diagram illustrating a functional block diagram of a device authentication device according to a first embodiment of the present disclosure as an inference device. [Figure 6] Flowchart showing the process for obtaining data [Figure 7] FIG. 1 is a diagram showing an outline of a control system according to a second embodiment of the present disclosure. [Figure 8]FIG. 13 is a diagram illustrating a functional block diagram of a device authentication device according to a second embodiment of the present disclosure as a learning device. [Figure 9] FIG. 13 is a diagram illustrating a functional block diagram of a device authentication device according to a second embodiment of the present disclosure as an inference device. [Figure 10] FIG. 13 is a diagram showing an outline of a control system according to a third embodiment of the present disclosure. [Figure 11] FIG. 13 is a diagram illustrating a functional block diagram of a device authentication device according to a third embodiment of the present disclosure as a learning device. [Figure 12] FIG. 13 is a diagram illustrating a functional block diagram of a device authentication device according to a third embodiment of the present disclosure as an inference device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, a field device authentication learning device, a field device authentication inference device, a field device authentication learning method, a field device authentication inference method, and a program according to embodiments of the present disclosure will be described in detail with reference to the drawings. Note that the same or corresponding parts in the drawings are denoted by the same reference numerals.

[0011] (Embodiment 1) 1 is a diagram showing an outline of a control system 1. The control system 1 includes a plurality of field devices 2, 1 to N, which are devices to be controlled, and a PLC 3 that executes a control program to control the devices to be controlled.

[0012] The PLC 3 is a programmable logic controller communicatively connected to each field device 2. The PLC 3 includes a CPU (Central Processing Unit) unit 4 that reads and executes a control program, and an input / output unit 5 that is connected to the field device 2. The CPU unit 4 and the input / output unit 5 may be connected via a baseboard that electrically connects each unit, or may be connected by a connector that electrically connects units provided in each unit to each other without using a baseboard. The input / output unit 5 is, for example, an I / O input / output unit, an analog unit, a counter unit, a network unit, or the like, that can input and / or output signals when controlling the field device 2 using the PLC 3.

[0013] The field devices 2 are devices assigned to the input / output terminals of the input / output unit 5, and are, for example, sensors which are input devices, and motors and actuators which are output devices. The control system 1 is realized by the cooperation of the field devices 2 based on a program executed by the PLC 3. The field devices 2 are connected to the input / output terminals of the input / output unit 5 by a control network / control IO wiring. The control system 1 is, for example, a product production system that operates in a factory, and the field devices 2 are equipment that are installed in the factory and perform various processes on workpieces to produce products, parts, etc., and the PLC 3 controls the field devices 2 by executing a control program to process the workpieces.

[0014] Furthermore, the field devices 2 are connected to a device authentication device 6. The device authentication device 6 acquires signals transmitted from the field devices 2 to the input / output terminals of the input / output unit 5. Based on the input of signals from the field devices 2, the device authentication device 6 outputs the result of judging whether each of the N field devices 2 is an authorized device or an unauthorized device.

[0015] 2 shows a hardware configuration of the device authentication device 6. The device authentication device 6 includes a control unit 11, a storage unit 12, a user interface 13, a display unit 14, and a communication unit 15. These units are connected via a communication bus.

[0016] The control unit 11 includes a CPU, a ROM (Read Only Memory), and a RAM (Random Access Memory). The CPU is also called a central processing unit, a processor, a microprocessor, a microcomputer, a DSP (Digital Signal Processor), etc., and functions as a central processing unit that executes processes and calculations related to the control of the device authentication device 6. In the control unit 11, the CPU reads out programs and data stored in the ROM, and uses the RAM as a work area to centrally control the device authentication device 6.

[0017] The storage unit 12 includes non-volatile memory such as a flash memory, an EPROM (Erasable Programmable ROM), an EEPROM (Electrically Erasable Programmable ROM), a hard disk, etc., and serves as a so-called secondary storage device or auxiliary storage device. The storage unit 12 stores programs and data used by the control unit 11 to perform various processes. The storage unit 12 also stores data generated or acquired by the control unit 11 performing various processes.

[0018] The user interface 13 is an input unit such as a keyboard, a mouse, a touch panel, etc. The display unit 14 displays the result of the determination as to whether the field device 2 is an authorized device or an unauthorized device.

