Encryption control system, encryption control method, and encryption control program

Abstract

To provide an encryption control program that prevents a digit overflow phenomenon (overflow) that occurs when a numerical value for modular multiplication increases, and an encryption control system using the same.SOLUTION: An encryption control system includes: an input device 10 which has a first encryption unit 101 that encrypts command input; a control device 20 which has a secret calculation unit 201; and a plant control device 30 which has a decryption unit 301 and a second encryption unit 302 that encrypts feedback signals. The system uses the encrypted command input from the input device and the encrypted feedback signals (sensor signals from a control target 30a) from the plant control device to split values stored in a prescribed data type into smaller values and perform calculation such that digit overflow does not occur in the time of multiplication.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an encryption control system, an encryption control method, and an encryption control program. [Background technology]

[0002] Conventional encryption control systems have been developed mainly using C or C++ programming languages. There are other software tools such as MATLAB (registered trademark) and Simulink (registered trademark), but for example, the standard specification for MATLAB is 64-bit numerical calculations due to the constraints of the number of bits for each variable.

[0003] In conventional secure control systems, signals on communication links are encrypted. However, the inventors' research has proposed an encrypted control system in which not only the signals on the communication links but also the parameters of the control device (controller) are encrypted, and the control device does not perform decryption processing that requires a private key (see Patent Documents 1 and 2). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 6360781 [Patent Document 2] International Publication No. WO2019 / 078343 Summary of the Invention [Problem to be solved by the invention]

[0005] In the encryption control program, when the value of the multiplication remainder becomes large, an overflow phenomenon occurs. Therefore, when multiplying values ​​that would cause an overflow when multiplied, it is not possible to obtain the remainder by simply multiplying them. One solution would be to treat the values ​​that would cause overflow when multiplied as a set of arbitrary values, calculate each of them separately, and finally add them all together to calculate the result. However, this would result in other problems, such as a long calculation time.

[0006] In other words, when taking into account calculation time, etc., the best method is to multiply two large numbers and then find the remainder. However, as mentioned earlier, multiplying two large numbers can cause the problem of overflow.

[0007] An object of the present invention is to provide an encryption control system, an encryption control method, and an encryption control program that are capable of avoiding the overflow phenomenon that occurs when the numerical value to be multiplied becomes large. [Means for solving the problem]

[0008] The present invention is an encryption control system comprising an input device having a first encryption unit that encrypts command input, a control device having a secret calculation unit, and a plant control device having a decryption unit and a second encryption unit that encrypts a feedback signal. In the encryption control system of the present invention, the secret calculation unit of the control device is characterized in that it uses encrypted command input from the input device and encrypted feedback signal from the plant control device to divide values ​​stored in a predetermined data type into smaller values ​​and calculate them so as to prevent overflow during multiplication. Effect of the Invention

[0009] According to the present invention, it is possible to perform calculations for encryption control using a dynamic key that allows the control software to set the maximum key length. Furthermore, according to the present invention, it is possible to increase the encryption strength and maintain high accuracy of the encryption control. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram for explaining the basic concept of an encryption control system of the present invention. [Diagram 2] This is an example (part 1) of a conventional PID control system before encryption control, in which the difference between a command signal from an input device and a feedback signal from the controlled object is supplied. [Diagram 3] This is an example (part 2) of a conventional PID control system before encryption control, in which the difference between a command signal from an input device and a feedback signal from the controlled object is supplied. [Figure 4] This is an example of a conventional PID control system (part 3) before encryption control, in which a command signal is supplied from an input device and a feedback signal from the controlled object, and PID control is performed based on the differences between P (proportional), I (integral), and D (derivative). [Diagram 5] FIG. 2 is a diagram showing an embodiment of the encryption control system of the present invention, which is a further concrete embodiment of the basic conceptual diagram (FIG. 1) of the encryption control system of the present invention. [Figure 6] 1 shows a vehicle speed command value when the encrypted control program of the present invention is applied to the control of a vehicle fuel efficiency model, and the output of the vehicle speed / vehicle model subjected to encrypted control (top), and a difference between the two (bottom). [Figure 7] 7 is a diagram (top) showing the control output by PID control without encryption control as shown in FIG. 3 and the control output by PID control when encryption control of the present invention is performed as shown in FIG. 5, and a diagram (bottom) showing the difference between the two. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Below, with reference to the drawings, examples of embodiments of the encryption control system, encryption control method, and encryption control program of the present invention (hereinafter referred to as "the present examples") will be described, along with a PID control system prior to the encryption control leading to the embodiment of the present invention.

