Encryption control system and encryption control program

Abstract

To provide an encryption control system that further reduces the risk of a cipher key leaking.SOLUTION: An encryption control system includes an input device, a plant-side control device, and a controller which are respectively equipped with pseudorandom number calculation units having a common function in a table record selection processing part, and are time synchronized, and start a synchronized operation at the same time. By thus configuring the encryption control system, it becomes possible to switch a pair of a public key and a private key in synchronization with the control cycle of the entire control system. Consequently, it becomes possible to instantaneously and definitely detect intervention in the control system by a malicious third party.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present invention relates to an encryption control system. [Background technology]

[0002] In recent years, with the development of information technology such as the Internet, the application of information technology has been progressing in the networking of infrastructure that supports people's lives, such as electricity, gas, and water, as well as the control systems that control industrial facilities such as factories and power plants. Such networking of control systems and the evolution of information and communication technology (ICT) have brought great benefits to control systems, such as improved processing speed and more advanced processing content. On the other hand, there are concerns that networking of control systems will bring about a new threat, namely cyber attacks. In fact, cyber attacks against control systems that monitor or control the operation of plants such as power plants and factories have appeared, and are attracting attention as a major social issue.

[0003] Against this background, there is an urgent need to develop technology to protect the control systems that support critical infrastructure from cyber attacks. In addition to adapting information security technologies to control systems, research is underway on detecting cyber attacks.

[0004] Patent Document 1 discloses a technology for an encryption control system, some of which is also invented by the present invention. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-90884 A Summary of the Invention [Problem to be solved by the invention]

[0006] In Patent Document 1, the inventors have succeeded in realizing a control system in which the controller, which is the core part of the control system, directly performs arithmetic processing on encrypted input data and output data, thereby eliminating the need for a public key and / or private key in the controller. With this invention, the control system only needs to be equipped with a private key in the plant, thereby reducing the risk of the public key and / or private key being leaked. However, only one pair of public and private keys is used in Patent Document 1. Therefore, there is a risk that the encryption may be decrypted when using huge computer resources such as cloud computing.

[0007] An object of the present invention is to provide an encryption control system that can solve the above problems and further reduce the risk of encryption key leakage. [Means for solving the problem]

[0008] In order to solve the above problems, the encryption control system of the present invention includes a controller and a plant side control device. the controller includes a first encryption processing unit that encrypts a target value with a public key and outputs the encrypted target value; and a second encryption processing unit that encrypts a target value with the public key and outputs the encrypted target value. The system is equipped with a first table record selection processing unit that selects a predetermined record for the first encryption processing unit from a public key sub-table in which a plurality of public keys are stored, and selects a predetermined record from an encryption parameter table consisting of records in which encryption parameters in which parameters of the control system are encrypted with a public key of the public key sub-table are recorded, a multiplication unit that receives an encrypted target error from the plant side control device, multiplies the encrypted target error by the encryption parameter selected by the first table record selection processing unit, and outputs an encrypted control input, and a second date and time information generation unit that provides date and time information to be added to the encrypted control input output from the multiplication unit and gives a start timing to the first table record selection processing unit. The plant-side control device includes a decryption processing unit that decrypts an encrypted target value received from the controller to obtain a target value and decrypts an encrypted control input received from the controller to obtain a control input, and a control processing unit that controls a predetermined control object based on the control input.The plant-side control device further includes a signal conversion processing unit that obtains an observation value from a sensor that observes the control object, a target error calculation processing unit that subtracts the observation value from the target value to calculate a target error, a second encryption processing unit that encrypts the target error and outputs an encrypted target error, a second table record selection processing unit that selects a predetermined record from a public key table in which a plurality of public keys and private keys that are pairs of the public keys are stored for the decryption processing unit and selects a predetermined record from the public key table for the second encryption processing unit, and a second date and time information generation unit that provides date and time information to be added to the encrypted target error output from the second encryption processing unit and gives a start timing to the second table record selection processing unit. The first date and time information generating section and the second date and time information generating section generate the activation timings simultaneously with each other. Effect of the Invention

[0009] According to the present invention, it is possible to provide an encryption control system that can further reduce the risk of an encryption key being leaked. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0010] [Figure 1] 1 is a schematic diagram showing the overall configuration of an encryption control system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram showing a hardware configuration of the input device. [Diagram 3] FIG. 2 is a block diagram showing a hardware configuration of a controller. [Figure 4] FIG. 2 is a block diagram showing a hardware configuration of a plant-side control device. [Diagram 5] 2 is a block diagram showing a hardware configuration of a date and time information source device; [Figure 6] FIG. 2 is a block diagram showing software functions in a control network of an encryption control system. [Figure 7] FIG. 2 is a block diagram showing software functions in an information network of the encryption control system. [Figure 8] 1 is a table showing the field configurations of a public key table, a public key sub-table, and an encryption parameter table. [Figure 9] FIG. 11 is a block diagram illustrating software functions of a table record selection processing unit of an input device and a controller, and software functions of a table record selection processing unit in an encrypted target value of a plant-side control device. [Figure 10] FIG. 13 is a block diagram illustrating software functions of a table record selection processing unit in an encrypted control input of a plant-side control device. [Figure 11] 13 is a flowchart showing the flow of a synchronous operation start process in a date and time information generating unit of the controller. [Figure 12] 10 is a flowchart showing the flow of operations of a pseudorandom number calculation unit of the controller. [Figure 13] 1 is a time chart illustrating synchronous operation of the encryption control system. [Figure 14] 1 is a graph showing the control input u and the target error ε in the encryption control system according to Patent Document 1 and the encryption control system according to an embodiment of the present invention. [Figure 15] 1 is a graph showing an attack detector in the encryption control system according to Patent Document 1 and in the encryption control system according to an embodiment of the present invention. [Figure 16] FIG. 11 is a block diagram showing software functions in a control network of a controller according to a modified embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] [Embodiment of encryption control system 101] 1 is a schematic diagram showing the overall configuration of an encryption control system 101 according to an embodiment of the present invention. In the following description, encrypted values ​​are represented by a function called Enc(). The encryption control system 101 includes an input device 102 , a plant side control device 103 , a controller 104 , and a date and time information source device 105 . The input device 102 transmits, via the controller 104 to the plant-side control device 103, an encrypted target value Enc(r) obtained by encrypting the target value r using public key cryptography. A controlled object 106 and a sensor 107 are connected to the plant-side control device 103. The plant-side control device 103 provides a control signal to the controlled object 106 and acquires an observed value y, which is state information of the controlled object 106, from the sensor 107. The plant-side control device 103 is connected to the controller 104 via a second control network L109, and transmits and receives encrypted control information.

