Control system and control method

Abstract

A control system according to one aspect of the present invention comprises a transfer source authenticity confirmation unit that, when a program is updated, confirms whether or not a transfer source of an encrypted update program is correct, by collating authentication information which is generated in the control system and authentication information which is included in collation data in communication data transferred from the transfer source together with the update program.

Description

Control System and Control Method

[0001] The present invention relates to a control system and a control method.

[0002] In recent years, digital devices are required to meet security requirements. Also, various methods for protecting digital devices and programs incorporated in the digital devices have been proposed.

[0003] For example, in Patent Document 1, an elevator control device temporarily stores update software received from a server in a temporary storage RAM, then writes it to two non-volatile memories with a time shift, and determines the integrity of the update data written to each non-volatile memory. Also, in Patent Document 1, the elevator control device transfers the update data in the update processing memory determined to be normal to the execution control RAM and starts the elevator. According to the technique described in Patent Document 1, even if some abnormality occurs during software update, the effect that either one of the update software can be surely secured is obtained.

[0004] Japanese Unexamined Patent Application Publication No. 2009-155092

[0005] By the way, in the above-mentioned Patent Document 1, although it is confirmed whether the data of the update software operates normally, the authenticity of the server that is the transmission source of the update software is not confirmed. Therefore, when the transmission source of the update software is a malicious third party and understands the method of integrity confirmation by the control device, it is difficult to protect the software (program), device, etc. to be updated by the technique described in Patent Document 1.

[0006] The present invention has been made in consideration of the above situation, and an object of the present invention is to enable confirmation of the authenticity of the transfer source of an update program.

[0007] A control system according to one aspect of the present invention includes a source authenticity verification unit that, when updating a program, verifies whether the source of the update program is correct by comparing authentication information contained in verification data transferred from the source along with the encrypted update program with authentication information generated within the control system.

[0008] According to at least one aspect of the present invention, it becomes possible to verify the authenticity of the source of the update program transfer. Other problems, configurations, and effects will be clarified by the following description of embodiments.

[0009] This is a diagram showing an example of the schematic configuration of a control system according to one embodiment of the present invention. This is a diagram showing an example of the configuration of a startup program according to one embodiment of the present invention. This is a diagram showing an example of the configuration of communication data according to one embodiment of the present invention. This is a diagram showing an example of the configuration of an encryption update program according to one embodiment of the present invention. This is a flowchart showing an example of the procedure for control processing by a control system according to one embodiment of the present invention. This is a flowchart showing an example of the procedure for source authenticity verification processing by a source authenticity verification unit according to one embodiment of the present invention. This is a flowchart showing an example of the procedure for encryption update program integrity verification processing by an encryption update program integrity verification unit according to one embodiment of the present invention.

[0010] Hereinafter, examples of embodiments for carrying out the present invention (hereinafter referred to as "embodiments") will be described with reference to the accompanying drawings. The present invention is not limited to these embodiments, and various numerical values ​​and other figures in the embodiments are illustrative. Furthermore, in this specification and drawings, the same reference numerals will be used for identical components or components having substantially the same function, and redundant explanations will be omitted.

[0011] <Outline Configuration of the Control System> First, with reference to Figure 1, the configuration of the control system 100 according to one embodiment of the present invention will be described. Figure 1 is a diagram showing an example of the outline configuration of the control system 100.

[0012] As shown in Figure 1, the control system 100 includes a main controller 1 and a server 2. The main controller 1 is a controller that controls the operation of each device or equipment (an example of controlled equipment) that constitutes an elevator (not shown), such as a car. The control of each device or equipment by the main controller 1 is performed by the MCU (Micro Controller Unit) 10 reading and executing a program Pg stored in the ROM 11 of the main controller 1.

[0013] Server 2 is located, for example, in a control center that monitors the operation status of elevators. Server 2 includes the encryption update program Pguc, created by a program developer (not shown), in the communication data Dt and transfers it to Server 2.

