Encryption control system and encryption control method

Abstract

To solve the problem that deterioration of communication performance due to change in a communication path state such as transient congestion makes it difficult to achieve both availability and security of a control system; in a control system in a best-effort type communication path in recent years, a main focus is placed on realization of stable control, and security is not regarded as important; and in order to minimize human and physical damage from cybercrime, coexistence between availability and security of a control system is required.SOLUTION: In an encryption control system for controlling a plant 30 through a control system communication path 60 by a controller 20 capable of concealing information in a control system by an encryption theory, key length of an encryption key is changed according to a state of a network communication path 60 to reduce deterioration of communication performance due to fluctuation of the communication path.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an encryption control system and an encryption control method. [Background technology]

[0002] Let's consider a remote control system where there is a significant physical distance between the operator and the controller, and between the controller and the controlled object. This system involves the operator providing a target value to the controller, which then provides control values ​​to the controlled object, such as a robotic arm, to approach the target value. Here, we further consider a remote encrypted control system where encryption is applied throughout the entire process using public-key cryptography. In this remote encrypted control system, the increase in communication data volume due to encryption and the increase in computation time due to encryption / decryption processing may become significant depending on the communication channel conditions. This creates a trade-off: prioritize control system availability over control system security, or prioritize control system security over control system availability. A method is needed to achieve both control system security and control system availability.

[0003] Conventionally, various encryption control technologies have been proposed to conceal control parameters and communication channels. For example, one technology for concealing control parameters and communication channels (see, for example, Patent Document 1) assumes a situation in which the encryption key continues to be used.

[0004] Furthermore, there are technologies for switching between pre-prepared encryption keys (see, for example, Patent Document 2) and encryption control technologies that employ dynamic key encryption schemes capable of updating encryption keys in milliseconds (see, for example, Patent Document 3). These conventional technologies are implemented under the assumption that the length of the encryption key is common. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-90884 [Patent Document 2] WO2019 / 078343 [Patent Document 3] WO2020 / 179672 [Summary of the Invention] [Problems to be Solved by the Invention]

[0006] As described above, in the prior art, the main focus has been only on improving the security of the control system, and reducing the adverse effects caused by fluctuations in the communication path state has not been considered. Therefore, in situations where it is desired to increase the encryption strength and enhance confidentiality, or in situations where the communication path state of the network to be used can vary significantly, with existing encryption control technologies, the design of the control system on the security side is forced, and it becomes difficult to operate while considering the availability of the control system.

[0007] The present invention aims to provide an encryption control system and an encryption control method that avoid designing a control system based on the worst value of fluctuations in the communication path state and enable both the security of the control system and the availability of the control system. [Means for Solving the Problems]

[0008] The encryption control system of the present invention is an encryption control system that controls a plant via a network communication path by a controller that can make the information within the control system confidential by means of encryption theory, Communication delay time due to network communication channel depending on, the key length of the encryption key It includes a key length switching control unit that allows the key length to be set to vary in multiple stages, The key length switching control unit switches the key length at a predetermined control cycle according to the communication delay time, thereby preventing failure of the control cycle. [Effects of the Invention]

[0009] According to the present invention, it becomes possible to construct an encryption control system that avoids designing a control system based on the worst value of fluctuations in the communication path state and enables both the security of the control system and the availability of the control system. Other issues, configurations, and effects not mentioned above will be clarified by the following description of [Modes for Carrying Out the Invention]. [Brief explanation of the drawing]

[0010] [Figure 1] This is a block diagram showing an example of the configuration of an FA system according to one embodiment of the present invention. [Figure 2] This is a sequence diagram showing the timing relationships in the measurement process of communication delay time in a communication channel. [Figure 3] This flowchart shows the process for measuring the communication delay time of a communication channel. [Figure 4] This is a schematic diagram showing an example of the configuration of a key length switching control unit in a plant. [Figure 5] This figure shows the verification results regarding the rotation angles of the yaw and pitch axes of the robot arm. [Figure 6] This figure shows the verification results for the encrypted text representing the rotation angles of the yaw and pitch axes of the robot arm. [Figure 7] Figure 6 shows the verification results for the ciphertext of the rotation angles of the yaw and pitch axes of the robot arm when the key length is shortened. [Figure 8] This figure shows the verification results regarding the computation time required for encryption processing. [Modes for carrying out the invention]

[0011] Hereinafter, embodiments for carrying out the present invention will be described with reference to the accompanying drawings. In this specification and drawings, components having substantially the same function or configuration are denoted by the same reference numerals, and redundant descriptions are omitted.

[0012] <About Cryptography> First, before describing specific embodiments to which the present invention is applied, we will explain the cryptography used in the present invention.

[0013] Generally, an encryption method that converts plaintext M, which is part of a set of integers Z, into ciphertext C, which is part of a set of integers Z, can be expressed by the following equation (1).

[0014]

number

[0015] Furthermore, an encryption method that allows the ciphertext Enc(M1○M2), obtained by encrypting a binary operation M1○M2 between plaintext M1 and plaintext M2, to be calculated using the ciphertext Enc(M1), obtained by encrypting plaintext M1, and the ciphertext Enc(M2), obtained by encrypting plaintext M2, is called a homomorphic encryption method. Such homomorphic encryption methods are applied in cloud computing and security systems for financial institutions.

