Control device, management method and security program

Abstract

To protect a control program, which is intellectual property.SOLUTION: A control apparatus collates unique information, which is generated by using identification information acquired from each of one or more devices, with unique information generated in advance in response to an execution start request relating to whether to execute a control program, and determines whether to execute the control program on the basis of the collation result. The control apparatus selects, for each of the one or more devices, identification information according to a security policy out of first identification information for identifying the type of the device and second identification information for individually identifying the device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a control device, a management method, and a security program. [Background technology]

[0002] Control devices such as programmable logic controllers (PLCs) are being introduced in various manufacturing sites. Such control devices are a type of computer that executes control programs designed for manufacturing devices or manufacturing facilities.

[0003] In recent years, a problem has arisen in which a control program is extracted from a control device that has already been in operation at a manufacturing site, and the extracted control program is used in a new control device created at a different manufacturing site.

[0004] Japanese Patent Laid-Open Publication No. 2008-065678 (Patent Document 1) discloses one method for dealing with such problems. Specifically, Patent Document 1 discloses a method in which a PLC determines whether or not an encrypted control program is a program specific to the facility device, and if the program is specific to the facility device, decrypts the control program from the encrypted program, and executes the control program to control the facility device. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2008-065678 A Summary of the Invention [Problem to be solved by the invention]

[0006] In the method disclosed in Patent Document 1, the PLC includes a storage means for storing identification data and encryption rules input in advance, and uses the identification data to determine whether the encrypted program is unique to the facility device. If it is determined that the encrypted program is unique to the facility device, the PLC obtains a control program by decrypting the encrypted program according to the encryption rules, and uses the control program. Therefore, if not only the encrypted program but also the identification data and encryption rules are extracted, the control program can be used. In other words, the method disclosed in Patent Document 1 leaves room for improvement in terms of protecting the intellectual property of the control program.

[0007] An object of the present disclosure is to protect intellectual property, namely, a control program. [Means for solving the problem]

[0008] According to an example of the present disclosure, a control device including one or more devices includes a control engine that executes a control program, and a security engine that manages whether or not the control engine can execute the control program. The security engine includes a generating means, a holding means, a matching means, and a permission means. The generating means generates unique information using identification information acquired from each of the one or more devices. The holding means holds first unique information generated in advance, and the matching means matches second unique information generated by the generating means according to a matching request with the first unique information. The permission means makes a matching request in response to a request to start execution of the control program, and determines whether or not the control program can be executed based on the matching result obtained from the matching means. The generating means selects identification information for each of the one or more devices from the first identification information that identifies the type of the device and the second identification information that individually identifies the device in accordance with a security policy.

[0009] According to this configuration, the security engine checks the second unique information generated in response to a request to start execution of the control program against the first unique information generated in advance, and judges whether or not the control program can be executed according to the check result. The unique information is generated from identification information selected from the first identification information that identifies the type of each device and the second identification information that individually identifies each device. Therefore, when a new control device is created by copying the software (including the first unique information and the control program) and hardware of the control device, the second unique information generated from the identification information of the device included in the new control device may not match the first unique information. As a result, it is possible to prevent the control program from being started in an environment different from the environment managed by the security engine. In other words, it is possible to protect the intellectual property of the control program.

[0010] Furthermore, the identification information is selected from the first identification information for identifying the type of device and the second identification information for identifying the device individually according to the security policy. Therefore, the developer of the control program can set the security policy appropriately, taking into consideration the priority of security measures for the control program. As a result, the security level in the security engine can be changed as desired.

[0011] In the above disclosure, the security policy is preset from among a first policy, a second policy, and a third policy. The first policy is a policy that selects a first identification information for each of one or more devices. The second policy is a policy that selects a first identification information for a first device that belongs to a first group among the one or more devices, and selects a second identification information for a second device that belongs to a second group that has a higher priority for security measures than the first group among the one or more devices. The third policy is a policy that selects a second identification information for each of the one or more devices.

[0012] According to this disclosure, a developer can arbitrarily change the security level in the security engine, taking into consideration the priority of security measures for a control program.

[0013] In the above disclosure, each of the one or more devices holds second identification information. The second identification information is a combination of the first identification information and a third identification information that is uniquely assigned to an individual device of a type identified by the first identification information. The generating means obtains the first identification information from the second identification information. According to this disclosure, each device only needs to store the second identification information.

[0014] In the above disclosure, the one or more devices include a control device having a control engine and a security device having a security engine.

[0015] According to this disclosure, by realizing a control engine, which requires freedom of modification to the control program, and a security engine, for which freedom of modification is not desirable for security reasons, as different devices, it is possible to design devices according to the characteristics of each engine.

[0016] In the above disclosure, the storage means stores the first unique information in the form of a distributed ledger between the external device and the storage means.

[0017] According to this disclosure, the first unique information is stored in a state that makes it more difficult to tamper with, thereby increasing the security level of the intellectual property that is the control program.

[0018] In the above disclosure, the checking means further checks the second unique information against the first unique information held by the external device.

[0019] According to this disclosure, a third party who has illegally copied the control device needs to tamper with the first unique information held by the external device in order to execute the control program, which further increases the security level of the control program.

[0020] According to another example of the present disclosure, a management method executed in a control device including one or more devices includes first to fourth steps. The first step is a step of holding first unique information generated in advance. The second step is a step of generating second unique information using identification information acquired from each of the one or more devices in response to a request to start execution of a control program. The third step is a step of comparing the first unique information with the second unique information. The fourth step is a step of determining whether or not the control program can be executed based on a result of the comparison. The second step (generating step) includes a step of selecting, for each of the one or more devices, identification information from the first identification information that identifies the type of the device and the second identification information that individually identifies the device in accordance with a security policy.

[0021] According to another example of the present disclosure, a security program causes a computer to execute the above-mentioned management method.

