Update content verification system and update content verification method

Abstract

To provide a system and a method for verifying detail of update to be executed on a control system.SOLUTION: An update detail verification system 100 includes an update information input unit, a verification information storage unit, an update and verification detail setting unit, an update and verification execution time estimation unit, and an execution feasibility determination unit. The update information input unit receives update information of a control system. An update information analysis unit analyzes the update information. The verification information storage unit stores verification information related to verification to be performed on detail of update. The update and verification detail setting unit sets detail of update to be executed on the control system and detail of verification to be executed on the update, among the analysis result and the verification information. The update and verification execution time estimation unit estimates an execution time required for executing the update and the verification. The execution feasibility determination unit compares the estimated execution time with a predetermined limited time, and determines whether or not the execution of update and verification can be completed within the limited time.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a system and method for verifying the contents of updates implemented in a control system, and in particular to a technique for verifying security or safety. [Background technology]

[0002] Currently, with the progress of DX (Digital Transformation), systems in which various control objects, including humans (manned aircraft), coexist and perform various controls in cooperation with each other are becoming widespread in businesses such as manufacturing and logistics. In such control systems, attention is being paid to changing and updating the control rules and system structure based on the situation on-site and management decisions, and improving the value of the system, such as productivity and efficiency.

[0003] However, if there are any defects in the changes or updates made to the above systems, safety, one of the important requirements for a control system, may be compromised. In addition, the above defects may expose the control system to the threat of cyber attacks such as unauthorized access. Therefore, it is necessary to verify the security and safety of system changes and updates and ensure safety.

[0004] In Patent Document 1, which is a technology relating to a method for verifying the security or safety of the above-mentioned system changes and updates, when a change is made to a computer system parameter, it is verified whether the contents of the update are acceptable from a security standpoint, and if they are not acceptable, the update contents are reconsidered, and if they are acceptable, the update is carried out. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-36274 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, the security verification method of Patent Document 1 only determines the content of the update from a security perspective, and there is a problem that implementing the determined update content may not complete even after factory downtime, causing disruption to operations.

[0007] Therefore, the present invention aims to determine the content of security or safety verification for a system update by inputting a time limit allowed for implementing the update and verification, and to determine the content of the system update that can be implemented within this time limit and the content of the verification to be performed on the update content to ensure security or safety. [Means for solving the problem]

[0008] In order to solve the above problems, the present invention is an update content verification system that verifies the content of an update to be performed on a control system, and includes an update information input unit to which update information for the control system is input, an update information analysis unit that analyzes the update information, a verification information storage unit in which verification information related to verification performed on the update content is stored, an update and verification content setting unit that sets the content of the update to be performed on the control system and the content of the verification to be performed on the update from the results of the analysis and the verification information, an implementation time estimation unit that estimates the implementation time required to perform the update and verification, and an implementation feasibility determination unit that compares the estimated implementation time with a predetermined time limit and determines whether the update and verification can be completed within the time limit.

[0009] The present invention also includes a method for determining the contents of security or safety verification, a computer program for causing a computer to execute the method for determining the contents of security or safety verification, and a storage medium storing the computer program. Effect of the Invention

[0010] According to the present invention, it is possible to determine the contents of system updates that can be implemented within a time limit for a control system and the contents of security or safety verification. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, the problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0011] [Figure 1] FIG. 2 is a functional block diagram showing an example of a functional configuration of the update content verification system according to the first embodiment. [Diagram 2] FIG. 1 is a system configuration diagram of an update content verification system according to first to third embodiments. [Diagram 3] FIG. 2 is a diagram showing an example of a control system used in the first to third embodiments. [Figure 4] FIG. 11 is a diagram showing an example of verification levels used in the first to third embodiments. [Diagram 5] FIG. 4 is a diagram showing an example of a flowchart of an update content verification method according to the first embodiment. [Figure 6] FIG. 11 is a functional block diagram showing an example of a functional configuration of an update content verification system according to a second embodiment. [Figure 7] FIG. 11 is a diagram showing an example of a flowchart of an update content verification method according to the second embodiment. [Figure 8] FIG. 11 is a functional block diagram showing an example of a functional configuration of an update content verification system according to a third embodiment. [Figure 9] FIG. 11 is a diagram showing an example of a flowchart of an update content verification method according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Each embodiment of the present invention will be described below with reference to the drawings. In each embodiment, update contents and security or safety verification contents of a control system to which components such as those shown in FIG. 3 are respectively connected are generated. Note that components include a robot management device A31, and the specific system configuration will be described later. Note that, hereinafter, "update contents of the control system" will be simply referred to as "update contents," and "security or safety verification contents" will be simply referred to as "verification contents."