[0012] The controller 104 is connected to the input device 102 via a first control network L108, and is also connected to the plant-side control device 103 via a second control network L109. The controller 104 receives the encrypted target value Enc(r) from the input device 102 via the first control network L108, and receives the encrypted target error Enc(ε) from the plant-side control device 103 via the second control network L109. The controller 104 then performs a predetermined calculation process on this encrypted information without decrypting it, and transmits the calculation result, the encrypted control input Enc(u), to the plant-side control device 103 via the second control network L109.

[0013] The public key cryptography used in the encryption control system 101 according to the embodiment of the present invention is homomorphic public key cryptography, such as RSA (Rivest Shamir Adleman) cryptography, as disclosed in Patent Document 1. Homomorphic public key cryptography multiplies two encrypted values ​​together without decrypting them, and then decrypts the multiplied value, making it possible to make the value before encryption equal to the multiplied value. An explanation of the homomorphism of public key cryptography is described in Patent Document 1, and since there is no change in the computational processing of public key cryptography itself in the encryption control system 101 according to the embodiment of the present invention, except that multiple pairs of public keys and private keys are used, a detailed explanation of the public key cryptography itself will be omitted.

[0014] The input device 102, the controller 104, and the plant side control device 103 are each connected to a date and time information source device 105 through an information network L110. The date and time information source device 105 is a personal computer or a server on which a network OS, an NTP server (Network Time Protocol), and an NTP client run. The first control network L108 and the second control network L109 are networks that place importance on the reliability of data transfer, and various types of network interfaces are available. On the other hand, the information network L110 does not require the same reliability as the control network. In the embodiment of the present invention, the well-known TCP / IP is used.

[0015] The input device 102, the controller 104, and the plant-side control device 103 are devices called programmable controllers. A case-shaped mount base 111 having many slots accommodates modules of a size that can be accommodated in the slots according to the required functions. The mount base 111 has a built-in interface for connecting modules together, and when a module is inserted into a slot, data transmission and reception between the modules and an appropriate power supply are established.

[0016] On a mount base 111a of the input device 102, a CPU module 112, an information network module 113, and a first control network module 114a are mounted. On the mount base 111b of the controller 104, a CPU module 112, an information network module 113, a first control network module 114b, and a second control network module 115 are mounted. On the mount base 111c of the plant side control device 103, a CPU module 112, an information network module 113, a second control network module 115, and an input / output module 116 are mounted. The first control network module 114a of the input device 102 is the sender, and the first control network module 114b of the controller 104 is the receiver. The controller 104 and the second control network module 115 of the plant side control device 103 are connected to each other at their transmitting terminals and receiving terminals.

[0017] [Hardware configuration of input device 102] FIG. 2 is a block diagram showing the hardware configuration of the input device 102. As shown in FIG. The input device 102 includes a CPU module 112, an information network module 113, and a first control network module 114a, which are connected to a module bus 201 provided on a mount base 111. The CPU module 112 includes a CPU 202, a ROM 203, a RAM 204, and an RTC (Real Time Clock) 205 that generates date and time information, all of which are connected to an internal bus 206. The internal bus 206 is connected to a module bus 201. The ROM 203 of the CPU module 112 stores programs for executing control arithmetic processing, encryption processing, and the like in the encryption control system 101 .

[0018] The information network module 113 includes a CPU 202, a ROM 203, a RAM 204, and a NIC (Network Interface Card) 207, which are connected to an internal bus 206. The internal bus 206 is connected to a module bus 201. The ROM 203 of the information network module 113 stores a network OS, an NTP server program, an NTP client program, and the like. In the first control network module 114 a , the transmitter 208 is connected to the module bus 201 .

[0019] [Hardware configuration of controller 104] FIG. 3 is a block diagram showing the hardware configuration of the controller 104. As shown in FIG. The controller 104 includes a CPU module 112 , an information network module 113 , a first control network module 114 b , and a second control network module 115 , which are connected to a module bus 201 provided on the mount base 111 . The CPU module 112 and the information network module 113 are the same as those in the input device 102, and therefore a description thereof will be omitted. In the first control network module 114 b , the receiver 309 is connected to the module bus 201 . In the second control network module 115, a transmitting unit 208 and a receiving unit 309 are connected to an internal bus 206. The internal bus 206 is connected to a module bus 201.

[0020] [Hardware configuration of the plant side control device 103] FIG. 4 is a block diagram showing a hardware configuration of the plant-side control device 103. As shown in FIG. The plant side control device 103 includes a CPU module 112 , an information network module 113 , a second control network module 115 , and an input / output module 116 , which are connected to a module bus 201 provided on a mount base 111 . The CPU module 112, the information network module 113, and the second control network module 115 are the same as those in the controller 104, and therefore a description thereof will be omitted. The input / output module 116 includes an A / D converter 410 to which the sensor 107 is connected, and a D / A converter 411 to which the control target 106 is connected, both of which are connected to the internal bus 206 . The internal bus 206 is connected to the module bus 201. Note that this input / output module 116 is merely an example, and a signal processing circuit or the like connected to the A / D converter 410 and the D / A converter 411 may be required depending on the connected object such as the controlled object 106 or the sensor 107.

[0021] [Hardware configuration of date and time information source device 105] FIG. 5 is a block diagram showing the hardware configuration of the date and time information source device 105. As shown in FIG. The date and time information source device 105, which is configured from a server device, a personal computer, or the like, includes a CPU 501, a ROM 502, a RAM 503, a non-volatile storage 504, an RTC 505, and a NIC 506, all of which are connected to a bus 507. When a personal computer is used, it may also include a display unit 508 and an operation unit 509. The non-volatile storage 504 stores a network OS, an NTP server program, and an NTP client program.

[0022] [Software function in the control network of the encryption control system 101] Fig. 6 is a block diagram showing software functions in the control network of the encryption control system 101. Due to space limitations, the description of the information network L110 is omitted in Fig. 6. The information network L110 will be described in Fig. 7. The input device 102 generates an encrypted target value Enc(r) for the plant-side control device 103 , and transmits it to the plant-side control device 103 via the controller 104 . A target value input unit 601 provides an unencrypted target value r to an input / output control unit 602 . The input / output control unit 602 passes the target value r input from the target value input unit 601 to the encryption processing unit 603. Then, the input / output control unit 602 receives the encrypted target value Enc(r) generated by the encryption processing unit 603 and transmits it to the controller 104.

[0023] The encryption processing unit 603 encrypts the target value r received from the input / output control unit 602, using a public key record selected by a table record selection processing unit 605 from a public key sub-table 604. Then, the encryption processing unit 603 passes the generated encrypted target value Enc(r) to the input / output control unit 602. The table record selection processing unit 605 generates a record number (label) of the public key sub-table 604 based on the current date and time information received from the date and time information generation unit 606. Then, the table record selection processing unit 605 reads the public key recorded in the record of the public key sub-table 604 that corresponds to the generated label, and passes it to the encryption processing unit 603. The date and time information generating unit 606 outputs the current date and time information, and also controls the start and stop of the table record selection processing unit 605 .

