Control device and control method

Abstract

[Problem] To provide a control device and a control method whereby connection to a communication device can be established quickly. [Solution] A control device according to the present embodiment comprises: a communication unit that receives a communication protocol connection request from a communication device; and a connection management unit that establishes a connection between the communication device and the communication protocol on the basis of the communication protocol connection request, that establishes a connection between the communication device and an encryption protocol in response to an encryption protocol connection request from the communication device being received by the communication unit within a certain time period from the establishment of the communication protocol connection, and that cuts off the communication protocol connection in response to the encryption protocol connection request not being received by the communication unit within the certain time period from the establishment of the communication protocol connection.

Description

Control Device and Control Method

[0001] This embodiment relates to a control device and a control method.

[0002] There is a cloud-based controller system that performs control calculations on a cloud server. In a cloud-based controller system, the cloud server is an HTTPS (Hyper Text Transfer Protocol Secure) server, and the edge server is an HTTPS client. The cloud server performs HTTPS communication via a communication connection established with the edge server, transmits control data for devices, and controls the devices connected to the edge server.

[0003] Since the communication between the cloud server and the edge server is via the Internet, an event of disconnection of the communication connection may also occur. When the communication connection is disconnected, an attempt is made to re-establish the communication connection between the cloud server and the edge server. On the other hand, since the cloud server is on the Internet, in addition to connection requests from the edge server, it may also receive connection requests from unintended clients (for example, devices of malicious third parties). The connection requests received by the cloud server are stored in the connection waiting port of the cloud server and processed in order. When a connection request for re-establishing the above communication connection is received from the edge server in a situation where connection requests from one or more unintended clients are accumulated, the cloud server takes time to process the connection request from the edge server. As a result, it takes time to establish a communication connection between the cloud server and the edge server.

[0004] Since data communication is constantly and periodically performed between the cloud server and the edge server, it is necessary to maintain the communication connection. Therefore, when the communication connection between the cloud server and the edge server is disconnected, the communication connection must be re-established promptly and the data communication must be resumed.

[0005] Japanese Patent No. 6436853

[0006] Therefore, this embodiment provides a control device and a control method that enable early establishment of a connection with a communication device.

[0007] The control device of this embodiment includes a communication unit that receives a connection request for a communication protocol from a communication device, and a connection management unit that establishes a connection between the communication device and the communication protocol based on the connection request for the communication protocol, establishes a connection between the communication device and the encryption protocol if the communication unit receives a connection request for an encryption protocol from the communication device within a certain period of time after the establishment of the connection for the communication protocol, and disconnects the connection for the communication protocol if no connection request for the encryption protocol is received within the certain period of time after the establishment of the connection for the communication protocol.

[0008] A block diagram showing a control system according to the first embodiment. A block diagram showing a control device according to the first embodiment. A flowchart showing an example of processing by the control device according to the first embodiment. A block diagram showing a control device according to the second embodiment. A flowchart showing an example of processing by the control device according to the second embodiment. A flowchart showing an example of processing by the control device according to a modified version of the second embodiment. A block diagram showing a control device according to the third embodiment. A diagram showing an example of a user interface settings screen according to the third embodiment. A block diagram showing a control device according to the fourth embodiment. A diagram showing an example of a user interface settings screen according to the fourth embodiment. A block diagram showing a control device according to the fifth embodiment. A diagram showing an example of an attacker list according to the fifth embodiment.

[0009] Embodiments of the present invention will be described below with reference to the drawings. The following description will focus on the main components of these embodiments, but there may be components and functions not shown or described. The following description does not exclude any components or functions not shown or described.

[0010] (First Embodiment) Figure 1 is a block diagram showing a control system 1 according to this embodiment. In the control system 1, the control device 10 is connected to the edge server 20 via the Internet 30. Specifically, after the control device 10 establishes a connection with the edge server 20 using a communication protocol, an encryption protocol is established with the edge server 20 based on the connection of the communication protocol. For example, the communication protocol is Transmission Control Protocol (TCP) and the encryption protocol is Transport Layer Security (TLS). Alternatively, the communication protocol is User Datagram Protocol (UDP) and the encryption protocol is Datagram Transport Layer Security (DTLS). However, the examples of communication protocols and encryption protocols are not limited to these.

