Operation verification system and operation verification method

Abstract

To reproduce operation in virtual environment, while concealing an operation logic itself in a reproduction object, and enable suitable operation verification.SOLUTION: An operation verification system 1 reproduces operation of an application 100 including a predetermined operation logic 101 in virtual environment 25, and verifies the operation. The system is configured to hold signal conversion means 301 in which relations between an input signal and an output signal in the operation logic 101 are defined, and reproduce and execute the application 100 in the virtual environment 25 in a manner that the operation logic 101 is substituted with the signal conversion means 301.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an operation verification system and an operation verification method. [Background technology]

[0002] There is a technology known as digital twin, which reproduces part or all of a control system (which may include plant equipment) in a virtual environment for the purpose of verifying its operation virtually, for example, in the case of control systems for plants, factories, and automobiles.

[0003] Because this digital twin exists in a virtual environment, it can be used to verify operation in situations that are difficult to reproduce or that are expected to have undesirable effects (such as malfunctions) in a real plant, or to try the same situation multiple times while changing the conditions, which are difficult to perform in a real system.

[0004] Areas where such verification is desirable include safety and efficiency, as well as the security of control systems, which has begun to attract attention since the 2010s.

[0005] When verifying control operations, it is necessary to reproduce the internal structure of control devices such as PLCs (Programmable Logic Controllers) and DCSs (Distributed Control Systems) in a virtual environment. However, for example, when evaluating the impact of a cyberattack on a control system or the effectiveness of countermeasures against such attacks, there may be situations where it is desirable to operate the control system at a level that takes into account the software and hardware that operate within it, as well as their vulnerabilities.

[0006] As a conventional technique related to such verification, a virtual plant monitoring and control system (see Patent Document 1) has been proposed, which realizes the same functions as an actual plant monitoring and control system on a general-purpose computer.

[0007] This virtual plant monitoring and control device is a device comprising: a human-machine interface device that outputs the contents of input operations for controlling controlled equipment installed in a plant and graphically displays the input data; a control device that controls the controlled equipment using pre-installed control logic in accordance with the contents of the input operation and outputs data obtained from the controlled equipment to the human-machine interface device; a virtual control device that virtualizes the control device using the hypervisor; a virtual human-machine interface device that virtualizes the human-machine interface device using the hypervisor; and a first virtual network device that virtualizes a network for transmitting and receiving data between the human-machine interface device and the control device and transmits and receives data between the virtual human-machine interface device and the virtual control device through the virtualized network. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-138525 Summary of the Invention [Problem to be solved by the invention]

[0009] For example, when providing a service that uses the digital twin described above to assess the impact of cyber attacks on control systems and evaluate countermeasures, it is necessary to reproduce the control system in a virtual environment.

[0010] In this case, by reproducing the software installed in the target control system, it is possible to reproduce the operation with high accuracy. However, from the perspective of the customer who operates the control system, there are cases where disclosure of the software containing the company's know-how is required. In such cases, the customer may be concerned about the leakage of such know-how and various intellectual property.

[0011] Therefore, an object of the present invention is to provide a technology that enables suitable operation verification by reproducing the operation in a virtual environment while keeping the operation logic itself of the object to be reproduced secret. [Means for solving the problem]

[0012] The operation verification system of the present invention, which solves the above-mentioned problems, is a system that reproduces the operation of an application including a predetermined operation logic in a virtual environment and verifies the operation, and defines the relationship between input signals and output signals in the operation logic. , and controlling the accuracy of the output signal according to a setting. The virtual environment includes a signal conversion means, and the application is reproduced and executed in the virtual environment with the operation logic replaced by the signal conversion means.

[0013] The operation verification method of the present invention also includes a step of: an information processing system defining a virtual environment for reproducing the operation of an application and a relationship between an input signal and an output signal in a predetermined operation logic included in the application; , and controlling the accuracy of the output signal according to a setting. The virtual environment includes a signal conversion means, and the application is reproduced and executed in the virtual environment with the operation logic replaced by the signal conversion means. [Effects of the Invention]

