Encryption control system and encryption control program

Abstract

To provide an encryption control system that further reduces the risk of a cipher key leaking.SOLUTION: An encryption control system includes an input device, a plant-side control device, and a controller which are respectively equipped with pseudorandom number calculation units having a common function in a table record selection processing part, and are time synchronized, and start a synchronized operation at the same time. By thus configuring the encryption control system, it becomes possible to switch a pair of a public key and a private key in synchronization with the control cycle of the entire control system. Consequently, it becomes possible to instantaneously and definitely detect intervention in the control system by a malicious third party.SELECTED DRAWING: Figure 6

Description

Technical Field

[0001] The present invention relates to an encryption control system and encryption control program and pertains to it

Background Art

[0002] In recent years, with the development of information technology such as the Internet, in control systems that control infrastructure (Infrastructure: social infrastructure) that supports national life, such as electricity, gas, and water supply, or industrial facilities such as factories and power plants, networking using information technology has been progressing. Due to the networking of such control systems and the evolution of ICT (Information and Communication Technology), the control systems have received great benefits such as improved processing speed and sophistication of processing content. On the other hand, there is concern that the networking of control systems may introduce a new threat of cyberattacks. In fact, cyberattacks against control systems that monitor or control plant operations such as power plants and factories have emerged and are attracting attention as an important social issue

[0003] Under such circumstances, it is an urgent task to develop technologies for protecting control systems that support important infrastructure from cyberattacks. In addition to applying information security technologies to control systems, research on detecting cyberattacks and the like is being advanced

[0004] Patent Document 1 discloses a technology for an encryption control system, which includes the inventors of the present invention in part

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] In Patent Document 1, the inventor succeeded in realizing a control system in which the controller, which is the core part of the control system, directly performs calculations on encrypted input and output data, thereby eliminating the need for a public key and / or private key in the controller. With this invention, the control system only needs to be equipped with a private key in the plant, thereby reducing the risk of leakage of the public key and / or private key. However, Patent Document 1 uses only one public-key and private-key pair. Therefore, there is a risk that the encryption could be cracked using vast computing resources such as those found in cloud computing.

[0007] This invention solves the aforementioned problems, secret An encryption control system that can further reduce the risk of key leakage. and encryption control program The purpose is to provide. [Means for solving the problem]

[0008] To solve the above problems, the encryption control system of this disclosure includes: a controller that selects a first public key from among multiple public keys stored in association with multiple time information based on first time information, and transmits a target value encrypted with the first public key and the first time information; and a plant-side control device that is synchronized with the controller and selects a first secret key from among multiple secret keys stored in association with multiple time information based on first time information, and controls a controlled object based on the target value decrypted with the first secret key. fruitThe plant-side control device selects a second public key from among multiple public keys stored in association with multiple time information based on the second time information, and sends the second time information and the operation information of the controlled object encrypted with the second public key to the controller. The controller selects a specific encryption parameter from among multiple encryption parameters stored in association with multiple time information based on the second time information, processes the operation information of the controlled object in an encrypted state using the specific encryption parameter, and generates an encrypted control input for controlling the controlled object. Furthermore, the controller transmits the encrypted control input and the second time information to the plant-side control unit. The plant-side control unit selects the second secret key from among several secret keys based on the second time information, and controls the controlled object based on the control input obtained by decrypting the encrypted control input with the second secret key. Furthermore, the controller generates an encrypted control input by multiplying a specific encryption parameter by the encrypted operation information of the controlled object. Furthermore, the operational information of the controlled object includes error information regarding the operation of the controlled object relative to the target value. Furthermore, the first and second time information are set based on the control cycle of the controlled object. Furthermore, the controller stores multiple public keys and multiple encryption parameters associated with record numbers that can be calculated based on multiple time information, while the plant-side control unit stores multiple private keys and multiple public keys associated with record numbers. Furthermore, the encryption control program of this disclosure includes selecting a first public key from among multiple public keys stored in association with multiple time information based on the first time information, and transmitting the target value encrypted with the first public key and the first time information to the controller; and in a plant-side control device synchronized with the controller, selecting a first secret key from among multiple secret keys stored in association with multiple time information based on the first time information, and controlling the controlled object based on the target value decrypted with the first secret key. The plant-side control device selects a second public key from among multiple public keys stored in association with multiple time information based on the second time information, and transmits the operation information of the controlled object encrypted with the second public key and the second time information to the controller. The controller selects a specific encryption parameter from among multiple encryption parameters stored in association with multiple time information based on the second time information, processes the operation information of the controlled object in an encrypted state using the specific encryption parameter, and generates an encrypted control input for controlling the controlled object. Have the computer execute it. [Effects of the Invention]

[0009] According to the present invention, secret an encryption control system that can further reduce the risk of key leakage and encryption control program can be provided. Problems, configurations, and effects other than those described above will be clarified by the description of the following embodiments.

Brief Description of Drawings

[0010] [Figure 1] It is a schematic diagram showing the overall configuration of an encryption control system according to an embodiment of the present invention. [Figure 2] It is a block diagram showing the hardware configuration of an input device. [Figure 3] It is a block diagram showing the hardware configuration of a controller. [Figure 4] It is a block diagram showing the hardware configuration of a plant-side control device. [Figure 5] It is a block diagram showing the hardware configuration of a date and time information source device. [Figure 6] It is a block diagram showing the software functions in the control network of an encryption control system. [Figure 7] It is a block diagram showing the software functions in the information network of an encryption control system. [Figure 8] It is a table showing the field configurations of a public key table, a public key sub-table, and an encryption parameter table. [Figure 9] It is a block diagram explaining the software functions of a table record selection processing unit of an input device and a controller, and the software functions of a table record selection processing unit at the encryption target value of a plant-side control device. [Figure 10] It is a block diagram explaining the software functions of a table record selection processing unit in the encryption control input of a plant-side control device. [Figure 11] It is a flowchart showing the flow of a synchronous operation start process in a date and time information generation unit of a controller. [Figure 12] It is a flowchart showing the operation flow of the pseudo-random number calculation unit of the controller. [Figure 13] It is a time chart explaining the synchronous operation of the encryption control system. [Figure 14] It is a graph of the control input u and the target error ε in the encryption control system according to Patent Document 1 and the encryption control system according to an embodiment of the present invention. [Figure 15] It is a graph of the attack detector in the encryption control system according to Patent Document 1 and the encryption control system according to an embodiment of the present invention. [Figure 16] It is a block diagram showing the software functions in the control network of the controller according to a modification example of the embodiment of the present invention.