[0024] The encrypted target value Enc(r) transmitted from the input device 102 to the controller 104 through the cable of the first control network module 114 a is input to the input / output control unit 607 of the controller 104 . The input / output control unit 607 transmits the encrypted target value Enc(r) received from the input device 102 as is to the plant-side control device 103 via the transmitting unit 208 of the second control network module 115. Then, the input / output control unit 607 passes the encrypted target error Enc(ε) received from the plant-side control device 103 via the receiving unit 309 of the second control network module 115 to the multiplying unit 608.

[0025] The multiplication unit 608 calculates the encrypted control input Enc(u) by multiplying the encrypted target error Enc(ε) by the encryption parameters Enc(Parameters) selected by the table record selection processing unit 610 from the encryption parameter table 609. Note that the multiplication process of the encryption parameters Enc(Parameters) and the encrypted target value Enc(r) in the multiplication unit 608 is not a simple multiplication but a partial multiplication process disclosed in Patent Document 1. The multiplication unit 608 passes the encryption control input Enc(u) calculated by multiplying the encryption parameters Enc(Parameters) by the encryption target value Enc(r) to the input / output control unit 607 .

[0026] The table record selection processing unit 610 generates a record number (label) of the encryption parameter table 609 based on the current date and time information included in the data frame received from the plant-side control device 103 via the receiving unit 309 of the second control network module 115. Then, it reads the encryption parameters recorded in the record of the encryption parameter table 609 that corresponds to the generated label, and passes them to the multiplication unit 608. The date and time information generating unit 611 outputs the current date and time information, and also outputs date and time information at the start of synchronous operation (hereinafter referred to as "start date and time information") instructed by the date and time information generating unit 611 of the controller 104. It also performs start and stop control for the table record selection processing unit 610. However, unlike the date and time information generating unit 606 of the input device 102, the current date and time information generated by the date and time information generating unit 611 of the controller 104 is not used for the calculation of the labels of the encryption parameter table 609 executed by the table record selection processing unit 610. Instead, the current date and time information generated by the date and time information generating unit 611 is stored as encoded date and time information in the encoded date and time field of the data frame of the encrypted control input Enc(u) transmitted from the multiplication unit 608 via the input / output control unit 607 and the transmission unit 208.

[0027] The encrypted target value Enc(r) and the encrypted control input Enc(u) transmitted from the controller 104 to the plant side control device 103 via the transmitting unit 208 of the second control network module 115 are input to the decryption processing unit 612 via the receiving unit 309 of the second control network module 115 of the plant side control device 103. The decryption processing unit 612 decrypts the encrypted target value Enc(r) and the encrypted control input Enc(u) using the private key acquired from the table record selection processing unit 613. The values ​​on which the decrypted target value r and control input u are based are delivered to the control calculation processing unit 614.

[0028] The control calculation processing unit 614 calculates values ​​on which the target value r and the control input u are based, and generates the target value r and the control input u. The control input u is passed to the control processing unit 615. The control processing unit 615 generates a control signal from the control input u and controls the controlled object 106 . For example, if the control target 106 is a motor, the control processing unit 615 controls the voltage, phase, etc. applied to the motor. When the control target 106 is controlled by the control processing unit 615, the operation of the control target 106 is detected by the sensor 107. The observation signal output by the sensor 107 is converted into an observation value y by a signal conversion processor 616. The observation value y output by the signal conversion processor 616 is input to a target error processor 617 together with a target value r output by a control processor 614. The target error processor 617 subtracts the observation value y from the target value r and outputs a target error ε. The target error ε is encrypted by the encryption processing unit 603 and converted into an encrypted target error Enc(ε). The encrypted target error Enc(ε) is transmitted to the controller 104 via the transmission unit 208 of the second control network module 115.

[0029] The table record selection processing unit 613 generates a record number (label) of the public key table 618 based on the current date and time information and start date and time information included in the data frame received from the controller 104 via the receiving unit 309 of the second control network module 115. Then, it reads the private key recorded in the record of the public key table 618 corresponding to the generated label, and passes it to the decryption processing unit 612. Similarly, it reads the public key recorded in the record of the public key table 618 corresponding to the generated label, and passes it to the encryption processing unit 603.

[0030] The date and time information generating unit 619 outputs the current date and time information, and also outputs date and time information at the start of synchronous operation (hereinafter referred to as "start date and time information") instructed by the date and time information generating unit 611 of the controller 104. The date and time information generating unit 619 also performs start and stop control for the table record selection processing unit 610. However, unlike the date and time information generating unit 606 of the input device 102, the current date and time information generated by the date and time information generating unit 619 of the plant side control device 103 is not used for the calculation of the label of the public key table 618 executed by the table record selection processing unit 613. Instead, the current date and time information generated by the date and time information generating unit 619 is stored as encoded date and time information in the encoded date and time field of the data frame of the encrypted target error Enc(ε) transmitted from the encryption processing unit 603 via the transmission unit 208.

[0031] If necessary, an external monitor device (not shown) may be connected to the input / output control unit 602 of the input device 102. A monitoring operator of the encryption control system 101 connects the external monitor device to the input device 102 to perform a predetermined monitoring task or the like. The input / output control unit 607 of the controller 104 is provided with a log table 620 that records the encrypted target value Enc(r), the encrypted control input Enc(u), the encrypted target error Enc(ε), etc. in their encrypted form, and is used for monitoring operations.

[0032] [Software function of the encryption control system 101 in the information network L110] FIG. 7 is a block diagram showing software functions in the information network L110 of the encryption control system 101. The date and time information generating section 606 of the input device 102, the date and time information generating section 611 of the controller 104, and the date and time information generating section 619 of the plant side control device 103 are connected to the date and time information source device 105 via the information network L110. The date and time information generation unit 606 of the input device 102, the date and time information generation unit 611 of the controller 104, and the date and time information generation unit 619 of the plant side control device 103 have the functions of a network OS, an NTP server program, and an NTP client program, similar to the date and time information source device 105, and each date and time information generation unit 606 is synchronized with the date and time information of the date and time information source device 105. Furthermore, one of the date and time information generating unit 606 of the input device 102, the date and time information generating unit 611 of the controller 104, and the date and time information generating unit 619 of the plant side control device 103 plays the role of a master that commands the start of synchronous operation, and the remaining two play the role of slaves that execute synchronous operation according to the instructions of the master.