[0014] According to the present invention, the operation of the object to be reproduced can be reproduced in a virtual environment while the operation logic itself is kept secret, thereby enabling suitable operation verification. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 illustrates an example of the overall configuration of an operation verification system according to an embodiment of the present invention. [Figure 2] FIG. 1 is a diagram illustrating an example of the configuration of a control system according to an embodiment of the present invention. [Figure 3] FIG. 2 is a diagram illustrating an example of the configuration of a virtual execution device according to the present embodiment. [Figure 4]FIG. 10 is a diagram illustrating an example of the configuration of equivalent secret logic in the present embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of the configuration of an equivalent confidential logic generating means in the present embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of the configuration of an equivalent secret logic setting means in the present embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of a flow of an operation verification method according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] [Example 1] An embodiment of an operation verification system according to the present invention will be described below with reference to the drawings. <System configuration> First, the overall configuration of the operation verification system 1 in this embodiment will be described. Fig. 1 shows the overall configuration of the operation verification system 1 in this embodiment.

[0017] The operation verification system 1 includes a control system 10 to be verified, a virtual execution means 20, an equivalent secure logic 301, an equivalent secure logic generation means 30, an equivalent secure logic setting means 40, and a network 50.

[0018] Of these, the control system 10 is a system that controls an actual plant or facility, and includes a control device 11, a management device 12, and a controlled object 13, as shown in FIG.

[0019] Programmable Logic Controller (PLC) and Distr A control device 11, which is realized by a distributed control system (DCS) or other control computer, controls a controlled object 13, such as a plant or equipment, connected via input / output signals 14, in accordance with the control procedures and control models described in an application 100.

[0020] Furthermore, the management device 12 is connected to the control device 11 via a network 15, and provides the user of the control system 10 with management functions such as various settings for the control device 11 and monitoring of the operating status.

[0021] The application 100 may also include confidential logic 101 that reflects the know-how of the developer or user of the control system 10. In the application 100, the confidential logic 101 is combined with other non-confidential logic 102.

[0022] The confidential logic 101 and the non-confidential logic 102 may each take the form of a portion of source code or source diagram, an independent object module, etc. Note that the control system 10 may include multiple applications 100, each of which may include different confidential logic 101 and non-confidential logic 102.

[0023] Returning now to the explanation of Fig. 1, the virtual execution means 20 in the operation verification system 1 is a means for reproducing the operation of the control system 10 without using the actual controlled object 13.

[0024] As shown in FIG. 3, the virtual execution means 20 includes a processor 21, a memory 22, a bus 23 connecting them, a hypervisor 24 and a virtual environment 25 realized by the functions of 21 to 23.

[0025] Of these, the virtual environment 25 is an environment in which a model of the operation of the hardware and software that constitute the control system 10 operates. Of the elements of the control system 10, only the virtual control device 210, which is a virtualized version of the control device 11, and the application 100 that it executes are described here. The virtual environment 25 also monitors the execution of the virtual control device 210 and the application 100, and outputs a log 26 related to the operating status.

[0026] The hypervisor 24 coordinates the use of resources such as the processor 21 and memory 22 required to run the virtual environment 25 .

[0027] Returning now to the explanation of Fig. 1, the equivalent secure logic 301 is a source code or object module that conceals the internal structure of the secure logic 101 and is configured so that an output signal can be obtained directly from an input signal.

[0028] 4, the equivalent confidential logic 301 includes an input / output correspondence rule 3011, an internal state 3012, and precision adjustment means 3015. In the input / output correspondence rule 3011, the equivalent confidential logic 301 obtains an output value 3014 corresponding to the value of an input signal 3013 and the value of the internal state 3012 at the time of input.

[0029] The internal state 3012 generates an internal state value at the next time from part or all of the output value 3014 and updates itself. The accuracy adjustment means 3015 adjusts the accuracy of the output value 3014 based on the accuracy command value 3016 to an extent that the know-how of the confidential logic 101 is not identified, and outputs it to the outside as an adjusted output value 3017.

[0030] The adjustment of the output value 3014 by the precision adjustment means 3015 can be realized by, for example, reducing the resolution of the output value, reducing the time resolution, thinning out the output signal, or a combination of these.

[0031] One example of a method for reducing the resolution of an output value is to increase the quantization step of the output value. For example, a value that would normally be expressed in a 16-bit range may be output as 12 bits by truncating the lowest 4 bits.

[0032] One example of a method for reducing the resolution in the time direction is to reduce the sampling timing of the output value from 10 ms to 100 ms. This changes the waveform and pulse width of the output signal, concealing detailed signal behavior. Furthermore, thinning the output signal completely conceals behavior by not sampling part of the output signal, and can be considered an extreme reduction in value or time resolution.