Embodiments for Carrying Out the Invention

[0011] [Embodiment of Encryption Control System 101] FIG. 1 is a schematic diagram showing the overall configuration of an encryption control system 101 according to an embodiment of the present invention. In the following description, an encrypted value is represented by a function Enc(). The encryption control system 101 includes an input device 102, a plant-side control device 103, a controller 104, and a date and time information source device 105. The input device 102 transmits an encrypted target value Enc(r) obtained by encrypting the target value r with public key encryption to the plant-side control device 103 through the controller 104. A control target 106 and a sensor 107 are connected to the plant-side control device 103. The plant-side control device 103 gives a control signal to the control target 106 and acquires an observed value y, which is the state information of the control target 106, from the sensor 107. Then, it is connected to the controller 104 via a second control network L109 and performs transmission and reception of encrypted control information.

[0012] Controller 104 is connected to input device 102 via first control network L108 and to plant-side control device 103 via second control network L109. Controller 104 receives the encryption target value Enc(r) from input device 102 via first control network L108 and the encryption target error Enc(ε) from plant-side control device 103 via second control network L109. Then, without decrypting this encrypted information, it performs predetermined calculation processing and transmits the calculation result, encrypted control input Enc(u), to plant-side control device 103 via second control network L109.

[0013] The public-key cryptography used in the encryption control system 101 according to an embodiment of the present invention is a homomorphic public-key cryptography, such as RSA encryption (Rivest Shamir Adleman), as disclosed in Patent Document 1. Homomorphic public-key cryptography makes it possible to make the value before encryption match the multiplied value by multiplying two encrypted values ​​without decryption and then decrypting the multiplied value. A description of the homomorphism of public-key cryptography is provided in Patent Document 1. In the encryption control system 101 according to the embodiment of the present invention, there are no changes to the arithmetic processing of public-key cryptography itself, except for the use of multiple public-key and private-key pairs. Therefore, a detailed explanation of public-key cryptography itself will be omitted.

[0014] The input device 102, controller 104, and plant-side control device 103 are each connected to the date and time information source device 105 via the information network L110. The date and time information source device 105 is a personal computer or server running a network OS, an NTP server (Network Time Protocol), and an NTP client. The first control network L108 and the second control network L109 are networks that prioritize the reliability of data transfer, and various types of network interfaces are available. On the other hand, the information network L110 does not require the same level of reliability as the control network. In the embodiments of the present invention, the well-known TCP / IP is used.

[0015] The input device 102, controller 104, and plant-side control device 103 are a device called a programmable controller. Modules of a size that fits into the slots are housed in a case-shaped mounting base 111 which has many slots, according to the required functions. The mount base 111 has a built-in interface for connecting modules to each other. When a module is inserted into a slot, data transmission and reception between modules, as well as proper power supply, are established.

[0016] The mounting base 111a of the input device 102 is equipped with a CPU module 112, an information network module 113, and a first control network module 114a. The controller 104's mounting base 111b is equipped with a CPU module 112, an information network module 113, a first control network module 114b, and a second control network module 115. The mounting base 111c of the plant-side control device 103 is equipped with a CPU module 112, an information network module 113, a second control network module 115, and an input / output module 116. The first control network module 114a of the input device 102 is the transmitting side, and the first control network module 114b of the controller 104 is the receiving side. The controller 104 and the second control network module 115 of the plant-side control device 103 have their respective transmitting and receiving terminals connected to each other.

[0017] [Hardware configuration of input device 102] Figure 2 is a block diagram showing the hardware configuration of the input device 102. The input device 102 includes a CPU module 112, an information network module 113, and a first control network module 114a, all of which are connected to a module bus 201 provided on the mount base 111. The CPU module 112 includes a CPU 202, ROM 203, RAM 204, and an RTC (Real Time Clock) 205 that generates date and time information, all connected to an internal bus 206. The internal bus 206 is connected to a module bus 201. The ROM 203 of the CPU module 112 stores programs for performing control calculations and encryption processing in the encryption control system 101.

[0018] The information network module 113 comprises a CPU 202, ROM 203, RAM 204, and a NIC (Network Interface Card) 207, all connected to an internal bus 206. The internal bus 206 is connected to a module bus 201. The ROM 203 of the information network module 113 stores the network OS, an NTP server program, an NTP client program, and the like. The first control network module 114a has a transmitter 208 connected to the module bus 201.

[0019] [Hardware configuration of controller 104] Figure 3 is a block diagram showing the hardware configuration of controller 104. The controller 104 includes a CPU module 112, an information network module 113, a first control network module 114b, and a second control network module 115, all connected to a module bus 201 provided on the mount base 111. The CPU module 112 and the information network module 113 are the same as those in the input device 102, so their explanation will be omitted. The first control network module 114b has a receiver 309 connected to the module bus 201. The second control network module 115 has a transmitter 208 and a receiver 309 connected to an internal bus 206. The internal bus 206 is connected to the module bus 201.

[0020] [Hardware configuration of the plant-side control device 103] Figure 4 is a block diagram showing the hardware configuration of the plant-side control device 103. The plant-side control device 103 includes a CPU module 112, an information network module 113, a second control network module 115, and an input / output module 116, all connected to a module bus 201 provided on the mount base 111. The CPU module 112, information network module 113, and second control network module 115 are the same as those in the controller 104, so their explanation will be omitted. The input / output module 116 includes an A / D converter 410 connected to the internal bus 206, to which the sensor 107 is connected, and a D / A converter 411 connected to the controlled object 106. The internal bus 206 is connected to the module bus 201. Note that this input / output module 116 is merely an example, and depending on the connected object such as the controlled object 106 or sensor 107, signal processing circuits connected to the A / D converter 410 and D / A converter 411 may be required.

[0021] [Hardware configuration of the date and time information source device 105] Figure 5 is a block diagram showing the hardware configuration of the date and time information source device 105. The date and time information source device 105, which consists of a server device or a personal computer, includes a CPU 501, ROM 502, RAM 503, non-volatile storage 504, RTC 505, and NIC 506 connected to the bus 507. If a personal computer is used, it may also include a display unit 508 and an operation unit 509. The non-volatile storage device 504 stores the network OS, an NTP server program, and an NTP client program.

[0022] [Software functions in the control network of the encryption control system 101] Figure 6 is a block diagram showing the software functions in the control network of the encryption control system 101. Due to space limitations, the information network L110 is omitted from Figure 6. The information network L110 will be explained in Figure 7. The input device 102 generates an encrypted target value Enc(r) and transmits it to the plant-side control device 103 via the controller 104. The target value input unit 601 provides the unencrypted target value r to the input / output control unit 602. The input / output control unit 602 passes the target value r input from the target value input unit 601 to the encryption processing unit 603. Then, it receives the encrypted target value Enc(r) generated by the encryption processing unit 603 and transmits it to the controller 104.