[0016] For example, the RSA (Rivest Shamir Adleman) encryption algorithm, which exhibits homomorphism with respect to multiplication, is a public-key cryptosystem that utilizes the difficulty of multi-digit prime factorization problems and has applications in digital signatures, among others. Below, we will explain the encryption and decryption algorithms of RSA encryption, as well as the homomorphism of RSA encryption with respect to multiplication.

[0017] When encrypting using RSA encryption, a public key e, a public key n, and a private key d are first generated, and the plaintext is encrypted using only the public keys e and n. On the other hand, when decrypting using RSA encryption, it is necessary to know the private key d.

[0018] The public key n is generated by determining two large prime numbers p and q and performing the product of the prime numbers p and q (n = p × q). On the other hand, the public key e is generated to be any positive integer that is relatively prime (gcd(e, φ(n)) = 1) to the Euler function φ(n) = (p-1) × (q-1) of the public key n. The private key d is generated as the reciprocal of the public key e modulo φ(n) and is defined as shown in equation (2) below.

[0019]

number

[0020] Further, from the definition of the remainder, the private key d is obtained by solving an indeterminate equation using an unknown constant Q as shown in the following equation (3). Note that an indeterminate equation in the form shown in the following equation (4) can be efficiently solved by the extended Euclidean algorithm.

[0021]

Number

Number

[0022] Thus, both the public key n and the private key d are generated from the pre-determined prime numbers p and prime numbers q. At this time, if the number of digits of the prime numbers p and prime numbers q is sufficiently large, it is difficult to restore the prime numbers p and prime numbers q by prime factorization even if the public key n (= p × q) is made public. Therefore, it is difficult to know the private key d unless the prime numbers p and prime numbers q are leaked.

[0023] Next, the plaintext M included in the set Z of integers is converted into the ciphertext C as shown in the following equation (5), that is, encrypted.

[0024]

Number

[0025] However, in equation (5), the number of digits of the plaintext M must be less than the number of digits of the public key n (M < n). In the case where the number of digits of the plaintext M is greater than or equal to the number of digits of the public key n (M ≥ n), it is necessary to divide the plaintext M by the number of digits of the public key n and encrypt it. Also, this encryption involves the calculation of the power of a large integer, and there is an efficient algorithm for performing this calculation.

[0026] On the other hand, the ciphertext C is converted into the plaintext M as shown in the following equation (6), that is, decrypted.

[0027]

number

[0028] Now, we will prove equation (6). First, we introduce a lemma as shown in equation (7).

[0029]

number

[0030] Furthermore, if we define the ciphertext C as shown in equation (8) below, then by the definition of remainder, we can set X = Q × n + C via a constant Q, and the left side of equation (7) above can be replaced as shown in equation (9) below.

[0031]

number

number

[0032] On the other hand, when the right-hand side of equation (9) is expanded using the binomial theorem, the right-hand side equals the left-hand side, as shown in equation (10).

[0033]

number

[0034] Then, using equation (7) above for the decoding operation, we get equation (11), and substituting equation (3) above into equation (11), we obtain equation (12).

[0035]

number

number

[0036] Here, from Euler's theorem shown in the following equation (13), equation (12) becomes as follows in equation (14).

[0037]

Number

Number

[0038] Therefore, from the assumption at the time of encryption, if the number of digits of the plaintext M is less than the number of digits of the public key n (M < n), since M mod n = M, it has been proven that decryption is achieved.

[0039] Next, the homomorphic property will be explained. The RSA cipher has a homomorphic property with respect to multiplication (hereinafter described as multiplicative homomorphic property), and the following relationship shown in equation (15) holds.

[0040]

Number

[0041] Here, proof is carried out for equation (15). When the dividend includes the case of being negative, there are multiple definitions for the remainder. As an example, the definition shown in the following equation (16) is used.

[0042]

Number

[0043] At this time, considering two ciphertexts as shown in the following equation (17), it becomes as shown in the following equation (18).

[0044]

Number

Number

[0045] Therefore, since the left side of equation (15) above is equal to the right side as shown in equation (19), it has been proven that the relationship shown in equation (15) holds.

[0046]

number

[0047] In this invention, RSA encryption, which has the multiplicative homomorphism described above, is used as the encryption method. Although RSA encryption is given as an example in this specification, the encryption method is not limited to RSA encryption, and any encryption method with multiplicative homomorphism, such as ElGamal encryption, may be used.

[0048] Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings.

[0049] <Embodiments of the Invention> As an embodiment of the present invention, the technology of the present invention will be described with reference to an example of its application to a Factory Automation (FA) system, which is an example of a remote control system.

[0050] [Example System Configuration] Figure 1 is a block diagram showing an example of the configuration of an FA system according to one embodiment of the present invention. In this specification, "system" refers to the entire apparatus composed of multiple devices.

[0051] In Figure 1, the FA system 1 according to this embodiment is configured as a control system using multiplicative homomorphism such as RSA encryption, and includes an input device 10, a controller 20, a plant 30, a time server 50, a control system communication channel 60, and a general-purpose communication channel 70. The input device 10 and the controller 20, and the time server 50 and the controller 20 are connected via the general-purpose communication channel 70, and the controller 20 and the plant 30 are connected via the control system communication channel 60.