[0012] FIG. 1 is a diagram for explaining the basic concept at the highest level of the encryption control system, encryption control method, and encryption control program of this embodiment. As shown in FIG. 1, the encryption control system of this embodiment includes an input device 10, a control device 20, and a plant control device 30. In the following description of FIGS. 2 to 4, the command input generated by the input device 10 will be referred to as "command input 10a," and the control target controlled by the plant control device 30 will be referred to as "control target 30a."

[0013] The input device 10 is a device with which an operator issues command inputs 10a such as control target values ​​to a specific control target 30a. The input device 10 in the encryption control system of this example includes an encryption unit (command) 101 that encrypts a command value. The encryption unit 101 supplies a command input encrypted by a public key to the control device 20. Here, the encryption unit (command) 101 is referred to as a first encryption unit in the claims.

[0014] The control device 20 includes a secure calculation unit 201. The secure calculation unit 201 performs calculations on the encrypted command input 10a supplied from the input device 10 and the encrypted feedback signal (feedback input) from the plant control device 30 while they remain in the encrypted state. Then, the control device 20 supplies the control output encrypted by the secure calculation unit 201 to the plant control device 30.

[0015] The plant control device 30 includes a decryption unit 301 and an encryption unit (feedback) 302. The decryption unit 301 decrypts an encrypted control input supplied from the control device 20, and supplies it to a control target 30a (not shown) as a normal control signal. The encryption unit (feedback) 302 encrypts a feedback signal from a sensor provided in the control target 30a, and feeds it back to the input device 10. In order to distinguish the encryption unit (feedback) 302 from the encryption unit (command) 101, the encryption unit (feedback) 302 is referred to as a second encryption unit in the claims.

[0016] [Method and program for modular multiplication to prevent overflow in the secure computation unit 201] Details will be described later in FIG. 5 which shows a specific example of the encryption control system of this embodiment, but here we will explain a modular multiplication method that prevents overflow and is used in calculations in the secret calculation unit 201 of the control device 20 and other parts, and the program that realizes this method.

[0017] As mentioned in the section on the problem of the invention, when the value of the modular multiplication in the encryption control program becomes large, an overflow phenomenon occurs. Therefore, in the encryption control program, it is important to prevent the overflow phenomenon (overflow) in the process of the modular multiplication in the control system. This becomes extremely important from an availability perspective.

[0018] In other words, when multiplying values ​​that would cause an overflow, you cannot simply multiply them together to get the remainder. One solution would be to treat the values ​​that would cause an overflow when multiplied as a set of arbitrary values, calculate each of them, and finally add them together to get the result, but this is not efficient because it takes a long time to calculate.

[0019] First, as an example, the maximum number of bits for each variable in a given programming language is 16-bit positive integer type (0 to 2 16 -1) Let us explain the case of modular multiplication in the environment. First, X 2 ≦L (where L is the maximum value that the data type can represent) Find the maximum X such that: 255 2 =65025≦65535=2 16 -1 Since L=65535, X=255 is the maximum value that satisfies the above formula. This X determines the range of numbers that can be handled by this method, which is 0 or more, X 2 is less than.

[0020] As an example, let us set M=65000, N=48600, and P=65011 as values ​​that will cause overflow when multiplied, and consider finding the remainder P when multiplying M and N. In other words, M×N is 3,159,000,000, and 2 16 = 65536, causing an overflow. In addition, dividing M × N into (M + M + (add N times) + M) and other calculations to find the final remainder takes too much time to perform in a program, so this method cannot be adopted lightly.

[0021] When M and N are expressed using X=255, the formula becomes as follows. M=M 1 X+M 2 (M 1 =254, M 2 =230) N=N 1 X+N 2 (N 1 =190, N 2 =150) At this time, M 1 , M 2 , N 1 , N 2 must be chosen to be less than X. The remainder of the multiplication is obtained by expanding MN%P as follows: MN%P=(M 1 X+M 2 )·(N 1 X+N 2 )%P =(M 1 N 1 X 2 +(M 1 N 2 +M 2 N 1 )X+M 2 N 2 )%P And, A=M 1 N 1 X 2 , -B=(M 1 N 2 +M 2 N 1 )X, C=M 2 N 2First, find the remainder of P for A, B, and C, and finally find (A+B+C)%P to find (M×N)%P. "%" is the operator that finds the remainder. A:(M 1 N 1 X 2 )%P B:(M 1 N 2 +M 2 N 1 )X%P CM 2 N 2 %P