[0011] The edge server 20 is connected to the controlled device 50 via a local network. The controlled device 50 is the equipment that is controlled by the control device 10. The controlled device 50 is, for example, equipment that makes up an industrial plant, such as valves, pumps, heat exchangers, mixers, etc.

[0012] The edge server 20 is a communication device or gateway device that mediates communication between the control device 10 and the controlled device 50, and is the desired communication partner (client) for the control device 10. The control device 10 controls the controlled device 50 by communicating data with the controlled device 50 via the edge server 20. Specifically, the control device 10 uses the communication connection established with the edge server 20 to receive data such as measurement data from the controlled device 50 and to transmit control data. The communication connection is a communication path formed by the connection of the aforementioned communication protocol and the connection of the encryption protocol. Encrypted and secure data communication takes place in the communication connection. For example, if the communication protocol is TCP and the encryption protocol is TLS, the communication connection is an HTTPS connection.

[0013] In Figure 1, there is one controlled device 50, but there may be two or more. Similarly, there is one edge server 20, but there may be two or more. In this case, one or more controlled devices may be connected to each edge server 20, or multiple edge servers 20 may be used in common for one or more controlled devices.

[0014] An attack device 40 is connected to the internet 30. The attack device 40 is a communication device operated by a malicious third party, who intends to attack the control system 1 (for example, an attack on the controlled device 50) by connecting the attack device 40 to the control device 10 via the internet 30. The attack device 40 is an undesirable client for the control device 10.

[0015] Figure 2 is a block diagram showing the control device 10 according to the first embodiment.

[0016] The control device 10 comprises a connection management unit 11, a control calculation unit 12, and a communication unit 13, which are processing units that perform the processing according to this embodiment. Some or all of the connection management unit 11, the control calculation unit 12, and the communication unit 13 may be composed of circuits or processors such as ASICs (application-specific integrated circuits) and FPGAs (Field-Programmable Gate Arrays). Alternatively, some or all of these elements may be executed by a CPU that executes a program. The control device 10 is a cloud server located on the cloud.

[0017] The communication unit 13 communicates with the communication device via the internet 30. This communication device is either an edge server 20 or an attack device 40. The communication unit 13 performs communication to establish a communication protocol connection with the communication device, and after the communication protocol connection is established, it performs communication to establish an encryption protocol connection. The communication to establish the encryption protocol connection is performed using the established communication protocol connection. Furthermore, after the communication connection is established with the communication device by establishing the encryption protocol connection, the communication unit 13 performs data communication via the communication connection. In the following description, when it is stated that the connection management unit 11 or the control calculation unit 12 communicates with the communication device, this communication is assumed to be performed via the communication unit 13.

[0018] The connection management unit 11 manages information regarding the connection status between the control device 10 (more specifically, the communication unit 13) and the communication device. The communication device is either an edge server 20 or an attack device 40.

[0019] Examples of connection status information include information indicating that a communication protocol connection has been established with the communication device, but an encryption protocol connection has not yet been established (referred to as a state where the encryption protocol connection is pending). Other examples include information about one or more established communication connections with the communication device. Communication connection information includes detailed information about the communication protocol connections and encryption protocol connections that constitute the connection. Information such as the number of established communication connections is also included.

[0020] There is an upper limit to the number of communication connections that the control device 10 can establish with a single communication device. In other words, a communication device can establish multiple communication connections with the control device 10, within a range below the upper limit. When the connection management unit 11 establishes a communication protocol connection upon receiving a connection request for a communication protocol from a communication device, it manages the communication device in a state of waiting for the establishment of an encrypted protocol connection. Then, when it establishes an encrypted protocol connection with the communication device in this state, it clears the state of waiting for the establishment of an encrypted protocol connection and manages the connection with the communication device as a state where a communication connection has been established. At this time, the connection management unit 11 increments the number of communication connections established with the communication device by one.

[0021] The connection management unit 11 processes connection requests (communication protocol connection requests or encryption protocol connection requests) received by the communication unit 13 from the communication device, based on the connection status information managed for each communication device.