[0033] [Table Field Configuration] FIG. 8 is a table showing the field configurations of the public key table 618, the public key sub-table 604, and the encryption parameter table 609. The public key table 618 has a record number field, a public key field, and a private key field. The record number field stores an integer starting from 1. This record number is a number that uniquely identifies a record in the public key table 618, and is also called a label. The public key field stores a public key for encrypting a desired value in a public key cryptosystem. The private key field stores a private key that pairs with the public key in the public key field for decrypting a desired value encrypted in public key cryptography.

[0034] The public key sub-table 604 has a record number field and a public key field. That is, public key sub-table 604 is a subset of public key table 618 with the private key field removed from public key table 618 .

[0035] The encryption parameter table 609 has a record number field, an encrypted first parameter field, an encrypted second parameter field, and an encrypted third parameter field. In the encrypted first parameter field, an encrypted first parameter Enc(Kp) obtained by encrypting a first parameter Kp which is a gain of the control system is stored. In the encrypted second parameter field, an encrypted second parameter Enc(Ki) obtained by encrypting a second parameter Ki, which is a gain of the control system, is stored. In the encrypted third parameter field, an encrypted third parameter Enc(Kd) obtained by encrypting a third parameter Kd which is a gain of the control system is stored. The first parameter Kp, the second parameter Ki, and the third parameter Kd are invariant values ​​in the control system, and are determined by a predetermined calculation when the control system is designed. Although the above first parameter Kp, second parameter Ki, and third parameter Kd are assumed to be PID control, the control system is not limited to PID control. Encryption parameter table 609 is provided with fields for encryption parameters according to the number of parameters required by the control system.

[0036] The encrypted first parameter field in a record whose record number field in the encryption parameter table 609 is "1" stores the encrypted first parameter Enc(Kp) obtained by encrypting the first parameter Kp using the public key stored in the public key field in the record whose record number field in the public key table 618 is "1". Similarly, the encrypted second parameter field in the record whose record number field in the encryption parameter table 609 is "1" stores the encrypted second parameter Enc(Ki) obtained by encrypting the second parameter Ki using the public key stored in the public key field in the record whose record number field in the public key table 618 is "1". Similarly, the encrypted third parameter field in the record whose record number field in the encryption parameter table 609 is "1" stores the encrypted third parameter Enc(Kd) obtained by encrypting the third parameter Kd using the public key stored in the public key field in the record whose record number field in the public key table 618 is "1".

[0037] The encrypted first parameter field in the record having the record number field set to “2” in the encryption parameter table 609 stores the encrypted first parameter Enc(Kp) obtained by encrypting the first parameter Kp using the public key stored in the public key field in the record having the record number field set to “2” in the public key table 618. Similarly, the encryption parameters of each record in the encryption parameter table 609 are encrypted with a public key stored in the public key field of the public key table 618 linked to the record number field of each record.

[0038] [Table record selection processing unit 605] FIG. 9A is a block diagram illustrating the software function of table record selection processing unit 605 of input device 102. As shown in FIG. The current date and time information output by the date and time information generation unit 606 is input to the step number calculation unit 902 together with the start date and time information 901 stored at the start of the synchronous operation. The step number calculation unit 902 subtracts the start date and time information 901 from the current date and time information and divides it by the step time to calculate the number of steps. For example, if the step time is 10 msec, the current date and time information is 2017-11-01 09:30:05.100 seconds, and the start date and time information 901 is 2017-11-01 09:30:05.000 seconds, the number of steps is 100÷10=10. The step time coincides with the control period of the controlled object 106.

[0039] In industrial equipment and the like, a control program relating to measurement and control is executed in a certain control cycle. Therefore, in the encryption control system according to the embodiment of the present invention, the start date and time of the control program is set to 0, and the number of steps is counted for each control cycle. This number of steps is used by the pseudo-random number calculation unit 903, which will be described later. In addition, as will be described in detail in FIG. 13, in the plant side control device 103, the number of steps advances by "1" between the data received and the data transmitted.

[0040] The number of steps output by the step number calculation unit 902 is input to the pseudorandom number calculation unit 903. The pseudorandom number calculation unit 903 is given an initial value 904, and generates a pseudorandom number that is an integer or a natural number greater than or equal to 0 by repeating a deterministic calculation process the number of steps input. The generated pseudorandom number is subjected to a remainder operation with the number of records in the public key subtable 604, and this remainder becomes a label, i.e., a record number. The pseudorandom number calculation unit 903 reads the public key field of the public key subtable 604 using the label, and outputs the public key to the encryption processing unit 603. Note that whether the record number starts from 0 (an integer greater than or equal to 0) or 1 (a natural number) is a design matter. The input device 102, the controller 104, and the table record selection processing unit 605 of the plant side control device 103 are equipped with pseudo-random number calculation units 903 that perform the same arithmetic processing, and are given the same initial value 904. As a result, each pseudo-random number calculation unit 903 given the same number of steps outputs the same label.

[0041] FIG. 9B is a block diagram illustrating the software functionality of the table record selection processor 610 of the controller 104. As shown in FIG. The data frame D905 received from the plant-side control device 103 includes a start date and time field and an encoding date and time field in addition to the encrypted target error Enc(ε). The encoding date and time information included in the encoding date and time field and start date and time information 901 included in the start date and time field are input to a step number calculation unit 902. The step number calculation unit 902 subtracts the start date and time information 901 from the encoding date and time information and divides it by the step time to calculate the number of steps. That is, the processing of the step number calculation unit 902 in the controller 104 is exactly the same as the calculation processing of the step number calculation unit 902 in the input device 102, except for the data that is input.

[0042] The number of steps output by the step number calculation unit 902 is input to the pseudorandom number calculation unit 903. The pseudorandom number calculation unit 903 is given an initial value 904, and generates a pseudorandom number that is an integer or a natural number equal to or greater than 0 by repeating a deterministic calculation process the number of steps input. The generated pseudorandom number is subjected to a modulus operation with the number of records in the encryption parameter table 609, and this remainder becomes a label, i.e., a record number. The pseudorandom number calculation unit 903 reads the encrypted first parameter field, the encrypted second parameter field, and the encrypted third parameter field in the encryption parameter table 609 using the label, and outputs the encrypted first parameter, the encrypted second parameter, and the encrypted third parameter to the multiplication unit 608.

[0043] FIG. 9C is a block diagram for explaining the software function of the table record selection processing unit 613 for the encrypted target value in the plant side control device 103. As shown in FIG. The data frame D906 received from the input device 102 via the controller 104 contains an encoding date and time field in addition to the encryption target value Enc(r). The encoded date and time information included in the encoded date and time field is input to a step number calculation unit 902 together with start date and time information 901 stored at the start of synchronous operation. The step number calculation unit 902 subtracts the start date and time information 901 from the encoded date and time information and divides it by the step time to calculate the number of steps. That is, the processing of the step number calculation unit 902 of the plant side control device 103 for the encrypted target value is exactly the same as the calculation processing of the step number calculation unit 902 of the input device 102, except for the input data.

