Elevator control device and method for updating elevator control program

Abstract

The present invention discloses an elevator control device capable of improving cyber security. This elevator control device (10) controls the operation of a car (2) and receives communication data including a control program. The control program has an authenticity verification code for verifying that the control program is authentic, and determines the authenticity of the control program included in the received communication data on the basis of the authenticity verification code.

Description

Elevator control device and elevator control program update method

[0001] The present invention relates to an elevator control device equipped with a control program, and a method for updating this control program.

[0002] The elevator control device controls the operation of the elevator car by a computer system such as a microcomputer executing a control program. When the operation method of the elevator car needs to be changed, the control program is updated.

[0003] A known prior art technique for updating control programs is described in Patent Document 1. In this prior art, an elevator control device stores control programs that are divided into a basic program that governs the basic operation of the elevator and a function program that improves the elevator's functions. A center that stores the function programs is connected to the elevator control device via a communication line. The function programs in the elevator control device are updated by access from the center.

[0004] Japanese Patent Application Laid-Open No. 2002-211853

[0005] In the above-mentioned conventional technology, the control program stored in the elevator control device is updated through communication with the center, which means that there is a risk that a cyber attack could update the program in the elevator control device to a program different from the control program transmitted by the center.

[0006] Therefore, the present invention provides an elevator control device and an elevator control program update method that can improve cybersecurity.

[0007] In order to solve the above problems, the elevator control device of the present invention controls the operation of a car, receives communication data including a control program, and the control program has an authenticity authentication code that certifies that the control program is authentic, and determines the authenticity of the control program included in the received communication data based on the authenticity authentication code.

[0008] In order to solve the above problem, the method for updating an elevator control program according to the present invention sets an authenticity authentication code in the update program to prove that the update program is authentic, creates communication data, and determines the authenticity of the control program included in the received communication data based on the authenticity authentication code.

[0009] The present invention improves cybersecurity.

[0010] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0011] 1 is a block diagram showing the configuration of an elevator control system according to a first embodiment. FIG. 2 is a block diagram showing the hardware configuration of an elevator control device 10 (FIG. 1). FIG. 3 is a data structure diagram showing a schematic configuration of an update program created by a server 100 (FIGS. 1 and 2). FIG. 4 is a data structure diagram showing a schematic configuration of communication data sent by the server 100 (FIGS. 1 and 2) to the elevator control device 10. FIG. 5 is a method explanatory diagram showing a means for generating an authenticity authentication code (CODE 1 to 4). FIG. 6 is a data structure diagram showing a schematic configuration of an example of fraudulently created communication data. FIG. 7 is a flowchart showing the authenticity authentication operation of an update program executed by the elevator control device 10 (FIG. 2). FIG. 8 is a data structure diagram showing a schematic configuration of communication data sent by the server 100 (FIGS. 1 and 2) to the elevator control device 10 in an elevator control system according to a modified embodiment. FIG. 9 is a block diagram showing the hardware configuration of an elevator control device according to a second embodiment. FIG. 10 is a data structure diagram showing a schematic configuration of an update program for a sub-controller created by the server 100 (FIG. 9). 1 is a data configuration diagram showing a schematic configuration of communication data that the server 100 (FIG. 9) sends to the elevator control device 10 when updating a program in the sub-controller 11. FIG. 2 is a method explanatory diagram showing a means for generating an authenticity authentication code (CODE 5, 6). FIG. 3 is a data configuration diagram showing a schematic configuration of an example of fraudulently created communication data. FIG. 4 is a flowchart showing an authenticity authentication operation of an update program for the sub-controller, executed by the elevator control device 10 (FIG. 9).

[0012] An elevator system according to one embodiment of the present invention will be described below with reference to the drawings in Examples 1 and 2. In each drawing, the same reference numerals indicate the same components or components with similar functions.

[0013] FIG. 1 is a block diagram showing the configuration of an elevator control system according to a first embodiment of the present invention.

[0014] In the elevator system 1, a car 2 and a counterweight 3 are suspended in a hoistway by a main rope 4. The main rope 4 is wound around a sheave and a direction-changing pulley 6 of a drive unit 5. When the sheave is rotated by a motor of the drive unit 5, the main rope 4 is driven. As a result, the car 2 and the counterweight 3 move up and down in opposite directions to each other in the hoistway.