[0022] First, A:(M 1 N 1 X 2 The following process is performed for %P. The key point of the calculation is "M 1 N 1 X 2 " to "(M 1 ×N 1 )×X 2 " and X 2 The remainder when dividing by P is "X 2 %P" by binary arithmetic (M 1 ×N 1 ) times. Binary is a numerical representation method using the binary system used in computers, and is one of the basic concepts of programming used to handle data inside a computer. Here, "%" is an operator that finds the remainder, and "e&1" indicates the AND of the binary number e and the binary number 1. Also, "e>>=1" indicates a one-digit shift to the right in binary representation. For example, 1010>>=1 indicates 101.

[0023] result=0 e=M 1 * N 1 mod=X 2 %P While(e>0) { If((e&1)==1) { result=(result+mod)%P} e>>=1 mod=(mod+mod)%P }

[0024] Here, e&1 is the AND of e in binary and 1 in binary. The result after the above processing is (M 1 N 1 X 2 )%P's answer, which is A's answer. However, the remainder of the addition ((S+T)%P) of (result+mod) %P or (mod+mod) %P in the above process is calculated as follows to prevent overflow. This algorithm is also applied to the remainder of the addition shown in the following algorithms.

[0025] / * (S+T)%P * / temp=PT if(temp>S) { return S+T }else{ return S-temp }

[0026] Next, B:((M 1 N 2 +M 2 N 1 )X)%P, the following process is carried out using the binary method. Note that " / " is an operator that calculates the quotient. The key point of this process is "((M 1 N 2 +M 2 N 1 )X)%P" to "(e * X 2 +result)%P" and the result in A("M 1 N 2 +M 2 N 1 " is divided by X, the remainder is multiplied by X, and the result is divided by P. The remainder is used as the initial value, and the same processing as that performed in A is performed.

[0027] e=(M 1 N 2 +M 2 N 1 )%P result = ((e%X) * X) % P e= e / X mod=X 2 %P While(e>0) { If(e&1)==1) result=(result+mod)%P } e>>=1 mod=(mod+mod)%P }

[0028] The result after the above processing is (M 1 N 2 +M 2 N 1 )%P's answer, which is B's answer. If the results in steps A and B are resultA and resultB, respectively, the answer we are looking for is, It looks like this: temp=(resultA+resultB)%P (temp+M 2 N 2 )%P

[0029] C's "M 2 N 2 In the calculation of "%P", M 2 ×N 2 = 150 × 230 = 34500, so the maximum value of 16-bit positive integer type, L(2 16 -1=65535). That is, M 2 <X、N 2 <XなのでM 2 N 2 <X 2 And C's "M 2 N 2 Even if "%P" is calculated as is, no overflow will occur.

[0030] [An example of PID control before the encrypted control program in this example was applied] Next, an example of a PID control system before the encrypted control program of this embodiment is applied will be described with reference to FIGS. The inventors have come up with the encryption control system of this embodiment shown in Fig. 5 based on the conventionally known PID control system as shown in Fig. 2 to Fig. 4. As will be described in detail later with reference to Fig. 5, a program for preventing the above-mentioned overflow phenomenon during multiplication is used in various parts of the encryption control system of this embodiment shown in Fig. 5.

[0031] The PID control system before encryption control shown in Figs. 2 to 4 will be described below. FIG. 2 is a block diagram showing a basic PID control system before the encryption control program of this example is applied. The PID control system is a system that reads the state of the controlled object 30a with a sensor, outputs a control signal based on error information between a command input 10a from an operator and a sensor signal from the controlled object 30a, and maintains the controlled object 30a in a predetermined controlled state.

[0032] The P (proportional) component outputs a control signal proportional to the error, the I (integral) component outputs a control signal taking into account the accumulation of the error, and the D (differential) component outputs a control signal taking into account the rate of change of the error. PID control systems are widely used in various industrial fields to achieve advanced control of controlled objects.

[0033] 2, in a conventional PID control system before encryption control, a command input 10a is issued from an input device (not shown), and is subtracted from a feedback signal detected in a controlled object 30a by a subtractor 11. The feedback error signal subtracted by the subtractor 11 is then supplied to a control device 20 that performs PID control.