[0013] [Example 1] A first embodiment of the present invention will be described below with reference to the drawings. 1 is a functional block diagram showing the functional configuration of an update content verification system 100 according to this embodiment. Each block (function) will be described below.

[0014] The update content verification system 100 includes an update content verification device 20 and a storage device 24 connected to the update content verification device 20 and storing a verification level storage unit 108. The update content verification device 20 includes a system update information input unit 101, an update information analysis unit 102, an update and verification content setting unit 103, an update and verification implementation time estimation unit 104, a time limit input unit 105, an implementation feasibility determination unit 106, and an update and verification content output unit 107. The storage device 24 is also connected to the update and verification content setting unit 103 so that they can communicate with each other.

[0015] The system update information input unit 101 receives update information for the control system. The update information analysis unit 102 analyzes the information received by the system update information input unit 101 and divides the update information into a plurality of stepwise update processes. The update and verification content setting unit 103 sets one of the stepwise update processes received by the update information analysis unit 102 as the update content, and sets the verification content for the update content based on the information in the verification level storage unit 108. The update and verification implementation time estimation unit 104 estimates the time required to implement the update and verification content set by the update and verification content setting unit 103. Here, the time required to implement the update and verification content refers to the time required from the start to the end of the actual execution of the update and / or verification. The start / end may be determined automatically or manually. The implementation feasibility determination unit 106 determines whether the time estimated by the update and verification implementation time estimation unit 104 will end within the time limit allowed for the implementation of the update and verification input by the time limit input unit 105.

[0016] The update and verification content output unit 107 outputs and displays the update and verification content that is determined by the implementation feasibility determination unit 106 to be completed within the time limit. Each storage unit and calculation unit may be a CPU or a PC itself. If the implementation feasibility determination unit 106 determines that the update and verification will not be completed within the time limit, the update and verification content setting unit 103 sets different update and verification content again.

[0017] Fig. 2 shows a system configuration in which the functional configuration of update content verification device 20 shown in Fig. 1 is realized on a computer. Update content verification device 20 is made up of a processing unit 21 such as a CPU, a memory 22, and an input / output I / F 23, which are connected to each other via a bus or the like.

[0018] Here, the processing unit 21 has an update information analysis unit 102, an update and verification content setting unit 103, an update and verification implementation time estimation unit 104, an implementation feasibility determination unit 106, an update and verification content output unit 107, a required update content setting unit 601, a verification content setting unit 602, a safety level calculation and determination unit 801, and a various information output unit 803, which can be realized by programs. That is, in this embodiment, the programs are loaded into the memory 22, and these functions and calculations are executed by the processing unit 21.

[0019] The update content verification device 20 is also connected to a storage device 24 via an input / output I / F 23. The storage device 24 stores verification level information 410. That is, the storage device 24 functions as the verification level storage unit 108 in Fig. 1. The storage device 24 may also be provided inside the update content verification device 20.

[0020] The mandatory update content setting unit 601 and the verification content setting unit 602 are used in the second embodiment and may not be used in this embodiment. The safety level calculation and determination unit 801 and the various information output unit 803 are functions used in the third embodiment and may not be used in this embodiment.

[0021] Furthermore, the update content verification device 20 is connected to various terminal devices 26-1, 2 via the input / output I / F 23. The terminal devices 26-1, 2 are each realized by a computer, and have the function of receiving input from a user and displaying the processing results of the update content verification device 20.

[0022] That is, the terminal devices 26-1 and 2 function as an input unit. More specifically, they function as the system update information input unit 101 and the time limit input unit 105 in Fig. 1, and the required level input unit 802 in Fig. 8. The terminal device 26-2 is connected to the update content verification device 20 via the network 25. The terminal devices 26-1 and 2 may be integrated with the update content verification device 20.

[0023] That is, a display device and an input / output device may be provided in the update content verification device 20. When the display device and the input / output device are configured as components of the present system, the cloud 30, the robot management device A31, the robot management device B32, and the robot management device C33 are provided with the functions of the update content verification device 20.