[0023] The encryption processing unit 603 uses the public key record selected by the table record selection processing unit 605 from the public key subtable 604 to encrypt the target value r received from the input / output control unit 602. Then, it passes the generated encrypted target value Enc(r) back to the input / output control unit 602. The table record selection processing unit 605 generates a record number (label) for the public key subtable 604 based on the current date and time information received from the date and time information generation unit 606. Then, it reads the public key recorded in the record of the public key subtable 604 corresponding to the generated label and passes it to the encryption processing unit 603. The date and time information generation unit 606 outputs the current date and time information and also controls the start and stop of the table record selection processing unit 605.

[0024] The encrypted target value Enc(r), transmitted from the input device 102 to the controller 104 via the cable of the first control network module 114a, is input to the input / output control unit 607 of the controller 104. The input / output control unit 607 transmits the encryption target value Enc(r) received from the input device 102 directly to the plant-side control device 103 via the transmission unit 208 of the second control network module 115. Then, the encryption target error Enc(ε) received from the plant-side control device 103 via the reception unit 309 of the second control network module 115 is passed on to the multiplication unit 608.

[0025] The multiplication unit 608 calculates the encryption control input Enc(u) by multiplying the encryption target error Enc(ε) using the encryption parameter Enc(Parameters) selected by the table record selection processing unit 610 from the encryption parameter table 609. Note that the multiplication process between the encryption parameter Enc(Parameters) and the encryption target value Enc(r) in this multiplication unit 608 is not a simple multiplication, but a partial multiplication process disclosed in Patent Document 1. The multiplication unit 608 passes the encryption control input Enc(u), calculated by multiplying the encryption parameter Enc(Parameters) and the encryption target value Enc(r), to the input / output control unit 607.

[0026] The table record selection processing unit 610 generates a record number (label) for the encrypted parameter table 609 based on the current date and time information contained in the data frame received from the plant-side control device 103 via the receiving unit 309 of the second control network module 115. Then, it reads the encrypted parameters recorded in the record of the encrypted parameter table 609 corresponding to the generated label and passes them to the multiplication unit 608. The date and time information generation unit 611 outputs the current date and time information, as well as the date and time information for the start of synchronous operation (hereinafter referred to as "start date and time information") as instructed by the date and time information generation unit 611 of the controller 104. It also performs start and stop control for the table record selection processing unit 610. However, unlike the date and time information generation unit 606 of the input device 102, the current date and time information generated by the date and time information generation unit 611 of the controller 104 is not used in the calculation of labels in the encryption parameter table 609 performed by the table record selection processing unit 610. Instead, the current date and time information generated by the date and time information generation unit 611 is stored as encoded date and time information in the encoded date and time field of the data frame of the encryption control input Enc(u) transmitted from the multiplication unit 608 through the input / output control unit 607 and the transmission unit 208.

[0027] The encryption target value Enc(r) and encryption control input Enc(u), transmitted from the controller 104 to the plant-side control device 103 via the transmission unit 208 of the second control network module 115, are input to the decryption processing unit 612 via the receiving unit 309 of the second control network module 115 of the plant-side control device 103. The decryption processing unit 612 decrypts the encryption target value Enc(r) and the encryption control input Enc(u) using the secret key obtained from the table record selection processing unit 613. The decrypted target value r and the base values ​​of the control input u are passed to the control arithmetic processing unit 614.

[0028] The control processing unit 614 calculates the base values ​​for the target value r and the control input u to generate the target value r and the control input u. The control input u is then passed to the control processing unit 615. The control processing unit 615 generates a control signal from the control input u and controls the controlled object 106. For example, if the controlled object 106 is a motor, the control processing unit 615 controls the voltage, phase, etc., supplied to the motor. Once the controlled object 106 is controlled by the control processing unit 615, the operation of the controlled object 106 is detected by the sensor 107. The observation signal output by sensor 107 is converted into an observation value y by signal conversion processing unit 616. The observation value y output by signal conversion processing unit 616 is input to target error calculation processing unit 617 along with the target value r output by control calculation processing unit 614. The target error calculation processing unit 617 subtracts the observation value y from the target value r and outputs the target error ε. The target error ε is encrypted by the encryption processing unit 603 and converted into an encrypted target error Enc(ε). The encrypted target error Enc(ε) is transmitted to the controller 104 through the transmission unit 208 of the second control network module 115.

[0029] The table record selection processing unit 613 generates a record number (label) for the public key table 618 based on the current date and time information and startup date and time information contained in the data frame received from the controller 104 through the receiving unit 309 of the second control network module 115. It then reads the private key recorded in the record of the public key table 618 corresponding to the generated label and passes it to the decryption processing unit 612. Similarly, it reads the public key recorded in the record of the public key table 618 corresponding to the generated label and passes it to the encryption processing unit 603.

[0030] The date and time information generation unit 619 outputs the current date and time information, as well as the date and time information for the start of synchronous operation (hereinafter referred to as "start date and time information") as instructed by the date and time information generation unit 611 of the controller 104. The date and time information generation unit 619 also performs start and stop control for the table record selection processing unit 610. However, unlike the date and time information generation unit 606 of the input device 102, the current date and time information generated by the date and time information generation unit 619 of the plant-side control device 103 is not used for the calculation of labels in the public key table 618 performed by the table record selection processing unit 613. Instead, the current date and time information generated by the date and time information generation unit 619 is stored as encoded date and time information in the encoded date and time field of the encryption target error Enc(ε) data frame transmitted from the encryption processing unit 603 through the transmission unit 208.

[0031] Furthermore, the input / output control unit 602 of the input device 102 may be connected to an external monitoring device (not shown) as needed. The monitoring operator of the encryption control system 101 connects the external monitoring device to the input device 102 and performs the prescribed monitoring tasks. The input / output control unit 607 of the controller 104 is equipped with a log table 620 that records the encryption target value Enc(r), encryption control input Enc(u), encryption target error Enc(ε), etc., in an encrypted state, and is used for monitoring purposes.