[0015] The elevator control device 10 controls the drive device 5 to control the operation of the car 2. In response to calls registered by an operation panel 30 provided in the car 2 or an operating device provided at the landing 50, the elevator control device 10 controls not only normal operation of running the car 2 and landing and stopping it at a floor, but also safety-related operations such as stopping at end floors and deceleration at the last floor.

[0016] The elevator control device 10 includes a microcomputer and stores a control program. The microcomputer executes the control program, whereby the elevator control device 10 controls the operation of the car 2.

[0017] When the operating specifications of the car 2 are changed, the control program stored in the elevator control device 10 is updated. The updated program is transmitted to the elevator control device 10 via the communication network 200 from a server 100 installed in a control center located geographically distant from the installation location of the elevator device 1.

[0018] The elevator system 1 includes the above-mentioned operation panel 30 and operating device 40, as well as a door driving device 20 provided on the car 2. The operation panel 30 includes a button switch for registering a car call, and a display device for displaying the floor on which the car is located and various other information. The operating device 40 includes a button switch for registering a car call. When the car 2 stops, the door driving device 20 drives a car door provided on the car 2. Because the car door engages with a landing door provided on the landing 50, when the car door is driven, both the car door and the landing door are opened or closed.

[0019] Each of the door drive device 20, the operation panel 30, and the operation device 40 has a control device (hereinafter referred to as a sub-controller). Each sub-controller is communicably connected to the elevator control device 10.

[0020] In response to button switch operations, the sub-controller of the operation panel 30 transmits a car call registration signal to the elevator control device 10. In addition, in response to control commands from the elevator control device 10, the sub-controller of the operation panel 30 displays the floor on which the car is located and various other information on a display device.

[0021] In response to the button switch operation, the sub-controller of the operating device 40 transmits a hall call registration signal to the elevator control device 10. If a display device is provided at the hall, the sub-controller of the operating device 40 displays various information such as arrival announcements on the display device in response to a control command from the elevator control device 10.

[0022] The sub-controller of the door drive device 20 controls the opening and closing of the car doors and the landing doors in response to a control command from the elevator control device 10.

[0023] Each sub-controller includes a microcomputer and stores a control program. The microcomputer executes the control program, causing each sub-controller to control the equipment to be controlled in response to a control command from the elevator control device 10.

[0024] When the specifications for the operation of the controlled device are changed, the control program stored in the sub-controller is updated. The updated program is transmitted to the elevator control device 10 via the communication network 200 from a server 100 installed in a control center located geographically distant from the installation location of the elevator device 1. The elevator control device 10 transfers the received updated program to the sub-controller.

[0025] As will be described later, the elevator control device 10 determines the authenticity of an update program received from the server 100 before storing it in the elevator control device 10 and executing it, or before transferring it to the subcontroller. If the elevator control device 10 determines that the received update program is an authentic program, it rewrites the stored control program with the update program or transfers it to the subcontroller.

[0026] FIG. 2 is a block diagram showing the hardware configuration of the elevator control device 10 (FIG. 1).

[0027] The elevator control device 10 includes a CPU (Central Processing Unit), which is an arithmetic processing device that generates control commands, a ROM (Read Only Memory), which is a non-volatile storage device, and a RAM (Random Access Memory), which is a volatile storage device that can be read and written freely.

[0028] The ROM stores the control program executed by the elevator control device 10. In the first embodiment, a rewritable nonvolatile storage device such as a flash memory is used as the ROM. This allows the elevator control device 10 to update the control program. The ROM also stores an identification code (hereinafter referred to as "main identification code") ID1 of the elevator control device 10. The main identification code is uniquely assigned to each of multiple elevator devices managed by a control center equipped with the server 100.

[0029] The RAM temporarily stores data while the elevator control device 10 executes the control program.

[0030] The CPU generates control commands by reading instructions in the control program stored in the ROM and executing arithmetic processing in accordance with the instructions. The CPU may also copy instructions from the ROM to the RAM and execute the instructions in the RAM.

[0031] The server 100 and the elevator control device 10 are connected so that they can communicate with each other. The server 100 creates an update program and sends the created update program to the elevator control device 10 via communication. The server 100 adds a code (hereinafter referred to as an "authenticity authentication code") to the created update program to prove that the update program created by the server 100 is genuine. When the elevator control device 10 confirms that the received update program is genuine based on the authenticity authentication code added to the update program, it rewrites the control program stored in ROM with the update program.