[0019] The communication unit 15 includes a communication interface for the device authentication device 6 to communicate with an external device via the network. The communication unit 15 communicates with the PLC 3 via the network.

[0020] The device authentication device 6 functions as a learning device 20 that learns authentication of the field device 2 to determine whether the field device 2 is a legitimate device or an unauthorized device. Fig. 3 is a diagram showing a schematic functional block of the device authentication device 6 as the learning device 20. The learning device 20, which is a device authentication learning device, includes a data acquisition unit 21, a model generation unit 22, and a learned model storage unit 23.

[0021] The data acquiring unit 21 acquires, as learning data, time-series signals transmitted from each field device 2 to the input / output terminals of the input / output unit 5 .

[0022] The signals transmitted by the field devices 2 have different characteristics depending on the individual field devices 2. These characteristic quantities are extracted, and the individual differences of the field devices 2 are recognized from the characteristic quantities, thereby identifying and authenticating the field devices 2.

[0023] The model generating unit 22 learns the identification and authentication of the field device 2, judging whether the field device 2 is a legitimate device or an unauthorized device, based on the learning data created based on the time-series signal transmitted from the field device 2 output from the data acquiring unit 21. That is, it generates a learned model that infers the result of judging whether the field device 2 is a legitimate device or an unauthorized device from the time-series signal transmitted from the field device 2.

[0024] The learning algorithm used by the model generation unit 22 may be a known algorithm such as supervised learning, unsupervised learning, or reinforcement learning. As an example, a case where K-means (clustering), which is unsupervised learning, is applied will be described. Unsupervised learning refers to a method of learning features in learning data that does not include results (labels) by providing the learning device 20 with the learning data.

[0025] The model generation unit 22 learns the result of judging whether the field device 2 is a legitimate device or an unauthorized device by so-called unsupervised learning according to a grouping method using the K-means method, for example. The K-means method is a non-hierarchical clustering algorithm, and is a method of classifying a given number of clusters into k using the average of the clusters. Specifically, the K-means method is processed in the following flow. First, a cluster is randomly assigned to each data xi. Next, the center Vj of each cluster is calculated based on the assigned data. Next, the distance between each xi and each Vj is obtained, and xi is reassigned to the cluster with the closest center. Then, if the cluster assignment of all xi does not change in the above process, or if the amount of change falls below a certain threshold set in advance, it is determined that convergence has occurred and the process is terminated.

[0026] In the present disclosure, the result of judging whether the field device 2 is a legitimate device or an unauthorized device is learned by so-called unsupervised learning according to learning data created based on a time-series signal transmitted from the field device 2 acquired by the data acquisition unit 21. The model generation unit 22 executes the above-mentioned learning to generate and output a trained model. The trained model storage unit 23 stores the trained model output from the model generation unit.

[0027] Next, the learning process of the learning device 20 will be described with reference to Fig. 4. Fig. 4 is a flowchart showing the learning process of the learning device 20.

[0028] In step S101, the data acquiring unit 21 acquires a time series signal transmitted from the field device 2. In step S102, the model generating unit 22 learns the result of judging whether the field device 2 is a legitimate device or an unauthorized device by so-called unsupervised learning in accordance with learning data created based on the time series signal transmitted from the field device 2 acquired by the data acquiring unit 21, and generates a trained model. In step S103, the trained model storage unit 23 stores the trained model generated by the model generating unit 22.

[0029] The device authentication device 6 functions as an inference device for identifying and authenticating the field device 2, which infers the determination result as to whether the field device 2 is an authorized device or an unauthorized device. Fig. 5 is a diagram showing a schematic functional block of the device authentication device 6 as an inference device 30.

[0030] The inference device 30, which is a device authentication inference device, includes a data acquisition unit 31, an inference unit 32, and a learned model storage unit 23. The data acquisition unit 31 acquires a time series signal transmitted from the field device 2. The inference unit 32 infers a result of judging whether the field device 2 is a legitimate device or an unauthorized device obtained by using the learned model stored in the learned model storage unit 23. That is, by inputting the time series signal transmitted from the field device 2 acquired by the data acquisition unit 31 to this learned model, it is possible to infer to which cluster the time series signal transmitted from the field device 2 belongs, and to output the inference result as a result of judging whether the field device 2 is a legitimate device or an unauthorized device.