[0052] In other words, the FA system 1 according to this embodiment is an encrypted control system that controls the plant 30 via a control system communication channel 60 using a controller 20 that can conceal information within the control system using cryptographic theory, such as multiplicative homomorphism encryption like RSA encryption. Time synchronization data and encrypted control data are transmitted through the control system communication channel 60.

[0053] The operation of FA system 1 is mainly defined by three parameters: an encryption control parameter, a key length switching determination parameter, and a time synchronization parameter. Of these three parameters, the encryption control parameter and the key length switching determination parameter are encrypted in the input device 10 using a homomorphic encryption scheme (in this example, a multiplicative homomorphic encryption scheme). The time synchronization parameter is not encrypted.

[0054] Encrypted control parameters are control parameters such as gain and target value, which are input by the operator using the input device 10, encrypted in the input device 10, and then transmitted to the controller 20. In the process where the controller 20 processes the encrypted parameters and executes control over the plant 30 via the control system communication channel 60, encrypted control parameters refer to the encrypted control parameters and are held by the input device 10, the controller 20, and the plant 30.

[0055] The key length switching determination parameter is a parameter consisting of thresholds used to determine key length switching, and is a parameter held by plant 30. The key length switching determination parameter is encrypted in the input device 10, similar to the encryption control parameter, and transmitted to plant 30 while remaining encrypted.

[0056] Time synchronization parameters are parameters used by the controller 20 and plant 30, including the transmission period multiplier for Sync messages and the transmission period multiplier for Delay_req messages, and are maintained by the controller 20 and plant 30. Time synchronization parameters may be transmitted in plain text. The transmission means may be a general-purpose communication channel 70 or a control system communication channel 60, or the parameters may be transmitted directly to the controller 20 and plant 30 using serial communication or the like.

[0057] FA System 1 has a time synchronization function compliant with IEEE 1588-2008. Time Server 50 corresponds to the Grand Master Clock (GMC) and is equipped with terminals for connecting external signals such as high-precision oscillators and GPS signals. It has the function of keeping accurate time in synchronization with these external signals and the function of distributing time information via a general-purpose communication port.

[0058] The time information distributed by the time server 50 is used as the control standard for the FA system 1, that is, as the control standard for the controller 20 and the plant 30. The time information distributed by the time server 50 is transmitted to the controller 20 via the general-purpose communication channel 70.

[0059] Controller 20 corresponds to the boundary clock (BC) and distributes time information generated by synchronizing with the time server 50 to Plant 30. Plant 30 corresponds to the ordinary clock (OC) and undergoes time synchronization processing to synchronize with the internal clock of Controller 20.

[0060] (Example of input device configuration) The input device 10 is configured to include a parameter input unit 11 and an encryption unit 12.

[0061] The parameter input unit 11 has, for example, an operating means such as a keyboard or a touch panel, and supplies parameters input by the operator to the encryption unit 12.

[0062] The encryption unit 12 encrypts the parameters supplied from the parameter input unit 11 in response to the operator's operation using a public key and sends the encrypted parameters Enc(Parameters) to the controller 20. As will be described later, the encryption unit 12 receives a public key with a key length set on the plant 30 side, which is transmitted from the plant 30 and supplied to the controller 20 and the general-purpose communication channel 70. The distribution of these public keys with different key lengths is set in advance before control starts. At this time, the encryption unit 12 performs encryption using the public key with the key length set on the plant 30 side.

[0063] (Example of controller configuration) The controller 20, acting as the master, is composed of a parameter acquisition / setting unit 21, a calculation unit 22, a receiving unit 23A, a transmitting unit 24A, a recording device 25, a time synchronization processing unit 26A, an internal clock adjustment unit 27, a receiving unit 23B, a transmitting unit 24B, and a time synchronization processing unit 26B.

[0064] The parameter acquisition / setting unit 21 communicates with the input device 10 via the general-purpose communication channel 70 to acquire encrypted parameters Enc(Parameters) transmitted from the encryption unit 12 through the receiving unit 23A and supplies them to the calculation unit 22. The receiving unit 23B receives encrypted control output Enc(x) transmitted from the plant 30 and supplies it to the calculation unit 22.

[0065] The calculation unit 22 uses encrypted control parameters from the encrypted parameters Enc(Parameters) supplied from the parameter acquisition / setting unit 21 and encrypted control output Enc(x) supplied from the receiving unit 23B to perform calculations for controlling the plant 30, while keeping the data in ciphertext.

[0066] At this time, the arithmetic unit 22 performs the calculation {Enc(u[k])=g'(Enc(x),Enc(u))} with the encrypted control parameters and control output Enc(x) of the encrypted parameters Enc(Parameters) still encrypted, and calculates the control input Enc(u) in an encrypted state, which is the control input u input to control the plant 30, without decryption and re-encryption. The arithmetic unit 22 then supplies the encrypted control input Enc(u) obtained by the calculation to the transmission unit 24B.

[0067] The transmitter 24B transmits the encrypted control input Enc(u) to the plant 30 via the control system communication channel 60.