[0034] The control device 20 includes an integrator combining an integral gain multiplication unit 21 and an integral processing unit 24 , a proportional gain multiplication unit 22 , and a differentiator combining a differential gain multiplication unit 23 and a differential processing unit 25 . The integral gain, proportional gain, and differential gain multiplied in the integral gain multiplication unit 21, proportional gain multiplication unit 22, and differential gain multiplication unit 23 are preset to appropriate gain values ​​taking into account the state of the controlled object 30a.

[0035] The output obtained by multiplying the feedback error signal by the integral gain in integral gain multiplication unit 21 is supplied to integral processing unit 24, and a signal in which the accumulation of feedback errors has been taken into consideration is supplied from the integrator to adder 26. The output obtained by multiplying the feedback error signal by the differential gain in differential gain multiplication unit 23 is supplied to differential processing unit 25, and a signal in which the rate of change of the feedback error has been taken into consideration is supplied from the differentiator to adder 26. The output obtained by multiplying the feedback error signal by the proportional gain in proportional gain multiplication unit 22 is supplied directly to adder 26. The adder 26 synthesizes (adds) the signal from the integral processing unit 24, the signal from the proportional gain multiplication unit 22, and the signal from the differential processing unit 25, and supplies the result as a control signal to the controlled object 30a.

[0036] Figure 3 adds a mechanism for discretization processing in order to implement the PID control system shown in Figure 2 on a computer. The difference from the PID control system in Figure 2 is that a sample time generator 27, a multiplication processing unit 24a, and a division processing unit 25a are provided in the control device 20. In the PID control system before encryption control shown in Fig. 3, the integral and differential processes are discretized by providing a sample time generator 27. Here, the integral processing unit 24 shown in Fig. 2 is composed of a one-sample delay unit 24b and an adder 24c in Fig. 3. Also, the differential processing unit 25 shown in Fig. 2 is composed of a one-sample delay unit 25b and a subtractor 25c in Fig. 3.

[0037] 3, the output signal from integral gain multiplication unit 21 is discretized in multiplication processing unit 24a at a sampling period generated by sample time generator 27. Then, the discretized integral gain output is supplied to integral processing unit 24 (see FIG. 2) consisting of one-sample delay unit 24b and adder 24c.

[0038] The output signal from the differential gain multiplication unit 23 is supplied to a differential processing unit 25 (see FIG. 2) that is composed of a one-sample delay unit 25b and a subtractor 25c. The output of the differential processing unit 25 is discretized by a division processing unit 25a at a sampling period generated by a sample time generator 27. In this way, in a computer that performs real-time calculations, integration processing is performed on the computer by adding the discretized output to the next step and multiplying it by the discretized time. Also, differentiation processing is performed on the computer by subtracting the next step from the previous step and then dividing by the discretized time. Note that the subsequent processing is the same as the processing in Figure 2, so repeated explanations will be omitted.

[0039] FIG. 4 shows a further modification of the conventional PID control system prior to cryptographic control. The PID control system shown in FIG. 4 differs from the PID control system shown in FIG. 3 in that a command input 10a is supplied to PID gain multiplication units 21a to 23a, and a sensor signal (feedback signal) from a controlled object 30a is supplied to PID gain multiplication units 21b to 23b.

[0040] That is, in the example shown in FIG. 4, the feedback signals from the command input 10a and the controlled object 30a are individually multiplied by the respective gains in the P (proportional), I (integral), and D (differential) gain multiplication units, and then sent to subtractors 21c, 22c, and 23c to obtain the respective feedback. In this way, by switching the order of subtraction and multiplication for the error signal between the command input 10a and the feedback signal from the controlled object 30a for each P (proportional), I (integral), and D (differential), it is possible to make it equivalent to the discretized PID control system (Figure 3) before the encryption control, and no difference occurs in the control performance due to this modification. The reason for transforming it as shown in Figure 4 is that ElGamal encryption is multiplicatively homomorphic, and therefore can only perform multiplication. Therefore, the part to be calculated is divided into multiplication (left side) and other parts (right side), and ElGamal encryption is applied to the multiplication part to make it the secret calculation part, and the parts other than multiplication are calculated after decryption on the controlled side. The processes after the multiplication processing unit 24a and the division processing unit 25a are the same as those in FIG. 3, so that a duplicated description will be omitted.