[0032] [Software functions of the encryption control system 101 in the information network L110] Figure 7 is a block diagram showing the software functions of the encryption control system 101 in the information network L110. The date and time information generation unit 606 of the input device 102, the date and time information generation unit 611 of the controller 104, and the date and time information generation unit 619 of the plant-side control device 103 are connected to the date and time information source device 105 via the information network L110. The date and time information generation unit 606 of the input device 102, the date and time information generation unit 611 of the controller 104, and the date and time information generation unit 619 of the plant-side control device 103, all have the functions of a network OS, an NTP server program, and an NTP client program, similar to the date and time information source device 105, and each date and time information generation unit 606 synchronizes with the date and time information of the date and time information source device 105. Furthermore, one of the date and time information generation unit 606 of the input device 102, the date and time information generation unit 611 of the controller 104, or the date and time information generation unit 619 of the plant-side control device 103 will act as a master, directing the start of synchronous operation, while the other two will act as slaves, executing synchronous operation according to the master's instructions.

[0033] [Table field structure] Figure 8 is a table showing the field structure of the public key table 618, the public key subtable 604, and the cryptographic parameter table 609. The public key table 618 has a record number field, a public key field, and a private key field. The record number field stores an integer starting from 1. This record number is a unique identifier for a record in public key table 618 and is also called a label. The public key field stores the public key used in a public-key cryptography scheme to encrypt a desired value. The private key field stores the private key that corresponds to the public key in the public key field, used to decrypt an encrypted desired value in a public-key cryptosystem.

[0034] The public key subtable 604 has a record number field and a public key field. In other words, the public key subtable 604 is a subset of the public key table 618, obtained by removing the private key field from the public key table 618.

[0035] The encryption parameter table 609 has a record number field, an encryption first parameter field, an encryption second parameter field, and an encryption third parameter field. The first encrypted parameter field stores the first encrypted parameter Enc(Kp), which is the encrypted first parameter Kp that serves as the gain for the control system. The encrypted second parameter field stores the encrypted second parameter Enc(Ki), which is the second parameter Ki that serves as the gain for the control system. The encrypted third parameter field stores the encrypted third parameter Enc(Kd), which is the third parameter Kd that serves as the gain for the control system. The first parameter Kp, the second parameter Ki, and the third parameter Kd are invariant values ​​in the control system and are determined by predetermined calculations during the design of the control system. Note that the first parameter Kp, the second parameter Ki, and the third parameter Kd mentioned above are based on the assumption of PID control, but the control system is not limited to PID control. The encryption parameter table 609 has fields for encryption parameters according to the number of parameters required by the control system.

[0036] In the first encryption parameter field of the record number field in the encryption parameter table 609, where the record number field is "1", the first encryption parameter Enc(Kp) is stored, which is obtained by encrypting the first parameter Kp using the public key stored in the public key field of the record number field in the public key table 618 where the record number field is "1". Similarly, in the second encryption parameter field of the record number field in the encryption parameter table 609 where the record number field is "1", the second encryption parameter Enc(Ki) is stored, which is the second parameter Ki encrypted using the public key stored in the public key field of the record number field in the public key table 618 where the record number field is "1". Similarly, in the third encryption parameter field of the record number field in the encryption parameter table 609 where the record number field is "1", the third encryption parameter Enc(Kd) is stored, which is obtained by encrypting the third parameter Kd using the public key stored in the public key field of the record number field in the public key table 618 where the record number field is "1".

[0037] In the first encryption parameter field of the record number field in the encryption parameter table 609, where the record number field is "2", the first encryption parameter Enc(Kp) is stored, which is the first encryption parameter Kp encrypted using the public key stored in the public key field of the record number field in the public key table 618 where the record number field is "2". Similarly, the encryption parameters for each record in the encryption parameter table 609 are encrypted with the public key stored in the public key field of the public key table 618, which is associated with the record number field of each record.

[0038] [Table record selection processing section 605] Figure 9A is a block diagram illustrating the software functions of the table record selection processing unit 605 of the input device 102. The current date and time information output by the date and time information generation unit 606, along with the start date and time information 901 stored at the start of synchronous operation, is input to the step number calculation unit 902. The step number calculation unit 902 subtracts the start date and time information 901 from the current date and time information and divides by the step time to calculate the step number. For example, if the step time is 10 msec, the current date and time information is November 1, 2017, 09:30:05.100 seconds, and the start date and time information 901 is November 1, 2017, 09:30:05.000 seconds, then the step number is 100 ÷ 10 = 10. Note that the step time matches the control cycle of the controlled object 106.

[0039] Industrial equipment and the like execute a control program related to measurement and control at a certain control cycle. In the encrypted control system according to the embodiment of the present invention, the start date and time of the control program is set to 0, and the number of steps is counted for each control cycle. This number of steps is used in the pseudo-random number generation unit 903, which will be described later. Also, as will be explained in detail in Figure 13, in the plant-side control device 103, the number of steps advances by "1" between the data to be received and the data to be transmitted.

[0040] The step number output by the step number calculation unit 902 is input to the pseudo-random number calculation unit 903. Given an initial value 904, the pseudo-random number calculation unit 903 generates a pseudo-random number that is a non-negative integer or natural number by repeating a deterministic arithmetic operation for the number of steps input. The generated pseudo-random number is subjected to a modulo operation on the number of records in the public key subtable 604, and this remainder becomes the label, i.e., the record number. The pseudo-random number calculation unit 903 reads the public key field of the public key subtable 604 using the label and outputs the public key to the encryption processing unit 603. Note that whether the record number starts from 0 (a non-negative integer) or 1 (a natural number) is a design matter. The input device 102, the controller 104, and the table record selection processing unit 605 of the plant-side control device 103 are equipped with pseudo-random number generators 903 that perform the same calculations and are given the same initial value 904. As a result, each pseudo-random number generator 903 given the same number of steps outputs the same label.

[0041] Figure 9B is a block diagram illustrating the software functions of the table record selection processing unit 610 of the controller 104. The data frame D905 received from the plant-side control device 103 includes, in addition to the encryption target error Enc(ε), a start date and time field and an encoded date and time field. The encoded date and time information contained in the encoded date and time field and the start date and time information 901 contained in the start date and time field are input to the step number calculation unit 902. The step number calculation unit 902 subtracts the start date and time information 901 from the encoded date and time information and divides by the step time to calculate the step number. In other words, the processing of the step number calculation unit 902 in the controller 104 is exactly the same as that of the step number calculation unit 902 in the input device 102, except that the input data is different.

[0042] The step number output by the step number calculation unit 902 is input to the pseudo-random number calculation unit 903. Given an initial value 904, the pseudo-random number calculation unit 903 generates a pseudo-random integer or natural number greater than or equal to 0 by repeating a deterministic arithmetic operation for the number of steps input. The generated pseudo-random number is subjected to a modulo operation using the number of records in the encryption parameter table 609, and this remainder becomes the label, i.e., the record number. Using the label, the pseudo-random number calculation unit 903 reads the first encryption parameter field, the second encryption parameter field, and the third encryption parameter field from the encryption parameter table 609, and outputs the first encryption parameter, the second encryption parameter, and the third encryption parameter to the multiplication unit 608.