[0014] The encrypted update program Pguc is an encrypted version of the update program, which is used to update the program Pg in the main controller 1. The process of generating the update program and encrypting the update program to generate the encrypted update program Pguc is performed using an unillustrated management device managed by the program creator (unillustrated).

[0015] [Server Configuration] Server 2 includes a communication interface (I / F) 21, a communication data generation unit 22, and a read-only memory (ROM) 23.

[0016] The communication interface 21 (an example of a communication unit) controls the communication between the main controller 1 and the system. The communication interface 21 also transmits the communication data Dt generated by the communication data generation unit 22 to the main controller 1.

[0017] The communication data generation unit 22 generates communication data Dt using the encryption update program Pguc, created by a program developer (not shown), and the plaintext verification data If2. The structure of the communication data Dt will be described in detail later with reference to Figure 3.

[0018] The ROM 23 of server 2 stores the encryption update program Pguc, created by the program developer. The verification data If2 is information referenced by the main controller 1 when it performs a verification process to confirm whether the source of the communication data Dt is genuine (hereinafter referred to as the "source authenticity verification process"). The structure of the verification data If2 will be described in detail later with reference to Figure 5.

[0019] Furthermore, the structure and generation method of the matching data If2 included in the communication data Dt are managed by the transferor (not shown) who generates the communication data Dt and transfers it from server 2 to main controller 1, and this information is not disclosed to the creator of the update program Pgu (see Figure 4). On the other hand, the encryption method (process) of the encryption update program Pguc and the key information used for encryption are managed by the program creator, and this information is not disclosed to the transferor of the communication data Dt.

[0020] [Main Controller] The main controller 1 (an example of a control device) includes an MCU 10, a communication interface 13, an ExROM 14, and an ExRAM 15. The MCU 10, the communication interface 13, the ExROM 14, and the ExRAM 15 are connected to each other via bus B so that they can send and receive information data. The MCU 10 (an example of a processor) includes a ROM 11 and a RAM (Random Access Memory) 12. The ROM 11 (an example of a storage unit) stores a program Pg and a startup program Pgs. The startup program Pgs is a program for selecting a program to run on the MCU 10 and is a program that executes the control processing according to this embodiment. The configuration of the startup program Pgs will be described in detail with reference to Figure 2 below.

[0021] The program Pg and the startup program Pgs are stored in the form of computer-readable program code, and the MCU 10 sequentially executes operations according to the program code. In other words, the ROM 11 in which these programs are stored is used as an example of a computer-readable, non-transient recording medium that stores programs executed by the computer.

[0022] Furthermore, ROM 11 is configured with a source authenticity verification unit Pg1. The source authenticity verification unit Pg1 is a processing unit that performs source authenticity verification processing to verify the authenticity of the source of the encryption update program Pguc stored in ExROM 14. An authentic source refers to server 2, while an unauthentic source refers to a server operated by a malicious third party. The source authenticity verification unit Pg1 determines whether the source of the encryption update program Pguc is authentic using the authentication information Ifa (see Figure 5) in the matching data If2 that is transmitted together with the encryption update program Pguc.

[0023] Then, if the source authenticity verification unit Pg1 can verify the authenticity of the source, it performs an integrity check on the encryption update program Pguc to see if the data has been received correctly. The integrity check is performed using methods that can verify integrity, such as data sum checks and hash calculations. Integrity is determined by the consistency between the integrity check data stored in the matching data If2 and the result calculated by the MCU 10 based on the encryption update program Pguc. If the integrity check is successful, a result indicating that the update data has been received is recorded in a part of the ExROM 14. On the other hand, if the authenticity of the source cannot be verified, the source authenticity verification unit Pg1 performs an error processing. Specifically, the source authenticity verification unit Pg1 discards the received communication data Dt and notifies the server 2 that it could not verify the authenticity of the source of the encryption update program Pguc. Furthermore, if the number of times the authenticity of the source of the encryption update program Pguc cannot be verified exceeds a predetermined threshold, the source authenticity verification unit Pg1 blocks the communication path from the outside.