[0044] The number of steps output by the step number calculation unit 902 is input to the pseudorandom number calculation unit 903. The pseudorandom number calculation unit 903 is given an initial value 904, and generates a pseudorandom number that is an integer or a natural number equal to or greater than 0 by repeating a deterministic calculation process the number of steps input. The generated pseudorandom number is subjected to a modulus operation with the number of records in the public key table 618, and this remainder becomes a label, i.e., a record number. The pseudorandom number calculation unit 903 reads the private key field of the public key table 618 using the label, and outputs the private key to the decryption processing unit 612.

[0045] FIG. 10 is a block diagram for explaining the software function of the table record selection processing unit 613 for encrypted control input in the plant side control device 103. As shown in FIG. The data frame D1007 received from the controller 104 contains a start date and time field and an encoding date and time field in addition to the encrypted control input Enc(u). The encoding date and time information included in the encoding date and time field and start date and time information 901 included in the start date and time field are input to a step number calculation unit 902. The step number calculation unit 902 subtracts the start date and time information 901 from the encoding date and time information and divides it by the step time to calculate the number of steps. Here, the step number calculation unit 902 shown in FIG. 10 differs from the step number calculation unit 902 in FIGS. 9A, 9B, and 9C in that it not only subtracts start date and time information 901 from the encoding date and time information, divides it by the step time, and outputs the step number to the pseudo-random number calculation unit 903, but also outputs the step number +1.

[0046] The number of steps and the value of step number+1 output by step number calculation unit 902 are input to pseudorandom number calculation unit 903. Pseudorandom number calculation unit 903 is given an initial value 904, and generates a pseudorandom number that is an integer or natural number equal to or greater than 0 by repeating a deterministic calculation process the number of steps input. The generated pseudorandom number is subjected to a modulus operation with the number of records in public key table 618, and this remainder becomes a label, i.e., a record number. The pseudo-random number calculation unit 903 reads the private key field of the public key table 618 using the label corresponding to the number of steps, and outputs the private key to the decryption processing unit 612 . Next, the pseudo-random number calculation unit 903 reads the public key field of the public key table 618 using the label corresponding to the value of the step number+1, and outputs the public key to the encryption processing unit 603 .

[0047] The pseudo-random number calculation units 903 provided in the table record selection processing unit 605 of the input device 102 shown in Fig. 9A, the table record selection processing unit 610 of the controller 104 shown in Fig. 9B, and the table record selection processing unit 613 of the plant side control device 103 shown in Fig. 9C and Fig. 10 all incorporate the same deterministic calculation process. Therefore, when the same initial value 904 is given, they all output the same label if the number of steps is the same.

[0048] [Synchronized operation start process] Fig. 11 is a flowchart showing the flow of synchronous operation start processing in the date and time information generating unit 611 of the controller 104. In Fig. 11, the explanation will be given on the assumption that the date and time information generating unit 611 of the controller 104 is the master, but the same applies if the input device 102 or the plant side control device 103 is the master. When the process starts (S1101), the date and time information generating unit 611 of the controller 104 checks whether its own date and time information has been calibrated with a sufficiently small error with respect to the date and time information output by the date and time information source device 105 (S1102).

[0049] If the date and time information of the date and time information generation unit 611 of the controller 104 itself has been calibrated with a sufficiently small error from the date and time information output by the date and time information source device 105 (YES in S1102), the date and time information generation unit 611 of the controller 104 then inquires of the date and time information generation unit 606 of the input device 102 whether the date and time information generation unit 606 of the input device 102 has been calibrated with a sufficiently small error from the date and time information output by the date and time information source device 105 (S1103).

[0050] If the date and time information of the date and time information generation unit 606 of the input device 102 has been calibrated with a sufficiently small error from the date and time information output by the date and time information source device 105 (YES in S1103), then the date and time information generation unit 611 of the controller 104 inquires of the date and time information generation unit 619 of the plant side control device 103 whether the date and time information generation unit 619 of the plant side control device 103 has been calibrated with a sufficiently small error from the date and time information output by the date and time information source device 105 (S1104). If the calibration of the date and time information has not been completed normally in any of the condition branches of steps S1102, S1103, and S1104 (NO in S1102, NO in S1103, NO in S1104), the process returns to step S1102 and the confirmation process is repeated.

[0051] In step S1104, if the date and time information of the date and time information generating unit 619 of the plant side control device 103 is calibrated with a sufficiently small error with the date and time information output by the date and time information source device 105 (YES in S1104), all of the date and time information generating units 606 of the input device 102, the controller 104, and the plant side control device 103 are calibrated at this point. Then, as a preparation stage for synchronous operation, the date and time information generating unit 611 of the controller 104 determines parameters such as the time to start synchronous operation, the step time, and the initial value 904 to be given to the pseudorandom number calculating unit 903 of the input device 102 and the pseudorandom number calculating unit 903 of the plant side control device 103 in cooperation with the pseudorandom number calculating unit 903 of the table record selecting processing unit 610, and transmits them to the date and time information generating units 619 of the input device 102 and the plant side control device 103 (S1105).

[0052] When preparation for synchronous operation is complete in step S1105, the date and time information generation unit 611 of the controller 104 waits until the set synchronous operation start time arrives (NO in S1106), and when the synchronous operation start time arrives (YES in S1106), it starts synchronous operation (S1107) and ends the series of processes (S1108).

[0053] [Pseudo-random number calculation process of the pseudo-random number calculation unit 903] The pseudorandom numbers used by the pseudorandom number calculation unit 903 must be designed so that a malicious third party cannot easily find patterns in them. An example of a pseudorandom number generation function that applies the addition theorem of elliptic curve functions, which are often used in cryptography, is shown below. FIG. 12 is a flowchart showing the flow of the operation of the pseudo-random number calculation unit 903 of the controller 104. When the process starts (S1201), first, the pseudorandom number calculation unit 903 determines the coefficients a and b of the elliptic curve function y2=x3+ax+b (S1202).

[0054] Next, the pseudorandom number calculation unit 903 determines a point P on the elliptic curve determined in step S1202 (S1203). It is an essential condition for this point P that the y coordinate is not 0. The above coefficients a, b and point P, and the number p of records in the public key sub-table 604, the encryption parameter table 609 and the public key table 618 are initial values ​​904 to be provided to the pseudorandom number calculation unit 903 of the input device 102 and the pseudorandom number calculation unit 903 of the plant side control device 103. Next, the pseudo-random number calculation unit 903 cooperates with the date and time information generation unit 611 to transmit the time to start synchronous operation, the step time, and the initial values ​​904, which are the coefficients a, b, and point P, to the date and time information generation unit 606 of the input device 102 and the date and time information generation unit 619 of the plant side control device 103 (S1204). The above steps S1202, S1203 and S1204 correspond to step S1105 in FIG.