[0022] These disclosures also help protect intellectual property, namely the control program. Effect of the Invention

[0023] According to the present disclosure, it is possible to protect intellectual property, that is, a control program. [Brief description of the drawings]

[0024] [Figure 1] FIG. 1 is a diagram illustrating an example of a scene in which a control device according to an embodiment is applied. [Diagram 2] FIG. 1 is a schematic diagram showing the overall configuration of a control system 10 including a control device 1 according to the present embodiment. [Diagram 3] FIG. 2 is a schematic diagram showing an example of a hardware configuration of a control unit 100 constituting a control device 1 according to the present embodiment. [Figure 4]FIG. 2 is a schematic diagram showing an example of a hardware configuration of a security unit 200 constituting a control device 1 according to the present embodiment. [Diagram 5] 1 is a diagram showing an example of identification information 40 held by each device included in the control device 1. FIG. [Figure 6] FIG. 11 is a diagram showing a flow of a method for determining whether or not the control program 140 can be executed. [Figure 7] 2 is a block diagram showing an example of a functional configuration of a control unit 100 and a security unit 200. FIG. [Figure 8] 10 is a sequence diagram showing a processing procedure when a request to start execution of a control program 140 is received in this embodiment. FIG. [Figure 9] FIG. 1 is a diagram showing an example of management information 30 held in the form of a distributed ledger. [Figure 10] FIG. 2 is a diagram showing a functional configuration of a security unit 200 that functions when a new block 50 is generated. [Figure 11] FIG. 11 is a sequence diagram showing a processing procedure when a request to start execution of the control program 140 is received in the first modification. [Figure 12] FIG. 11 is a sequence diagram showing another example of the processing procedure when a request to start execution of the control program 140 is received in the second modification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0025] Hereinafter, each embodiment according to the present invention will be described with reference to the drawings. In the following description, the same parts and components are given the same reference numerals. Their names and functions are also the same. Therefore, detailed description thereof will not be repeated. Note that each embodiment and each modified example described below may be appropriately combined selectively.

[0026] § 1. Examples of Application An overview of a control system according to the present embodiment will be described. Fig. 1 is a diagram showing an example of a scene in which a control device 1 according to the embodiment is applied. As shown in Fig. 1, the control device 1 includes a control program 140 for controlling a control target, a control engine 142 for executing the control program 140, and a security engine 230 for managing whether or not the control engine 142 can execute the control program 140.

[0027] The control device 1 includes one or more devices. Each device is controlled by executing a control program 140, and each device is controlled to control a manufacturing facility or the like that is to be controlled.

[0028] The security engine 230 includes an authorization unit 232 , a generation unit 234 , a storage unit 236 , and a matching unit 238 .

[0029] The permission unit 232 receives a request to start the control program 140 from the control engine 142 and determines whether or not the control program 140 can be executed.

[0030] The generating unit 234 generates unique information using identification information acquired from each of the one or more devices constituting the control device 1. For each of the one or more devices, the generating unit 234 selects identification information from first identification information that identifies the type of the device and second identification information that individually identifies the device in accordance with the security policy. Since the unique information is generated using the identification information acquired in this manner, it changes in accordance with a change in the configuration of the control device 1.

[0031] The storage unit 236 stores management information 30 including unique information 20 previously generated for the control device 1. To prevent the unique information 20 from being illegally tampered with, the storage unit 236 permits updating of the management information 30 only when a predetermined condition is satisfied. The predetermined condition is, for example, that a preset access ID and password match the input information.

[0032] The collation unit 238 compares the unique information 22 generated by the generation unit 234 in response to a collation request with the unique information 20 included in the management information 30. Collation means determining whether or not they match.

[0033] Next, a method for managing whether or not a control program executed in the control device 1 can be executed will be described, starting from step 1 shown in Fig. 1. In Fig. 1 and the following description, steps are simply abbreviated as "S".

[0034] S1: The generating unit 234 generates in advance the unique information 20 of the control device 1. The holding unit 236 holds the management information 30 including the unique information 20 generated in advance.

[0035] S2: The permission unit 232 receives a start request for the control program 140. In the example shown in Fig. 1, the control engine 142 issues the start request, but the security engine 230 may include a reception unit that receives the start request.

[0036] S3: In response to the start request from the control program 140, the permission unit 232 requests the verification unit 238 to verify.

[0037] S4: The collation unit 238 requests the generation unit 234 to generate the unique information 22 in response to the request for collation.

[0038] S5: In response to a generation request, the generating unit 234 acquires identification information from one or more devices included in the control device 1, and generates the unique information 22 using the acquired identification information. For each device, the generating unit 234 selects identification information from the first identification information that identifies the type of the device and the second identification information that individually identifies the device, according to the security policy. Note that the generating unit 234 may select the first identification information for all of the one or more devices, or may select the second identification information for all of the one or more devices. Alternatively, the generating unit 234 may select the first identification information for some of the one or more devices, and select the second identification information for the remaining devices. The security policy is set in advance for the control device 1.

[0039] S6: The collation unit 238 compares the unique information 20, which is included in the management information 30 and is generated in advance, with the unique information 22, which is generated at the time when the request for collation is received, to obtain a collation result.

[0040] S7: The collation unit 238 provides the obtained collation result to the permission unit 232. The permission unit 232 determines whether or not to execute the control program 140 based on the provided collation result. Specifically, the permission unit 232 permits execution of the control program 140 in response to the collation result indicating a match. The permission unit 232 prohibits execution of the control program 140 in response to the collation result indicating a mismatch.

[0041] S8: The permission unit 232 provides the result of the determination (permission or prohibition) based on the collation result to the control engine 142. The control engine 142 executes the control program 140 only when the determination result of the permission unit 232 is "permission".

[0042] The control program 140 for realizing the environment managed by the control device 1 may be developed by a company other than the company that uses the control device 1. In such a case, if the control program 140 and the environment in which the control program 140 can be used are easily imitated, the intellectual property of the company developing the control program 140 cannot be adequately protected.

[0043] When imitating the control device 1, both the hardware and software of the control device 1 are copied in order to execute the control program 140. Copying the software means copying not only the control program 140, but also the system programs for operating the control engine 142 and the security engine 230. Furthermore, by copying the software, the management information 30 held by the security engine 230 is also copied.

[0044] On the other hand, for hardware, the control device 1 is imitated by installing a device that replaces each device constituting the control device 1. In another control device imitating the control device 1, the unique information 22 is generated using identification information acquired from a device different from the control device 1. Therefore, the unique information 22 may not match the unique information 20 included in the copied management information 30. In particular, by setting a security policy to acquire second identification information for at least one device, the unique information 22 does not match the unique information 20. Alternatively, when at least one device constituting the control device 1 is imitated using a device of a different model having the same function as the device, even if the first identification information is acquired for the device, the unique information 22 does not match the unique information 20. As a result, it is possible to prevent the control program 140 from being started in an environment different from the environment managed by the security engine 230. In other words, it is possible to protect the intellectual property of the control program 140.