[0022] When the connection management unit 11 receives a connection request for a communication protocol from a communication device, if the number of established communication connections with the communication device is less than the upper limit, the connection management unit 11 accepts the connection request from the communication device and establishes a connection for the communication protocol. The connection management unit 11 sends an acceptance response to the communication device indicating that it has accepted the connection request for the communication protocol, that is, that it has established a connection for the communication protocol. If the number of communication connections with the communication device has reached the upper limit, the connection management unit 11 decides not to accept the connection request for the communication protocol from the communication device and sends a rejection response indicating that it will not establish a connection for the communication protocol.

[0023] The connection management unit 11 determines, when a connection of a communication protocol is established with a communication device, whether a connection request for an encrypted protocol has been received by the communication unit 13 within a certain period of time after the connection is established. If a connection request for an encrypted protocol has been received within a certain period of time and the number of established communication connections with the communication device is less than the upper limit, the connection management unit 11 accepts the connection request for an encrypted protocol from the communication device and establishes a connection for the encrypted protocol. The starting point for the certain period of time can be any time after the establishment of the communication protocol connection has been decided. For example, it may be the time when an acceptance response is sent, the time when the establishment of the connection is decided, or, if there is an ACK from the communication device for the acceptance response, the time when the ACK is received.

[0024] The connection management unit 11 sends an acceptance response to the communication device indicating that it has accepted the connection request for the encryption protocol, that is, that it has established a connection for the encryption protocol. With the establishment of the connection for the encryption protocol, a communication connection is established between the communication device and the connection for the communication protocol, including both the communication protocol connection and the encryption protocol connection.

[0025] On the other hand, if the connection management unit 11 does not receive a connection request for the encryption protocol at the communication unit 13 within a certain period of time after the establishment of the communication protocol connection, or if the number of communication connections with the communication device has reached the upper limit, it decides not to accept the connection request for the encryption protocol. It then sends a rejection response indicating that it will not establish an encryption protocol connection. The connection management unit 11 then clears the state of waiting for the establishment of an encryption protocol connection to the communication device.

[0026] In the above description, the connection management unit 11 determined whether the number of established communication connections with the communication device was less than the upper limit both when it received a connection request for a communication protocol and when it received a connection request for an encryption protocol. However, it may also be done in only one of these cases.

[0027] The connection management unit 11 sends information about the communication connection established with the communication device to the control calculation unit 12.

[0028] The control calculation unit 12 uses the communication connection information received from the connection management unit 11 to perform data communication with the communication device via the communication connection. For example, if the communication device is an edge server 20, the control calculation unit 12 obtains information about the controlled device 50 from the edge server 20 (for example, detailed information about the controlled device 50 and measurement data from sensors that monitor the controlled device 50) and generates control data for the controlled device 50. The control calculation unit 12 then transmits the control data to the controlled device 50 via the edge server 20. This controls the controlled device 50.

[0029] Figure 3 shows a flowchart of an example of the processing of the control device 10 as a control method according to this embodiment.

[0030] First, the control device 10 receives a Connect packet from the communication device as a connection request for the communication protocol (S301). Upon receiving the Connect packet, the connection management unit 11 of the control device 10 accepts the connection request for the communication protocol (S301). The connection management unit 11 sends an Accept packet to the communication device as an acknowledgment that it has accepted the connection request (S301). This establishes a connection for the communication protocol between the control device and the communication device.

[0031] Next, the connection management unit 11 of the control device 10 waits for the communication device to receive a connection request for an encrypted protocol (S302). As an example, in order to accept connection requests using Secure Sockets Layer (SSL) or TLS, SSL Accept (connection waiting process) is executed on non-blocking sockets at regular intervals. Alternatively, Mutual TLS may be used to verify the certificate of the edge server 20 at the same time as executing the Accept (connection waiting process). Sending an encrypted protocol connection request from the communication device to the control device 10 can be done, for example, by executing SSL Connect. Certificates and other necessary documents for SSL authentication should be prepared in advance. However, the method of waiting for the reception of an encrypted protocol connection request and the method of sending an encrypted protocol connection request are not limited to these methods.