[0055] Next, the pseudorandom number calculation unit 903 initializes the number of steps t to 0, and substitutes the coordinate information of point P for point Q (S1205). Then, under the control of the date and time information generation unit 611, the process waits for the synchronous operation start time (S1206). This step S1206 corresponds to step S1106 in FIG. When the synchronous operation start time arrives (YES in S1206), the date and time information generation unit 611 provides a start trigger to the pseudo-random number calculation unit 903. In response to this, the pseudo-random number calculation unit 903 continues the subsequent processing.

[0056] First, the pseudorandom number calculation unit 903 finds the coordinates of a third point R on the elliptic curve that intersects with the line connecting point P and point Q (S1207). If point P and point Q have the same coordinates, the intersection with the tangent on the elliptic curve is set as point R'. Next, the pseudorandom number calculation unit 903 converts the value of the x-coordinate of the point R' into an integer. The x-coordinate of the point R' is a rational number, but for example, the numden() function implemented in MATLAB (registered trademark) converts the rational number into a fraction and outputs its denominator and numerator. It is possible to convert the value of the x-coordinate of the point R into an integer by converting a rational number into a fraction and extracting its denominator, as with this numden() function. Then, the remainder of the number of records p is obtained from the obtained integer, which is a pseudorandom number (S1208). This remainder becomes a label, that is, a record number that indicates a record in the public key sub-table 604, the encryption parameter table 609, and the public key table 618. Next, the pseudo-random number calculation unit 903 increments the step number t by 1 (S1209). Then, the value obtained by inverting the sign of the y-axis value of point R' is set to R, which is the mapping of point R'. The coordinate information of this point R is substituted for point Q (S1210). Then, a series of processes are repeated from step S1207.

[0057] 12 shows the flow of operation of the pseudorandom number calculation unit 903 of the master controller 104, but the pseudorandom number calculation unit 903 of the input device 102 and the pseudorandom number calculation unit 903 of the plant side control device 103, which are slaves, execute operation from step S1205 onwards when they receive the initial value 904 from the date and time information generation unit 611 of the controller 104 at step S1204. That is, the operation of the pseudorandom number calculation unit 903 from step S1205 onwards is the same in both the master and the slave.

[0058] [Synchronized operation processing] Fig. 13 is a time chart explaining the synchronous operation of the encryption control system 101. In Fig. 13, the step time is 10 msec, and the number of steps is t. The start of the synchronous operation is set to t=0, and after t=0, t is incremented by 1. At the start of synchronous operation (t=0), the input device 102 encrypts the target value r with a public key corresponding to the label at t=0 to obtain an encrypted target value Enc(r). Then, the encrypted target value Enc(r) is transmitted to the plant-side control device 103 via the controller 104 (S1301). The data frame D1321 of the encrypted target value Enc(r) contains the current date and time information at t=0 generated by the date and time information generating unit 606.

[0059] At the start of synchronous operation (t=0), the controller 104 reads out the encrypted first parameter, the encrypted second parameter, and the encrypted third parameter corresponding to the label at t=0 from the encrypted parameter table 609, and performs multiplication processing with the control input u as the initial value 904 in the multiplication unit 608 to obtain the encrypted control input Enc(u). Then, the encrypted control input Enc(u) is transmitted to the plant-side control device 103 (S1302). The data frame D1322 of the encrypted control input Enc(u) contains the start date and time information 901 at the start of synchronous operation and the current date and time information at t=0. At this point, the start date and time information 901 and the current date and time information are the same.

[0060] At the start of synchronous operation (t=0), the plant side control device 103 receives the encrypted target value Enc(r) from the input device 102 via the controller 104, and receives the encrypted control input Enc(u) from the controller 104 (S1303). Next, the decryption processing unit 612 of the plant side control device 103 calculates a label based on the current date and time information and start date and time information 901 attached to each data frame, and decodes the target value r and the control input u using the encryption key corresponding to the calculated label. The control calculation processing unit 614 performs calculation processing on the values ​​that are the basis of the target value r and the control input u decoded by the decryption processing unit 612, and generates the target value r and the control input u. The homomorphic public key cryptography used in the embodiment of the present invention can multiply (divide) encrypted data together, but cannot add (subtract) them. Therefore, the multiplication unit 608 of the controller 104 performs only multiplication processing in the control calculation processing on the given data. Then, the control calculation processing is completed by the control calculation processing unit 614 performing addition processing that cannot be performed in the encrypted state. The control processing unit 615 generates a control signal from the control input u and controls the controlled object 106. When the controlled object 106 is controlled by the control processing unit 615, the operation of the controlled object 106 is detected by the sensor 107.

[0061] The observation signal output by the sensor 107 is converted into an observation value y by a signal conversion processing unit 616. The observation value y output by the signal conversion processing unit 616 is input to a target error calculation processing unit 617 together with a target value r output by a control calculation processing unit 614. The target error calculation processing unit 617 subtracts the observation value y from the target value r and outputs a target error ε (S1304). The encryption processing unit 603 encrypts the target error ε with a public key corresponding to a label corresponding to the step number of t+1 (S1305). Since t=0 at this point, the public key corresponding to t+1=1, that is, the label corresponding to the step number of 1, is used to encrypt the target error ε.

[0062] When the number of steps increments by one from the start of synchronous operation and reaches t=1, the plant-side control device 103 transmits the encrypted target error Enc(ε) to the controller 104 through the transmission unit 208 of the second control network module 115 (S1306). The data frame D1323 of the encrypted target error Enc(ε) includes the start date and time information 901 at the start of synchronous operation and the current date and time information at t=1.

[0063] At the time t=1, the controller 104 receives the encrypted target error Enc(ε) from the plant side control device 103 (S1307). The encrypted target error Enc(ε) received from the receiver 309 of the second control network module 115 of the controller 104 is passed to the multiplier 608 via the input / output controller 607. The multiplier 608 passes the start date and time information 901 and the current date and time information at t=1 attached to the data frame of the encrypted target error Enc(ε) to the table record selection processor 610. The table record selection processor 610 reads the encrypted first parameter, the encrypted second parameter, and the encrypted third parameter corresponding to the label at t=1, and passes them to the multiplier 608. The multiplier 608 multiplies the encrypted first parameter, the encrypted second parameter, and the encrypted third parameter by the encrypted target error Enc(ε) to obtain the encrypted control input Enc(u) (S1308). Then, the encrypted control input Enc(u) is transmitted to the plant-side control device 103 (S1309). The data frame D1324 of the encrypted control input Enc(u) includes start date and time information 901 at the start of synchronous operation and current date and time information at t=1.