[0045] In another control device that mimics the control device 1, the unique information 22 can match the unique information 20 by falsifying the identification information of each device. However, the number of devices constituting the control device 1 may be several tens. In such a case, it is necessary to falsify the identification information of all several tens of devices. Therefore, a great deal of labor is required to mimic the control device 1 managed by the control program 140.

[0046] Also, in the present embodiment, the identification information is selected according to the security policy from the first identification information for identifying the type of device and the second identification information for individually identifying the device. For example, the developer of the control program 140 may lower the priority of the security measures by selecting the first identification information for devices that are expected to be replaced due to failures or regular maintenance. Thereby, the developer can balance the maintainability such as device replacement and the protection of intellectual property.

[0047] §2. Specific Example <A. Control System> FIG. 2 is a schematic diagram showing the overall configuration of a control system 10 including the control device 1 according to the present embodiment. Referring to FIG. 2, the control system 10 includes one or more control devices 1 and a host device 3.

[0048] The control device 1 controls the control target. The control target includes various industrial devices for automating the production process, and includes a device that gives some physical action to a manufacturing device, a production line, etc. (hereinafter also collectively referred to as "field"), and an input / output device that exchanges information with the field. Note that the entire production line may be the control target.

[0049] The control device 1 is communicably connected to a higher-level device 3 and other control devices 1 via an information network 2. The information network 2 is a network that complies with a communication standard such as EtherNet / IP (registered trademark) or OPC UA (Object Linking and Embedding for Process Control Unified Architecture) that can realize data exchange independent of the vendor, the type of OS (Operating System), etc.

[0050] The control device 1 includes one or more devices. In the example shown in Fig. 2, the control device 1 includes a control unit 100, a security unit 200, an I / O (Input / Output) unit 300, a communication coupler 400, etc. In the following, each unit and the communication coupler constituting the control device 1 will be collectively referred to as a "device".

[0051] The control unit 100 is an example of a control device constituting the control device 1, and executes a control program for controlling a controlled object and performs central processing in the control device 1.

[0052] The security unit 200 is an example of a security device constituting the control device 1, and manages whether or not a control program can be executed in the control unit 100. The method of managing whether or not a control program can be executed will be described later.

[0053] The control unit 100 and the security unit 200 are connected, for example, via any data transmission path (for example, PCI Express or EtherNet / IP (registered trademark)).

[0054] The I / O unit 300 is an example of a device constituting the control device 1, and is a unit related to general input / output processing. The I / O unit 300 collects detection values ​​from IO devices including various sensors, various switches, encoders, and the like.

[0055] The control unit 100 and the I / O unit 300 are communicatively connected via an internal bus. The control unit 100 executes calculations of a control program using detection values ​​collected by the I / O unit 300, and outputs the values ​​of the calculation results to the I / O unit 300.

[0056] The communication coupler 400 is communicatively connected to the control unit 100 via the field network 4. The communication coupler 400 performs processing related to data transmission in the field network 4. The communication coupler 400 is communicatively connected to one or more I / O units 300, for example, via an internal bus. Detection values ​​collected by each of the one or more I / O units 300 connected to the communication coupler 400 are output to the control unit 100 via the field network 4.

[0057] Typically, various types of industrial Ethernet (registered trademark) can be used as the field network 4. Known examples of industrial Ethernet (registered trademark) include EtherCAT (registered trademark), Profinet IRT, MECHATROLINK (registered trademark)-III, Powerlink, SERCOS (registered trademark)-III, and CIP Motion, and any of these may be adopted. Furthermore, a field network other than the industrial Ethernet (registered trademark) may also be used. For example, if motion control is not performed, DeviceNet, CompoNet / IP (registered trademark), etc. may be used.

[0058] Each device constituting the control device 1 has identification information 40. Typically, the identification information 40 is an individual identification code such as an SGTIN (Serialized Global Trade Item Number).

[0059] Note that the devices constituting the control device 1 are not limited to the devices shown in FIG. 2. The devices constituting the control device 1 may include, for example, a power supply unit that supplies power, a special unit having functions not supported by the I / O unit 300, a safety unit that provides a safety function for preventing the safety of people from being threatened by facilities, machines, etc. Further, the devices constituting the control device 1 may include, for example, an HMI (Human Machine Interface) that presents various information obtained by control calculations in the control unit 100 or other units to the operator and generates internal commands or the like for the control unit 100 or other units according to operations from the operator.

[0060] The host device 3 is configured as a server within the control system 100, or an external server such as a cloud server, or a PLC having higher performance than the control device 1, or an industrial computer (so-called IPC: Industrial Personal Computer).

[0061] <B. Hardware Configuration> An example of the hardware configuration of the main devices constituting the control device 1 according to the present embodiment will be described.

[0062] (b1. Control Unit) FIG. 3 is a schematic diagram showing an example of the hardware configuration of the control unit 100 constituting the control device 1 according to the present embodiment. Referring to FIG. 3, the control unit 100 mainly includes a processor 102 such as a CPU (Central Processing Unit) and a GPU (Graphical Processing Unit), a chipset 104, a main storage device 106, a secondary storage device 108, a communication controller 110, a USB controller 112, a memory card interface 114, a field network controller 116, an internal bus controller 118, and an information system network controller 120.

[0063] The processor 102 reads out various programs stored in the secondary storage device 108 or the memory card 115, expands them in the main storage device 106, and executes them to realize control calculations for controlling the controlled object and processing related to requests to start execution of the control programs, as described below.

[0064] The primary storage device 106 is configured with a volatile storage device such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). The secondary storage device 108 is configured with a non-volatile storage device such as a hard disk drive (HDD) or a solid state drive (SSD).

[0065] The chipset 104 mediates data exchange between the processor 102 and each component, thereby realizing processing of the control unit 100 as a whole.

[0066] In addition to a system program 1082 for realizing the basic functions of the control unit 100, the secondary memory device 108 stores a control program 140 created according to the controlled object such as equipment or machinery, and identification information 40 for identifying the control unit 100.

[0067] The system program 1082 incorporates an authentication program 130. The authentication program 130 is a program that is executed when the control program 140 is started, and is a program for requesting permission to execute the control program 140 to be started from the security unit 200. The system program 1082 also provides a function as a control engine that executes the control program 140.

[0068] The control program 140 is an intellectual property whose basic algorithm is created by a program development company. For example, a user sets parameters according to the control device 1 to prepare an environment in which the control program 140 provided by the program development company can be executed.