[0032] Next, the connection management unit 11 of the control device 10 determines whether a connection request for the encryption protocol was received within a certain period of time after the establishment of the communication protocol connection (S303). If a connection request for the encryption protocol is received within a certain period of time (No in step S303), the process proceeds to step S304. If a connection request for the encryption protocol is not received within a certain period of time (Yes in step S303), a timeout error (first error) is detected, and the process proceeds to step S307.

[0033] In step S307, the connection management unit 11 of the control device 10 terminates the communication protocol connection with the communication device (S307). Specifically, the connection management unit 11 terminates the communication protocol connection with the communication device by sending a communication protocol disconnection request packet to the communication device. Examples include, but are not limited to, SSL shutdown or performing a shutdown or close on the relevant communication socket.

[0034] In step S304, the connection management unit 11 of the control device 10 checks whether the number of established communication connections with the communication device is less than the upper limit. If the upper limit has been reached (No in S304), the process proceeds to step S307. The processing in step S307 is as described above. If the number is less than the upper limit (Yes in S304), the process proceeds to step S305.

[0035] In step S305, the connection management unit 11 of the control device 10 decides to accept the connection request for the encrypted protocol from the communication device and establishes an encrypted protocol connection. The connection management unit 11 sends an acceptance response to the communication device indicating that it has accepted the connection request for the encrypted protocol, that is, that an encrypted protocol connection has been established. As a result, a communication connection for data communication is established (set up) between the control device and the communication device.

[0036] The connection management unit 11 of the control device 10 notifies the control calculation unit 12 of the information of the established communication connection (S306). The control calculation unit 12 uses the information of the communication connection to perform data communication with the communication device (S306).

[0037] The following are specific examples of operation when the communication device is an edge server 20 and when it is an attack device 40, with reference to Figure 3.

[0038] [When the communication device is the edge server 20] As a prerequisite, it is assumed that no communication connection has yet been established between the edge server 20 and the control device 10. The following describes the operation in which the control device 10 establishes a communication connection with the edge server 20 by connecting a communication protocol and an encryption protocol, and then starts controlling the controlled device 50 via the communication connection.

[0039] First, the connection management unit 11 of the control device 10 receives a Connect packet from the edge server 20 as a connection request for the communication protocol, and sends an Accept packet as an acknowledgment that it has accepted the connection request for the communication protocol (S301). This establishes a connection for the communication protocol between the control device 10 (or communication unit 13) and the edge server 20.

[0040] The connection management unit 11 of the control device 10 waits to receive a connection request for the encryption protocol from the edge server 20 (S302). The connection management unit 11 of the control device 10 determines whether a connection request for the encryption protocol has been received within a certain time after the establishment of the communication protocol connection (S303). Since the edge server 20 is configured to send the connection request for the encryption protocol within the aforementioned certain time after the establishment of the communication protocol connection, the connection request for the encryption protocol is received within the certain time (No in S303), and no timeout error occurs.

[0041] The connection management unit 11 of the control device 10 checks whether the number of established communication connections with the edge server 20 is less than the upper limit (S304). At this point, the edge server 20 has not established any communication connections with the control device 10, so the number of connections is zero, and the process proceeds to step S305.

[0042] In step S305, the connection management unit 11 of the control device 10 determines to accept the connection request of the encryption protocol from the edge server 20 and establishes the connection of the encryption protocol. The connection management unit 11 transmits an acceptance response indicating that it has accepted the connection request of the encryption protocol to the edge server 20 (same S305). Thereby, a communication connection for data communication is established between the control device 10 and the edge server 20.

[0043] The connection management unit 11 of the control device 10 notifies the control arithmetic unit 12 of the information of the established communication connection (S306). The control arithmetic unit 12 performs data communication with the edge server 20 using the information of the communication connection (same S306). For example, the control arithmetic unit 12 sets the edge server 20 as a reception monitoring target so that it can receive data necessary for controlling the controlled device 50 (for example, measurement data of sensors for monitoring the controlled device 50) from the edge server 20. The control arithmetic unit 12 performs an operation using the received data and transmits control data including the operation result to the edge server 20. The transmitted control data is transmitted to the controlled device 50 via the edge server 20, and an operation based on the control data is performed in the controlled device 50.