[0033] These resolution reductions may not only be permanent, but may also be applied only to specific time periods according to the definition of the accuracy command value 3016. Furthermore, accuracy reduction may be performed to different degrees for each time period.

[0034] Returning now to the explanation of Fig. 1, the equivalent secure logic generation means 30 is a means for generating equivalent secure logic 301, particularly input / output correspondence rules 3011, from the secure logic 101. For example, as shown in Fig. 5, this equivalent secure logic generation means 30 includes a virtual environment 31, an input generation means 32, an output recording means 33, and a correspondence relationship generation means 34.

[0035] Returning now to the explanation of Fig. 1, the equivalent secure logic setting means 40 is a means for generating an accuracy command value 3016 that controls the output accuracy from the equivalent secure logic 301. As shown in Fig. 6, this equivalent secure logic setting means 40 includes an execution state analysis means 401 and an execution accuracy determination means 402.

[0036] Of these, the execution status analysis means 401 acquires the log 26 output from the virtual execution means 20 and analyzes the extent and degree of influence of the output of the equivalent confidential logic 301 on the control system 10, i.e., the contribution of the equivalent confidential logic 301 to the output of the control system 10.

[0037] Based on the analysis results of the execution state analysis means 401, the execution accuracy determination means 402 determines the output accuracy of the equivalent secure logic 301 required to achieve the target verification accuracy in the operation verification system 1 and to prevent the know-how of the secure logic 101 from being identified. The determined output accuracy is supplied to the equivalent secure logic 301 as an accuracy command value 3016. <Operation verification method> The actual procedure of the operation verification method in this embodiment will be described below with reference to the drawings. The various operations corresponding to the operation verification method described below are realized by a program that is read into memory or the like and executed by the devices that make up the operation verification system 1. This program is composed of code for performing the various operations described below.

[0038] 7 is a diagram showing an example of a flow of the operation verification method in this embodiment. First, the virtual execution means 20 separates the confidential logic 101 from the application 100 in the virtual control device 210 (which is a reproduction of the control system 10 to be verified) and replaces it with a predetermined dummy logic (s10).

[0039] Thereafter, the virtual execution means 20 operates the virtual control device 210, which is equipped with the application 100 including the above-mentioned dummy logic, in the virtual environment 25 (s11). At this point, the virtual control device 210 does not operate as a complete control device, but the operation log 26 output from the virtual environment 25 records the access operation to the dummy logic that has replaced the confidential logic 101 and how the output value from the dummy logic is used by the virtual control device 210.

[0040] Next, the equivalent confidential logic setting means 40 acquires the above-mentioned operation log 26 from the virtual execution means 20, and analyzes the access operations to the above-mentioned dummy logic and the usage status of the output from the dummy logic in the execution state analysis means 401 (s12).

[0041] As a result of this analysis, the execution state analysis means 401 obtains the time when the operation of the secure logic 101 is required and the contribution of the output from the secure logic 101 to the output of the virtual controller 210 .

[0042] Next, the execution accuracy determination means 402 derives the time at which the output accuracy of the secure logic 101 should be controlled based on the information on the time at which the operation of the secure logic 101 is required obtained in the analysis of s12 (s13).The execution accuracy determination means 402 also derives the output accuracy required for the output of the secure logic 101 based on the information on the contribution of the output obtained in the analysis of s12 and the verification accuracy required in the operation verification system 1 (s14).

[0043] The execution accuracy determination means 402 finally generates an accuracy command value 3016 from the time when the output accuracy of the secure logic 101 should be controlled and the output accuracy required for the output of the secure logic 101 (s15).

[0044] The secure logic 101 separated from the application 100 is stored in the virtual environment 31 in the equivalent secure logic generating means 30 shown in FIG.

[0045] The virtual environment 31 may be realized with the same configuration as the virtual environment 25 in the virtual execution means 20, and since the virtual environment 31 is smaller in scale than the virtual control system 210 if it contains only the confidential logic 101, it may be realized with a simple configuration using only a means such as an interpreter that reads and executes the code of the confidential logic 101.

[0046] Within the virtual environment 31, the input generating means 32 sequentially generates patterns of input signals expected for the confidential logic 101 and inputs them to the confidential logic 101, and the output recording means 33 collects the output signals from the confidential logic 101 and the internal state of the confidential logic 101 (s16).