[0069] The communication controller 110 is responsible for exchanging data with the security unit 200. As the communication controller 110, for example, a communication chip compatible with PCI Express or Ethernet (registered trademark) can be used.

[0070] The USB controller 112 is responsible for exchanging data with any information processing device via a USB connection. The information processing device may include, for example, a support device that provides a user with functions such as creating or editing the control program 140, debugging, and setting various parameters.

[0071] Memory card interface 114 is configured to allow a memory card 115, which is an example of a storage medium, to be detachably attached. Memory card interface 114 is capable of writing data such as control program 140 and various settings to memory card 115, and reading data such as control program 140 and various settings from memory card 115.

[0072] The field network controller 116 controls data exchange with other devices via the field network 4 .

[0073] The internal bus controller 118 controls data exchange with other devices (such as the I / O unit 300) via the internal bus. The internal bus may use a communication protocol unique to the manufacturer, or may use a communication protocol that is the same as or conforms to any industrial network protocol.

[0074] The information network controller 120 controls data exchange with other control devices 1 via the information network 2 .

[0075] 3 shows an example of a configuration in which the processor 102 executes a program to provide necessary functions, but some or all of these provided functions may be implemented using a dedicated hardware circuit (e.g., ASIC or FPGA). Alternatively, the main part of the control unit 100 may be realized using hardware that conforms to a general-purpose architecture (e.g., an industrial PC based on a general-purpose PC). In this case, virtualization technology may be used to run multiple OSs with different uses in parallel, and necessary applications may be executed on each OS.

[0076] (b2. Security Unit) Fig. 4 is a schematic diagram showing an example of a hardware configuration of a security unit 200 constituting the control device 1 according to the present embodiment. Referring to Fig. 4, the security unit 200 includes, as main components, a processor 202 such as a CPU or a GPU, a chipset 204, a main memory device 206, a secondary memory device 208, a communication controller 210, a USB controller 212, a memory card interface 214, and an information system network controller 220.

[0077] The processor 202 reads out various programs stored in the secondary storage device 208 or the memory card 215, deploys them in the main storage device 206, and executes them, thereby realizing a function of managing whether or not the control programs can be executed in the control unit 100. The main storage device 206 is configured with a volatile storage device such as a DRAM or an SRAM. The secondary storage device 208 is configured with a non-volatile storage device such as an HDD or an SSD, for example.

[0078] The chipset 204 mediates data exchange between the processor 202 and each component, thereby realizing processing of the security unit 200 as a whole.

[0079] In the secondary storage device 208, in addition to a system program 2082 for implementing the basic functions of the security unit 200, the identification information 40 and the management information 30 are stored.

[0080] A security program 240 is incorporated into the system program 2082. The security program 240 is a program for managing whether or not the control program 140 executed in the control device 1 can be executed. In other words, the security program 240 provides a function as a security engine that manages whether or not the control program 140 can be executed.

[0081] The management information 30 is information for managing unique information generated using identification information 40 acquired from one or more devices constituting the control device 1. The unique information is used as criterion information for determining whether or not to permit execution of the control program 140. The unique information will be described later.

[0082] The communication controller 210 is responsible for exchanging data with the control unit 100. As the communication controller 210, like the communication controller 210 in the control unit 100, for example, a communication chip compatible with PCI Express or Ethernet (registered trademark) can be used.

[0083] The USB controller 212 is responsible for sending and receiving data to and from any information processing device via a USB connection. The information processing device may include, for example, a support device that provides a user with functions such as the setting of the security program 240.

[0084] Memory card interface 214 is configured to allow a memory card 215, which is an example of a storage medium, to be detachably attached. Memory card interface 214 is capable of writing data such as programs and various settings to memory card 215, and reading data such as programs and various settings from memory card 215.

[0085] The information network controller 220 controls the exchange of data with other control devices 1 via the information network 2. The information network controller 220 may adopt a general-purpose network protocol such as Ethernet (registered trademark).

[0086] FIG. 4 shows a configuration example in which functions necessary for the processor 202 to execute a program are provided. However, some or all of these provided functions may be implemented using a dedicated hardware circuit (for example, an ASIC or an FPGA). Alternatively, the main part of the security unit 200 may be realized using hardware (for example, an industrial personal computer based on a general-purpose personal computer) that follows a general-purpose architecture. In this case, virtualization technology may be used to execute a plurality of different-purpose OSs in parallel and execute necessary applications on each OS.

[0087] Referring to FIGS. 3 and 4, the control device 1 may be connected to the information network 2 via the information network controller 120 of the control unit 100, or may be connected via the information network controller 220 of the security unit 200. In the present embodiment, the control device 1 will be described as being connected via the information network controller 220 of the security unit 200.

[0088] <C. Identification Information> FIG. 5 is a diagram showing an example of the identification information 40 possessed by each device included in the control device 1. In FIG. 5, the identification information 40 which is SGTIN is shown. SGTIN is one of the identification codes for writing on an electronic tag standardized by the distribution system standardization organization GS1, and is an individual identification code for a product. The identification information 40 is the second identification information for individually identifying a device.

[0089] 5, the identification information 40 is a combination of identification information 42, which is a product identification code that identifies the type of device, and a serial number 44 (third identification information) that is uniquely assigned to an individual device of the type identified by the identification information 42. The identification information 42 is the first identification information for identifying the type of device.

[0090] The identification information 42 is a product identification code GTIN (Global Trade Item Number) standardized by the distribution system standardization organization GS1. The GTIN is composed of an indicator, a company code, a product item code, and a check digit.

[0091] <D.セキュリティポリシー> The developer of the control program 140 sets a security policy for the control program 140. Note that the setting of the security policy is not limited to being performed by the developer of the control program 140, and may be performed by other persons. The security policy is set in advance in the security program 240.

[0092] In this embodiment, the security policy is preset from among the following policies (A) to (C). Policy (A): Select the identification information 40 (second identification information) for all devices. Policy (B): Select identification information 42 (first identification information) for a first device belonging to a first group, and select identification information 40 (second identification information) for a second device belonging to a second group having a higher priority for security measures than the first group. Policy (C): Select the identification information 42 (first identification information) for all devices.

[0093] For example, when the developer believes that the control program 140 is likely to be emulated and wants to increase the security level of the control program 140, the developer sets Policy (A). When the developer believes that the control program 140 is less likely to be emulated or the value of the control program 140 as intellectual property is not high, the developer sets Policy (B) or Policy (C).