[0044] As described above, the control device 10 can quickly establish a secure communication connection with the edge server 20, which is a desired communication partner, and control the controlled device 50.

[0045] [When the communication device is the attack device 40] Hereinafter, after the control device 10 establishes a connection of the communication protocol with the attack device 40, a timeout error is detected without receiving a connection request of the encryption protocol within a certain time from the attack device 40, and an operation of quickly disconnecting the connection with the communication protocol of the attack device 40 will be described.

[0046] The connection management unit 11 of the control device 10 receives a Connect packet as a connection request of the communication protocol from the attack device 40. The connection management unit 11 determines to accept the connection request of the communication protocol, and transmits an Accept packet as a response of acceptance indicating that the connection request of the communication protocol has been accepted to the attack device 40 (S301). Thereby, a connection of the communication protocol is established between the control device 10 (or the communication unit 13) and the attack device 40.

[0047] The connection management unit 11 of the control device 10 waits to receive a connection request of the encryption protocol from the attack device 40 (S302).

[0048] The connection management unit 11 of the control device 10 determines whether a connection request of the encryption protocol has been received within a certain time from the establishment of the connection of the communication protocol (S303). Here, since a connection request of the encryption protocol is not received within the certain time, a timeout error (the first error) occurs (Yes in S303). That is, the attack device 40 is not configured to transmit a connection request of the encryption protocol after the establishment of the connection of the communication protocol, or even if it is configured to transmit a connection request of the encryption protocol, the transmission is not configured to be performed within the above certain time.

[0049] The connection management unit 11 of the control device 10 terminates the connection of the communication protocol with the attack device 40 (S307). Specifically, the connection management unit 11 terminates the connection of the communication protocol with the attack device 40 by transmitting a disconnection request packet of the communication protocol.

[0050] Through the above process, the control device 10 can prematurely disconnect the communication protocol connection with the attack device 40, which is not the desired communication partner. By prematurely disconnecting the communication protocol connection with the attack device 40, the state of waiting for an encrypted protocol connection request from the attack device 40 is eliminated, and processing of the connection request can be started immediately upon receiving a communication protocol connection request from the edge server 20. For example, even if the communication connection between the control device 10 and the edge server 20 is interrupted for any reason, the control device 10 can accept the communication protocol reconnection request from the communication device 20 without delay and immediately establish a communication connection with the communication device 20. Therefore, it becomes possible to quickly switch to controlling the controlled device 50 and maintain periodic data communication.

[0051] (Second Embodiment) Figure 4 is a block diagram showing the control device 10A according to the second embodiment. The operation of the connection management unit 11A differs in part from that of the connection management unit 11 in the first embodiment. Elements with the same names as in Figure 1 are denoted by the same reference numerals, and detailed explanations are omitted except for modified or extended processes.

[0052] When the connection management unit 11A receives a connection request for an encrypted protocol from a communication device (edge ​​server 20 or attack device 40), it verifies the legitimacy of the communication device based on the communication device's certificate. That is, it checks whether the communication device possesses the desired certificate. If the communication device does not possess the desired certificate, it determines that the communication device is not legitimate and decides not to accept the connection request for the encrypted protocol. It then disconnects the communication protocol connection with the communication device. If the communication device possesses the desired certificate, it determines that the communication device is legitimate, accepts the connection request for the encrypted protocol, and establishes an encrypted protocol connection. This establishes a communication connection with the communication device.

[0053] Figure 5 shows a flowchart of an example of the processing of the control device 10A as a control method according to this embodiment. Explanations that are the same as those in the flowchart of Figure 3 are omitted as appropriate.

[0054] When the connection management unit 11A of the control device 10A receives a connection request for an encrypted protocol from a communication device that established a connection for a communication protocol in step S301 (S302), it checks whether the communication device possesses the desired certificate (S303A). If the desired certificate is not possessed, a certificate error (second error) is detected, and the process proceeds to step S307. Step S307 is the same as in the first embodiment. If the communication device is the attack device 40, a certificate error is detected because it does not possess the desired certificate, and the connection for the communication protocol with the communication device is disconnected. On the other hand, if the communication device is the edge server 20, a certificate error is not detected because it possesses the desired certificate, and the process proceeds to step S304. Steps S304 onward are the same as in the first embodiment.