[0024] The update content verification device 20 can also acquire external information by connecting to the Internet 27. As an example, a system to be verified may be connected via the Internet 27, and verification level information 410 may be received from the system.

[0025] Next, the update content verification method according to the present embodiment will be described using a specific example. First, the control system to be updated is shown in Fig. 3. This control system 300 is composed of a cloud 30, a robot management device A31, a robot management device B32, a robot management device C33, a robot A34, a robot B35, a robot C36, and a belt conveyor 37 as components.

[0026] Each component is connected to the other components as follows: The cloud 30 is connected to a robot management device A31, a robot management device B32, and a robot management device C33. The robot management device A31 is connected to the cloud 30, a robot management device B32, and a robot A34. The robot management device B32 is connected to the cloud 30, a robot management device A31, a robot management device C33, and a robot B35. The robot management device C33 is connected to the cloud 30, a robot management device B32, and a robot C36.

[0027] Furthermore, the update content verification device 20 may be connected to the present system, or may be realized as one of the components of the present system. When the update content verification device 20 is configured as one of the components of the present system, the cloud 30, the robot management device A31, the robot management device B32, or the robot management device C33 is provided with the functions of the update content verification device 20.

[0028] The present invention is effective not only for the control system example shown in Fig. 3 but also for control systems that allow for gradual system updates. Examples of control systems that allow for gradual system updates include a manufacturing line system as shown in Fig. 3, a sorting system in a logistics warehouse, and large-scale FA (Factory Automation) and PA (Plant Automation) systems. However, the present invention is not limited to the control systems given as examples.

[0029] 4 is a diagram showing the verification level information 410 stored in the verification level storage unit 108. The verification level information 410 has a granularity table 420 and a range table 430. In this embodiment, information related to security is described. Each table has three levels (Lv), and has the following contents, for example.

[0030] Table 420 for "Grain Size" Lv1: Verification using a simple checklist Lv2: Verification using tools Lv3: Detailed verification by experts

[0031] Table 430 in "Scope" Lv1: Only devices that are subject to change or update Lv2: Only devices subject to change / update + adjacent devices Lv3: Entire control system

[0032] The higher the level of granularity, the more detailed the verification content and the more time it takes to perform the verification. Also, the higher the level of range, the wider the verification range and the more time it takes to perform the verification. The verification content setting unit selects one level from each of the granularity table 420 and the range table 430, and uses them in the update and verification content setting unit 103. In this embodiment, the verification level is expressed by two axes, granularity and range, and an example is shown in which the verification content is determined by selecting each of them. However, the verification level may be either granularity or range. Also, the content expressing the verification level is not limited to granularity and range. Furthermore, the verification level does not have to be expressed in a table format.

[0033] In addition, the contents of granularity table 420 and range table 430 are general expressions and do not reflect the configuration of the target control system, etc., but they may be expressions that include specific device names or network names that take into account the target control system configuration, etc., as an expression of the verification level.

[0034] 5 shows an overall flow of an update content verification method according to an embodiment of the present invention. First, the system update information input from the system update information input unit 101 is analyzed (S501). Then, using the analysis result of step S501 and information in the verification level storage unit 108, the update content and verification content are set (S502).

[0035] Then, the implementation time of the set updates and verification contents is estimated (S503). Then, the time limit inputted by the time limit input unit 105 is compared with the implementation time of the updates and verification contents estimated in step S503 (S504). If the time limit in step S504 is shorter than the estimated implementation time, the process returns to step S502 and the updates and verification contents are reset. On the other hand, if the time limit in step S504 is equal to or longer than the estimated implementation time, the process proceeds to step S505. In step S505, it is determined whether further verification is required for a combination of updates and verification contents. If it is determined in step S505 that further verification is required, the process returns to step S502 and the updates and verification contents are reset. If it is determined that no further verification is required, the verification is terminated.

[0036] Each flow in FIG. 5 will be explained using the control system 300 and the verification level information 410 in FIG. 3 as an example. First, assume that "update of the robot control program and the device itself of each of the robot management device A31 and the robot management device B32" is input to the system update information input unit 101. In this embodiment, the input to the system update information input unit 101 is text, but the input method from the user may be, for example, a method of graphically inputting update information on a system configuration diagram shown on the screen of the terminal devices 26-1 and 2, or an input method in which the user selects update information candidates on the screen of the terminal devices 26-1 and 2, and is not limited to these. In step S501, the input from the system update information input unit 101 is analyzed as follows, and the update information is divided into stepwise updates.