[0064] At the time t=1, the input device 102 encrypts the target value r with a public key corresponding to the label at t=1 to obtain an encrypted target value Enc(r). Then, the encrypted target value Enc(r) is transmitted to the plant side control device 103 via the controller 104 (S1310). The data frame D1325 of the encrypted target value Enc(r) includes the current date and time information at t=1.

[0065] At time t=1, the plant side control device 103 receives the encrypted target value Enc(r) from the input device 102 via the controller 104, and receives the encrypted control input Enc(u) from the controller 104 (S1311). Next, the decryption processing unit 612 of the plant side control device 103 calculates a label based on the current date and time information and start date and time information 901 attached to each data frame, and decodes the target value r and the control input u using the encryption key corresponding to the calculated label. The control calculation processing unit 614 performs calculation processing on the values ​​that are the basis of the target value r and the control input u decoded by the decryption processing unit 612, and generates the target value r and the control input u. The control processing unit 615 generates a control signal from the control input u and controls the controlled object 106. When the controlled object 106 is controlled by the control processing unit 615, the operation of the controlled object 106 is detected by the sensor 107.

[0066] The observation signal output by the sensor 107 is converted into an observation value y by a signal conversion processing unit 616. The observation value y output by the signal conversion processing unit 616 is input to a target error calculation processing unit 617 together with a target value r output by a control calculation processing unit 614. The target error calculation processing unit 617 subtracts the observation value y from the target value r and outputs a target error ε (S1312). The encryption processing unit 603 encrypts the target error ε with a public key corresponding to a label corresponding to the step number of t+1 (S1313). Since t=1 at this point in time, the public key corresponding to t+1=2, that is, the label corresponding to the step number 2, is used to encrypt the target error ε.

[0067] Similarly, when the plant-side control device 103 receives the encrypted target value Enc(r) at step number t from the input device 102 and the encrypted control input Enc(u) at step number t from the controller 104, it controls the controlled object 106 based on the target value r and the control input u. As a result, it obtains the target error ε by subtracting the observation value y obtained from the sensor 107 from the target value r. The encryption processing unit 603 encrypts the target error ε with the public key at step number t+1, and outputs the encrypted target error Enc(ε) to the controller 104. That is, in the cycle of data reception, calculation, and data transmission of the plant side control device 103, the number of steps is incremented by one.

[0068] In response to this, the controller 104 multiplies the encrypted target error Enc(ε) by the current date and time information attached to the data frame of the encrypted target error Enc(ε) received from the plant-side control device 103, and the encrypted first parameter, the encrypted second parameter, and the encrypted third parameter for the step number t obtained from the start date and time information 901, to obtain the encrypted control input Enc(u) and transmits it to the plant-side control device 103. That is, in the cycle of data reception, calculation, and data transmission by the controller 104, the number of steps remains unchanged.

[0069] [Numerical Simulation] For theoretical verification of the encryption control system 101 according to the embodiment described above, a numerical simulation was carried out on a computer. FIG. 14A is a graph of the control input u and the target error ε in the encryption control system 101 according to Patent Document 1. FIG. 14B is a graph of the control input u and the target error ε in the encryption control system 101 according to the embodiment of the present invention. Both the graphs in FIG. 14A and FIG. 14B show the results of a simulation assuming that a step time is 10 msec and a tampering attack is performed on the encrypted target error Enc(ε) at a time of 10 sec.

[0070] In Fig. 14A, since only one set of public key and private key is used, the effect of the tampering attack does not appear in the target error ε. However, in Fig. 14B, since a mechanism is adopted in which the set of public key and private key used is randomly switched for each step number, the target error ε changes discontinuously due to the tampering attack, clearly different from before the tampering attack.

[0071] In a control system, it is desirable that the controlled object 106 is in a stable state. For this reason, it is highly unlikely that the target error ε will fluctuate significantly. Therefore, the fluctuation range of the target error ε is generally small and continuous. If a signal that has a small fluctuation range and is continuous under normal conditions suddenly becomes fluctuating in a large range and shows a discontinuous change, it can be clearly recognized that some kind of abnormality has occurred.

[0072] For example, by squaring the fluctuation range of the target error ε and comparing it with a predetermined threshold, if the threshold is exceeded, it can be determined that there has been an attack on the encryption control system 101. This determination calculation is referred to as an attack detector. FIG. 15A is a graph of an attack detector in the encryption control system 101 according to Patent Document 1. FIG. 15B is a graph of an attack detector in the encryption control system 101 according to an embodiment of the present invention.

[0073] In Fig. 15A, only one set of public key and private key is used, so the attack detector cannot detect the tampering attack. However, in Fig. 15B, a mechanism is adopted in which the set of public key and private key used is randomly switched for each step number, so the attack detector can clearly recognize that the target error ε has been tampered with by a tampering attack.

[0074] The embodiment described above may be modified as follows. (1) In the above embodiment, the pseudo-random number calculation unit 903 is configured to operate when a calculation request occurs, but the results of calculations may be stored in advance in the label table. The label table has a step number field and a label field. The step number field stores the number of steps. The label field stores a label calculated by the pseudo-random number calculation unit 903 and corresponding to the number of steps. By storing several thousand or tens of thousands of records in such a label table, the computation resources of the CPU module 112 can be concentrated on the main control computations.

[0075] (2) In the above embodiment, the public key and private key pair is switched every control cycle, but it may be switched every several control cycles. However, if the switching cycle is too long, there is a risk that the vulnerability to malicious third parties will increase. (3) The function of the date and time information source device 105 may be shared by any one of the input device 102, the plant side control device 103, and the controller 104. For example, by equipping the input device 102 with a GPS (global positioning system) receiver, it becomes possible to obtain accurate date and time information.

[0076] (4) The input device 102 and the controller 104 can be integrated. FIG. 16 is a block diagram showing software functions in a control network of a controller 1601 according to a modified embodiment of the present invention. A controller 1601 shown in FIG. 16 is configured by integrating the input device 102 and the controller 104 shown in FIG. First, the table record selection processor 1602 has the functions of the table record selection processor 605 of the input device 102 and the table record selection processor 610 of the controller 104. That is, the table record selection processor 1602 has the function of selecting a predetermined record from the public key sub-table 604 for the encryption processor 603, and also selecting a predetermined record from the encryption parameter table 609.