[0068] The recording device 25 records the encrypted parameters Enc(Parameters) acquired by the parameter acquisition / setting unit 21, categorized by key length. Furthermore, along with the encrypted parameters Enc(Parameters), the recording device 25 also records the encrypted control output Enc(x) used in the calculations performed by the calculation unit 22 using the encrypted parameters Enc(Parameters), and the encrypted control input Enc(u) obtained by those calculations, categorized by key length.

[0069] The recording device 25 only needs to be configured to record at least one of the following: encrypted parameters Enc(Parameters), encrypted control output Enc(x), and encrypted control input Enc(u). The recording device 25 also has a key length switching determination parameter and a time synchronization parameter input by the input device 10.

[0070] The time synchronization processing unit 26A receives time synchronization information from the time server 50 through the receiving unit 23A, and uses that time synchronization information to perform a process in the internal clock adjustment unit 27 to synchronize with the clock of the time server 50.

[0071] The time synchronization processing unit 26B starts processing triggered by the rising edge of the control cycle signal. This processing is periodic and corresponds to the control cycle. Upon starting processing, the time synchronization processing unit 26B increments (adds 1 to) an internal counter. When the internal counter becomes equal to the transmission cycle multiplier of the Sync message, the time synchronization processing unit 26B transmits a Sync message containing time information to the plant 30 through the transmission unit 24B. After that, the internal counter is reset.

[0072] (Example of plant configuration) The slave plant 30 is configured to include a receiving unit 31, a decryption unit 32, a control execution unit 33, an encryption unit 34, a transmission unit 35, a time synchronization processing unit 36, an internal clock adjustment unit 37, a delay measurement unit 38, a key length switching control unit 39, a recording device 40, and a parameter acquisition / setting unit 41.

[0073] The receiving unit 31 receives the encrypted control input Enc(u) transmitted from the transmitting unit 24B of the controller 20 via the control system communication channel 60 and supplies it to the decryption unit 32.

[0074] The decryption unit 32 has a secret key corresponding to the public key used for encryption by the encryption unit 12 of the input device 10, and supplies the plaintext control input u obtained by decrypting the encrypted control input Enc(u) supplied from the receiving unit 31 to the control execution unit 33.

[0075] Furthermore, when the receiving unit 31 receives a Sync message from the controller 20, it passes the Sync message to the time synchronization processing unit 36. Similarly, when the receiving unit 31 receives a Delay_resp message from the controller 20, it passes the Delay_resp message to the time synchronization processing unit 36.

[0076] The control execution unit 33 executes control on an actuator (control target), for example, an actuator (control target), according to the control input u supplied from the decryption unit 32. The control execution unit 33 also has a sensor, for example, that measures the drive of the actuator, and supplies the value measured by the sensor, or the tracking deviation which is the error from the target value, to the encryption unit 34 as a control output x for the control according to the control input u. Alternatively, the control execution unit 33 may perform an operation {x[k]=f(x,u)} to determine the control output x for the control according to the control input u.

[0077] The encryption unit 34 encrypts the control output x supplied from the control execution unit 33 and supplies the encrypted control output Enc(x) to the transmission unit 35. At this time, the public key required for encryption by the encryption unit 34 can be obtained from the key length switching control unit 39. The public key held by the key length switching control unit 39 is obtained from the recording device 40 via the parameter acquisition / setting unit 41. The public key of the recording device 40 is set in advance via the parameter acquisition / setting unit 41 before control starts.

[0078] The transmitting unit 35 transmits the encrypted control output Enc(x) supplied from the encryption unit 34 to the controller 20 via the control system communication channel 60.

[0079] The time synchronization processing unit 36 ​​starts processing triggered by the reception of control data. This processing is a periodic process that corresponds to the control cycle. As soon as the time synchronization processing unit 36 ​​starts processing, it increments an internal counter (adds 1).

[0080] When the time synchronization processing unit 36 ​​receives a Sync message from the receiving unit 31, it uses the time information contained in the message to synchronize the internal clock with the internal clock of the controller 20 using the internal clock adjustment unit 37.

[0081] When the internal counter becomes equal to the transmission period multiplier of the Delay_req message, the time synchronization processing unit 36 ​​sends the Delay_req message to the controller 20 through the transmission unit 35 and resets the internal counter.

[0082] Each time the delay measurement unit 38 receives Delay_resp from the receiving unit 31 through the time synchronization processing unit 36, it executes a process to calculate the communication delay time of the control system communication channel 60 and passes the calculated communication delay time information to the key length switching control unit 39. A specific example of the processing performed by the delay measurement unit 38 to measure the communication delay time of the control system communication channel 60 will be described later.

[0083] Each time the key length switching control unit 39 receives Delay_resp from the receiving unit 31 via the time synchronization processing unit 36 ​​and the delay measurement unit 38, it executes the following example of processing. Specifically, the processing executed by the key length switching control unit 39 includes storing the communication delay time calculated by the delay measurement unit 38 into the recording device 40, calculating a representative value using statistical processing (e.g., moving average) with past communication delay times recorded in the recording device 40, comparing the representative value with a predetermined threshold, and switching the key length of the encryption key. Access to the recording device 40 is performed via the parameter acquisition / setting unit 41.