[0032] The server 100 generates an authenticity authentication code based on information that can be used to identify the elevator control device 10 to which the update program is to be sent. In the first embodiment, the authenticity authentication code is generated based on the main identification code ID1 assigned to the elevator control device 10.

[0033] FIG. 3 is a data structure diagram showing a schematic structure of an update program created by the server 100 (FIGS. 1 and 2).

[0034] The update program 110 has a plurality of data areas (three areas A, B, and C in FIG. 3).

[0035] Data areas A and B contain standard programs for car operation control. The standard programs are control programs based on standard operating specifications that are applicable to multiple elevators, regardless of the elevator model or the building to which the elevator is applied. Data area A contains a standard program for controlling safety-related operations. Data area B contains a standard program for controlling non-safety-related operations, i.e., normal operation. Data area C contains a control program, i.e., an arrangement program, based on operating specifications specific to the building to which the elevator is applied.

[0036] The load modules constituting each program of the update program 110 are created in the control center and stored in a storage device provided in the control center. Each program is assigned an arbitrary code a1, b1, or c1 that is used to detect program alterations due to noise, cyber attacks, or the like. The server 100 selects a combination of programs to be set in data areas A, B, and C from the load modules stored in the storage device according to the elevator control device 10 to which the update program is to be sent, and creates the update program 110.

[0037] The arbitrary code is uniquely determined for each control program. For example, sum values ​​calculated from program data using a predetermined formula are applied as the arbitrary codes a1, b1, and c1.

[0038] FIG. 4 is a data configuration diagram showing a schematic configuration of communication data that the server 100 (FIGS. 1 and 2) sends to the elevator control device 10 when updating a program.

[0039] The server 100 generates communication data 120 by adding a communication header to the aforementioned update program 110 (Figure 3) and adding an authenticity authentication code (CODE 1 to 4) to the communication header and each program that makes up the update program 110.

[0040] The communication data 120 has the above-mentioned data areas A, B, and C, as well as a data area D in which a communication header is set.

[0041] 4, the arbitrary codes a1, b1, and c1 in FIG. 3 are respectively written as arbitrary codes 1, 2, and 3. Also, the authenticity verification codes d1, a2, b2, and c2 are respectively written as CODE 1, 2, 3, and 4.

[0042] The arbitrary codes a1, b1, and c1 are calculated from the program data of a standard program for controlling safety-related operations, a standard program for controlling non-safety-related operations, i.e., normal operations, and an arrange program, respectively.

[0043] As shown in Fig. 4, CODE1 is set in data area D together with the communication header. Optional code 1 and CODE2 are set in data area A together with a standard program for controlling safety-related operations. Optional code 2 and CODE3 are set in data area B together with a standard program for controlling non-safety-related operations, i.e., normal operations. Optional code 3 and CODE4 are set in data area C together with an arrange program.

[0044] FIG. 5 is a diagram illustrating a method for generating the authenticity authentication code (CODE1 to CODE4).

[0045] The server 100 generates the authenticity authentication code by a predetermined calculation means. In the first embodiment, the server 100 generates the authenticity authentication code (CODE1 to CODE4) by using a so-called hash function.

[0046] A hash function is a general term for an algorithm that calculates a specific size of separate data, i.e., a hash value, from an arbitrary size of original data. In this embodiment 1, a so-called cryptographic hash function is applied. A cryptographic hash function generates dissimilar hash values, like a cryptography, when a part of the original data is different. Furthermore, a cryptographic hash function is a one-way function that makes it virtually impossible to restore the original data from the hash value.

[0047] As cryptographic hash functions, algorithms such as MD5 and SHA2 are known.

[0048] 5, the server 100 first generates CODE1 from among the authentication codes CODE1 to CODE4 using a cryptographic hash function f based on the main identification code ID1. In this first embodiment, data (ID1+DUMMY) obtained by adding arbitrary data (DUMMY) to ID1 is input to f. This makes it difficult for a third party to guess ID1 from the hash value.

[0049] Next, the server 100 generates CODE2 using f based on CODE1. In the first embodiment, data obtained by adding DUMMY to CODE2 (CODE1+DUMMY) is input to f.

[0050] Next, the server 100 generates CODE3 using f based on CODE2. In the first embodiment, data obtained by adding DUMMY to CODE2 (CODE2+DUMMY) is input to f.

[0051] Next, the server 100 generates CODE4 using f based on CODE3. In the first embodiment, data obtained by adding DUMMY to CODE4 (CODE3+DUMMY) is input to f.