[0037] 1. Update the robot control program of the robot management device A31. 2. Updating the robot control programs of the robot management device A31 and the robot management device B32. 3. Updating the robot control program of the robot management device A31 and the device itself. 4. Updating the robot control programs of the robot management device A31 and the robot management device B32 and the devices themselves.

[0038] In step S502 in Fig. 5, the update and verification contents are set using the above information and the verification level information 410 in Fig. 4. Here, "4. Update of the robot control programs and the devices themselves of robot management device A31 and robot management device B32," which takes the longest time to implement among the results of analysis in step S501, is set, and in the verification level information 410, Level 3, "Granularity: detailed verification by experts" and "Scope: entire control system," which are the highest levels in terms of granularity and scope, are set.

[0039] That is, in this example, the setting is "an expert performs detailed verification of the entire control system for updates to the robot control programs and the devices themselves of the robot management device A31 and the robot management device B32." For these settings, a digital model (digital twin) that reproduces the characteristics of the hardware, software, etc. of the control system in FIG. 3 in a virtual space can be used. This digital model can also be used in the following steps S503 and S504. However, the present invention is not limited to the implementation of steps S502, S503, and S504 using a digital model, and it is also possible to use information in which the characteristics of the hardware, software, etc. of the control system are described in a text table format or in a mathematical formula format.

[0040] In step S503, the time required for carrying out the operation set in step S502, "to have an expert conduct a detailed verification of the entire control system for the updates of the robot control programs and the devices themselves of the robot management device A31 and the robot management device B32," is estimated. Here, it is assumed that six hours is estimated to be required.

[0041] In the next step S504, the time limit input in time limit input unit 105 is compared with the time estimated in step S503. Here, the process will be described in the case where the input time limit is 2 hours, which is shorter than the estimated 6 hours. Since the time limit is shorter than the estimated time, the process returns to step S502 to reset the update and verification contents. For the resetting, the update and verification contents that are expected to take the next longest time to implement are set.

[0042] In the case of this embodiment, the current update is "4. Updating the robot control programs of the robot management device A31 and robot management device B32, and updating the devices themselves", and the verification level granularity and scope are both set to Level 3, "Granularity: Detailed verification by experts", and "Scope: Entire control system", so the update that is expected to take the next longest time to implement is set to "3. Updating the robot control program of the robot management device A31, and updating the devices themselves", and the verification level granularity and scope are both set to Level 3, "Granularity: Detailed verification by experts", and "Scope: Entire control system".

[0043] After the above-mentioned resetting is performed, the implementation time for update and verification is estimated in step S503 in the same manner as described above, and the estimated implementation time is compared with the time limit in step S504.

[0044] With this method, the contents of the update and the verification for the update are selected in order of the verification contents with the greatest effect on the update and the highest verification level, and the contents to be determined always include the contents with the greatest effect on the update and the highest verification level within the time limit, so that the effect of the present invention can be further enhanced. However, the present invention is not limited to this setting method, and a method of setting each content randomly is also possible.

[0045] On the other hand, the process will be described when the input time limit is 12 hours, which is longer than the estimated implementation time of 6 hours. If the time limit is longer than the estimated time, the current update and verification content are permissible. Therefore, the process proceeds to the next step, step S505. In step S505, it is determined whether verification is required for the combination of additional update and verification content.

[0046] When the user requests the output of multiple combinations of updates and verification contents, the current combination of updates and verification contents is retained, and then in step S502, a different combination from the current combination of updates and verification contents is set, and the same processing as described above is then performed.

[0047] As a specific example, if the current update is set to "1. Update of the robot control program and the device itself of the robot management device A31," and the verification level is set to Level 3, which has the highest granularity and scope, "Granularity: Detailed verification by experts," and "Scope: Entire control system," then a combination of additional updates and verification contents could be selected to be "1'. Update of the robot control program and the device itself of the robot management device B32," and the verification level is set to Level 3, which has the highest granularity and scope, "Granularity: Detailed verification by experts," and "Scope: Entire control system."

[0048] The request for additional combinations may be confirmed with the user each time step S505 is performed, or may be confirmed with the user before the entire flow starts, or may be set as the default setting for the entire flow to output a single content or multiple contents, etc. On the other hand, if it is determined in step S505 that no additional update and verification content combinations are required, the entire flow in FIG. 5 ends.