[0084] The key length switching control unit 39 compares a representative value with a predetermined threshold value. If the representative value exceeds the predetermined threshold value, it determines that the state (communication performance) of the control system communication channel 60 has deteriorated and performs control to switch the key length of the encryption key. The key length switching control unit 39 then passes a key length switching request, including the number of control steps until the key length switching, to the decryption unit 32 and the encryption unit 34. The number of control steps is assumed to be stored in the recording device 40.

[0085] The number of control steps until the key length is switched is included in the encryption control datagram, and this datagram has a dedicated field that indicates the number of control steps until the key length is switched. This field only needs to be 8 bits (1 octet). If the key length is not switched, the value is 0, but if the key length is switched, a value of 1 or greater is set.

[0086] One implementation method, where two key lengths are used, is described below. In this example, when the field value becomes (00000001)2, the arithmetic unit 22 of the controller 20, the decryption unit 32 of the plant 30, and the encryption unit 34 of the plant 30 branch to key length switching processing at the final stage of reception processing. In this example, the key length is switched after 10 steps of the control cycle. The encryption unit 34, having received a key length switching request from the key length switching control unit 39, sets the field to (00001011)2. The control output Enc(x) containing that field value is transmitted to the controller 20 via the transmission unit 35 and the control system communication channel 60.

[0087] In the arithmetic unit 22 of the controller 20, at the final stage of processing, the value obtained by decrementing (subtracting 1) from the field value (00001011)2 is reset and transmitted to the plant 30 along with the control input Enc(u). This process is repeated, and when the field value becomes (00000001)2 after the subtraction process in the arithmetic unit 22, the key length is switched. At the time the key length is switched, the transmitted control input Enc(u) remains with the old key length, and the new key length is used from the next control cycle.

[0088] Once the key length switching is complete, the calculation unit 22 notifies the input device 10 via the transmission unit 24A that the key length has been switched. Upon receiving this notification, the input device 10 switches the key length. Since immediacy is not required between the input device 10 and the controller 20, this notification method is sufficient. In the decryption unit 32 of the plant 30, if the field value is (00000001)2, the key length is switched at the final stage of processing (when the decryption process is completed). Decryption with the new key length will be performed from the next control cycle onward.

[0089] The recording device 40 stores encryption control parameters (gain, target value, etc.), time synchronization parameters (transmission period multiplier for the Delay_req message), and key length switching parameters (a dataset consisting of time information and communication delay time measured by the delay measurement unit 38, a predetermined threshold, and the number of control steps until key length switching). During control execution, only the parameter acquisition / setting unit 41 can store data in the recording device 40.

[0090] The parameter acquisition and setting unit 41 is responsible for setting parameters to the recording device 40 and acquiring parameters from the recording device 40. Various methods can be considered for setting parameters; they may be set via the general-purpose communication channel 70 and the control system communication channel 60 from the input device 10, or the input device 10 may be directly connected to the plant 30 via serial communication or the like for setting.

[0091] The FA system 1 according to this embodiment is configured as described above, and employs a multiplicative homomorphic encryption method such as RSA encryption for encrypting information transmitted and received via the control system communication channel 60 connecting the controller 20 and the plant 30. As a result, the arithmetic unit 22 of the controller 20 can perform calculations to execute control on the plant 30 without decrypting the control output Enc(x). Therefore, the FA system 1 can be configured such that only the decryption unit 32 of the plant 30 holds the secret key.

[0092] In conventional industrial networks, both the controller and the plant hold secret keys. Compared to such conventional industrial networks, the FA system 1 according to this embodiment can reduce the number of locations where secret keys are held. Therefore, even if the controller 20 is hacked, the FA system 1 according to this embodiment can avoid the leakage of secret keys. Furthermore, because the parameters, control outputs, and control inputs recorded in the controller 20's recording device 25 are encrypted, even if these are leaked, information from the controller 20 and the plant 30 will not be leaked, thus enhancing security.

[0093] In other words, in the FA system 1 according to this embodiment, even if the controller 20 and the plant 30 are located in separate locations and control inputs and outputs are transmitted and received via the control system communication channel 60, the risk of information leakage between the controller 20 and the plant 30 can be reduced.

[0094] Thus, the FA system 1 according to this embodiment can reduce the number of attack points compared to conventional industrial networks. While parameters used by the controller 20 for calculations, such as various gains, must be encrypted due to the nature of multiplicative homomorphic encryption, these parameters can be encrypted using only a public key, thus not increasing vulnerabilities.

[0095] Furthermore, in the FA system 1 according to this embodiment, when the RSA encryption described above is used, the RSA encryption does not have homomorphism with respect to addition, so the controller 20 controls the plant 30 using proportional control (P control) which does not require addition. Similarly, since it is not possible to calculate the feedback error on the ciphertext, the control execution unit 33 is configured to be able to directly measure the deviation, for example, by regulation problems or sensors.

[0096] [Example of a process for measuring communication delay time] Here, a specific example of the processing performed by the delay measurement unit 38 to measure the communication delay time of the control system communication channel 60 will be explained using Figures 2 and 3.