[0047] Furthermore, the correspondence generating means 34 associates the input signal generated by the input generating means 32 with the output signal and internal state collected by the output recording means 33, and generates an input / output correspondence rule 3011 to be installed in the equivalent confidential logic 301 (s17).

[0048] Naturally, the type and degree of accuracy adjustment required to achieve the verification accuracy of the operation verification system 1 will vary depending on the application 100, so the input / output correspondence rule 3011 and accuracy command value 3016 must be generated each time the application 100 is changed.

[0049] Furthermore, the correspondence generating means 34 loads the generated input / output correspondence rule 3011 and precision command value 3016 into the equivalent security logic 301 (s18).

[0050] The virtual execution means 20 also replaces the equivalent confidential logic 301 with dummy logic (which replaced the confidential logic 101 in the application 100) again in the virtual environment 25, and combines it with the non-confidential logic 102 (s19). At this point, the virtual control device 210 including the application 100 becomes capable of operating as a complete control device.

[0051] The configuration and operation of the operation verification system 1 described above allows the control system 1 to be verified. The confidential logic 101 included in the virtual execution means 20 is replaced with equivalent confidential logic 301 whose contents are concealed, and the accuracy of the output is adjusted to a degree that can achieve the target accuracy of the operation verification system 1. Therefore, the desired operation verification can be achieved without disclosing the detailed behavior of the confidential logic 101 that reflects know-how to the operator of the virtual execution means 20. [Example 2] Next, a description will be given of another embodiment of the operation verification system 1. In this embodiment, a case will be described in which the operation verification system 1 is configured for the purpose of verifying the behavior of the control system 10 under a cyber attack.

[0052] The configuration of this embodiment is similar to that of the first embodiment, but the operation and usage of some of the components are different, so the following description will focus on the differences.

[0053] 4 (in the first embodiment), it is assumed that the confidential logic 101 operates normally, so the input and output signals match those assumed at the time of design. On the other hand, in this embodiment, the confidential logic 101 is configured so that the manifestation of a certain vulnerability causes unauthorized operation, resulting in some output signals and internal states that differ from those assumed.

[0054] This is realized by configuring the input generating means 32 in the equivalent secret logic generating means 30 so as to generate an illegal input, and by generating an output in the output recording means 33 that is not actually generated.

[0055] By incorporating the equivalent confidential logic 301 generated in this manner into the application 100 and executing it within the virtual environment 25, the behavior of the virtual control system 210 in the event of abnormal operation simulating a cyber attack can be evaluated via the operation log 26.

[0056] The operation described above allows the operation of an application including logic that reflects know-how to be reproduced in a virtual environment in the operation verification system 1 without disclosing the contents of the logic or its detailed behavior, making it possible to evaluate the operation under various conditions without affecting the real-world control system.

[0057] It should be noted that in the above description, functions and means for which no special mention is made regarding their configuration may be realized by a program executed by a combination of electric circuits, electronic circuits, logic circuits, and integrated circuits incorporating them, as well as microcomputers, processors, and similar arithmetic devices, ROM, RAM, flash memory, hard disks, SSDs, memory cards, optical disks, and similar storage devices, buses, networks, and similar communication devices, and peripheral devices, and the present invention can be realized in any manner.

[0058] Furthermore, the present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0059] According to this embodiment, instead of the logic portion of the operation based on know-how, a signal conversion means configured to have an equivalent signal input / output relationship is used, so that the same operation can be reproduced in a virtual environment while keeping the original operation logic secret, making it possible to verify the operation of an application without disclosing the customer's know-how.

[0060] In addition, there are cases where know-how is contained not only in the application's operational logic but also in the form of the signals output from it. In such cases, the customer's know-how can be prevented from being disclosed by reducing the output precision of the operational logic to a level that achieves the desired operational precision in the control system in the virtual environment.

[0061] Furthermore, it is possible to reproduce the operation in a virtual environment while keeping the operation logic of the object to be reproduced secret, thereby enabling suitable operation verification.

[0062] The description of this specification makes at least the following clear: In the operation verification system of this embodiment, the signal conversion means may control the precision of the output signal in accordance with a setting.

[0063] This not only addresses the operational logic of the application, but also the case where know-how is included in the form of the signal output from it, and by reducing the output accuracy of the operational logic to the extent that the desired operational accuracy can be verified in the control system within the virtual environment, it is possible to prevent the customer's know-how from being made public.