[0041] [Example of an embodiment in which the encrypted control program of this example is applied to a PID control system] Fig. 5 is a configuration diagram of an encrypted PID control system in which the encrypted control program of this embodiment is applied to a PID control system. That is, the configuration diagram of Fig. 5 is an embodiment of the present invention that embodies the basic conceptual diagram of Fig. 1. The encryption control program, encryption control method, and encryption control system of this embodiment will be described below with reference to FIGS.

[0042] As shown in FIG. 5, in the encryption control system of this embodiment, first, an encryption unit (command) 101 of an input device 10 encrypts a command input 10a. In this encryption unit 101, key generation Gen and encryption Enc(m, pk) are performed according to instructions from an operator.

[0043] First, key generation (Gen) is explained in detail in the inventors' patent presented as prior art, so we will not go into detail here, but a prime number p and a primitive element (generator) g are randomly selected, and an integer s is randomly selected from 0≦s≦p-2 as the private key. And h=g s Calculate modp and output the public key pk = (p, g, h) and the private key sk = s, where h is g s is the remainder when divided by p.

[0044] In this case, a multiplicatively homomorphic encryption scheme such as ElGamal encryption is used. 1 and plaintext m 2 Binary operation with (m 1 ○m 2 ) is encrypted as ciphertext Enc(m 1 ○m 2 ) into plaintext m 1 The encrypted ciphertext Enc(m 1 ) and plaintext m 2 The encrypted ciphertext Enc(m2 It is an encryption that can be calculated using That is, a multiplicative homomorphic encryption can multiply two encrypted values as they are without decrypting them, and by decrypting the multiplied value, it can be made to match the value obtained by multiplying the values before encryption. Such multiplicative homomorphic encryption is widely applied in cloud computing, password systems of financial institutions, etc.

[0045] Next, the encryption unit (command) 101 encrypts the plaintext m and generates the ciphertext c = Enc(m, pk). First, let the plaintext be m (0 < m < p). Then, an integer r is randomly selected from 0 ≤ r ≤ p - 2, and c 1 = g r mod p, c 2 = mh r mod p are calculated. As a result, the encryption unit (command) 101 outputs c -= (c 1 , c 2 ) as the ciphertext c. Note that encryption is a probabilistic algorithm. Different ciphertexts are calculated even when the same plaintext is encrypted.

[0046] As shown in FIG. 5, the ciphertext encrypted by the encryption unit (command) 101 of the input device 10 is supplied to the control device 20. Also, the feedback signal from the control target 30a encrypted by the encryption unit (feedback) 302 of the plant control device 30 is also supplied to the control device 20.

[0047] The secret calculation unit 201 of the control device 20 performs calculation processing on the encrypted command input 10a from the input device 10 and the encrypted feedback signal from the control target 30a without decrypting them, in the encrypted state. That is, the encrypted command input 10a from the input device 10 is supplied to the integral gain multiplication unit 201a, the proportional gain multiplication unit 201b, and the differential gain multiplication unit 201c. On the other hand, the encrypted feedback signal from the control target 30a is supplied to the integral gain multiplication unit 201d, the proportional gain multiplication unit 201e, and the differential gain multiplication unit 201f.

[0048] The secure computation unit 201 of the control device 20 computes integrals C of the encrypted text in order to perform I (integral), P (proportional), and D (differential) computations for the encrypted command input and the encrypted feedback input, respectively. I The integral gain multiplication units 201a and 201d store the proportional gain C P The proportional gain multiplication units 201b and 201e store the differential gain C D The secure calculation unit 201 has differential gain multiplication units 201c and 201f storing the above. Then, the secure calculation unit 201 performs a multiplication process of the encrypted predetermined value set in advance for each control target 30a and the encrypted command input 10a. In this multiplication process, a process for preventing overflow is performed by the binary method program described above.

[0049] That is, in the secure calculation unit 201, the values ​​(I, P, D gains) stored in a predetermined data type for the encrypted command input 10a from the input device 10 and the encrypted feedback signal from the controlled object 30a of the plant control device 30 are divided into smaller values ​​and calculated so as to prevent overflow during multiplication. The mathematical algorithm for preventing overflow during multiplication used in the secure calculation unit 201 is also used in the decryption process in the plant control device 30.