[0097] Figure 2 is a sequence diagram showing the timing relationships in the measurement process of the communication delay time of the control system communication channel 60. This sequence diagram is an example of the processing of control step (k) and control step (k+1) in communication between the controller 20 and the plant 30. That is, the processing of control step (k) starts after the processing of the previous control step (k-1) is completed, and the process moves to the next control step (k+2) after the processing of control step (k+1) is completed. In Figure 2, thick solid arrows represent encrypted control communication, and thin dashed arrows represent time synchronization communication. k represents the discrete signal sequence number. Figure 3 is a flowchart showing the flow of the measurement process of the communication delay time of the control system communication channel 60.

[0098] Regarding communication between the controller 20 and the plant 30, there is a time synchronization phase in which only time synchronization communication is performed, and a control phase in which time synchronization communication and control communication are performed simultaneously, and the system transitions to the control phase after the time synchronization phase is completed.

[0099] Before the start of the time synchronization phase, the user (operator) sets the control period T. c , Sync message transmission cycle multiplier n sync , the transmission period multiplier n for the Delay_req message delay The settings are configured on the controller 20 and the plant 30. Each setting must be the same on the controller 20 and the plant 30. The setting means is not specified here; the communication line used in the present invention may be used, or other setting means may be employed.

[0100] The control system communication channel 60, which is the communication line between the controller 20 and the plant 30, may be either a wireless communication line or a wired communication line. No specific type of communication line is designated here.

[0101] Before the start of the control phase, it is assumed that the times within the controller 20 and within the plant 30 are synchronized with high precision by communication according to IEEE 1588-2008. Whether to encrypt the communication for time synchronization is optional. However, if encryption is performed, it shall be realized by means different from the encryption control (such as the method proposed in IEEE 1588-2019).

[0102] After the start of the control phase, the transmission of the Sync message and the transmission of the Delay_req message are interlocked with the communication for encryption control. The transmission period of the Sync message is n sync T c and the transmission period n delay T c of the Delay_req message.

[0103] Since the transmission period n sync T c of the Sync message coincides with the current control period T c the controller 20 transmits the Sync message to the plant 30 at the rising time t1 of the control period (step S11). The plant 30 receives the Sync message transmitted from the controller 20 at time t2 (step S21).

[0104] Immediately after transmitting the Sync message, the controller 20 starts a secure calculation process to obtain the control input u[k] using the control output x[k - 1] (step S12), and transmits the control input u[k] to the plant 30 after the elapse of the processing time d proc [k] (step S13).

[0105] The plant 30 receives the control input u[k] transmitted from the controller 20 at the reception time t u [k] (step S22), and then obtains the difference between the reception time t2 of the Sync message and the reception time t u [k] of the control input u[k], and records it as the processing time of the controller 20 (step S23).

[0106] The processing time d proc[k] is d proc [k]=t U [k]-t2……(01) This value will be used to estimate the processing load of controller 20.

[0107] Plant 30 transmits a control output x[k] to the controller 20 (step S24). The controller 20 receives the control output x[k] transmitted from the controller 20 (step S14).

[0108] In the current control step (k), plant 30 sets the transmission period n for the Delay_req message. delay T c and the current control period T c Since they do not match, the Delay_req message will not be sent.

[0109] In the next control step (k+1), the transmission period n of the Sync message is set. sync T c and the current control period T c Because they do not match, controller 20 does not send a Sync message.

[0110] The controller 20 performs a secure calculation process to determine the control input u[k+1] using the control output x[k] (step S15), and the determined control input u[k+1] is processed during the processing time d proc After [k+1] has elapsed, send to plant 30 (step S16).

[0111] Plant 30 receives the control input u[k+1] transmitted from controller 20 at time t u The signal is received at [k+1] (step S25), and then the reception time t of the control input u[k] is determined. u [k] and the time t of the control input u[k+1] u From the difference with [k+1], the variation in the control cycle on the plant 30 side is determined (step S26). Since this variation includes fluctuations in processing load and communication delay, it can be used to estimate the processing load of the controller 20. ΔTc =t u [k+1]-t u [k]-T c ...(02)

[0112] Next, plant 30 sends control output x[k+1] to controller 20 (step S27). Immediately after that, plant 30 sends the period n of the Delay_req message. delay T c and the current control period T c Since they matched, the Delay_req message is sent to the controller 20 at time t3 (step S28).

[0113] The controller 20 receives the control output x[k+1] transmitted from the plant 30 (step S17). Next, the controller 20 receives the Delay_req message transmitted from the plant 30 at time t4 (step S18), and immediately after receiving it, sends a Delay_resp message back to the plant 30 (step S19).

[0114] Plant 30 receives a Delay_resp message sent from controller 20 (step S29).

[0115] By following the procedure described above, plant 30 can obtain times t1, t2, t3, and t4. Then, the communication delay time of the control system communication channel 60 can be determined by the following calculation process.

[0116] If the clock deviation of controller 20 and plant 30 is δ, t2-t1=δ+d path1 ...(03) t4-t3=-δ+d path2 ...(04) This is the result.

[0117] Then, adding equation (03) and equation (04), {(t2-t1)+(t4-t3)} / 2=(d path1 +d path2) / 2 ……(05) This is the result.