[0049] This completes the description of this embodiment. In this embodiment, a method is set in which the update contents to be implemented in the control system 300 shown in Fig. 3 are selected from a plurality of update processes including any of a plurality of control programs / devices themselves so that the update contents can be implemented within a time limit, and the update contents are verified. Therefore, according to the update content verification method of this embodiment, it is possible to determine system updates and security or safety verifications that can be implemented within a time limit.

[0050] [Example 2] Second Embodiment Hereinafter, a second embodiment of the present invention will be described with reference to the drawings. When considering updating a system, there may be some contents that must be updated in the current update. In the example of the control system 300 in Fig. 3, examples of contents that must be updated include responding to failures of devices such as the robot A34, the robot B35, the robot C36, and the belt conveyor 37, and updating the robot control programs of the robot management device A31, the robot management device B32, and the robot management device C33 due to changes in the objects to be processed in the control system. Therefore, in this embodiment, a system update method that ensures the security or safety of the control system within a limited time period by adding a function for setting required update contents to the method described in the first embodiment will be described.

[0051] In this embodiment, a block diagram shown in Fig. 6 is used in which a mandatory update content setting unit 601 is added to the functional block diagram of the update content verification device in Fig. 1 described in the first embodiment, and the update and verification content setting unit 103 is changed to a verification content setting unit 602. In Fig. 6, reference numerals 101 to 102 and 104 to 108 are the same as those in Fig. 1, and their explanations are omitted. In this embodiment, the mandatory update content setting unit 601 and the verification content setting unit 602 shown in Fig. 2 are further used.

[0052] Fig. 7 is a diagram showing the overall flow of this embodiment. Step S701 for determining mandatory update contents based on analysis information and step S702 for setting verification contents for the mandatory update contents are added to the overall flow of Fig. 5 described in the first embodiment. Steps S501 and S503 to S505 in Fig. 7 are the same as those in the first embodiment, and their explanations are omitted. In the following, an example of the operation of the overall flow using the control system 300 and verification level information 410 in Fig. 3, as in the first embodiment, will be described.

[0053] Assume that "update the robot control programs and the devices themselves of robot management device A31 and robot management device B32" is input to system update information input unit 101. In this embodiment, the input to system update information input unit 101 is text, but the input method from the user is not limited to, and may include a method of graphically inputting update information on a system configuration diagram displayed on the screen of terminal devices 26-1, 2, or an input method in which the user selects update information candidates on the screen of terminal devices 26-1, 2. In step S501, the input from system update information input unit 101 is analyzed as follows, and the update information is divided into stepwise updates.

[0054] 1. Update the robot control program of the robot management device A31 2. Updating the robot control programs of the robot management device A31 and the robot management device B32 3. Updating the robot control program of the robot management device A31 and the device itself 4. Updating the robot control programs and the devices themselves of the robot management device A31 and the robot management device B32

[0055] In step S701, it is assumed that "3. Update of the robot control program of the robot management device A31 and the device itself" is determined as the required update content from the above information. This determination may be made using machine learning or AI based on the information inputted in the system update information input unit 101, or may be specified and determined by the user from the terminal devices 26-1, 2 at the time of executing step S701. Alternatively, it may be determined by inputting only the relevant update content as the required update content when inputting to the system update information input unit 101.

[0056] Then, in step S702, since the update contents have been determined in step S701, only the verification contents are determined. For the verification contents, Level 3 "Granularity: Detailed verification by experts" and "Scope: Entire control system", which are the highest levels in both granularity and scope in the verification level information 410, are set. That is, in this example, "the robot control program of the robot management device A31 and the update of the device itself are set as mandatory update contents, and detailed verification by experts will be performed on the entire control system" is set.

[0057] For these settings, it is possible to utilize a digital model (digital twin) that reproduces the characteristics of the hardware, software, etc. of the control system in Fig. 3 in a virtual space. This digital model can also be utilized in the following steps S503 and S504. However, the present invention is not limited to the implementation of steps S502, S503, and S504 using a digital model, and it is also possible to utilize information in which the characteristics of the hardware, software, etc. of the control system are described in a text table format or in a mathematical formula format.

[0058] In step S503, the time required for "updating the robot control program of the robot management device A31 and the device itself as a mandatory step, and having a detailed verification by an expert performed on the entire control system" set in step S502 is estimated. Here, it is assumed that 4 hours is estimated to be required.