[0052] As described above, CODE1 to CODE4 are generated by repeatedly applying f based on ID1. In the first embodiment, f is applied four times to generate CODE4, which is assigned to the standard program for controlling the most important safety-related operation among the programs constituting the control program. In other words, the reliability of the authenticity authentication code assigned to a program of high importance is increased by applying f multiple times to generate it.

[0053] As described above, CODEn+1 is generated by f based on CODEn (n=1, 2, 3), so CODE1 to CODE4 are related by f, so to speak. Therefore, CODE1 to CODE4 certify the authenticity of the communication header and each program constituting the update program, and also reliably certify the authenticity of the entire update program consisting of the combination of each program.

[0054] FIG. 6 is a data structure diagram showing a schematic structure of an example of fraudulently created communication data (see FIG. 4).

[0055] In the communication data 120', the standard program for controlling non-safety related operations, i.e., normal operation, which is set in data area B, has been modified compared to the authentic communication data 120 (FIG. 4). As a result, the arbitrary code b1 becomes arbitrary code 2', which does not match the arbitrary code 2 in the authentic communication data 120 (FIG. 4). Furthermore, because it is difficult for the creator of the fraudulent communication data 120' to obtain or estimate information related to the main identification code ID1, the authenticity verification codes d1, a2, b2, and c2 are CODE 1', 2', 3', and 4', respectively, which do not match the CODE 1, 2, 3, and 4 in the authentic communication data 120 (FIG. 4).

[0056] The elevator control device 10 (FIG. 2) determines that the update program has been tampered with or is not authentic based on the discrepancy between the above-described arbitrary code and the authenticity authentication code in the received communication data.

[0057] FIG. 7 is a flowchart showing the operation of authenticating the authenticity of the update program executed by the elevator control device 10 (FIG. 2).

[0058] The elevator control device 10 executes each step (S101 to S111) in FIG. 7 using the CPU (FIG. 2).

[0059] In step S101, the elevator control device 10 decodes the received communication data that has been coded by coding processing such as encryption, and restores the original communication data 120 (FIG. 4).

[0060] Next, in step S102, the elevator control device 10 extracts data of the main identification code ID1 from the ROM (FIG. 2) that stores the control program to be updated and the main identification code ID1.

[0061] Next, in step S103, the elevator control device 10 extracts an arbitrary code from the data of the control program currently in operation that is stored in the ROM.

[0062] Next, in step S104, the elevator control device 10 generates an authenticity authentication code (d1, c2, b2, a2 ​​in FIG. 4) based on the ID1 extracted in step S102 using the same means as the authenticity authentication code generation means (FIG. 5) in the server 100 (FIG. 2).

[0063] Next, in step S105, the elevator control device 10 compares the authenticity authentication code set in each data area (A, B, C, D in FIG. 4) of the communication data 120 (FIG. 4) restored in step S101 with the authenticity authentication code of the corresponding data area generated in step S104, thereby determining whether the two codes match for all data areas.

[0064] If the elevator control device 10 determines that the two match for all data areas (YES in step S105), that is, if it has confirmed that the received update program is authentic, it then executes step S106. If the elevator control device 10 determines that the two do not match for at least some data areas (NO in step S105), that is, if it cannot confirm that the received update program is authentic, it then executes step S107.

[0065] In step S106, the elevator control device 10 accepts the received communication data 120 and rewrites the control program stored in the ROM with the update program determined to be authentic. After executing step S106, the elevator control device 10 ends the series of processes.

[0066] From step S107 onwards, the elevator control device 10 detects a cybersecurity incident based on the arbitrary code and authenticity authentication code assigned to the update program.

[0067] In step S107, the elevator control device 10 compares the arbitrary code set in the program data area (A, B, C in FIG. 4) of the communication data restored in step S101, i.e., the received communication data 120, with the arbitrary code assigned to the data of the currently operating control program extracted in step S103, to determine whether the two are inconsistent in at least a portion of the program data area.

[0068] If the elevator control device 10 determines that the two programs do not match in at least some of the program data areas (YES in step S107), that is, if it determines that the update program contains changes to the currently operating control program, it then executes step S108.If the elevator control device 10 determines that the two programs do not match in all of the program data areas (NO in step S107), that is, if it determines that the update program contains no changes, it then executes step S111.