[0094] When setting Policy (B), the developer pre-sets the Global Trade Item Number (GTIN) (identification information 42) of the devices belonging to the first group and the GTIN (identification information 42) of the devices belonging to the second group.

[0095] <E. Outline of the method for determining whether to execute the control program> FIG. 6 is a diagram showing the flow of the method for determining whether to execute the control program 140. In the example shown in FIG. 6, for the sake of simplicity of the drawing, the description of units other than the control unit 100 and the security unit 200 (such as the I / O unit 300, the communication coupler 400, etc.) constituting the control device 1 is omitted.

[0096] First, the control unit 100 requests the security unit 200 to determine whether the control program 140 can be executed ((1) in the figure).

[0097] In response to the determination request from the control unit 100, the security unit 200 collects the identification information 40 from one or more devices constituting the control device 1 ((2) in the figure).

[0098] The security unit 200 selects one of the identification information 40 (SGTIN) and the identification information 42 (GTIN) included in the identification information 40 for each device in accordance with a preset security policy ((3) in the figure). When the above policy (A) is set, the security unit 200 selects the identification information 40 for all devices. When the above policy (B) is set, the security unit 200 selects the identification information 42 for the device corresponding to the product identification code GTIN set in the first group. Furthermore, the security unit 200 selects the identification information 40 for the device corresponding to the product identification code GTIN set in the second group. When the above policy (C) is set, the security unit 200 selects the identification information 42 for all devices.

[0099] The security unit 200 generates a system hash value as the unique information 22 based on the identification information (identification information 40 or identification information 42) selected for each device ((4) in the figure). The system hash value is obtained by using a known hash function with the identification information 40 of the devices constituting the control device 1, excluding the security unit 200, as an argument.

[0100] The security unit 200 compares the unique information 22 (system hash value) generated using the identification information 40 with the unique information 20 managed by the management information 30, and determines whether they match ((5) in the figure).

[0101] In (5) in the figure, the newly generated unique information 22 is compared with the unique information 20 managed by the management information 30. If they match, it is guaranteed that the control device 1 is a properly managed device. On the other hand, if they do not match, the control device 1 may be a control device not managed by the management information 30.

[0102] Based on the collation result obtained in the process of (5), the security unit 200 determines whether the control program 140 requested in (1) can be executed ( (6) in the figure). When the collation result indicates "match", the security unit 200 permits the execution of the control program 140.

[0103] The security unit 200 notifies the control unit 100 of the determination result indicating whether the control program 140 can be executed ( (7) in the figure).

[0104] <F. Functional Configuration> FIG. 7 is a block diagram showing an example of the functional configurations of the control unit 100 and the security unit 200. In FIG. 7, the dashed arrows indicate the flow of instructions, and the solid arrows indicate the flow of information.

[0105] As shown in FIG. 7, the control unit 100 includes a control program execution unit 144 and an authentication unit 132. Each of these functions is realized by the processor 102 of the control unit 100 executing the system program 1082.

[0106] The control program execution unit 144 functions to execute the control program 140. Upon receiving a request to start the execution of the control program 140, the control program execution unit 144 requests the authentication unit 132 to authenticate the control program 140. Authentication means authenticating whether the execution environment of the control program 140 is an environment managed by the management information 30 held by the control device 1, that is, authenticating whether it is an environment in which the control program 140 can be executed.

[0107] The authentication unit 132 includes a determination request unit 134, an identification information transmission unit 136, and an identification information collection unit 138. When receiving a request for authentication from the control program execution unit 144, the determination request unit 134 requests the permission unit 232 of the security unit 200 to determine whether the control program 140 can be executed.

[0108] The identification information transmitting unit 136 transmits the identification information 40 of each device constituting the control device 1 collected by the identification information collecting unit 138 to the security unit 200 .

[0109] The identification information collector 138 receives a request from the generator 234 of the security unit 200 and collects the identification information 40 of each device constituting the control device 1. The identification information collector 138 is requested to collect the identification information 40 from the security unit 200 not only when determining whether the control program 140 can be executed, but also when registering new unique information (system hash value) in the management information 30. In this embodiment, the identification information collector 138 collects the identification information 40 from each of the devices constituting the control device 1 except for the security unit 200. The identification information 40 used to generate the system hash value, which is unique information, may include the identification information 40 of the security unit 200.

[0110] After the control program execution unit 144 requests authentication of the control program 140, the authentication unit 132 receives the determination result of whether or not the control program 140 can be executed from the permission unit 232 of the security unit 200. The authentication unit 132 performs processing according to the determination result received from the security unit 200. If the authentication unit 132 obtains a determination result that the execution can be permitted, it notifies the control program execution unit 144 to start executing the control program 140. On the other hand, if the authentication unit 132 obtains a determination result that the execution cannot be permitted, it instructs the control program execution unit 144 to prohibit the execution of the control program 140.

[0111] The security unit 200 includes an authorization unit 232, a generation unit 234, a storage unit 236, and a matching unit 238. Each of these functions is realized by the processor 202 of the security unit 200 executing a security program 240.

[0112] The permission unit 232 includes a determination unit 2322 and a matching request unit 2324. The determination unit 2322 determines whether or not to permit execution of the control program 140 based on matching results obtained from the matching unit 238 of the security unit 200 in which the determination unit 2322 is included and the matching units 238 of the other security units 200, and notifies the authentication unit 132 of the control unit 100 of the determination result. The matching request unit 2324 requests the matching unit 238 to match the unique information.

[0113] The generation unit 234 generates a system hash value, which is unique information. The generation unit 234 includes a collection request unit 2342 and a system hash value calculation unit 2344.

[0114] The collection request unit 2342 functions when requested to generate a system hash value by the collation unit 238 or the storage unit 236. The collation unit 238 requests the generation of a system hash value when collation starts. The storage unit 236 requests the generation of a system hash value when, for example, the control device 1 is properly changed, and the devices constituting the control device 1 are changed and the unique information of the changed control device 1 is newly registered in the management information 30. The collection request unit 2342 requests the identification information collection unit 138 of the control unit 100 to collect the identification information 40.

[0115] The system hash value calculation unit 2344 generates a system hash value using the identification information 40 of each device sent from the identification information transmission unit 136. The system hash value calculation unit 2344 typically generates the system hash value using an algorithm used in a known hash function.

[0116] The system hash value calculation unit 2344 selects, in accordance with a preset security policy, identification information to be used in generating a system hash value from among the identification information 40 (SGTIN) and the identification information 42 (GTIN), which is a part of the identification information 40. The system hash value calculation unit 2344 uses the selected identification information (the identification information 40 or the identification information 42) for each device to generate a system hash value as unique information.