[0043] Figure 9C is a block diagram illustrating the software functions of the table record selection processing unit 613 of the plant-side control device 103 in relation to the encryption target value. The data frame D906 received from the input device 102 via the controller 104 includes an encoded date and time field in addition to the encryption target value Enc(r). The encoded date and time information contained in the encoded date and time field, along with the start date and time information 901 stored at the start of synchronous operation, is input to the step number calculation unit 902. The step number calculation unit 902 subtracts the start date and time information 901 from the encoded date and time information, divides by the step time, and calculates the step number. In other words, the processing of the step number calculation unit 902 in the plant-side control device 103 for the encryption target value is exactly the same as that of the step number calculation unit 902 in the input device 102, except that the input data is different.

[0044] The step number output by the step number calculation unit 902 is input to the pseudo-random number calculation unit 903. Given an initial value 904, the pseudo-random number calculation unit 903 generates a pseudo-random integer or natural number greater than or equal to 0 by repeating a deterministic arithmetic operation for the number of steps input. The generated pseudo-random number is subjected to a modulo operation using the number of records in the public key table 618, and this remainder becomes the label, i.e., the record number. The pseudo-random number calculation unit 903 reads the private key field of the public key table 618 using the label and outputs the private key to the decryption processing unit 612.

[0045] Figure 10 is a block diagram illustrating the software functions of the table record selection processing unit 613 in the encrypted control input of the plant-side control device 103. The data frame D1007 received from controller 104 includes, in addition to the encryption control input Enc(u), a start date and time field and an encoded date and time field. The encoded date and time information contained in the encoded date and time field and the start date and time information 901 contained in the start date and time field are input to the step number calculation unit 902. The step number calculation unit 902 subtracts the start date and time information 901 from the encoded date and time information and divides by the step time to calculate the step number. Here, the difference between the step number calculation unit 902 shown in Figure 10 and the step number calculation unit 902 in Figures 9A, 9B, and 9C is that it not only subtracts the start date and time information 901 from the encoded date and time information, divides by the step time, and outputs the step number to the pseudo-random number calculation unit 903, but also outputs the step number + 1.

[0046] The step number and the step number + 1 value output by the step number calculation unit 902 are input to the pseudo-random number calculation unit 903. Given an initial value 904, the pseudo-random number calculation unit 903 generates a pseudo-random integer or natural number greater than or equal to 0 by repeating a deterministic calculation process for the number of steps input. The generated pseudo-random number is subjected to a modulo operation on the number of records in the public key table 618, and this remainder becomes the label, i.e., the record number. The pseudo-random number generation unit 903 reads the private key field of the public key table 618 using a label corresponding to the step number and outputs the private key to the decryption processing unit 612. Next, the pseudo-random number generation unit 903 reads the public key field of the public key table 618 using a label corresponding to the step number + 1 value, and outputs the public key to the encryption processing unit 603.

[0047] The pseudo-random number generation units 903 in the table record selection processing unit 605 of the input device 102 shown in Figure 9A, the table record selection processing unit 610 of the controller 104 shown in Figure 9B, and the table record selection processing unit 613 of the plant-side control device 103 shown in Figures 9C and 10, all incorporate the same deterministic calculation process. Therefore, if the same initial value 904 is given, they will all output the same label if the number of steps is the same.

[0048] [Synchronized operation start process] Figure 11 is a flowchart showing the flow of the synchronous operation start process in the date and time information generation unit 611 of the controller 104. In Figure 11, the explanation is based on the assumption that the date and time information generation unit 611 of the controller 104 is the master, but the same applies if the input device 102 or the plant-side control device 103 is the master. When processing begins (S1101), the date and time information generation unit 611 of the controller 104 checks whether its own date and time information is calibrated with the date and time information output by the date and time information source device 105 with a sufficiently small error (S1102).

[0049] If the date and time information generation unit 611 of the controller 104 is calibrated with a sufficiently small error compared to the date and time information output by the date and time information source device 105 (YES in S1102), then the date and time information generation unit 611 of the controller 104 asks the date and time information generation unit 606 of the input device 102 whether the date and time information generation unit 606 of the input device 102 is calibrated with a sufficiently small error compared to the date and time information output by the date and time information source device 105 (S1103).

[0050] If the date and time information generated by the date and time information generation unit 606 of the input device 102 is calibrated with a sufficiently small error compared to the date and time information output by the date and time information source device 105 (YES in S1103), then the date and time information generation unit 611 of the controller 104 queries the date and time information generation unit 619 of the plant-side control device 103 to ask whether the date and time information generation unit 619 of the plant-side control device 103 is calibrated with a sufficiently small error compared to the date and time information output by the date and time information source device 105 (S1104). In any of the conditional branches in steps S1102, S1103, and S1104, if the calibration of the date and time information is not completed successfully (NO in S1102, NO in S1103, NO in S1104), the process returns to step S1102 and the verification process is repeated.

[0051] In step S1104, if the date and time information generated by the date and time information generation unit 619 of the plant-side control device 103 is calibrated with a sufficiently small error compared to the date and time information output by the date and time information source device 105 (YES in S1104), then at this point, all date and time information generation units 606 of the input device 102, controller 104, and plant-side control device 103 are calibrated. Then, as a preparatory step for synchronous operation, the date and time information generation unit 611 of the controller 104, in cooperation with the pseudo-random number calculation unit 903 of the table record selection processing unit 610, determines parameters such as the time to start synchronous operation, the step time, and the initial value 904 to be given to the pseudo-random number calculation unit 903 of the input device 102 and the pseudo-random number calculation unit 903 of the plant-side control device 103, and transmits these to the date and time information generation units 619 of the input device 102 and plant-side control device 103 (S1105).

[0052] Once the preparation for synchronous operation is complete in step S1105, the date and time information generation unit 611 of the controller 104 waits until the set synchronous operation start time (NO in S1106), and when the synchronous operation start time arrives (YES in S1106), it starts the synchronous operation (S1107) and finishes the series of processes (S1108).

[0053] [Pseudorandom number generation process of pseudorandom number generation unit 903] The pseudorandom numbers used by the pseudorandom number generator 903 must be designed so that malicious third parties cannot easily find any patterns in them. An example of a pseudorandom number generation function that applies the addition theorem of elliptic curve functions, which is frequently used in cryptography, is shown below. Figure 12 is a flowchart showing the operation flow of the pseudo-random number generation unit 903 of the controller 104. When processing begins (S1201), the pseudo-random number generation unit 903 first determines the coefficients a and b of the elliptic curve function y² = x³ + ax + b (S1202).