[0069] In step S111, the elevator control device 10 determines that there is no alteration unit and that it cannot confirm that an incident has occurred, and therefore discards the communication data 120 that could not be confirmed to be authentic in step S105 without accepting it. After executing step S111, the elevator control device 10 ends the series of processes.

[0070] In step S108, for a program data area determined in step S107 to contain a mismatch between the arbitrary code set in the program data area (A, B, C in FIG. 4) of the received communication data 120 and the arbitrary code assigned to the data of the control program currently in operation, the elevator control device 10 calculates an arbitrary code from the program data set in that program data area of ​​the received communication data 120, and determines whether the calculated arbitrary code matches the arbitrary code set in that program data area in the received communication data 120.

[0071] If the elevator control device 10 determines that the two match (YES in step S108), that is, if it determines that the change portion of the received update program may have been generated due to the occurrence of an incident, it then executes step S109.If the elevator control device 10 determines that the two do not match in the entire program data area (NO in step S107), that is, if it determines that the change portion of the received update program may have been generated due to a communication abnormality, it then executes step S111.

[0072] In step S111, the elevator control device 10 determines that the change portion may have been generated due to a communication abnormality and cannot confirm that it was generated due to an incident, and discards the communication data 120 that could not be confirmed to be authentic in step S105 without accepting it. After executing step S111, the elevator control device 10 ends the series of processes.

[0073] In step S109, the elevator control device 10 determines whether the authenticity authentication code set in the program data area where the modification unit is located does not match the authenticity authentication code in the same program data area generated based on ID1 in step S105.

[0074] If the elevator control device 10 determines that the two do not match (YES in step S109), that is, if it determines that the received update program is not authentic and the change portion was generated due to an incident, it then executes step S110. If the elevator control device 10 determines that the two do not match (NO in step S109), that is, if it cannot confirm that the received update program is not authentic and cannot determine that the change portion was generated due to an incident, it then executes step S111.

[0075] In step S110, the elevator control device 10 determines that an incident has been detected. After executing step S110, the elevator control device 10 ends the series of processes.

[0076] In step S111, the elevator control device 10 determines that it cannot confirm that the change portion was generated due to an incident, and discards the communication data 120 that could not be confirmed as authentic in step S105 without accepting it. After executing step S111, the elevator control device 10 ends the series of processes.

[0077] FIG. 8 is a data configuration diagram showing a schematic configuration of communication data that the server 100 (FIGS. 1 and 2) sends to the elevator control device 10 when updating a program in an elevator control system that is a modified example of the first embodiment.

[0078] In this modification, the configuration of communication data is different from that of the first embodiment (FIG. 4), as shown in Fig. 8. Note that in this modification, the configuration of the control system is the same as that of the first embodiment (FIGS. 1 and 2).

[0079] In this modified example, the communication data 130′ has a data area D in which a communication header is set, and a data area B in which only a program having an update section, that is, a standard program for controlling normal operation in this modified example, is set among the multiple programs constituting the update program 110 (FIG. 3).

[0080] Authenticity authentication codes d1, d2, and d3, along with a communication header, are set in data area D. A standard program for controlling normal operation, along with an arbitrary code b1 and an authenticity authentication code b2, are set in data area B.

[0081] These correspond to the authenticity verification codes d1, a2, c2, and b2 in the first embodiment (FIG. 4), respectively. The arbitrary code b2 is an arbitrary code added to a program having an update section, which in this modification is a standard program for controlling normal operation, and corresponds to the arbitrary code b1 in the first embodiment (FIG. 4).

[0082] The means for generating the authenticity authentication code and the arbitrary code are the same as those in the first embodiment.

[0083] 8 in the same manner as in FIG. 6 (with "'" added), the authenticity authentication codes d1, d2, d3, and b2, as well as the arbitrary code b1, in the fraudulently generated communication data 130' are different from those in the authentic communication data. Therefore, in this embodiment as well, as in the first embodiment, it is possible to determine the authenticity of the control program and whether an incident has occurred, based on the authenticity authentication code and the arbitrary code in the communication data.

[0084] According to this modification, the amount of communication data is reduced when updating the control program, thereby reducing the processing load on the elevator control device 10 and the server 100. This reduces the time required to update the control program.

[0085] As described above, when updating the control program, a code calculated based on the identification code assigned to the elevator control device is set in the communication data containing the update program. Based on this code, the elevator control device 10 can determine the authenticity of the received update program. This improves the cybersecurity of the elevator system.