[0050] The secret calculation unit 201 of the control device 20 performs a predetermined calculation process on the command input 10a from the input device 10 and the feedback signal from the control object 30a, which are calculated in an encrypted state, and then supplies them to the plant control device 30 in their encrypted form. As shown in FIG. 5, the decryption unit 301 of the plant control device 30 includes decoders 301a-301f that decrypt six input encrypted signals, subtraction processing units 303a-303c, a multiplication processing unit 304a, a division processing unit 305a, an integrator consisting of a one-sample delay unit 304b and an adder 304c, a differentiator consisting of a one-sample delay unit 305b and a subtractor 305c, a sample time generator 306, and an adder 307.

[0051] The decoders 301a to 301c of the decryption unit 301 respectively decrypt the I (integral) component, P (proportional) component, and D (differential) component of the encrypted command input 10a from the input device 10. The decoders 301d to 301g of the decryption unit 301 respectively decrypt the encrypted signal obtained by multiplying the feedback signal from the controlled object 30a by the integral (I), proportional (P), and differential (D) gains.

[0052] The output signals after multiplication by the integral (I), proportional (P), and differential (D) gains decoded by the decoders 301a to 301c are supplied to subtraction processing units 303a to 303c, respectively, and feedback error signals are obtained for each of the integral (I), proportional (P), and differential (D) components.

[0053] The feedback error signal of the I (integral) component decoded by decoder 301a and decoder 301d of decoding unit 301 and subtracted by subtraction processing unit 303a is sent to multiplication processing unit 304a and discretized by a sample time signal from sample time generator 306. The error signal of the I (integral) component discretized (multiplied) by multiplication processing unit 304a is integrated by an integrator consisting of one-sample delay unit 304b and adder 304c, and supplied to adder 307.

[0054] Furthermore, the feedback error signal of the P (proportional) component decoded by the decoders 301b and 301e of the decoding unit 301 and subjected to subtraction by the subtraction processing unit 303b is supplied to the adder 307 as is. On the other hand, the feedback error signal of the D (differential) component decoded by the decoder 301c and decoder 301f of the decoding unit 301 and subtracted by the subtraction processing unit 303c is differentiated by a differentiator consisting of a one-sample delay unit 305b and a subtractor 305c, and supplied to the division processing unit 305a. Then, in the division processing unit 305a, the signal is discretized (divided) by a sample time signal from a sample time generator 306, and is supplied to an adder 307 as a feedback error signal of a decoded D (differential) component.

[0055] The adder 307 adds the decoded I (integral) component feedback error signal, P (proportional) component feedback error signal, and D (differential) component feedback error signal, and supplies the summed signal to the controlled object 30a as a control signal.

[0056] Here, updating of the private key used in the decryption process of the decryptors 301a to 301f in FIG. 5 will be described. The secret key sk=s at time t t " is expressed as follows and is updated every period determined by t. s t =s t-1 +w(t-1)modp(t≧1) Here, w( ) is a deterministic algorithm that outputs a pseudorandom number sequence. When updating the private key, it is necessary to update the public key and the encrypted ciphertext accordingly.

[0057] In addition, the public key pk=(p,g,h) at time t is t can be expressed by the following formula: TIFF2025025408000002.tif9157However, The file is TIFF2025025408000003.tif9157.

[0058] In addition, the updated state of the ciphertext encrypted at time t can be expressed by the following equation. TIFF2025025408000004.tif42157Even if the secret key is leaked, it cannot be decrypted if the random number sequence output function w(··) is secure. t For example, the gains C I (t), C P (t), C D It can be read as (t). In other words, the ciphertext of the leaked public key / private key can be deciphered, but the public key / private key are updated successively, and no one can predict the public key / private key that will be updated in the future without the random number sequence output function w(··). Therefore, a mechanism is established in which future ciphertexts are secure thanks to the existence of the random number sequence output function w(··).

[0059] FIG. 6 is a diagram showing the control results of the encryption control system of this embodiment when the encryption control system and the encryption control program of this embodiment are applied to a vehicle model. In other words, the upper diagram in Figure 6 shows that the encrypted command value (solid line) supplied to the control device 20 from the input device 10 shown in Figure 5 and the vehicle speed command value (dotted line) which is the output of the plant control device 30 almost overlap.