[0117] When the system hash value calculation unit 2344 is requested to generate a system hash value from the collation unit 238, the system hash value calculation unit 2344 sends the generated system hash value to the collation unit 238. Further, when the system hash value calculation unit 2344 is requested to generate a system hash value from the holding unit 236, the system hash value calculation unit 2344 sends the generated system hash value to the holding unit 236.

[0118] The holding unit 236 holds management information 30 including unique information 20 (system hash value) generated in response to a request from the holding unit 236. The holding unit 236 includes a registration unit 2362.

[0119] The registration unit 2362 functions when the device constituting the control device 1 is changed, the unique information 20 of the control device 1 after the change is newly registered in the management information 30, and the management of the unique information 20 is started. The registration unit 2362 starts processing in response to the satisfaction of the condition that a preset access ID and password match the input information.

[0120] The registration unit 2362 requests the generation unit 234 to generate unique information 20. The registration unit 2362 registers the unique information 20 generated by the generation unit 234 as part of the management information 30.

[0121] The holding unit 236 transmits the unique information 22 included in the management information 30 to the collation unit 238 in response to a request from the collation unit 238.

[0122] The collation unit 238 requests the generation unit 234 to generate unique information 22 in response to a request from the collation request unit 2324. Further, the collation unit 238 requests the holding unit 236 to transmit the unique information 20 included in the management information 30 in response to a request from the collation request unit 2324. The collation unit 238 collates the unique information 22 sent from the system hash value calculation unit 2344 with the unique information 20 sent from the holding unit 236, and sends the collation result to the determination unit 2322.

[0123] <G. Sequence Diagram> 8 is a sequence diagram showing a processing procedure when a request to start execution of the control program 140 is received in this embodiment. Note that hereinafter, a sequence will be simply referred to as "SQ."

[0124] In SQ102, the control unit 100 notifies the security unit 200 of a request to start a control program.

[0125] In SQ104, the security unit 200 requests the control unit 100 to collect the identification information 40.

[0126] In SQ 106 , the control unit 100 sends the identification information 40 of each device constituting the control device 1 to the security unit 200 .

[0127] In SQ108, the security unit 200 selects one of the identification information 40 (SGTIN) and the identification information 42 (GTIN) which is part of the identification information 40 for each device according to the security policy.

[0128] In SQ110, the security unit 200 generates unique information 22 (system hash value) using the selected identification information for each device.

[0129] In SQ112, the security unit 200 compares the generated unique information 22 with the unique information 20 (system hash value) in the management information 30 to obtain a comparison result.

[0130] In SQ114, the security unit 200 determines whether or not the control program can be executed based on the comparison result obtained in SQ112. Specifically, the security unit 200 permits the execution of the control program in response to the comparison result indicating a "match." On the other hand, the security unit 200 prohibits the execution of the control program in response to the comparison result indicating a "mismatch."

[0131] In S116, the security unit 200 notifies the control unit 100 of the determination result.

[0132] <H. Modification Example> (h1. Modification Example 1) The holding unit 236 of the security engine 230 may hold the management information 30 in the form of a distributed ledger with other devices. For example, the management information 30 is held in the form of a distributed ledger with the host device 3. In this case, the management information 30 is managed and shared by the control device 1 and the host device 3 using known distributed ledger technology. Alternatively, the management information 30 may be held in the form of a distributed ledger with other control devices 1. In this case, the management information 30 is managed and shared by a plurality of control devices 1 using known distributed ledger technology. Alternatively, the management information 30 may be held in the form of a distributed ledger on the cloud. Since the management information 30 is held in the form of a distributed ledger, it is difficult to be tampered with.

[0133] FIG. 9 is a diagram showing an example of the management information 30 held in the form of a distributed ledger. As shown in FIG. 9, the management information 30 is composed of a plurality of connected blocks 50. Each block 50 includes at least the unique information 20 (system hash value) obtained from the configuration of the control device 1 at a certain timing. The block 50 is generated when a change occurs in the devices constituting the control device 1. The information in each block 50 is not updated, and a new block 50 is generated in relation to the latest block 50.

[0134] Specifically, each block 50 includes a block hash value 52, system configuration information 54, and a nonce 56. The system configuration information 54 includes the identification information 40 of the security unit 200 and the unique information 20 (system hash value) of the control device 1 including the security unit 200.

[0135] The block hash value 52 is unique information that indicates information of the previous block. The block hash value 52 is, for example, a return value obtained according to a known hash function using information of the previous block as an argument.

[0136] 9 shows the management information 30 when a change occurs in the device configuration of the control device 1 and a new block 50-n+1 is added to the management information 30 in a situation where the management information 30 contains blocks 50-1 to 50-n in order. The block 50-n+1 includes a block hash value 52-n. The block hash value 52-n is a return value obtained according to a known hash function using the information of the block 50-n as an argument.

[0137] The nonce 56 is a numerical value that is generated when a new block 50 is generated, that is, a numerical value that is generated every time a block 50 is generated. The nonce 56 is a unique value for each block 50.

[0138] Fig. 10 is a diagram showing the functional configuration of the security unit 200 that functions when a new block 50 is generated. Note that the functions described with reference to Fig. 7 will not be described again. Fig. 10 also shows the flow of data when blocks up to block 50-n are stored and a new block 50-n+1 is stored based on a change in the device constituting the control device 1. In the example shown in Fig. 10, the management information 30 is held in the form of a distributed ledger between the higher-level device 3 and the higher-level device 3.

[0139] As described above, the collection request unit 2342 of the generation unit 234 receives a request to generate the unique information 20 (system hash value) from the storage unit 236 and requests the control unit 100 to collect the identification information 40. The system hash value calculation unit 2344 generates the unique information 20 based on the identification information 40 of each device constituting the control device 1 sent from the control unit 100.

[0140] The registration unit 2362 of the holding unit 236 includes a distribution unit 236A, a mining unit 236B, and a block hash value calculation unit 236C. The system hash value calculation unit 2344 sends the generated unique information 20 to the distribution unit 236A.

[0141] The higher-level device 3 includes a mining unit 236D, a block hash value calculation unit 236E, and management information 30.

[0142] The distribution unit 236A generates system configuration information 54 from the unique information 20 and the identification information 40 of the security unit 200, and distributes it to the mining unit 236B and the higher-level device 3.