[0024] Furthermore, ROM 11 contains a Secure ROM 110, which is an area with higher security settings than other areas. The main IDIm and the first key Ky1 are stored in the Secure ROM 110. The main IDIm (an example of identification information) is a unique ID assigned to the main controller 1. The first key Ky1 is secure information used by the startup program Pgs when it performs a process to verify whether the encryption update program Pguc is sound or not (hereinafter also referred to as the "encryption update program soundness verification process").

[0025] RAM 12 is an area where variables and parameters generated during calculation processing by MCU 10 are temporarily written. Communication I / F 13 is used to send and receive various information with server 2.

[0026] ExROM14 (an example of a second storage unit) is a ROM located outside the MCU10, and stores the encryption update program Pguc extracted from the communication data Dt transmitted from the server 2. ExROM14 also stores the verification data If2 included in the communication data Dt. Furthermore, ExROM14 also stores the encrypted existing program Pgbc. The encrypted existing program Pgbc is an encrypted version of the existing program, and is a currently running program whose authenticity is guaranteed. In this embodiment, since only the information of the encrypted program is stored in ExROM14, even if ExROM14 is removed by a third party, it is possible to prevent the third party from obtaining the program information.

[0027] ExRAM15 is RAM located outside the MCU10, and data is temporarily stored there.

[0028] Next, the configuration of the startup program Pgs will be described with reference to Figure 2. Figure 2 is a diagram showing an example configuration of the startup program Pgs. As shown in Figure 2, the startup program Pgs includes an update availability check unit Pgs1 and an update program integrity check unit Pgs2. In this embodiment, the update availability check is responsible for confirming whether the program has been updated and whether the updated program is a correct program, while the update program integrity check is responsible for confirming that the program is complete and free from defects.

[0029] The update confirmation unit Pgs1 checks whether there are any updated programs in ExROM14 and deploys the encryption update program Pguc to ROM11 in MCU10.

[0030] The update confirmation unit Pgs1 first decrypts the encryption update program Pguc when it is deployed to the ROM 11 in the MCU 10. If the encryption update program Pguc is decrypted, the existing program Pg (see Figure 1) is updated by the decrypted update program.

[0031] Next, the update availability check unit Pgs1 obtains the integrity check data Dv contained in the decrypted update program Pgu. Then, the update availability check unit Pgs1 generates integrity check data using the first key Ky1 stored in the Secure ROM 110. Furthermore, the update availability check unit Pgs1 determines the integrity of the encrypted update program Pguc by comparing the generated integrity check data with the integrity check data Dv contained in the decrypted update program Pgu (see Figure 4).

[0032] If the integrity of the decrypted update program Pgu (see Figure 4) cannot be confirmed, the update confirmation unit Pgs1 performs an error process. Specifically, the update confirmation unit Pgs1 resets the MCU 10. Next, the update confirmation unit Pgs1 retrieves and decrypts the encrypted existing program Pgbc stored in ExROM 14. Then, the update confirmation unit Pgs1 notifies the server 2 that integrity confirmation is not possible. Furthermore, if the number of times integrity confirmation is not possible exceeds a predetermined threshold, the update confirmation unit Pgs1 blocks the means for updating the program. Specifically, the update confirmation unit Pgs1 blocks the means for rewriting the data stored in ROM 11.

[0033] The update program integrity verification unit Pgs2 performs a process to verify the integrity of the update program Pgu. For example, the update program integrity verification unit Pgs2 determines whether the update program Pgu can operate normally by checking the hash value, etc. Then, if the update program integrity verification unit Pgs2 has confirmed the integrity of the decrypted update program Pgu, it starts the program Pg that has been updated by the update program Pgu.

[0034] [Communication Data Structure] Next, the structure of the communication data Dt transmitted from the server 2 to the main controller 1 will be described with reference to Figure 3. Figure 3 shows an example of the structure of the communication data Dt. The communication data Dt is data encrypted using a first key (an example of a first key), and includes an encryption update program Pguc and plaintext verification data If2. Note that the key used to encrypt the communication data Dt may be a key other than the first key.