[0064] In the operation verification system of this embodiment, the signal conversion means may control at least the value resolution and the time resolution as the precision of the output signal.

[0065] This allows us to handle cases where know-how is included not only in the operational logic of the application but also in the form of the signals output from it, and by more accurately reducing the output accuracy of the operational logic to the extent that the operational accuracy desired to be verified in the control system within the virtual environment is obtained, it is possible to prevent the customer's know-how from being made public.

[0066] Furthermore, in the operation verification system of this embodiment, the signal modification means may set the accuracy of the output signal in correspondence with at least one of the time within the virtual environment, a specific area of ​​the application executed within the virtual environment, and an input / output signal in the application.

[0067] This allows us to handle cases where know-how is included not only in the operational logic of the application but also in the form of the signals output from it, and by more accurately reducing the output accuracy of the operational logic to the extent that the operational accuracy desired to be verified in the control system within the virtual environment is obtained, it is possible to prevent the customer's know-how from being made public.

[0068] Furthermore, in the operation verification system of this embodiment, the signal modification means may determine the setting for the accuracy of the output signal, which is associated with at least one of time within the virtual environment, a specific area of ​​the application executed within the virtual environment, and an input / output signal in the application, based on the analysis results of the part of the application excluding the operation logic.

[0069] This allows us to handle cases where know-how is included not only in the operational logic of the application but also in the form of the signals output from it, and by more accurately reducing the output accuracy of the operational logic to the extent that the operational accuracy desired to be verified in the control system within the virtual environment is obtained, it is possible to prevent the customer's know-how from being made public.

[0070] In addition, in the operation verification system of this embodiment, the signal conversion means may be generated based on the correspondence between input signals and output signals obtained from the analysis results of the operation logic of the application.

[0071] This allows us to handle cases where know-how is included not only in the operational logic of the application but also in the form of the signals output from it, and by more accurately reducing the output accuracy of the operational logic to the extent that the operational accuracy desired to be verified in the control system within the virtual environment is obtained, it is possible to prevent the customer's know-how from being made public. [Explanation of symbols]

[0072] 1 Operation verification system 10. Control System 11 Control device 12 Management device 13 Control Objects 14 Input / Output Signals 15 Network 20 Virtual Execution Means 21 processors 22 Memory 23 Bus 24 Hypervisor 25 Virtual Environment 26 Execution Log 26 Execution Log 30 Equivalent confidential logic generation means 31 Virtual Environment 32 Input Generation Means 33 Output recording means 34 Correspondence generation means 40 Equivalent secret logic setting means 50 Network 100 Applications 101 Confidential Logic 102 Non-Confidential Logic 210 Virtual Control Device 301 Equivalent Confidential Logic 3011 Input / Output Correspondence Rules 3012 Internal State 3013 Input signal 3014 Output signal 3015 Accuracy adjustment means 3016 Precision command value 3017 Adjusted output value 401 Execution status analysis means 402 Execution accuracy determination means

Claims

1. A system for reproducing the operation of an application including predetermined operation logic in a virtual environment and verifying the operation, a signal conversion means for determining the relationship between an input signal and an output signal in the operation logic and controlling the precision of the output signal in accordance with a setting; and a means for reproducing and executing the application in the virtual environment with the operation logic replaced by the signal conversion means; An operation verification system characterized by:

2. the signal conversion means controls at least the value resolution and the time resolution as the accuracy of the output signal; 2. The operation verification system according to claim 1.

3. In the signal conversion means, the precision of the output signal is set in correspondence with at least one of time in the virtual environment, a specific area of ​​the application executed in the virtual environment, and an input / output signal of the application.

2. The operation verification system according to claim 1.

4. In the signal conversion means, a setting for precision of the output signal associated with at least one of time in the virtual environment, a specific area of ​​the application executed in the virtual environment, and an input / output signal of the application is determined based on an analysis result of a portion of the application excluding the operation logic.

4. The operation verification system according to claim 3.

5. the signal conversion means is generated based on a correspondence between an input signal and an output signal obtained from an analysis result of the operation logic of the application; 2. The operation verification system according to claim 1.

6. The information processing system a virtual environment that reproduces the operation of an application, and a signal conversion means that defines the relationship between input signals and output signals in a predetermined operation logic included in the application, and controls the precision of the output signals in accordance with settings; Reproducing and executing the application in the virtual environment with the operation logic replaced by the signal conversion means; 10. An operation verification method comprising:

Images