[0118] In a communication channel where the bidirectional communication delay times are approximately equal, d path1 ≒d path2 Therefore, the right-hand side of equation (05) is as follows: (d path1 +d path2 ) / 2 ≈ 2d path1 / 2=d path1 ...(06)

[0119] Plant 30 can estimate the communication delay time of the control system communication channel 60 by performing a series of processes from equation (03) to equation (06) and statistical processing such as moving average of the calculated values, and the processing delay time of the controller 20 by performing statistical processing such as moving average of equations (01) and (02).

[0120] By the way, if the communication channel condition of the control system communication channel 60 deteriorates, a communication delay will occur in the control system communication channel 60, making it difficult to maintain the control cycle and causing the control to fail. Here, deterioration of the communication channel condition of the control system communication channel 60 refers to an increase in communication traffic, or in wireless communication, a decrease in received power due to interference or obstacles.

[0121] Therefore, in the FA system 1 according to this embodiment, the communication delay time of the control system communication channel 60 is measured, the communication channel state of the control system communication channel 60 is estimated from the measured communication delay time, and the key length of the encryption key is changed (switched) according to the communication channel state. This control to change the key length of the encryption key is performed in the key length switching control unit 39 in the plant 30.

[0122] The following describes a specific configuration example of the key length switching control unit 39 in plant 30.

[0123] [Example configuration of key length switching control unit] Figure 4 is a schematic diagram showing an example of the configuration of the key length switching control unit 39 in plant 30. In this example, the case where the key length is switched in two stages is used as an example for explanation, but the number of key length switching stages is not limited to two stages, and it is also possible to switch in three or more stages.

[0124] As shown in Figure 4, the key length switching control unit 39 in this example has a key length switching determination processing unit 391 and a selector 392. The key length switching determination processing unit 391 is supplied with information on the communication delay time of the control system communication channel 60, which is measured by the delay measurement unit 38, from the delay measurement unit 38.

[0125] The key length switching determination processing unit 391 calculates a representative value based on the communication delay time supplied from the delay measurement unit 38, using statistical processing (e.g., moving average) with past communication delay times stored in the recording device 40, and compares this representative value with a predetermined threshold value previously stored in the recording device 40.

[0126] Here, the predetermined threshold is, for example, the criterion for determining when the state of the control system communication channel 60 has deteriorated. The predetermined threshold is stored in the recording device 40 by input operations by the operator in the parameter acquisition / setting unit 41.

[0127] Here, for two different key lengths, ciphertexts generated with a normal key length (a predetermined key length) and ciphertexts generated with a key length shorter than the normal key length are prepared in advance and stored in the recording device 40. In the ciphertexts stored in the recording device 40, the gain is a control parameter and is implemented in an encrypted form.

[0128] The selector 392 is configured with a two-stage switch to accommodate switching between two different key lengths. When the control system communication channel 60 is in a normal state, it is switched to terminal a under the control of the key length switching determination processing unit 391, and selects the ciphertext with the normal key length (relatively long key length) stored in the recording device 40.

[0129] The key length switching determination processing unit 391 calculates a representative value based on the communication delay time measured by the delay measurement unit 38, using statistical processing (e.g., moving average) with past communication delay times recorded in the recording device 40, and compares this calculated representative value with a predetermined threshold value recorded in the recording device 40.

[0130] The key length switching determination processing unit 391 then compares the representative value with a predetermined threshold, and if the representative value exceeds the predetermined threshold, it determines that the state of the control system communication channel 60 has deteriorated and performs control to switch the selector 392 to terminal b. As a result, the selector 392 selects an ciphertext with a key length shorter than the normal key length stored in the recording device 40 (a relatively short key length). Shortening the key length reduces communication traffic (amount of data) and shortens the secure calculation processing time (calculation time for encryption processing).

[0131] By shortening the key length, communication traffic (amount of data) decreases, and secure computation processing time (computation time for encryption processing) is reduced. This can potentially improve the state of the control system communication channel 60, which had been deteriorating, to a state where the representative value obtained by statistical processing using communication delay time falls below a predetermined threshold. When the representative value falls below the predetermined threshold, the key length switching determination processing unit 391 controls the selector 392 to switch to terminal a. As a result, the ciphertext with the normal key length is selected.

[0132] As described above, the FA system 1 according to this embodiment is an encrypted control system that controls the plant 30 via a control system communication channel 60 using a controller 20 that can conceal information within the control system using cryptography. The system is configured to change the key length of the encryption key according to the communication channel state of the control system communication channel 60. This prevents the breakdown of the control cycle due to increased communication delay and enables operation that takes into account the availability of the system.

[0133] [Verification Results] Here, we will examine the behavior of the robot arm when the key length of the encryption key is changed, assuming that the control target of the control execution unit 33 of the plant 30 is, for example, a robot arm.

[0134] The robot arm will be driven by two axes: a yaw axis motor and a pitch axis motor. Here, we will encrypt and control one robot arm with a key length of 256 bits at time 0 ≤ t ≤ 5s and a key length of 32 bits at time 5 ≤ t ≤ 10s, and observe its response when tracking a sine wave.