[0054] Next, the pseudo-random number generation unit 903 determines a point P on the elliptic curve determined in step S1202 (S1203). It is an essential condition that the y-coordinate of this point P is not 0. The coefficients a, b and point P, along with the number of records p in the public key subtable 604, the encryption parameter table 609, and the public key table 618, constitute the initial value 904 given to the pseudo-random number generation unit 903 of the input device 102 and the pseudo-random number generation unit 903 of the plant-side control device 103. Next, the pseudo-random number generation unit 903, in cooperation with the date and time information generation unit 611, transmits the time to start synchronous operation, the step time, and the coefficients a and b, which are initial values ​​904, and point P to the date and time information generation unit 606 of the input device 102 and the date and time information generation unit 619 of the plant-side control device 103 (S1204). Steps S1202, S1203, and S1204 described above correspond to step S1105 in Figure 11.

[0055] Next, the pseudo-random number generation unit 903 initializes the step number t to 0 and assigns the coordinate information of point P to point Q (S1205). Then, under the control of the date and time information generation unit 611, it waits for the synchronous operation start time (S1206). This step S1206 corresponds to step S1106 in Figure 11. When the synchronous operation start time arrives (YES in S1206), the date and time information generation unit 611 gives a start trigger to the pseudo-random number calculation unit 903. The pseudo-random number calculation unit 903 receives this and continues the subsequent processing.

[0056] First, the pseudo-random number generation unit 903 finds the coordinates of a third point R on the elliptic curve that intersects the line connecting points P and Q (S1207). If points P and Q have the same coordinates, the intersection point where the tangent line on the elliptic curve intersects is defined as point R'. Next, the pseudo-random number generation unit 903 converts the x-coordinate of point R' into an integer. Although the x-coordinate of point R' is a rational number, the numden() function implemented in MATLAB (registered trademark), for example, converts a rational number into a fraction and outputs its numerator and denominator. By converting a rational number into a fraction and extracting its denominator, as with this numden() function, it is possible to convert the x-coordinate of point R into an integer. Then, the remainder of the number of records p is calculated from the obtained pseudo-random integer (S1208). This remainder becomes the label, i.e., the record number that points to the record in the public key subtable 604, the cryptographic parameter table 609, and the public key table 618. Next, the pseudo-random number generation unit 903 increments the step number t by 1 (S1209). Then, the value obtained by inverting the sign of the y-axis value of point R' is taken as R, which is the mapping of point R'. The coordinate information of this point R is substituted into point Q (S1210). Then, the series of processes from step S1207 are repeated.

[0057] Figure 12 shows the operation flow of the pseudo-random number generation unit 903 of the master controller 104. However, the pseudo-random number generation unit 903 of the slave input device 102 and the pseudo-random number generation unit 903 of the plant-side control device 103, upon receiving the initial value 904 from the date and time information generation unit 611 of the controller 104 at step S1204, execute the operations from step S1205 onward. In other words, the operation of the pseudo-random number generation unit 903 from step S1205 onward is the same for both the master and the slave.

[0058] [Synchronized operation process] Figure 13 is a time chart illustrating the synchronous operation of the encryption control system 101. In Figure 13, the step time is 10 msec and the number of steps is t. The start of synchronous operation is defined as t=0, and thereafter t increments by 1. At the start of synchronous operation (t=0), the input device 102 encrypts the target value r with the public key corresponding to the label at t=0 to obtain the encrypted target value Enc(r). Then, the encrypted target value Enc(r) is transmitted to the plant-side control device 103 via the controller 104 (S1301). The data frame D1321 of the encrypted target value Enc(r) contains the current date and time information at t=0 generated by the date and time information generation unit 606.

[0059] At the start of synchronous operation (t=0), the controller 104 reads the first encrypted parameter, second encrypted parameter, and third encrypted parameter corresponding to the label at t=0 from the encrypted parameter table 609, and multiplies them with the control input u (initial value 904) in the multiplication unit 608 to obtain the encrypted control input Enc(u). Then, the encrypted control input Enc(u) is transmitted to the plant-side control device 103 (S1302). The data frame D1322 of the encrypted control input Enc(u) contains the start date and time information 901 at the start of synchronous operation and the current date and time information at t=0. At this point, the start date and time information 901 and the current date and time information are the same.

[0060] When synchronous operation starts (t=0), the plant-side control device 103 receives the encrypted target value Enc(r) from the input device 102 via the controller 104, and the encrypted control input Enc(u) from the controller 104 (S1303). Next, the decoding processing unit 612 of the plant-side control device 103 calculates a label based on the current date and time information and start date and time information 901 attached to each data frame, and then applies the calculated label to... secretThe target value r and control input u are decoded using the key. The control arithmetic processing unit 614 performs arithmetic operations on the target value r decoded by the decryption processing unit 612 and the base value of the control input u to generate the target value r and control input u. The homomorphic public-key cryptography used in the embodiment of the present invention allows multiplication (division) of encrypted data, but not addition (subtraction). Therefore, the multiplication unit 608 of the controller 104 performs only the multiplication operation in the control arithmetic processing on the given data. Then, the control arithmetic processing is completed by performing the addition operation, which cannot be done while the data is encrypted, in the control arithmetic processing unit 614. The control processing unit 615 generates a control signal from the control input u and controls the controlled object 106. When the target object 106 is controlled by the control processing unit 615, the operation of the controlled object 106 is detected by the sensor 107.

[0061] The observation signal output by sensor 107 is converted into an observation value y by signal conversion processing unit 616. The observation value y output by signal conversion processing unit 616 is input to target error calculation processing unit 617 along with the target value r output by control calculation processing unit 614. The target error calculation processing unit 617 subtracts the observation value y from the target value r and outputs the target error ε (S1304). The encryption processing unit 603 encrypts the target error ε with the public key corresponding to the label corresponding to the step number at t+1 (S1305). At this point, t=0, so t+1=1, i.e., the public key corresponding to the label corresponding to step number 1 is used to encrypt the target error ε.

[0062] When the step count increments by 1 from the start of synchronous operation and t=1, the plant-side control device 103 transmits the encrypted target error Enc(ε) to the controller 104 via the transmission unit 208 of the second control network module 115 (S1306). The data frame D1323 of the encrypted target error Enc(ε) contains the start date and time information 901 at the start of synchronous operation and the current date and time information at t=1.