[0035] The matching data If2 is data containing authentication information that is referenced by the source authenticity verification unit Pg1 when the source authenticity verification process of the encryption update program Pguc is performed, and is unencrypted plaintext data. The configuration of the encryption update program Pguc will be described in detail with reference to Figure 4 below, and the configuration of the matching data If2 will be described in detail with reference to Figure 5 below.

[0036] [Configuration of the Encryption Update Program] Figure 4 shows an example of the configuration of the encryption update program Pguc. As shown in Figure 4, the encryption update program Pgu includes the plaintext update program Pgu. The update program Pgu also includes information on the arbitrary code Ca and the consistency check data Dv.

[0037] The arbitrary code Ca consists of a unique ID, etc., assigned to each elevator case controlled by the main controller 1. The consistency check data Dv is data referenced when the encryption update program integrity verification process is performed by the main controller 1, and is data that can be generated using the first key Ky1.

[0038] [Configuration of Matching Data] Figure 5 shows an example of the configuration of matching data If2. As shown in Figure 5, the plaintext matching data If2 includes authentication information Ifa, and the authentication information Ifa includes information for the second key Ky2. The authentication information Ifa is information that can be generated using the information for the first key Ky1 or the main IDIm. It is preferable that the second key Ky2 be set separately for each case, each elevator, each main controller 1, etc.

[0039] As described above, the sender of the communication data Dt (not shown) is unaware of the encryption method of the encryption update program Pguc (an encryption method using the second key Ky2), and the creator of the update program Pgu is unaware of the structure of the matching data If2 included in the communication data Dt transmitted from server 2. In this embodiment, secure information is not centrally managed. Therefore, even if a malicious third party were to obtain and understand the method for verifying the integrity of the encryption update program Pguc, the third party would not be able to rewrite the existing program Pg with their own update program.

[0040] <Control Method by Control System> Next, the control method by the control system 100 according to this embodiment will be described with reference to Figure 6. Figure 6 is a flowchart showing an example of the procedure for control processing by the control system 100.

[0041] First, the communication I / F 13 of the main controller 1 receives the communication data Dt transmitted from the server 2 (step S1). Next, the MCU 10 of the main controller 1 executes communication check of the received communication data Dt (step S2). Specifically, the MCU 10 confirms the integrity of the communication data Dt based on the information of the header of the communication data Dt and the like. Next, the MCU 10 determines whether the integrity of the communication data Dt can be confirmed (step S3). If it is determined in step S3 that the integrity cannot be confirmed (step S3 is NO), the MCU 10 notifies the server 2 to that effect (step S4). Then, after the processing of step S4, the MCU 10 ends the control process.

[0042] On the other hand, if it is determined in step S3 that the integrity of the communication data Dt can be confirmed (step S3 is YES), the MCU 10 stores and decrypts the communication data Dt in the ExRAM 15 (step S5). By performing the processing of step S5, the encrypted update program Pguc and the plaintext collation data If2 included in the communication data Dt are stored in the ExRAM 15.

[0043] Next, the transfer source authenticity confirmation unit Pg1 (see FIG. 2) in the MCU 10 performs transfer source authenticity confirmation processing (step S6). The transfer source authenticity confirmation processing in step S6 will be described in detail with reference to FIG. 7 below.

[0044] Next, the update presence / absence confirmation unit Pgs1 performs encrypted update program integrity confirmation processing (step S7). The encrypted update program integrity confirmation processing in step S7 will be described in detail with reference to FIG. 8 described later.

[0045] Next, the update program integrity confirmation unit Pgs2 performs decryption update program integrity confirmation processing (step S8). Next, the update program integrity confirmation unit Pgs2 determines whether the integrity of the decrypted update program Pgu could be confirmed (step S9). If it is determined in step S9 that the integrity could not be confirmed (step S9 is NO), the update program integrity confirmation unit Pgs2 performs the processing of step S4. That is, the update program integrity confirmation unit Pgs2 reports the inability to confirm integrity to the server 2. Then, after the processing of step S4, the MCU 10 ends the control processing.