[0031] In the present embodiment, the model generating unit 22 of the device authentication device 6 is used to determine whether the field device 2 is a legitimate device or an unauthorized device, and the result is output. However, the model generating unit 22 of another device authentication device 6 may acquire a learned model from the outside, that is, the learned model, and output the result of determining whether the field device 2 is a legitimate device or an unauthorized device based on the learned model. In this way, the inference unit 32 outputs the identification and authentication result of the field device 2, which is the result of determining whether the field device 2 is a legitimate device or an unauthorized device, based on the time-series signal transmitted from the field device 2.

[0032] Next, a process for obtaining data that is a result of identification and authentication of the field device 2 using the inference device 30 will be described with reference to FIG.

[0033] In step S201, the data acquisition unit 31 acquires a time series signal transmitted from the field device 2. In step S202, the inference unit 32 inputs the time series signal transmitted from the field device 2 acquired in step S201 into the learned model stored in the learned model storage unit 23, and obtains a result of determining whether the field device 2 is a legitimate device or an unauthorized device. In step S203, the inference unit 32 outputs the identification and authentication result of the field device 2 obtained by the learned model. This makes it possible to prevent data fabrication caused by connecting unauthorized devices to the control network and control IO wiring.

[0034] In the present embodiment, the case where unsupervised learning is applied to the learning algorithm used by the model generating unit 22 and the inference unit 32 has been described, but the present invention is not limited to this. As for the learning algorithm, reinforcement learning, supervised learning, semi-supervised learning, etc. can also be applied in addition to unsupervised learning.

[0035] The learning algorithm used in the learning device 20 may be deep learning, which learns to extract the feature amount itself, or other known methods. In this case, the extracted feature amount reflects features that allow individual differences in the field device 2 to be recognized, such as the waveform of a weak signal superimposed at a level that does not affect control and included in the signal transmitted by the field device 2, and the waveform at the rise and fall of the signal. If it is expected that the field device 2 will gradually deteriorate due to long-term use, causing changes in the transmitted signal and the detection value of the sensor attached to the field device 2, the learning can be repeated periodically.

[0036] When implementing unsupervised learning in this embodiment, the present invention is not limited to the non-hierarchical clustering using the k-means method described above, and any other known method capable of clustering may be used. For example, hierarchical clustering such as a shortest distance method may be used.

[0037] In this embodiment, the learning device 20 and the inference device 30 may be connected to the control system 1 via a network, for example. The learning device 20 and the inference device 30 may be separate devices from the field device authentication device. The learning device 20 and the inference device 30 may be built into the PLC 3. The learning device 20 and the inference device 30 may exist on a cloud server. The model generation unit 22 may learn the identification and authentication results of the field device 2 according to the learning data created for the multiple control systems 1. The model generation unit 22 may acquire the learning data from the multiple control systems 1 used in the same area, or may learn the identification and authentication results of the field device 2 using the learning data collected from the multiple control systems 1 operating independently in different areas. It is also possible to add or remove the control system 1 that collects the learning data to or from the target midway. Furthermore, a learning device 20 that has learned the identification and authentication results of a field device 2 for a certain control system 1 may be applied to another control system 1, and the identification and authentication results of the field device 2 for the other control system 1 may be re-learned and updated.

[0038] (Embodiment 2) In the first embodiment, the individual differences of the devices are identified based on the characteristics of the time series signals transmitted from the field devices 2 to the input / output terminals of the input / output unit 5. However, instead of this, a signal detected by a sensor attached to each of the field devices 2 is input as an input to the device authentication device 6, and based on this input, a result of determining whether each of the N multiple field devices 2 is a legitimate device or an unauthorized device is output.

[0039] 7 is a diagram showing an outline of a control system 1 in embodiment 2. The control system 1 includes a plurality of field devices 2, 1 to N, which are control target devices, and a PLC 3 that executes a control program to control the control target devices.