[0059] In the next step S504, the time limit input in time limit input unit 105 is compared with the time estimated in step S503. Here, the processing will be described for the case where the input time limit is 2 hours, which is shorter than the estimated time of 4 hours. If the time limit of 2 hours is shorter than the estimated time, the process returns to step S702 to reset the verification content. For the resetting, a verification content that is expected to take the next longest time to implement than the currently set verification content is set.

[0060] In the case of this embodiment, the update contents are not changed because they are required, but the verification contents are changed. Currently, the verification level granularity and scope are set to Level 3 "Granularity: Detailed verification by experts" and "Scope: Entire control system", which are the highest levels, so the verification level granularity is set to Level 3 "Detailed verification by experts" and the scope is set to Level 2 "Only devices subject to change / update + adjacent devices or programs within these devices" as the verification contents that are expected to take the next longest time to implement. After resetting as above, the implementation time for update and verification is estimated in step S503, and the estimated implementation time is compared with the time limit in step S504, as described above.

[0061] In this embodiment, the verification content for the required update content is reset by setting the content that is expected to take the next longest time to be implemented after the current content. This method enhances the effect of the present invention because the verification content is selected in order of the highest verification level, and the content that is determined always includes the content with the highest verification level within the time limit. However, the present invention is not limited to this setting method, and a method of randomly setting each content is also possible.

[0062] On the other hand, the process when the input time limit is 12 hours, which is longer than the estimated implementation time of 4 hours, will be described. When the time limit of 12 hours is longer than the estimated time of 4 hours, the current update and verification contents are permissible. Therefore, the process proceeds to the next step, step S505. In step S505, it is determined whether verification is required for the combination of additional updates and verification contents. When the user requests the output of a combination of multiple updates and verification contents, the current combination of updates and verification contents is retained, and a different combination from the current combination of updates and verification contents is set again in step S502, and the same process as described above is performed thereafter. As for the additional updates and verification contents, a method of searching again whether there are any required updates may be used, a method of selecting updates that are not required but have high importance may be used, or a method of random selection may be used.

[0063] The request for additional combinations may be confirmed with the user each time step S505 is performed, or may be confirmed with the user before the start of the entire flow, or may be set as the default setting of the entire flow to output a single content or multiple contents, etc. On the other hand, if it is determined in step S505 that no additional update and verification content combination is required, the entire flow in FIG. 5 ends.

[0064] This completes the description of the present embodiment. According to the update content verification method of the present embodiment, the verification content of security or safety is determined while ensuring essential system updates and enabling their implementation within a time limit.

[0065] [Example 3] A third embodiment of the present invention will be described below with reference to the drawings. When considering updating a system, there may be a level of security or safety (safety level) that needs to be satisfied. In that case, updates and verification contents that can obtain a certain level of safety or higher are required as output. In this embodiment, a function for inputting a required level of safety, calculating an attained level of safety, and judging whether the calculated level satisfies the required level is added to the method described in the first embodiment. Furthermore, a function for including an estimated time, which is an intermediate output in the overall flow of FIG. 5, in the output is added.

[0066] In this embodiment, a block diagram shown in FIG. 8 is used in which a safety level calculation and judgment unit 801 and a required level input unit 802 are added to the functional block diagram of the update content verification system shown in FIG. 1 described in the first embodiment, and the update and verification content output unit 107 is changed to a various information output unit 803.

[0067] In Fig. 8, reference numerals 101 to 106 and 108 are the same as those in Fig. 1. In the various information output unit 803, the estimated time result of the update and verification execution time estimation unit 104 and the assumed safety level calculated by the safety level calculation and judgment unit 801 are output together with the update and verification contents. This allows the user to obtain more information in addition to the update and verification contents. The safety level calculation and judgment unit 801 and the various information output unit 803 are functions mounted in the update content verification device 20 shown in Fig. 2. Note that although the safety level calculation and judgment unit is depicted as one functional unit in Fig. 8, these may be separate functional units.

[0068] Fig. 9 is a diagram showing the overall flow of this embodiment. Step S901 of calculating an assumed safety level based on a combination of updates and verification contents completed within a time limit, and step S902 of comparing the assumed safety level with a required level input in the required level input unit 802 are added to the overall flow of Fig. 5 described in the first embodiment. Reference characters S501 to S505 in Fig. 9 are the same as those in the first embodiment, and their explanations are omitted. In the following, an example of the operation of the overall flow using the control system 300 and verification level information 410 in Fig. 3, as in the first embodiment, will be described.