[0046] On the other hand, if it is determined in step S9 that the integrity of the decrypted update program Pgu could be confirmed (step S9 is YES), the update program integrity confirmation unit Pgs2 starts the program P updated by the decrypted update program Pgu (step S10). After the processing of step S10, the MCU 10 ends the control processing.

[0047] [Transfer source authenticity confirmation processing] Next, referring to FIG. 7, the transfer source authenticity confirmation processing (step S6 in FIG. 6) by the transfer source authenticity confirmation unit Pg1 will be described. FIG. 7 is a flowchart showing an example of the procedure of the transfer source authenticity confirmation processing by the transfer source authenticity confirmation unit Pg1.

[0048] First, the transfer source authenticity confirmation unit Pg1 generates authentication information using the information stored in the Secure ROM 110 (step S11). The transfer source authenticity confirmation unit Pg1 can generate authentication information using information such as the main ID Im, the first key Ky1, etc. as the information stored in the Secure ROM 110. Next, the transfer source authenticity confirmation unit Pg1 collates the authentication information generated in step S11 with the authentication information Ifa (see FIG. 4) in the collation data If2 included in the decrypted communication data Dt (step S12).

[0049] Next, the source authenticity verification unit Pg1 checks whether the two authentication pieces of information match (step S13). If it is determined in step S13 that the two authentication pieces of information match (step S13 is YES), the source authenticity verification unit Pg1 retrieves the encryption update program Pguc from ExRAM 15 and stores it in ExROM 14 (step S14), and terminates the source authenticity verification process. On the other hand, if it is determined in step S13 that the two authentication pieces of information do not match (step S13 is NO), the source authenticity verification unit Pg1 discards the encryption update program Pguc and the verification data If2 (communication data Dt) (step S15). The process in step S15 prevents the update program from affecting the communication data even if it was created by a malicious third party. Next, the source authenticity verification unit Pg1 notifies the server 2 that the authenticity of the source of the communication data Dt could not be verified (step S16). As a result of the processing in step S16, server 2 can grasp information that the authenticity of the source cannot be verified, and take necessary countermeasures.

[0050] Next, the source authenticity verification unit Pg1 determines whether the number of times the authenticity of the source of the communication data Dt could not be verified has exceeded a predetermined threshold (step S17). If it is determined in step S17 that the number of times the authenticity could not be verified is less than the predetermined threshold (step S17 is NO), the source authenticity verification unit Pg1 terminates the source authenticity verification process.

[0051] On the other hand, if in step S17 it is determined that the number of times authenticity cannot be verified has exceeded a predetermined threshold (step S17 is YES), the MCU 10 blocks the communication path from the communication unit I / F 13 (communication by server 2 or other program update means) (step S18). As part of the process of blocking the communication path, the MCU 10 performs a process such as not receiving any communication packets even if some communication packets are sent from an external source. By performing such a process, even if a malicious third party performs remote operation via the communication path, it is possible to prevent the program Pg from being rewritten by such remote operation. After the processing in step S18, the MCU 10 terminates the source authenticity verification process.

[0052] [Encryption Update Program Integrity Verification Process] Next, with reference to Figure 8, the encryption update program integrity verification process performed by the update presence / absence verification unit Pgs1 (step S7 in Figure 6) will be explained. Figure 8 is a flowchart showing an example of the procedure for the encryption update program integrity verification process performed by the update presence / absence verification unit Pgs1.

[0053] First, the update confirmation unit Pgs1 stores the encrypted update program Pguc, whose authenticity as the source of the transfer has been confirmed, in the MCU 10 (step S21). Next, the update confirmation unit Pgs1 decrypts the encrypted update program Pguc to obtain the update program Pgu (step S22). Then, the update confirmation unit Pgs1 generates consistency check data using the first key Ky1 stored in the Secure ROM 110 (step S23).