[0040] The difference from the first embodiment is that the field device 2 is not connected to the device authentication device 6, and the device authentication device 6 does not acquire a signal transmitted from the field device 2 to the input / output terminal of the input / output unit 5. Instead, a sensor 40 is attached to the field device 2, and the output from the sensor 40 is connected to the device authentication device 6. The sensor 40 is a sensor attached to the field device 2 alone or in a number of two or more to detect vibration, temperature, displacement, image, etc. of the field device 2, and a sensor capable of detecting information sufficient to identify individual differences of each field device 2 is selected. The sensor 40 may be a sensor that is not attached to the field device 2 and performs sensing on the field device 2. The device authentication device 6 acquires a detection signal from the sensor 40, and outputs a result of determining whether each of the N field devices 2 is a legitimate device or an unauthorized device based on the detection signal from the sensor 40.

[0041] FIG. 8 is a diagram showing a schematic functional block of the device authentication device 6 according to the second embodiment as a learning device 50. As shown in FIG.

[0042] 3, the learning device 50, which is an equipment authentication learning device, includes a data acquisition unit 51, a model generation unit 52, and a learned model storage unit 53. The data acquisition unit 51 acquires detection signals from the sensors 40 attached to the respective field devices 2 as learning data. The detection signals from the sensors 40 attached to the field devices 2 have different characteristics depending on the individual field devices 2, and these characteristic amounts are extracted, and the individual differences of the respective field devices 2 are recognized from the characteristic amounts, thereby identifying and authenticating the field devices 2.

[0043] The model generating unit 52 learns the identification and authentication of the field device 2, judging whether the field device 2 is a legitimate device or an unauthorized device, based on the learning data created based on the detection signal from the sensor 40 attached to the field device 2 output from the data acquiring unit 51. That is, the model generating unit 52 generates a trained model that infers the result of judging whether the field device 2 is a legitimate device or an unauthorized device from the detection signal from the sensor 40 attached to the field device 2. The model generating unit 52 learns the result of judging whether the field device 2 is a legitimate device or an unauthorized device by so-called unsupervised learning according to a grouping method using the K-means method, for example. When the model generating unit 52 generates the trained model by executing the above-mentioned learning, the trained model storage unit 53 stores the trained model output from the model generating unit 52.

[0044] Next, the learning process of the learning device 50 in the second embodiment will be described with reference to FIG. 4, which is the same as the flowchart relating to the learning process of the learning device 20 in the first embodiment.

[0045] In step S101, the data acquiring unit 51 acquires a detection signal from the sensor 40 attached to the field device 2. In step S102, the model generating unit 52 learns the result of determining whether the field device 2 is a legitimate device or an unauthorized device by so-called unsupervised learning according to learning data created based on the detection signal from the sensor 40 attached to the field device 2 acquired by the data acquiring unit 51, and generates a trained model. In step S103, the trained model storage unit 53 stores the trained model generated by the model generating unit 52.

[0046] FIG. 9 is a diagram showing a schematic functional block of the device authentication device 6 serving as the inference device 60 in the second embodiment.

[0047] 5, the inference device 60, which is a device authentication inference device, includes a data acquisition unit 61, an inference unit 62, and a learned model storage unit 53. The data acquisition unit 61 acquires detection signals from sensors 40 attached to the field devices 2. Note that, although the data acquisition unit 61 is described as acquiring detection signals from the sensors 40 attached to a plurality of field devices 2 simultaneously, it is sufficient that the detection signals from the respective sensors 40 are input in an associated manner, and the detection signals may be acquired at different times.

[0048] The inference unit 62 infers the result of judging whether the field device 2 is a legitimate device or an unauthorized device, obtained by using the learned model stored in the learned model storage unit 53. That is, by inputting the detection signal from the sensor 40 attached to the field device 2 acquired by the data acquisition unit 61 to this learned model, it is possible to infer to which cluster the detection signal from the sensor 40 attached to the field device 2 belongs, and to output the inference result as the result of judging whether the field device 2 is a legitimate device or an unauthorized device.

[0049] In this embodiment, the model generating unit 52 of the device authentication device 6 is used to determine whether the field device 2 is a legitimate device or an unauthorized device, and the result is output. However, the model generating unit 52 may obtain a learned model from an external device, that is, another device authentication device 6, and output the result of determining whether the field device 2 is a legitimate device or an unauthorized device based on the learned model. In this way, the inference unit 62 outputs the identification and authentication result of the field device 2, which is the result of determining whether the field device 2 is a legitimate device or an unauthorized device, based on the detection signal from the sensor 40 attached to the field device 2.