[0143] The mining unit 236B of the registration unit 2362 cooperates with the mining unit 236D of the higher-level device 3 to generate a block 50-n+1.

[0144] 8, the last registered block 50 is block 50-n, so that block hash value 52-n is generated based on block 50-n. Similarly, the block hash value calculation unit 236E of the higher-level device 3 also generates a block hash value 52 from the block 50 last registered in the management information 30.

[0145] The mining unit 236B of the registration unit 2362 generates a block 50 by setting a nonce 56 based on the system configuration information 54 and the block hash value 52-n so that information obtained from the generated block 50 satisfies a predetermined condition. The process of setting a nonce 56 and generating a block 50 that satisfies a predetermined condition is called mining. The mining unit 236D of the higher-level device 3 also performs mining. The block 50 generated by the mining unit that finds the nonce 56 that satisfies the predetermined condition earliest among the mining units 236B and 236D is stored in the management information 30 of the control device 1 and the higher-level device 3.

[0146] In other words, the entity that generated the system configuration information 54 may be different from the entity that generated the block 50 .

[0147] In this way, the block 50 is stored in the management information 30 of each of the control device 1 and the host device 3. That is, the management information 30 of each of the control device 1 and the host device 3 is common unless tampered with.

[0148] Each block 50 included in the management information 30 includes a block hash value 52 obtained based on the previous block 50. In other words, when one block 50 is tampered with, it becomes necessary to tamper with the other blocks 50 in a chain reaction, and tampering with the management information 30 requires a lot of effort. In other words, it can be said that the management information 30 is information that is difficult to tamper with. By using the unique information 20 included in such management information 30, which is difficult to tamper with, as the object of comparison, it is possible to suppress unauthorized copying and use of the control program 140.

[0149] It should be noted that the method of generating one block 50 is not limited to the method described with reference to Figures 9 and 10. The method of generating one block 50 may be designed arbitrarily.

[0150] For example, the method of generating the block 50 may be selected depending on the security level of the control device 1. For example, if the security level of the control device 1 is high, the security level (transparency, strictness) of the process of generating the block 50 can be lowered. On the other hand, if the security level of the control device 1 is low, the security level (transparency, strictness) of the process of generating the block 50 needs to be raised.

[0151] Specifically, when the management information 30 is held in the form of a distributed ledger using private or consortium blockchain technology, the hurdle for consensus building can be lowered and the time required for consensus building, i.e., the time required for generating one block 50 and storing it in the management information 30, can be shortened. On the other hand, when the management information 30 is held in the form of a distributed ledger using public blockchain technology, the hurdle for consensus building must be raised.

[0152] Fig. 11 is a sequence diagram showing the processing procedure when a request to start execution of control program 140 is received in Modification 1. In Fig. 11, SQ numbers common to Fig. 8 are assumed to be common processes. Only the processes different from Fig. 8 will be explained below. That is, the processes of SQ102 to SQ112, SQ116 are common to Fig. 8, and the added SQ120 to SQ126 will be explained.

[0153] Specifically, in SQ120 following SQ112, the security unit 200 transmits to the higher-level device 3 the unique information 22 (system hash value) generated in SQ110.

[0154] In SQ122, the host device 3 compares the unique information 20 and the unique information 22 contained in the latest block 50 in the management information 30 to obtain a comparison result.

[0155] In SQ124, the host device 3 transmits the collation result obtained in SQ122 to the security unit 200.

[0156] In SQ126, the security unit 200 determines whether or not to allow the control program to be executed based on the comparison result of SQ112 and the comparison result obtained in SQ124. Specifically, the security unit 200 permits the execution of the control program in response to both of the comparison results indicating a "match." On the other hand, the security unit 200 prohibits the execution of the control program in response to at least one of the two comparison results indicating a "mismatch."

[0157] For example, if another control device is generated by illegally imitating the control device 1, the management information 30 held by the other control device is tampered with, and the unique information 20 of the other control device is registered in the management information 30. In this case, the security program of the other control device checks not only the management information 30 in its own device, but also the management information 30 of the higher-level device 3. Therefore, unless the management information 30 of the higher-level device 3 is also tampered with, the execution of the control program is not permitted, and the security level can be increased.

[0158] (h2. Variation 2) Similar to variant 1, variant 2 is an example in which management information 30 is maintained in the form of a distributed ledger between other devices (e.g., higher-level device 3), and differs in the processing procedure when a request to start execution of control program 140 is received.

[0159] Fig. 12 is a sequence diagram showing another example of the processing procedure when a request to start execution of the control program 140 is received in the modified example 2. In Fig. 12, SQ numbers common to Fig. 11 are assumed to be common processes. As shown in Fig. 12, in the modified example 2, SQ112 is omitted, and SQ128 is executed instead of SQ126.

[0160] In SQ128, the security unit 200 determines whether or not the control program can be executed based on the comparison result obtained in SQ124. Specifically, the security unit 200 permits the execution of the control program in response to the comparison result indicating a "match." On the other hand, the security unit 200 prohibits the execution of the control program in response to the comparison result indicating a "mismatch."

[0161] Thus, according to variant example 2, the matching result is not obtained by comparing with the unique information 20 in the management information 30 held by the control device 1, but by comparing with the unique information 20 in the management information 30 held by another device (for example, the higher-level device 3).

[0162] When another control device is installed by illegally imitating the control device 1, it is more difficult to tamper with data in the higher-level device 3 than to tamper with data in the other control device. Therefore, according to the second modification, unless the management information 30 of the higher-level device 3 is also tampered with, execution of the control program is not permitted, so that the security level can be increased.

[0163] (h3. Other modifications) In the above embodiment, the processor 102 that executes the control program and the processor 202 that executes the security program are included in different devices. However, one device may include the processor 202 that executes the security program and the processor 102 that executes the control program.

[0164] § 3. Supplementary Notes As described above, the disclosure of the above-described embodiment and modified examples includes the following disclosure.

[0165] <Configuration 1> A control device (1) including one or more devices, a control engine (142) that executes a control program (140); a security engine (230) for managing whether or not the control program can be executed by the control engine; The security engine includes: A generating means (234) for generating unique information using identification information acquired from each of the one or more devices; A storage means (236) for storing first unique information generated in advance; a matching means (238) for matching the second unique information generated by the generating means in response to a matching request with the first unique information; a permission means (232) for requesting the collation in response to a request to start execution of the control program, and for determining whether or not the control program can be executed based on a collation result obtained from the collation means; The generation means selects, for each of the one or more devices, the identification information from first identification information (42) that identifies a type of the device and second identification information (42) that individually identifies the device in accordance with a security policy.