[0063] At t=1, the controller 104 receives the encryption target error Enc(ε) from the plant-side control device 103 (S1307). The encryption target error Enc(ε) received from the receiving unit 309 of the second control network module 115 of the controller 104 is passed to the multiplication unit 608 via the input / output control unit 607. The multiplication unit 608 passes the start date and time information 901 and the current date and time information at t=1, which are attached to the data frame of the encryption target error Enc(ε), to the table record selection processing unit 610. The table record selection processing unit 610 reads the first encryption parameter, second encryption parameter, and third encryption parameter corresponding to the label at t=1 and passes them to the multiplication unit 608. The multiplication unit 608 multiplies the first encryption parameter, second encryption parameter, and third encryption parameter with the encryption target error Enc(ε) to obtain the encryption control input Enc(u) (S1308). Then, the encrypted control input Enc(u) is transmitted to the plant-side control device 103 (S1309). The data frame D1324 of the encrypted control input Enc(u) contains the start date and time information 901 at the start of synchronous operation and the current date and time information at t=1.

[0064] At t=1, the input device 102 encrypts the target value r with the public key corresponding to the label at t=1 to obtain the encrypted target value Enc(r). Then, it transmits the encrypted target value Enc(r) to the plant-side control device 103 via the controller 104 (S1310). The data frame D1325 of the encrypted target value Enc(r) contains the current date and time information at t=1.

[0065] At t=1, the plant-side control device 103 receives the encryption target value Enc(r) from the input device 102 via the controller 104, and the encryption control input Enc(u) from the controller 104 (S1311). Next, the decoding processing unit 612 of the plant-side control device 103 calculates a label based on the current date and time information and start date and time information 901 attached to each data frame, and then applies the calculated label to... secretThe target value r and control input u are decoded using a key. The control arithmetic processing unit 614 performs calculations on the target value r and the base value of the control input u decoded by the decoding processing unit 612 to generate the target value r and control input u. The control processing unit 615 generates a control signal from the control input u. The control unit 615 then controls the controlled object 106. When the controlled object 106 is controlled by the control processing unit 615, the operation of the controlled object 106 is detected by the sensor 107.

[0066] The observation signal output by sensor 107 is converted into an observation value y by signal conversion processing unit 616. The observation value y output by signal conversion processing unit 616 is input to target error calculation processing unit 617 along with the target value r output by control calculation processing unit 614. The target error calculation processing unit 617 subtracts the observation value y from the target value r and outputs the target error ε (S1312). The encryption processing unit 603 encrypts the target error ε with the public key corresponding to the label corresponding to the step number t+1 (S1313). At this point, t=1, so t+1=2, i.e., the public key corresponding to the label corresponding to step number 2 is used to encrypt the target error ε.

[0067] Similarly, when the plant-side control device 103 receives the encrypted target value Enc(r) at step number t from the input device 102 and the encrypted control input Enc(u) at step number t from the controller 104, it controls the controlled object 106 based on the target value r and the control input u. As a result, the observed value y obtained from the sensor 107 is subtracted from the target value r to obtain the target error ε. The encryption processing unit 603 encrypts the target error ε with the public key at step number t+1 and outputs the encrypted target error Enc(ε) to the controller 104. In other words, in the data reception, calculation, and data transmission cycle of the plant-side control device 103, the number of steps is incremented by 1.

[0068] In response, the controller 104 multiplies the encryption target error Enc(ε) with the current date and time information attached to the data frame of the encryption target error Enc(ε) received from the plant-side control device 103, the first encryption parameter at step number t obtained from the start date and time information 901, the second encryption parameter, and the third encryption parameter at step number t, to obtain the encryption control input Enc(u), and transmits it to the plant-side control device 103. In other words, the number of steps remains unchanged throughout the data reception, calculation, and data transmission cycle of the controller 104.

[0069] [Numerical Simulation] To theoretically verify the encryption control system 101 according to the embodiment described above, numerical simulations were performed on a computer. Figure 14A is a graph of the control input u and target error ε in the encryption control system 101 according to Patent Document 1. Figure 14B is a graph of the control input u and target error ε in the encryption control system 101 according to an embodiment of the present invention. Both graphs in Figure 14A and Figure 14B show the simulation results assuming a step time of 10 msec and a tampering attack was performed on the encryption target error Enc(ε) at time 10 sec.

[0070] In Figure 14A, since only one pair of public and private keys is used, the effect of a tampering attack does not appear in the target error ε. However, in Figure 14B, a mechanism is employed to randomly switch the pair of public and private keys used at each step, so the target error ε shows a clearly different, non-continuous change from before the tampering attack.

[0071] The control system desires that the controlled object 106 be in a stable state. Therefore, it is highly unlikely that the target error ε will fluctuate significantly. Consequently, the fluctuation range of the target error ε is generally small and continuous. If a signal that normally has a small fluctuation range and is continuous suddenly shows a large fluctuation range and exhibits discontinuous changes, it can be clearly recognized that some kind of abnormality has occurred.

[0072] For example, by squaring the range of variation of the target error ε and comparing it to a predetermined threshold, if the result exceeds the threshold, it can be determined that an attack has occurred against the encryption control system 101. This determination calculation is used as the attack detector. Figure 15A is a graph of the attack detector in the encryption control system 101 described in Patent Document 1. Figure 15B is a graph of the attack detector in the encryption control system 101 according to an embodiment of the present invention.

[0073] In Figure 15A, since only one pair of public and private keys is used, the attack detector cannot detect the tampering attack. However, in Figure 15B, a mechanism is employed to randomly switch the pair of public and private keys used at each step, so the attack detector can clearly recognize that the target error ε has been tampered with.

[0074] The embodiments described above can be modified in the following ways. (1) In the above embodiment, the pseudo-random number generation unit 903 was configured to operate when a calculation request occurred, but the results of calculations performed in advance may be stored in the label table. The label table has a step count field and a label field. The step count field stores the number of steps. The label field stores the label calculated by the pseudo-random number generator 903, corresponding to the number of steps. By storing several thousand or tens of thousands of records in such a label table, the computing resources of the CPU module 112 can be concentrated on the primary control operations.

[0075] (2) In the above embodiment, the public key and private key pair was configured to be switched at each control cycle, but it may also be configured to be switched at multiple control cycles. However, if the switching cycle is too long, there is a risk that the vulnerability to malicious third parties will increase. (3) The function of the date and time information source device 105 may be shared by any one of the input device 102, the plant-side control device 103, or the controller 104. For example, by equipping the input device 102 with a GPS (global positioning system) receiver, it becomes possible to obtain accurate date and time information.