[0050] Next, the process for obtaining data that is the result of identification and authentication of the field device 2 using the inference device 60 in embodiment 2 will be described with reference to Figure 6, which is the same as the flowchart related to the process for obtaining data from the inference device 30 in embodiment 1.

[0051] In step S201, the data acquisition unit 61 acquires a detection signal from the sensor 40 attached to the field device 2. In step S202, the inference unit 62 inputs the detection signal from the sensor 40 attached to the field device 2 acquired in step S201 to the learned model stored in the learned model storage unit 53, and obtains a result of judging whether the field device 2 is a legitimate device or an unauthorized device. In step S203, the inference unit 62 outputs the identification and authentication result of the field device 2 acquired by the learned model. This makes it possible to prevent data fabrication caused by connecting an unauthorized device to the control network and control IO wiring. In this embodiment, the case where unsupervised learning is applied to the learning algorithm used by the model generation unit 52 and the inference unit 62 has been described, but the present invention is not limited to this. As for the learning algorithm, reinforcement learning, supervised learning, semi-supervised learning, etc. can be applied in addition to unsupervised learning.

[0052] (Embodiment 3) In the first embodiment, the individual differences of the devices are identified based on the characteristics of the time series signal transmitted from the field device 2 to the input / output terminal of the input / output unit 5, whereas in the second embodiment, instead, the detection signal of the sensor 40 attached to the field device 2 is input as an input to the device authentication device 6, and the individual differences of the devices are identified based on the characteristics of the detection signal of the sensor 40. In the third embodiment, the individual differences of the devices are identified based on the characteristics of the detection signal of the sensor 40 attached to the field device 2 in addition to the characteristics of the time series signal transmitted from the field device 2. This makes it possible to identify the individual differences of the devices more accurately, and to accurately determine whether the field device 2 is a legitimate device or an unauthorized device.

[0053] 10 is a diagram showing an outline of a control system 1 in embodiment 3. The control system 1 includes a plurality of field devices 2, 1 to N, which are control target devices, and a PLC 3 that executes a control program to control the control target devices.

[0054] The field device 2 is connected to the device authentication device 6, and the device authentication device 6 acquires a signal transmitted from the field device 2. Furthermore, a sensor 40 is attached to the field device 2, and the output from the sensor 40 is connected to the device authentication device 6. The sensor 40 is a sensor attached to the field device 2 alone or in a number of two or more to detect vibration, temperature, displacement, images, etc. of the field device 2, and a sensor capable of detecting information sufficient to identify individual differences of each field device 2 is selected.

[0055] The device authentication device 6 acquires a signal transmitted from the field device 2 and a detection signal from the sensor 40, and based on both acquired signals, outputs the result of determining whether each of the N field devices 2 is a legitimate device or an unauthorized device.

[0056] FIG. 11 is a diagram showing a schematic functional block of the device authentication device 6 as a learning device 70 in the third embodiment.

[0057] A learning device 70, which is an equipment authentication learning device, includes a data acquisition unit 71, a model generation unit 72, and a learned model storage unit 73, similar to FIG. 3. The data acquisition unit 71 acquires signals transmitted from the field devices 2 and detection signals from the sensors 40 attached to the field devices 2 as learning data. The signals transmitted from the field devices 2 have different characteristics depending on the individual field devices 2. Also, the detection signals from the sensors 40 attached to the field devices 2 have different characteristics depending on the individual field devices 2. Therefore, both signals are combined, feature amounts are extracted, and the individual differences of each field device 2 are recognized from the feature amounts, thereby identifying and authenticating the field devices 2.

[0058] The model generating unit 72 learns the identification and authentication of the field device 2, which determines whether the field device 2 is a legitimate device or an unauthorized device, based on the learning data created based on the signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2, which are output from the data acquiring unit 71. That is, the model generating unit 72 generates a trained model that infers the result of determining whether the field device 2 is a legitimate device or an unauthorized device from a combination of the time-series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2. The model generating unit 72 learns the result of determining whether the field device 2 is a legitimate device or an unauthorized device by so-called unsupervised learning according to a grouping method using the K-means method, for example. When the model generating unit 72 generates the trained model by executing the above-mentioned learning, the trained model storage unit 73 stores the trained model output from the model generating unit 72.