[0077] Next, the input / output control unit 1603 has the functions of the input / output control unit 602 of the input device 102 and the input / output control unit 607 of the controller 104 . Then, the date and time information generating unit 606 of the input device 102 is omitted. That is, the date and time information generating unit 611 has a function of providing date and time information to be added to the encrypted control input output from the multiplication unit 603, and also provides date and time information to the table record selection processing unit 1602 and gives it a start timing.

[0078] As described above, in the encryption control system 101, even if the input device 102 and the controller 104 are replaced with the controller 1601 that integrates the input device 102 and the controller 104, the same functions can be realized. 6 has a public key sub-table 604. When implementing controller 1601 in which input device 102 and controller 104 are integrated, if encryption processing unit 603 is configured to encrypt not only target value r but also first parameter Kp, second parameter Ki, and third parameter Kd together, the amount of calculation of encryption processing unit 603 will increase, but encryption parameter table 609 can be omitted.

[0079] In this embodiment, the encryption control system 101 is disclosed. The input device 102, the plant control device 103, and the controller 104 are equipped with a pseudorandom number calculation unit 903 having a common function to perform time synchronization. Then, they start synchronous operation at the same time. By configuring the encryption control system 101 in this way, it becomes possible to switch the public key and private key pair in synchronization with the control period of the entire control system. Therefore, it becomes possible to instantly and clearly detect any intervention by a malicious third party in the control system.

[0080] Although an embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and includes other modifications and applications without departing from the gist of the present invention described in the claims. [Explanation of symbols]

[0081] 101...Encryption control system, 102...Input device, 103...Plant side control device, 104...Controller, 105...Date and time information source device, 106...Control object, 107...Sensor, 111...Mount base, 112...CPU module, 113...Information network module, 114a, 114b...First control network module, 115...Second control network module, 116...Input / output module, 201...Module bus, 202...CPU, 203...ROM, 204...RAM, 205...RTC, 206...Internal bus, 207...NIC, 208...Transmitter, 309...Receiver, 410...A / D converter, 411...D / A converter, 501...CPU, 502...ROM, 503...RAM, 504...Non-volatile storage, 505...RTC, 506...NIC, 507...Bus, 508...Display unit, 5 09...operation unit, 601...target value input unit, 602...input / output control unit, 603...encryption processing unit, 604...public key sub-table, 605...table record selection processing unit, 606...date and time information generation unit, 607...input / output control unit, 608...multiplication unit, 609...encryption parameter table, 610...table record selection processing unit, 611...date and time information generation unit, 612...decryption processing unit, 613...table record selection processing unit, 614...control calculation processing unit, 615...control processing unit, 616...signal conversion processing unit, 617...target error calculation processing unit, 618...public key table, 619...date and time information generation unit, 620...log table, 901...start date and time information, 902...step number calculation unit, 903...pseudo-random number calculation unit, 904...initial value, 1601...controller, 1602...table record selection processing unit, 1603...input / output control unit

Claims

1. a controller and a plant-side control device, The controller: a first encryption processing unit that encrypts a target value with a public key and outputs the encrypted target value; a first table record selection processing unit for selecting a predetermined record from a public key sub-table in which a plurality of public keys are stored, and selecting a predetermined record from an encryption parameter table including records in which encryption parameters obtained by encrypting parameters of a control system using a public key from the public key sub-table are recorded, for the first encryption processing unit; a multiplication unit that receives an encrypted target error from the plant-side control device, multiplies the encrypted target error by the encrypted parameter selected by the first table record selection processing unit, and outputs an encrypted control input; providing date and time information to be added to the encrypted control input output from the multiplication unit; a first date and time information generating unit that provides date and time information to the first table record selection processing unit and also provides a start timing; Equipped with The plant side control device includes: a decryption processing unit that decrypts the encrypted target value received from the controller to obtain a target value, and that decrypts the encrypted control input received from the controller to obtain a control input; A control processing unit that controls a predetermined control target based on the control input; a signal conversion processing unit that acquires an observation value from a sensor that observes the controlled object; a target error calculation processing unit that calculates a target error by subtracting the observed value from the target value; a second encryption processing unit that encrypts the target error and outputs an encrypted target error; a second table record selection unit that selects a predetermined record from a public key table in which a plurality of public keys and private keys that are pairs of the public keys are stored for the decryption unit, and selects a predetermined record from the public key table for the second encryption unit; a second date and time information generating unit that provides date and time information to be added to the encrypted target error output from the second encryption processing unit and that provides a start timing to the second table record selection processing unit; Equipped with The first date and time information generating unit and the second date and time information generating unit generate start timings simultaneously with each other. Encryption control system.

2. An encryption control system having an input device, a controller, and a plant-side control device, The input device is a first encryption processing unit that encrypts a target value with a public key and outputs the encrypted target value; a first table record selection unit that selects a predetermined record from a public key sub-table in which a plurality of public keys are stored, for the first encryption unit; a first date and time information generating unit that provides date and time information to the first table record selection processing unit and also provides a start timing; Equipped with The controller: a second table record selection processing unit that selects a predetermined record from an encryption parameter table including records in which encryption parameters obtained by encrypting a parameter of a control system using a public key of the public key sub-table are recorded; a multiplication unit that receives an encrypted target error from the plant-side control device, multiplies the encrypted target error by the encrypted parameter selected by the second table record selection processing unit, and outputs an encrypted control input; providing date and time information to be added to the encrypted control input output from the multiplication unit; a second date and time information generating unit that gives a start timing to the second table record selection processing unit; Equipped with The plant side control device includes: a decryption processing unit that decrypts the encrypted target value received from the input device to obtain a target value, and that decrypts the encrypted control input received from the controller to obtain a control input; A control processing unit that controls a predetermined control target based on the control input; a signal conversion processing unit that acquires an observation value from a sensor that observes the controlled object; a target error calculation processing unit that calculates a target error by subtracting the observed value from the target value; a second encryption processing unit that encrypts the target error and outputs an encrypted target error; a third table record selection unit that selects a predetermined record from a public key table in which a plurality of public keys and private keys that are pairs with the public keys are stored for the decryption unit, and selects a predetermined record from the public key table for the second encryption unit; a third date and time information generating unit that provides date and time information to be added to the encrypted target error output from the second encryption processing unit and that provides a start timing to the third table record selection processing unit; Equipped with The first date and time information generating unit, the second date and time information generating unit, and the third date and time information generating unit generate start timings simultaneously with each other. Encryption control system.

3. the first table record selection processor, the second table record selection processor, and the third table record selection processor are each provided with an identical initial value, perform an identical arithmetic process at a predetermined period, and each include a pseudorandom number calculation unit that outputs integers corresponding to record numbers of the public key sub-table, the encryption parameter table, and the public key table. The encryption control system according to claim 2 .

Images