[0069] Steps S501 to S505 in Fig. 9 are the same as those in the first embodiment. For each combination of updates and verification contents that are completed within the time limit as a result of step S505, a security or safety level is calculated in step S901. The attained level may be calculated by referring to a method such as a specification or standard. Alternatively, the level may be calculated by arithmetic using the Lv of the verification level information 410.

[0070] Then, in step S902, the calculated safety level is compared with the required level input in required level input unit 802 to determine whether it satisfies the requirements. If it is determined in step S902 that a certain combination of updates and verification contents does not satisfy the requirements, the process proceeds to step S903, where the combination of updates and verification contents is discarded and not output. On the other hand, if it is determined in step S902 that a certain combination of updates and verification contents satisfies the requirements, the combination of updates and verification contents is output. The above determination is made for each combination of updates and verification contents whose implementation is completed within the time limit, which is the result of step S505.

[0071] This completes the description of this embodiment. According to the method for determining the contents of the security verification of this embodiment, a system update and the contents of the security verification that can be performed within a time limit while satisfying a required security level are determined.

[0072] According to the embodiment of the present invention described above, the following advantageous effects are obtained. (1) The update content verification system of the present invention is an update content verification system that verifies the content of an update to be performed on a control system, and includes an update information input unit to which update information for the control system is input, an update information analysis unit that analyzes the update information, a verification information storage unit in which verification information related to the verification performed on the update content is stored, an update and verification content setting unit that sets the content of the update to be performed on the control system and the content of the verification to be performed on the update from the results of the analysis and the verification information, an implementation time estimation unit that estimates the implementation time required to perform the update and verification, and an implementation feasibility determination unit that compares the estimated implementation time with a predetermined time limit and determines whether the update and verification can be completed within the time limit.

[0073] The above configuration makes it possible to determine system updates and safety verification contents that can be performed within an allowable time limit for a control system.

[0074] (2) The update information analysis unit analyzes the update information and divides it into multiple update processes. This makes it possible to generate multiple candidate update processes to be performed on the control system, and ensures a greater number of options for the updates and verification contents to be performed.

[0075] (3) The update and verification content setting unit sets at least one of the divided update processes as the update content to be implemented for the control system. This makes it possible to implement some of the update contents even if it is not possible to implement all of the update contents included in the update information, making it possible to select the update contents from various perspectives.

[0076] (4) At least one of the analysis by the update information analysis unit, the setting by the update and verification content setting unit, and the estimation by the implementation time estimation unit is performed based on a digital model that reproduces the hardware or software that executes the control system on a computer. This allows the hardware and / or software to be executed without actually using them, thereby making it possible to conserve resources.

[0077] (5) The verification information includes at least one of the verification scope and the verification granularity, with multiple levels set, which makes it possible to appropriately prioritize and select the updates and verification contents to be selected based on this information.

[0078] (6) When the implementation feasibility determination unit determines that the update and verification can be completed within the time limit, the update and verification content setting unit additionally sets update content and verification content other than the implementation and verification content determined to be able to be completed within the time limit, the implementation time estimation unit estimates the time required to perform the additionally set update and verification, and the implementation feasibility determination unit determines whether the additionally set update and verification can be performed in addition to the update and verification determined to be able to be completed within the time limit. This makes it possible to perform additional updates and verifications even after one update and verification has been performed, thereby further improving the safety of the control system.

[0079] (7) The system further includes a mandatory update content setting unit that sets mandatory update content from the results of the analysis by the update information analysis unit. This makes it possible to set mandatory update content even when there are multiple update processes that can be performed on the control system. This makes it possible to reduce the risk that, for example, if there is a device / program that needs to be updated immediately from a security standpoint, other non-mandatory updates will be prioritized and the control system will be put at risk.

[0080] (8) The control system further includes a safety level calculation unit that calculates an assumed safety level when the update and verification are performed if the implementation feasibility determination unit determines that the update and verification can be completed within the time limit, and a safety level determination unit that compares the assumed safety level with a safety level required for the control system to determine whether the update and verification can be performed. This makes it possible to reduce the risk of exposing the control system to danger, as in (7).