[0059] Next, the learning process performed by the learning device 70 in the third embodiment will be described with reference to FIG. 4, which is the same as the flowchart related to the learning process of the learning device 20 in the first embodiment.

[0060] In step S101, the data acquisition unit 71 acquires the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2. Although the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2 are acquired simultaneously, it is sufficient that the two signals are input in association with each other, and the data of the two signals may be acquired at different timings. In step S102, the model generation unit 72 learns the result of determining whether the field device 2 is a legitimate device or an unauthorized device by so-called unsupervised learning according to learning data created based on a combination of the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2 acquired by the data acquisition unit 71, and generates a learned model. In step S103, the learned model storage unit 73 stores the learned model generated by the model generation unit 72.

[0061] FIG. 12 is a diagram showing a schematic functional block of the device authentication device 6 as an inference device 80 in the third embodiment.

[0062] The inference device 80, which is a device authentication inference device, includes a data acquisition unit 81, an inference unit 82, and a learned model storage unit 73, as in FIG. 5. The data acquisition unit 81 acquires a time series signal transmitted from the field device 2 and a detection signal from the sensor 40 attached to the field device 2. The inference unit 82 infers a result of judging whether the field device 2 is a legitimate device or an unauthorized device obtained by using the learned model stored in the learned model storage unit 73. That is, by inputting the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2 acquired by the data acquisition unit 81 to this learned model, it is possible to infer to which cluster the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2 belong, and to output the inference result as a result of judging whether the field device 2 is a legitimate device or an unauthorized device. In the present embodiment, the model generating unit 72 of the device authentication device 6 is used to determine whether the field device 2 is a legitimate device or an unauthorized device, and the result is output. However, the model generating unit 72 of another device authentication device 6 may acquire a learned model from an external device, that is, the learned model, and output the result of determining whether the field device 2 is a legitimate device or an unauthorized device based on the learned model. In this way, the inference unit 82 outputs the identification and authentication result of the field device 2, which is the result of determining whether the field device 2 is a legitimate device or an unauthorized device, based on a combination of the time-series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2.

[0063] Next, the process for obtaining data that is the result of identification and authentication of the field device 2 using the inference device 80 in embodiment 3 will be described using Figure 6, which is the same as the flowchart related to the process for obtaining data from the inference device 30 in embodiment 1.

[0064] In step S201, the data acquisition unit 81 acquires the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2. In step S202, the inference unit 82 inputs the time series signal transmitted from the field device 2 and the detection signal from the sensor 40 attached to the field device 2 acquired in step S201 to the learned model stored in the learned model storage unit 73, and obtains a result of judging whether the field device 2 is a legitimate device or an unauthorized device. In step S203, the inference unit 82 outputs the identification and authentication result of the field device 2 obtained by the learned model. This makes it possible to prevent data fabrication caused by connecting an unauthorized device to the control network and control IO wiring. In this embodiment, a case where unsupervised learning is applied to the learning algorithm used by the model generation unit 72 and the inference unit 82 has been described, but the present invention is not limited to this. As for the learning algorithm, reinforcement learning, supervised learning, semi-supervised learning, etc. can be applied in addition to unsupervised learning.

[0065] Various embodiments and modifications of the present disclosure are possible without departing from the broad spirit and scope of the present disclosure. The above-described embodiments are for explaining the present disclosure and do not limit the scope of the present disclosure. In other words, the scope of the present disclosure is indicated by the claims, not the embodiments. Various modifications made within the scope of the claims and within the scope of the disclosure equivalent thereto are considered to be within the scope of the present disclosure.

[0066] Various aspects of the present disclosure are summarized below as appendices.