[0076] (4) The input device 102 and the controller 104 can be integrated into one unit. Figure 16 is a block diagram showing the software functions in the control network of a controller 1601 according to a modified embodiment of the present invention. The controller 1601 shown in Figure 16 is a configuration that integrates the input device 102 and the controller 104 shown in Figure 6. First, the table record selection processing unit 1602 has the functions of the table record selection processing unit 605 of the input device 102 and the table record selection processing unit 610 of the controller 104. That is, the table record selection processing unit 1602 has the function of selecting a predetermined record from the public key subtable 604 and a predetermined record from the encryption parameter table 609 for the encryption processing unit 603.

[0077] Next, the input / output control unit 1603 has the functions of the input / output control unit 602 of the input device 102 and the input / output control unit 607 of the controller 104. Furthermore, the date and time information generation unit 606 of the input device 102 is omitted. That is, the date and time information generation unit 611 has the function of providing date and time information to be added to the encryption control input output from the multiplication unit 603, as well as providing date and time information to the table record selection processing unit 1602 and giving it a startup timing.

[0078] As explained above, in the encryption control system 101, equivalent functionality can be achieved by using a controller 1601 that integrates the input device 102 and the controller 104, instead of the input device 102 and the controller 104. Note that the input device 102 in Figure 6 has a public key subtable 604. Therefore, when realizing a controller 1601 that integrates the input device 102 and the controller 104, if the encryption processing unit 603 is configured to encrypt not only the target value r but also the first parameter Kp, the second parameter Ki, and the third parameter Kd, the computational load on the encryption processing unit 603 will increase, but the encryption parameter table 609 can be omitted.

[0079] In this embodiment, an encryption control system 101 is disclosed. The input device 102, the plant-side control device 103, and the controller 104 are equipped with a pseudo-random number generator 903 that has a common function to synchronize the time. Then, synchronized operation starts at the same time. By configuring the encrypted control system 101 in this way, it becomes possible to switch the public key and private key pair in synchronization with the control cycle of the entire control system. Therefore, it becomes possible to instantly and clearly detect intervention by a malicious third party in the control system.

[0080] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above, and includes other modifications and applications as long as they do not depart from the gist of the present invention as described in the claims. [Explanation of Symbols]

[0081] 101...Encryption control system, 102...Input device, 103...Plant-side control device, 104...Controller, 105...Date and time information source device, 106...Controlled object, 107...Sensor, 111...Mount base, 112...CPU module, 113...Information network module, 114a, 114b...First control network module, 115...Second control network module, 116...Input / output module, 201...Module bus, 202...CPU, 203...ROM, 204...RAM, 205...RTC, 206...Internal bus, 207...NIC, 208...Transmitter, 309...Receiver, 410...A / D converter, 411...D / A converter, 501...CPU, 502...ROM, 503...RAM, 504...Non-volatile storage, 505...RTC, 506...NIC, 507...Bus, 508...Display unit, 5 09...Operation Unit, 601...Target Value Input Unit, 602...Input / Output Control Unit, 603...Encryption Processing Unit, 604...Public Key Subtable, 605...Table Record Selection Processing Unit, 606...Date and Time Information Generation Unit, 607...Input / Output Control Unit, 608...Multiplication Unit, 609...Encryption Parameter Table, 610...Table Record Selection Processing Unit, 611...Date and Time Information Generation Unit, 612...Decryption Processing Unit, 613...Table Record Selection Processing Unit, 614...Control Calculation Processing Unit, 615...Control Processing Unit, 616...Signal Conversion Processing Unit, 617...Target Error Calculation Processing Unit, 618...Public Key Table, 619...Date and Time Information Generation Unit, 620...Log Table, 901...Start Date and Time Information, 902...Step Count Calculation Unit, 903...Pseudo-Random Number Calculation Unit, 904...Initial Value, 1601...Controller, 1602...Table Record Selection Processing Unit, 1603...Input / Output Control Unit

Claims

1. A controller that selects a first public key from among multiple public keys stored in association with multiple time information based on a first time information, and transmits the target value encrypted with the first public key and the first time information, The system includes a plant-side control device that is synchronized with the controller and selects a first secret key from among a plurality of secret keys stored in association with the plurality of time information, based on the first time information, and controls the controlled object based on the target value decrypted with the first secret key, The plant-side control device selects a second public key from among the multiple public keys stored in association with the multiple time information, based on the second time information, and transmits the operation information of the controlled object encrypted with the second public key and the second time information to the controller. The controller is an encryption control system that selects a specific encryption parameter from among a plurality of encryption parameters stored in association with the plurality of time information based on the second time information, processes the operation information of the controlled object in an encrypted state using the specific encryption parameter, and generates an encrypted control input for controlling the controlled object.

2. The controller transmits the encrypted control input and the second time information to the plant-side control device. The encryption control system according to claim 1, wherein the plant-side control device selects a second secret key from the plurality of secret keys based on the second time information, and controls the controlled object based on the control input obtained by decrypting the encryption control input with the second secret key.

3. The encryption control system according to claim 1 or 2, wherein the controller generates the encryption control input by multiplying the specific encryption parameter by the encrypted operation information of the controlled object.

4. The encryption control system according to any one of claims 1 to 3, wherein the operation information of the controlled object includes error information of the operation of the controlled object with respect to the target value.

5. The encryption control system according to any one of claims 1 to 4, wherein the first time information and the second time information are set based on the control period of the controlled object.

6. The controller stores the multiple public keys and the multiple encryption parameters in association with record numbers that can be calculated based on the multiple time information, The encryption control system according to any one of claims 1 to 5, wherein the plant-side control device stores the plurality of secret keys and the plurality of public keys in association with the record number.

7. A controller selects a first public key from among a plurality of public keys stored in association with a plurality of time information based on a first time information, and transmits the target value encrypted with the first public key and the first time information to a plant-side control device synchronized with the controller, The plant-side control device includes selecting a first secret key from among a plurality of secret keys stored in association with the plurality of time information based on the first time information, and controlling the control target based on the target value decrypted with the first secret key, The plant-side control device selects a second public key from among the multiple public keys stored in association with the multiple time information, based on the second time information, and transmits the operation information of the controlled object encrypted with the second public key and the second time information to the controller. The controller selects a specific encryption parameter from among a plurality of encryption parameters stored in association with the plurality of time information based on the second time information, processes the operation information of the controlled object in an encrypted state using the specific encryption parameter, and generates an encrypted control input for controlling the controlled object. An encryption control program that causes a computer to execute a command.

8. The controller transmits the encrypted control input and the second time information to the plant-side control device, The encryption control program according to claim 7, wherein the plant-side control device causes a computer to select a second secret key from the plurality of secret keys based on the second time information, and to control the controlled object based on the control input obtained by decrypting the encryption control input with the second secret key.

Images