[0054] Next, the update availability confirmation unit Pgs1 compares the consistency check data generated in step S23 with the consistency check data Dv contained in the update program Pgu (step S24). Next, the update availability confirmation unit Pgs1 determines whether the two consistency check data match (step S25). If it is determined in step S25 that the two consistency check data match (step S25 is YES), the update availability confirmation unit Pgs1 determines that the encrypted update program Pguc is a healthy program encrypted in an appropriate manner, and terminates the encrypted update program health verification process.

[0055] On the other hand, if step S25 determines that the two consistency check data do not match (step S25 is NO), the update presence / absence confirmation unit Pgs1 resets the MCU 10 (step S26). Because the update program is forcibly stopped by the process in step S26, even if the decrypted update program was created by a malicious third party, it is possible to prevent the program from being started in the MCU 10.

[0056] Next, the update availability check unit Pgs1 retrieves and decrypts the existing encrypted program Pgbc stored in ExROM14 (step S27). Then, the update availability check unit Pgs1 notifies the server 2 that the integrity of the encrypted update program cannot be confirmed (step S28).

[0057] Next, the update availability check unit Pgs1 determines whether the number of times the integrity of the encryption update program could not be verified has exceeded a predetermined threshold (step S29). If step S29 determines that the number of times the integrity could not be verified is less than the predetermined threshold (step S29 is NO), the update availability check unit Pgs1 terminates the encryption update program integrity verification process.

[0058] On the other hand, if in step S29 it is determined that the number of times health cannot be confirmed has exceeded a predetermined threshold (step S29 is YES), the update availability confirmation unit Pgs1 blocks the program update means (step S30). In other words, the update availability confirmation unit Pgs1 prevents the program Pg in ROM 11 from being rewritten. As a result of the process in step S30, if it is desired to rewrite the program, it becomes necessary to replace the MCU 10 itself. Since the replacement work can only be performed by a specialized engineer, this embodiment reliably prevents the existing program from being rewritten by a program created by a malicious third party.

[0059] After the processing in step S30, the update status confirmation unit Pgs1 terminates the encryption update program integrity confirmation process. After the encryption update program integrity confirmation process is completed, the determination in step S9 of Figure 6 is performed.

[0060] Then, in step S9, if the integrity of the decrypted update program Pgu is confirmed, the update program integrity confirmation unit Pgs2 starts the program Pg that has been updated by the update program Pgu.

[0061] In the embodiment described above, the source authenticity verification unit Pg1 of the main controller 1 verifies the authenticity of the source of the update program by comparing the authentication information Ifa contained in the matching data If2 of the communication data Dt transmitted from the communication I / F 21 with the authentication information generated using the information stored in ROM 11 (Secure ROM 110), and decrypts the encrypted update program Pguc if the authenticity of the source is confirmed. Furthermore, the update presence / absence verification unit Pgs1 verifies the integrity of whether the encrypted update program is properly encrypted by comparing the consistency check data Dv contained in the decrypted update program Pgu with the consistency check data generated using the first key Ky1 stored in ROM 11 (Secure ROM 110). Therefore, according to this embodiment, the source of the update program and the authenticity of the update program can be verified.

[0062] In the above-described embodiment, the source authenticity verification unit Pg1 stores the encryption update program Pguc and verification data If2, which were included in the communication data Dt transmitted from the server 2's communication I / F 21, in ExROM 14. If the authenticity of the source is confirmed, the encryption update program is deployed from ExROM 14 to ROM 11. Therefore, according to this embodiment, if the authenticity of the source is not confirmed, the update program is not deployed to ROM 11. Thus, even if the update program was created by a malicious third party, damage to the MCU 10 can be prevented.

[0063] Furthermore, in this embodiment, the structure and generation method of the matching data If2 included in the communication data Dt are information managed by the sender of the communication data Dt, and this information is kept secret from the creator of the update program Pgu. On the other hand, the encryption method (process) of the encrypted update program Pguc and the key information used for encryption are information managed by the program creator, and this information is kept secret from the sender of the communication data Dt. Therefore, even if a malicious third party understands only the method for verifying the integrity of the update program, the update program created by that third party will not be executed on the ROM 11 of the main controller 1. In other words, according to this embodiment, it is possible to more reliably protect the program to be updated and the main controller 1 from malicious third parties.