[0086] Second Embodiment A second embodiment of the present invention will be described below, focusing mainly on the differences from the first embodiment.

[0087] FIG. 9 is a block diagram showing a hardware configuration of an elevator control device according to a second embodiment of the present invention.

[0088] In the second embodiment, the elevator control device 10 and the subcontroller 11 are connected to each other so that they can communicate with each other. The subcontroller 11, like the elevator control device 10, includes a CPU, a ROM, and a RAM. The ROM stores a control program that the subcontroller 11 executes when controlling a controlled device. The ROM also stores an identification code (hereinafter referred to as a "subcode") ID2 of the subcontroller 11.

[0089] The devices controlled by the sub-controller 11 are elevator devices provided in the car 2 and the hall 50, such as the door drive device 20, the control panel 30, and the operating device 40 (FIG. 1).

[0090] The server 100 transmits the update program to the subcontroller 11 by communication via the elevator control device 10. When the elevator control device 10 determines that the received update program is authentic, it transfers the update program to the subcontroller 11. The subcontroller 11 rewrites the control program stored in the ROM with the update program transferred from the elevator control device 10.

[0091] FIG. 10 is a data structure diagram showing a schematic structure of an update program for the subcontroller created by the server 100 (FIG. 9).

[0092] The update program 140 has a data area E. The data area E has a program for controlling the devices to be controlled by the sub-controller 11.

[0093] The load modules that make up the update program 140 are created in the control center and stored in a storage device provided in the control center. The update program is assigned an arbitrary code e1 that is used to detect program alterations due to noise, cyber attacks, etc. The server 100 selects a control program to be set in the data area E from the load modules stored in the storage device according to the subcontroller 11 to which the update program is to be sent, and creates the update program 140.

[0094] For example, a sum value calculated from program data using a predetermined formula is applied as the arbitrary code e1.

[0095] FIG. 11 is a data configuration diagram showing a schematic configuration of communication data that the server 100 (FIG. 9) sends to the elevator control device 10 when updating a program in the subcontroller 11.

[0096] The server 100 generates communication data 150 by adding a communication header to the update program 140 (FIG. 10) and adding an authenticity authentication code (CODE 5-6) to the communication header and the program that constitutes the update program 110.

[0097] The communication data 150 has, in addition to the data area E described above, a data area F in which a communication header is set.

[0098] 11, the arbitrary code e1 in FIG. 10 is written as arbitrary code 5. Also, the authenticity authentication codes f2 and e2 are written as CODE 5 and CODE 6, respectively.

[0099] The arbitrary code e1 is calculated from the data in the update program.

[0100] 11, CODE5 and subcode f1 (corresponding to ID2 in FIG. 9) are set together with the communication header in data area F. Arbitrary code 5 and CODE6 are set together with the update program for the subcontroller 11 in data area F.

[0101] FIG. 12 is a diagram illustrating a method for generating an authenticity authentication code (CODE5, CODE6).

[0102] In the second embodiment, the server 100 generates an authenticity authentication code (CODE5, CODE6) using a hash function, as in the first embodiment.

[0103] 12, the server 100 first generates CODE5 of the authenticity authentication codes CODE5 and CODE6 using a cryptographic hash function f based on the main identification code ID1 and subcode ID2. In the second embodiment, the data (ID1+ID2+DUMMY) obtained by adding ID1, ID2, and arbitrary data (DUMMY) is input to f. This makes it difficult for a third party to guess, from the hash value, the main identification code ID1 of the elevator control device 10 to which the update program is to be sent.

[0104] Next, the server 100 generates CODE6 using f based on CODE5. In the second embodiment, data obtained by adding DUMMY to CODE5 (CODE5+DUMMY) is input to f.

[0105] As described above, CODE5 and CODE6 are generated by repeatedly applying f based on ID1 and ID2. In the second embodiment, f is applied twice to generate CODE6, which is the most important code in the communication data and is assigned to the update program. In other words, the reliability of the authenticity authentication code assigned to the update program is increased by applying f multiple times to generate it.

[0106] FIG. 13 is a data structure diagram showing a schematic structure of an example of fraudulently created communication data (see FIG. 11).