[0166] <Configuration 2> the security policy is preset from among a first policy, a second policy, and a third policy; the first policy is a policy for selecting the first identification information for each of the one or more devices; the second policy is a policy for selecting the first identification information for a first device belonging to a first group among the one or more devices, and for selecting the second identification information for a second device belonging to a second group having a higher priority in security measures than the first group among the one or more devices; 2. The control device according to configuration 1, wherein the third policy is a policy for selecting the second identification information for each of the one or more devices.

[0167] <Configuration 3> each of the one or more devices holds the second identification information; the second identification information is a combination of the first identification information and third identification information (44) that is uniquely assigned to an individual device of the type identified by the first identification information; 3. The control device according to claim 1, wherein the generating means acquires the first identification information from the second identification information.

[0168] <Configuration 4> The control device according to any one of configurations 1 to 3, wherein the one or more devices include a control device (100) having the control engine and a security device (200) having the security engine.

[0169] <Component 5> The control device according to any one of configurations 1 to 4, wherein the storage means stores the first unique information in a distributed ledger format between the control device and an external device (3).

[0170] <Component 6> 6. The control device according to configuration 5, wherein the comparison means further compares the second unique information with the first unique information held by the external device.

[0171] <Component 7> A management method executed in a control device (1) including one or more devices, A step (S1) of storing first unique information generated in advance; A step (S5, SQ108, SQ110) of generating second unique information using identification information acquired from each of the one or more devices in response to a request to start execution of the control program (140); A step of comparing the first unique information with the second unique information (S6, SQ112); and determining whether or not the control program is executable based on the result of the comparison (S8, SQ114). A management method, wherein the generating step includes a step (SQ108) of selecting, for each of the one or more devices, the identification information from first identification information that identifies a type of the device and second identification information that individually identifies the device in accordance with a security policy.

[0172] <Component 8> A security program (230) for causing a computer to execute a management method executed in a control device (1) including one or more devices, The management method includes: A step (S1) of storing first unique information generated in advance; A step (S5, SQ108, SQ110) of generating second unique information using identification information acquired from each of the one or more devices in response to a request to start execution of the control program (140); A step of comparing the first unique information with the second unique information (S6, SQ112); and determining whether or not the control program is executable based on the result of the comparison (S8, SQ114). A security program, wherein the generating step includes a step (SQ108) of selecting, for each of the one or more devices, the identification information from first identification information that identifies a type of the device and second identification information that individually identifies the device in accordance with a security policy.

[0173] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is indicated by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims. In addition, the inventions described in the embodiments and each modified example are intended to be implemented, as far as possible, either alone or in combination. [Explanation of symbols]

[0174] 1 Control device, 2 Information system network, 3 Upper device, 4 Field network, 10 Control system, 20 Unique information (first unique information), 22 Unique information (second unique information), 30 Management information, 40 Identification information (second identification information), 42 Identification information (first identification information), 44 Serial number (third identification information), 50 Block, 52 Block hash value, 54 System configuration information, 56 Nonce, 100 Control unit, 102, 202 Processor, 104, 204 Chip set, 106, 206 Main memory device, 108, 208 Secondary memory device, 110, 210 Communication controller, 112, 212 USB controller, 114, 214 Memory card interface, 115, 215 Memory card, 116 Field network controller, 118 Internal bus controller, 120, 220 Information system network controller, 130 Authentication program, 132 authentication unit, 134 judgment request unit, 136 identification information transmission unit, 138 identification information collection unit, 140 control program, 142 control engine, 144 control program execution unit, 200 security unit, 230 security engine, 232 permission unit, 234 generation unit, 236 storage unit, 236A distribution unit, 236B, 236D mining unit, 236C, 236E block hash value calculation unit, 238 matching unit, 240 security program, 300 I / O unit, 400 communication coupler, 1082, 2082 system program, 2322 judgment unit, 2324 matching request unit, 2342 collection request unit, 2344 system hash value calculation unit, 2362 registration unit.

Claims

1. A control device including a plurality of devices, a control engine for executing a control program; a security engine that manages whether or not the control program can be executed by the control engine; The security engine includes: a generating means for generating unique information using identification information acquired from each of the plurality of devices; A storage means for storing first unique information generated in advance; a matching means for matching the second unique information generated by the generating means in response to a matching request with the first unique information; a permission means for requesting the collation in response to a request to start execution of the control program, and determining whether or not to permit execution of the control program based on a collation result obtained from the collation means, The generation means selects, for a first device among the plurality of devices belonging to a first group, first identification information that identifies a type of the device as the identification information, and selects, for a second device among the plurality of devices belonging to a second group, second identification information that individually identifies the device as the identification information.

2. Each of the plurality of devices holds the second identification information; the second identification information is a combination of the first identification information and a third identification information that is uniquely assigned to an individual device of a type identified by the first identification information; The control device according to claim 1 , wherein the generating means acquires the first identification information from the second identification information.

3. The control device according to claim 1 , wherein the plurality of devices includes a control device having the control engine and a security device having the security engine.

4. The control device according to claim 1 , wherein the holding means holds the first unique information in a distributed ledger format between the control device and an external device.

5. The control device according to claim 4 , wherein the checking means further checks the second unique information against the first unique information held by the external device.

6. A management method executed in a control device including a plurality of devices, comprising: A step of storing first unique information generated in advance; generating second unique information using identification information acquired from each of the plurality of devices in response to a request to start execution of a control program; A step of matching the first unique information with the second unique information; and determining whether or not the control program is executable based on a result of the comparison. The generating step includes: selecting, for a first device belonging to a first group among the plurality of devices, first identification information that identifies a type of the device as the identification information; and selecting, for a second device belonging to a second group among the plurality of devices, second identification information that individually identifies the device as the identification information.

7. A security program for causing a computer to execute a management method executed in a control device including a plurality of devices, The management method includes: A step of storing first unique information generated in advance; generating second unique information using identification information acquired from each of the plurality of devices in response to a request to start execution of a control program; A step of matching the first unique information with the second unique information; and determining whether or not the control program is executable based on a result of the comparison. The generating step includes: selecting, for a first device belonging to a first group among the plurality of devices, first identification information that identifies a type of the device as the identification information; and selecting, for a second device belonging to a second group among the plurality of devices, second identification information that individually identifies the device as the identification information.

Images