[0060] Moreover, the lower graph in FIG. 6 shows the difference between the encrypted command value (solid line) and the vehicle speed command value (dotted line) which is the output of the plant control device 30, that is, the difference between the vehicle model output and the command value (vehicle speed difference). As shown in the lower diagram of Figure 6, the vehicle speed difference signal indicates that there is a certain degree of difference between the vehicle model output and the command value, but judging from the magnitude of this difference, it can be seen that the encrypted command input for the vehicle speed and the decrypted control input for the vehicle speed are almost the same. In other words, it can be said that the encryption control system of this example is functioning well.

[0061] The upper diagram of FIG. 7 shows an example of vehicle speed control using the same vehicle model, showing the control input of PID control without encryption control as shown in FIG. 3 and the control input of encrypted PID control with encryption control as shown in FIG. 5. As shown in the upper diagram of Figure 7, it can be seen that the control input of the PID control without encryption control shown in Figure 3 and the control input of the PID control with encryption control of the present invention shown in Figure 5 are largely identical.

[0062] The lower graph in FIG. 7 shows the difference between the control input of the PID control without encryption control shown in FIG. 3 and the control input of the encrypted PID control when the encryption control of the present invention shown in FIG. 5 is performed. As can be seen from the lower graph in Figure 7, even when encryption control is performed using the encryption control system of this example, the accuracy does not change much compared to when PID control is performed without encryption control.

[0063] The above describes the overview and details of the encryption control system, encryption control method, and encryption control program, which are example embodiments of the present invention. However, the present invention is not limited to the above-described example embodiments, and includes various application examples and modified examples as long as they do not deviate from the scope of the claims. [Explanation of symbols]

[0064] 10...input device, 10a...command input, 20...control device, 30...plant control device, 30a...control target, 11, 25c, 304c...subtractor, 26, 24c, ...adder, 303a to 303c, 305c...subtraction processing unit, 21 to 23, 201a to 201f...gain multiplication unit, 24...integration processing unit, 25...differential processing unit, 24a, 304a...multiplication processing unit, 25a, 305a...division processing unit, 24b, 25b, 304b, 305b...1 sample delay circuit, 304c, 307...adder, 27, 306...sample time generator, 101...encryption unit (command), 201...secret calculation unit, 301...decryption unit, 301a to 301f...decryptor, 302...encryption unit (feedback)

Claims

1. An encryption control system including an input device having a first encryption unit that encrypts a command input, a control device having a secure calculation unit, and a plant control device having a decryption unit and a second encryption unit that encrypts a feedback signal, The secure calculation unit of the control device divides a value stored in a predetermined data type into smaller values ​​so as to prevent overflow during multiplication, using an encrypted command input from the input device and an encrypted feedback signal from the plant control device, and performs calculations. Encryption control system.

2. In the secure computation unit of the control device, when dividing the value into smaller values ​​and performing computation so as to prevent overflow during multiplication, Using integers M and N and integer X, M=M 1 X+M 2 N=N 1 X+N 2 And MN%P is expressed as MN%P=(M 1 X+M 2 )・(N 1 X+N 2 )%P =(M 1 N 1 X 2 +(M 1 N 2 +M 2 N 1 )X+M 2 N 2 )%P Expanding this, A = M 1 N 1 X 2 , -B=(M 1 N 2 +M 2 N 1 ) X, C=M 2 N 2 Let (A+B+C) / P, and calculate MN%P by taking the remainder for A, B, and C without multiplying M×N. The encryption control system of claim 1 .

3. The secure computation unit computes the modular addition remainder by performing the following case distinction in order to prevent overflow in the modular addition remainder: / * (S+T)%P * / temp=P-T if(temp>S){ return S+T }else{ ReturnS-temp } The encryption control system according to claim 2 .

4. An encryption control method in an encryption control system including an input device having a first encryption unit that encrypts a command input, a control device having a secure calculation unit, and a plant control device having a decryption unit and a second encryption unit that encrypts a feedback signal, comprising: The secure calculation unit of the control device divides a value stored in a predetermined data type into smaller values ​​so as to prevent overflow during multiplication, using an encrypted command input from the input device and an encrypted feedback signal from the plant control device, and performs calculations. Encryption control methods.

5. An encryption control program used in an encryption control system including an input device having a first encryption unit that encrypts a command input, a control device having a secret calculation unit, and a plant control device having a decryption unit and a second encryption unit that encrypts a feedback signal, On the computer, Using the encrypted command input from the input device and the encrypted feedback signal from the plant control device, a value stored in a predetermined data type is divided into smaller values ​​so as to prevent overflow during multiplication, and calculation is performed. Encryption control program.

Images