[0107] In communication data 150', the update program for the subcontroller 11 set in data area E has been changed compared to communication data 150 (FIG. 11) whose authenticity has been verified. As a result, arbitrary code e1 has become arbitrary code 5', which does not match arbitrary code 5 in the authentic communication data 150 (FIG. 11). Furthermore, because it is difficult for the creator of fraudulent communication data 150' to obtain or estimate information related to main identification code ID1, authenticity verification codes f2 and e2 are CODE 5' and 6', respectively, which do not match CODE 5 and 6 in the authentic communication data 150 (FIG. 11).

[0108] Based on the discrepancy between the arbitrary code and the authenticity authentication code as described above in the received communication data, the elevator control device 10 (Figure 9) determines that the update program for the sub-controller 11 has been fraudulently modified or that the update program is not authentic.

[0109] FIG. 14 is a flowchart showing the operation of authenticating the authenticity of the update program for the sub-controller, which is executed by the elevator control device 10 (FIG. 9).

[0110] The elevator control device 10 executes each step (S201 to S212) in FIG. 14 using the CPU (FIG. 9).

[0111] In step S201, the elevator control device 10 decodes the received communication data that has been coded by coding processing such as encryption, and restores the original communication data 150 (FIG. 11).

[0112] Next, in step S202, the elevator control device 10 extracts the data of the main identification code ID1 from the ROM (FIG. 11) that stores the main identification code ID1.

[0113] Next, in step S203, the elevator control device 10 determines the subcontroller 11 for updating the control program based on the subcode ID2 set in the communication header of the received communication data 150.

[0114] Next, in step S204, the elevator control device 10 instructs the subcontroller 11 determined in step S203 to extract an arbitrary code from the data of the control program currently in operation stored in the ROM of the subcontroller 11.

[0115] Next, in step S205, the elevator control device 10 generates an authenticity authentication code (f2, e2 in FIG. 11) based on the sub-code ID2 of the sub-controller 11 and the ID1 extracted in step S202 by the same means as the authenticity authentication code generation means (FIG. 12) in the server 100 (FIG. 9).

[0116] Next, in step S206, the elevator control device 10 compares the authenticity authentication code set in each data area (F, E in FIG. 11) of the communication data 150 (FIG. 11) restored in step S201 with the authenticity authentication code of the corresponding data area generated in step S205, thereby determining whether the two codes match for all data areas.

[0117] If the elevator control device 10 determines that the two programs match for all data areas (YES in step S206), i.e., if it has confirmed that the received update program is authentic, it then executes step S207. If the elevator control device 10 determines that the two programs do not match for at least some data areas (NO in step S206), i.e., if it cannot confirm that the received update program is authentic, it then executes step S208.

[0118] In step S207, the elevator control device 10 accepts the received communication data 150 and transfers the update program determined to be authentic to the subcontroller 11. The subcontroller 11 rewrites the control program stored in the ROM of the subcontroller 11 with the update program transferred from the elevator control device 10. After executing step S207, the elevator control device 10 ends the series of processes.

[0119] From step S208 onwards, the elevator control device 10 detects a cybersecurity incident based on the arbitrary code and authenticity authentication code assigned to the update program.

[0120] In step S208, the elevator control device 10 compares the communication data restored in step S201, i.e., the arbitrary code set in the program data area (E in FIG. 11) of the received communication data 150, with the arbitrary code (sub-information) assigned to the data of the currently operating control program extracted in step S204, to determine whether the two are inconsistent.

[0121] If the elevator control device 10 determines that the two programs do not match (YES in step S208), that is, if it determines that the update program contains changes to the currently operating control program, it then executes step S209. If the elevator control device 10 determines that the two programs do not match (NO in step S208), that is, if it determines that the update program contains no changes, it then executes step S212.

[0122] In step S212, the elevator control device 10 determines that there is no change unit and that it cannot confirm that an incident has occurred, and discards the communication data 150 that could not be confirmed to be authentic in step S206 without accepting it. After executing step S212, the elevator control device 10 ends the series of processes.

[0123] In step S209, for program data area E (E in FIG. 11) of the received communication data 150 for which it was determined in step S208 that the arbitrary code set in the program data area does not match the arbitrary code assigned to the data of the control program currently in operation, the elevator control device 10 calculates an arbitrary code from the program data set in the program data area of ​​the received communication data 150, and determines whether the calculated arbitrary code matches the arbitrary code set in the program data area in the received communication data 150.