[0064] Furthermore, the embodiments described above are detailed and specific explanations of the device and system configurations in order to clearly illustrate the present invention, and are not necessarily limited to configurations that include all of the described features. In addition, while this example assumes a scenario in which the encryption update program Pguc is directly transferred from server 2, updates from a local terminal isolated from the network are also conceivable. In that case, it is also conceivable that the data downloaded from server 2 to the local terminal is directly transferred to main controller 1. Even in that case, by implementing the measures based on this embodiment, communication data verification and confirmation of the encryption update program can be performed, enabling the protection of correct data. Therefore, the method for verifying the authenticity of the data transfer source according to this embodiment may be applied to either server 2 or the local terminal.

[0065] Furthermore, the control lines or information lines shown as solid lines in Figure 1 are those deemed necessary for explanation purposes and do not necessarily represent all control lines or information lines in the actual product. In reality, it can be assumed that almost all components are interconnected.

[0066] 1...Main controller, 2...Server, 10...MCU, 11...ROM, 12...RAM, 14...ExROM, 15...ExRAM, 22...Communication data generation unit, 23...ROM, 100...Control system, 110...Secure,ROM, If2...Verification data, Ky1...First key, Ky2...Second key, Pg1...Transfer source authenticity verification unit, Pgs1...Update presence / absence verification unit, Pgs2...Update program integrity verification unit

Claims

1. A control system having a control device that controls a controlled device based on a program stored in a memory unit, wherein the control system includes a source authenticity verification unit that, when updating the program, verifies whether the source of the update program is correct by comparing authentication information contained in verification data in communication data transmitted from the source along with an encrypted update program with authentication information generated within the control system.

2. The control system according to claim 1, further comprising an update presence / absence confirmation unit that, when the source authenticity confirmation unit confirms the authenticity of the source, checks whether the update program is correct by comparing the consistency check data obtained from the decoded update program with the consistency check data generated within the control system.

3. The control system according to claim 2, characterized in that the source authenticity verification unit and the update status verification unit are each provided with different error processing when their respective verification results are determined to be incorrect.

4. The control system according to claim 3, wherein the source authenticity verification unit stores the update program and the verification data contained in the communication data transmitted from the source, which is composed of a server or local terminal, in a second storage unit different from the storage unit, and when the authenticity of the source can be verified, the update program is deployed from the second storage unit to the storage unit.

5. The control system according to claim 3, wherein if the source authenticity verification unit fails to verify the authenticity of the source of the update program, it performs the following abnormal processing: discarding the communication data and notifying the source that the authenticity of the source of the update program could not be verified.

6. The control system according to claim 5, wherein the source authenticity verification unit performs the following abnormal processing: if the number of times the authenticity of the source of the update program cannot be verified exceeds a predetermined threshold number, it blocks the communication path with the source.

7. The control system according to claim 5, wherein, if the update status confirmation unit fails to confirm the integrity of the update program, it performs the following abnormal processing: resetting the processor on which the storage unit is provided, decrypting a pre-provided backup encrypted existing program, and reporting to the source that the integrity of the update program could not be confirmed.

8. The control system according to claim 7, wherein the update status confirmation unit performs the abnormal processing of blocking the update means of the program when the number of times the update program is deemed unhealthy exceeds a predetermined threshold number.

9. The control system according to claim 7, wherein the consistency check data can be generated using a first key, and the update program is an update program encrypted using a second key different from the first key.

10. The control system according to claim 9, wherein the authentication information contained in the matching data is information relating to the second key.

11. The control system according to claim 9, wherein the information stored in the storage unit used by the source authenticity verification unit to generate the authentication information is the first key or identification information that can uniquely identify the control device.

12. A control method by a control device that controls a device to be controlled based on a program stored in a memory unit, the control method comprising a source authenticity verification procedure that, when updating the program, verifies whether the source is legitimate by comparing authentication information contained in verification data in communication data transmitted from the source along with an encrypted update program with authentication information generated within the control method.

Images