[0081] (9) Furthermore, the update content verification method of the present invention acquires update information for a control system, analyzes the update information, sets the update content to be performed on the control system and the verification content to be performed on the update from the results of the analysis and from verification information related to the verification to be performed on the update content, estimates the implementation time required to perform the update and verification, and compares the estimated implementation time with a specified time limit to determine whether the update and verification can be completed within the time limit.

[0082] With the above configuration, similarly to (1), it is possible to determine the system update and safety verification contents that can be performed within the time limit allowed for the control system.

[0083] This concludes the description of the embodiment of the present invention. Note that the present invention is not limited to the above-described embodiment, and includes various modified examples. The above-described embodiment has been described in detail to explain the present invention in an easily understandable manner. For this reason, the present invention is not necessarily limited to all of the configurations, processes, information, and numerical values ​​described above, such as the contents of information stored in the storage unit, the analysis process in the update information analysis unit, the estimation process in the update and verification execution time estimation unit, and the output results.

[0084] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD. [Explanation of symbols]

[0085] 101...system update information input unit (update information input unit), 102...update information analysis unit, 103...update and verification content setting unit, 104...update and verification implementation time estimation unit, 105...time limit input unit, 106...implementation feasibility determination unit, 108...verification level storage unit (verification information storage unit), 300...control system, 410...verification level information, 601...mandatory update content setting unit, 801...safety level calculation and determination unit (safety level calculation unit, safety level determination unit)

Claims

1. An update content verification system that verifies the content of an update to be implemented in a control system, an update information input unit to which update information of the control system is input; an update information analysis unit that analyzes the update information; a verification information storage unit storing verification information related to the verification performed on the content of the update; an update and verification content setting unit that sets content of an update to be performed on the control system and content of a verification to be performed on the update from the result of the analysis and the verification information; an implementation time estimation unit that estimates an implementation time required to perform the update and the verification; and an execution possibility determination unit that compares the estimated execution time with a predetermined time limit and determines whether the update and the verification can be completed within the time limit.

1. An update content verification system comprising:

2. 2. The update content verification system according to claim 1, The update information analysis unit analyzes the update information and divides it into a plurality of update processes.

1. An update content verification system comprising:

3. 3. The update content verification system according to claim 2, the update and verification content setting unit sets at least one of the divided update processes as an update content to be performed on the control system; 1. An update content verification system comprising:

4. 2. The update content verification system according to claim 1, At least one of the analysis by the update information analysis unit, the setting by the update and verification content setting unit, and the estimation by the implementation time estimation unit is performed based on a digital model that reproduces hardware or software that executes the control system on a computer.

1. An update content verification system comprising:

5. 2. The update content verification system according to claim 1, The verification information includes at least one of a verification range and a verification granularity, in which a plurality of levels are set.

1. An update content verification system comprising:

6. 2. The update content verification system according to claim 1, When the execution possibility determination unit determines that the update and the verification can be completed within the time limit, the update and verification content setting unit additionally sets the update content and the verification content other than the implementation and verification content determined to be able to be completed within the time limit; The implementation time estimation unit estimates a time required to implement the additionally set update and verification, An update content verification system characterized in that the implementation feasibility determination unit determines whether the additionally set update and verification can be implemented in addition to the update and verification that have been determined to be able to be completed within the time limit.

7. 2. The update content verification system according to claim 1, a mandatory update content setting unit that sets mandatory update content from among the results of the analysis by the update information analysis unit, 1. An update content verification system comprising:

8. 2. The update content verification system according to claim 1, a safety level calculation unit that calculates an assumed safety level when the update and the verification are performed, when the execution possibility determination unit determines that the update and the verification can be completed within the time limit; and and a safety level determination unit that determines whether the update and verification can be performed by comparing the assumed safety level with a safety level required for the control system.

1. An update content verification system comprising:

9. An update content verification method for the update content verification system according to claim 1, comprising: the update information analysis unit analyzes the update information of the control system inputted to the update information input unit; the update and verification content setting unit sets the content of the update to be performed on the control system and the content of the verification to be performed on the update from among the result of the analysis and the verification information related to the verification to be performed on the content of the update stored in the verification information storage unit; the execution time estimation unit estimates an execution time required to execute the update and the verification; the execution possibility determination unit compares the estimated execution time with a predetermined time limit to determine whether the update and the verification can be completed within the time limit.

13. A method for verifying update contents, comprising:

Images