[0124] If the elevator control device 10 determines that the two match (YES in step S209), that is, if it determines that the change portion of the received update program may have been generated due to the occurrence of an incident, it then executes step S210. If the elevator control device 10 determines that the two do not match (NO in step S209), that is, if it determines that the change portion of the received update program may have been generated due to a communication abnormality, it then executes step S212.

[0125] In step S212, the elevator control device 10 determines that the change portion may have been generated due to a communication abnormality and cannot confirm that it was generated due to an incident, and discards the communication data 150 that could not be confirmed to be authentic in step S206 without accepting it. After executing step S212, the elevator control device 10 ends the series of processes.

[0126] In step S210, the elevator control device 10 determines whether the authenticity authentication code set in the program data area where the modification unit is located does not match the authenticity authentication code in the same program data area generated based on ID1 and ID2 in step S205.

[0127] If the elevator control device 10 determines that the two do not match (YES in step S210), that is, if it determines that the received update program is not authentic and the change portion was generated due to an incident, it then executes step S211. If the elevator control device 10 determines that the two do not match (NO in step S210), that is, if it cannot confirm that the received update program is not authentic and cannot determine that the change portion was generated due to an incident, it then executes step S212.

[0128] In step S211, the elevator control device 10 determines that an incident has been detected. After executing step S211, the elevator control device 10 ends the series of processes.

[0129] In step S212, the elevator control device 10 determines that it cannot confirm that the change portion was generated due to an incident, and discards the communication data 150 that could not be confirmed as authentic in step S206 without accepting it. After executing step S212, the elevator control device 10 ends the series of processes.

[0130] As described above, when updating the control program in the sub-controller, a code calculated based on the identification code assigned to the elevator control device is set in the communication data containing the update program. Based on this code, the elevator control device 10 can determine the authenticity of the received update program for the sub-controller. This improves the cybersecurity of the elevator system.

[0131] The present invention is not limited to the above-described first and second embodiments, and includes various modifications. For example, the above-described first and second embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0132] 1... elevator device, 2... car, 3... counterweight, 4... main rope, 5... drive device, 10... elevator control device, 11... sub-controller, 20... door drive device, 30... operation panel, 40... operation device, 50... landing, 100... server, 200... communication network, 110... update program, 120... communication data, 120'... communication data, 130'... communication data, 140... update program, 150... communication data, 150'... communication data

Claims

1. An elevator control device that controls the operation of a car, comprising: a control program; a control unit that receives communication data including the control program; the control program having an authenticity authentication code that certifies that the control program is authentic; and a control unit that determines the authenticity of the control program included in the received communication data based on the authenticity authentication code.

2. An elevator control device according to claim 1, characterized in that the communication data transmitted includes an authentic control program in which an authenticity authentication code calculated by a predetermined calculation means is set.

3. An elevator control device as described in claim 2, characterized in that the authenticity of the received control program is determined by comparing the authenticity authentication code contained in the received control program with the authenticity authentication code calculated by the elevator control device using the specified calculation means.

4. An elevator control device according to claim 2, wherein the authenticity authentication code is calculated based on an identification code of the elevator control device.

5. An elevator control device as described in claim 4, characterized in that the operation of the elevator car, which is related to safety, is controlled by executing the control program, and the authenticity authentication code is calculated using the specified calculation means multiple times.

6. In the elevator control device described in claim 1, the control program includes a first program section for controlling the operation of the car under normal conditions and a second program section for controlling the operation of the car related to safety, and the authenticity authentication code includes a first authenticity authentication code set in the first program section and a second authenticity authentication code set in the second program section.

7. An elevator control device according to claim 6, wherein the second authenticity authentication code is calculated using a predetermined calculation means a plurality of times.

8. An elevator control device as described in claim 1, wherein the control program has an arbitrary code calculated based on the control program, and an elevator control device detects cybersecurity incidents based on the authenticity authentication code and the arbitrary code.

9. An elevator control device according to claim 8, wherein the arbitrary code is uniquely determined for the control program.

10. An elevator control device according to claim 1, characterized in that the operation of the car is controlled by executing the control program.

11. An elevator control device as described in claim 1, which is communicatively connected to a sub-controller that controls elevator equipment by executing the control program, and which transfers the control program to the sub-controller when it is determined that the control program is authentic.

12. A method for updating an elevator control program, comprising the steps of: setting an authenticity authentication code in the update program to prove that the update program is authentic; creating communication data; and determining the authenticity of the control program contained in the received communication data based on the authenticity authentication code.

Images