[0135] Figure 5 shows the verification results regarding the rotation angles of the yaw and pitch axes of the robot arm. In Figure 5, A shows the time-yaw relationship, and B shows the time-pitch relationship. As is clear from the verification results regarding the rotation angles of the yaw and pitch axes shown in Figures 5A and 5B, changing the key length of the encryption key at time t=5 does not affect the operation of the robot arm; in other words, the robot arm operates stably.

[0136] Figure 6 shows the verification results for the ciphertext of the rotation angles of the yaw and pitch axes of the robot arm. In Figure 6, A and B show the time-encrypted pitch relationship. The verification results for the ciphertext of the rotation angles of the yaw and pitch axes of the robot arm show that changing the key length reduces the number of digits in the ciphertext; for example, at time 0 ≤ t ≤ 5s, it becomes 10 76 This will be a custom order.

[0137] Figure 7 shows the verification results for the ciphertext of the rotation angles of the yaw and pitch axes of the robot arm when the key length is shortened compared to Figure 6. In Figure 7, A and B show the time-encrypted pitch relationship. In the verification results for the ciphertext of the rotation angles of the yaw and pitch axes of the robot arm when the vertical axis is enlarged compared to Figure 6, it is found that changing the key length reduces the number of digits in the ciphertext. For example, at time 5 ≤ t ≤ 10s, the number of digits becomes 10. 9 This will be a custom order.

[0138] Figure 8 shows the verification results regarding the computation time for encryption. As is clear from Figure 8, which shows the relationship between time and computation time, it can be seen that shortening the key length reduces the computation time for encryption.

[0139] <Variation> Although the present invention has been described above based on preferred embodiments, the present invention is not limited to these embodiments, and various other modifications can be made as long as they do not depart from the gist of the invention as described in the claims. For example, the embodiments described above are detailed and specific in order to explain the configuration of the encryption control system and encryption control method in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described.

[0140] Furthermore, although the embodiments described above used an FA system as an example of a remote control system to which the present invention is applied, the present invention is not limited to FA systems. It is applicable to all remote control systems in the industrial sector, such as a remote control system where the controlled object is, for example, a robot arm.

[0141] Furthermore, although the above-described embodiment used RSA encryption as an example, the encryption method is not limited to RSA encryption; any encryption method with multiplicative homomorphism, such as ElGamal encryption, is acceptable.

[0142] Furthermore, in Figure 1, the functions of the controller 20 and the plant 30 are illustrated as functional blocks. These functional blocks can be realized by a microcomputer that runs in software, with the processor interpreting and executing each function. [Explanation of Symbols]

[0143] 1...FA system, 10...Input device, 11...Parameter input unit, 12...Encryption unit, 20...Controller, 21...Parameter acquisition / setting unit, 22...Calculation unit, 23A,23B...Receiver unit, 24A,24B...Transmitter unit, 25...Recording device, 26A,26B...Time synchronization processing unit, 27...Internal clock adjustment unit, 30...Plant, 31...Receiver unit, 32...Decryption unit, 33...Control execution unit, 34...Encryption unit, 35...Transmitter unit, 36...Time synchronization processing unit, 37...Internal clock adjustment unit, 38...Delay measurement unit, 39...Key length switching control unit, 40...Recording device, 41...Parameter acquisition / setting unit, 50...Time server, 60...Control system communication channel, 70...General-purpose communication channel

Claims

1. An encrypted control system that controls a plant via a network communication channel using a controller that can conceal information within the control system using cryptography, The system includes a key length switching control unit that sets the key length of the encryption key to vary in multiple stages according to the communication delay time of the aforementioned network communication path. The key length switching control unit switches the key length at a predetermined control cycle according to the communication delay time, thereby avoiding a breakdown of the control cycle. Encryption control system.

2. The network includes a delay time measurement unit for measuring the communication delay time of the network communication path, The key length switching control unit selects a first key length if the delay time measured by the delay time measurement unit is less than or equal to a first threshold, and sets the key length to a second stage shorter than the first key length if the delay time exceeds the first threshold. The encryption control system according to claim 1.

3. The controller is equipped with an input device that inputs encrypted parameters, which are input in response to operations performed by the operator, to the controller. The encryption control system according to claim 2.

4. The aforementioned parameters are parameters encrypted by a homomorphic cryptographic scheme. The encryption control system according to claim 3.

5. Equipped with a time server that has the function of distributing time information, The time information distributed by the aforementioned time server is information that is not encrypted using the aforementioned encryption key, and is used as a control standard for the controller and the plant. The encryption control system according to claim 4.

6. An encrypted control method for controlling a plant via a network communication channel using a controller that can conceal information within the control system using cryptography, This system performs key length switching control processing, which sets the key length of the encryption key to be variable in multiple stages according to the communication delay time of the aforementioned network communication path. The key length switching control process avoids failure of the control cycle by switching the key length at a predetermined control cycle according to the communication delay time. Encryption control method.

7. Includes a delay time measurement process for measuring the communication delay time of the network communication path, In the key length switching control process, if the delay time measured by the delay time measurement process is less than or equal to a first threshold, the first key length is selected. If the delay time exceeds the first threshold, the key length is set to a second stage, which is shorter than the first key length. The encryption control method according to claim 6.

Images