[0067] (Appendix 1) A field device authentication learning device for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires a time series signal transmitted by the field device as learning data; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from the time-series signal by using the training data; A field device authentication learning device comprising: (Appendix 2) A field device authentication learning device for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires detection signals from sensors attached to the field devices as learning data; a model generation unit that generates a trained model for inferring, using the learning data, a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from the detection signal; and A field device authentication learning device comprising: (Appendix 3) A field device authentication learning device for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires, as learning data, a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from the time-series signal and the detection signal using the training data; and A field device authentication learning device comprising: (Appendix 4) 1. A field device authentication inference device for authenticating a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit for acquiring a time series signal transmitted by the field device; an inference unit that outputs information on a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal; A field device authentication inference device comprising: (Appendix 5) 1. A field device authentication inference device for authenticating a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires a detection signal from a sensor attached to the field device; an inference unit that outputs information on a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device based on the detection signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device based on the detection signal; A field device authentication inference device comprising: (Appendix 6) 1. A field device authentication inference device for authenticating a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; an inference unit that outputs information on a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal and the detection signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal and the detection signal; A field device authentication inference device comprising: (Appendix 7) 1. A field device authentication learning method for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: acquiring at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device as learning data; generating a trained model that uses the training data to infer a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from at least one of the time-series signal and the detection signal; The field device authentication learning method includes: (Appendix 8) 1. A field device authentication inference method for authenticating a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: acquiring at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; a step of inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time series signal and the detection signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time series signal and the detection signal; A field device authentication inference method comprising: (Appendix 9) a computer that learns authentication of a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit; a data acquisition unit that acquires at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device as learning data; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from at least one of the time-series signal and the detection signal, using the training data; A program that functions as a (Appendix 10) a computer that authenticates a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit; a data acquisition unit that acquires at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; an inference unit that outputs information on the result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time-series signal and the detection signal, using a trained model for inferring the result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time-series signal and the detection signal; A program that functions as a [Explanation of symbols]

[0068] 1 control system, 2 field device, 3 PLC, 4 CPU unit, 5 input / output unit, 6 device authentication device, 11 control unit, 12 memory unit, 13 user interface, 14 display unit, 15 communication unit, 20, 50, 70 learning device, 21, 31, 51, 61, 71, 81 data acquisition unit, 22, 52, 72 model generation unit, 23, 53, 73 learned model memory unit, 30, 60, 80 inference device, 32, 62, 82 inference unit, 40 sensor.

Claims

1. A field device authentication learning device for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires a time series signal transmitted by the field device as learning data; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from the time-series signal by using the training data; A field device authentication learning device comprising:

2. A field device authentication learning device for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires detection signals from sensors attached to the field devices as learning data; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from the detection signal, using the training data; and A field device authentication learning device comprising:

3. A field device authentication learning device for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires, as learning data, a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from the time-series signal and the detection signal by using the training data; A field device authentication learning device comprising:

4. A field device authentication inference device for authenticating a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit for acquiring a time series signal transmitted by the field device; an inference unit that outputs information on a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal; A field device authentication inference device comprising:

5. A field device authentication inference device for authenticating a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires a detection signal from a sensor attached to the field device; an inference unit that outputs information on a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device based on the detection signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device based on the detection signal; A field device authentication inference device comprising:

6. A field device authentication inference device for authenticating a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit, comprising: a data acquisition unit that acquires a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; an inference unit that outputs information on a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal and the detection signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from the time-series signal and the detection signal; A field device authentication inference device comprising:

7. 1. A field device authentication learning method for learning authentication of a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: acquiring at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device as learning data; generating a trained model that uses the training data to infer a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from at least one of the time-series signal and the detection signal; The field device authentication learning method includes:

8. 1. A field device authentication inference method for authenticating a field device in a control system in which a field device is connected to an input / output terminal of an input / output unit, comprising: acquiring at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; a step of inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time series signal and the detection signal, using a trained model for inferring a result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time series signal and the detection signal; A field device authentication inference method comprising:

9. a computer that learns authentication of a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit; a data acquisition unit that acquires at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device as learning data; a model generation unit that generates a trained model for inferring a result of determining whether the field device connected to the control system is an authorized device or an unauthorized device from at least one of the time-series signal and the detection signal, using the training data; A program that functions as a

10. a computer that authenticates a field device in a control system in which the field device is connected to an input / output terminal of an input / output unit; a data acquisition unit that acquires at least one of a time series signal transmitted by the field device and a detection signal from a sensor attached to the field device; an inference unit that outputs information on the result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time-series signal and the detection signal, using a trained model for inferring the result of determining whether the field device connected to the control system is a legitimate device or an illegitimate device from at least one of the time-series signal and the detection signal; A program that functions as a

Images