[0055] As described above, even if the control device 10A receives a connection request for an encrypted protocol from an attack device 40 that is not the desired communication partner, it can disconnect the communication protocol connection and quickly resolve the state of waiting for an encrypted protocol connection request from the attack device 40. As a result, when it receives a connection request for a communication protocol from the communication device 20, it can immediately start processing the connection request. For example, if the communication connection between the control device 10 and the edge server 20 is disconnected for any reason, it is possible to accept a reconnection request for a communication protocol from the communication device 20 without delay and immediately establish a communication connection with the communication device 20. Therefore, it is possible to quickly switch to controlling the controlled device 50 and maintain periodic data communication.

[0056] [Modification of the second embodiment] The second embodiment may be combined with the first embodiment so that the connection management unit 11A of the control device 10A can detect both timeout errors and certificate errors.

[0057] Figure 6 shows a flowchart of an example of the processing of the control device 10A in a modified version of the second embodiment. Step S303 in Figure 3 is added before step S303A in Figure 5. If neither a timeout error nor a certificate error is detected, the connection management unit 11A proceeds to step S304, which checks whether the number of communication connections is less than the upper limit. If either error is detected, the process proceeds to step S307, and the connection of the communication protocol is disconnected.

[0058] As described above, the control device 10A can quickly resolve the state of waiting for a connection request for the encrypted protocol from the attack device 40 by disconnecting the communication protocol connection as soon as either a timeout error or a certificate error is detected. As a result, when a connection request for the communication protocol is received from the communication device 20, processing of the connection request can be started immediately.

[0059] (Third Embodiment) In the first embodiment described above, a timeout error was detected when a connection request for the encryption protocol was not received within a certain period of time, and in the second embodiment, a certificate error was detected when the attack device 40 did not possess the desired certificate. This embodiment allows the user to arbitrarily set which type of error to detect. That is, the user can arbitrarily set the criteria for deciding whether or not to accept a connection request for the encryption protocol, and an error is detected when the criteria are not met.

[0060] Figure 7 is a block diagram showing a control device 10B according to the third embodiment. A user interface 14 is provided. The reference numeral of the connection management unit has also been changed to 11B. Elements with the same names as in Figure 1 are given the same reference numerals, and detailed explanations are omitted except for modified or extended processes.

[0061] The user interface 14 can configure the types of errors that will cause the communication protocol connection to be disconnected, based on the user's input information. By using the user interface 14, the user can set the conditions for deciding which errors will cause the communication protocol connection to be disconnected, in other words, whether or not to accept the connection request for the encrypted protocol. The user's input information is received from the user's terminal via the internet 30. The user's terminal may be located under the edge server 20 or on a different segment.

[0062] The user selects one or more error types (judgment conditions) to set in the connection management unit 11B from the first to the nth error types (where n is an integer of 2 or more). Alternatively, the user may select the target error type by specifying a value based on a predetermined value-to-error-type correspondence table and set it in the connection management unit 11B. Error types may also be set by methods other than those described above.

[0063] Figure 8 shows an example of the settings screen for the user interface 14. On this screen, the user checks the box for the error type they want to use. In this example, the first error type is selected.

[0064] The connection management unit 11B determines whether an error of the type selected in the user interface 14 has been detected when waiting to receive or receiving a connection request for an encrypted protocol. For example, if the set error type is the first error type (first judgment condition), the operation of the first embodiment is performed, and if it is the second error type (second judgment condition), the operation of the second embodiment is performed. If both the first and second error types are selected, the operation of a modified version of the second embodiment is performed. Similarly, if an error type other than the first and second error types is selected, the operation corresponding to the selected error type is performed.

[0065] In this way, by allowing the user to set the error type (judgment condition) to be used, it is possible to appropriately disconnect the communication protocol connection to the attack device or prevent the establishment of a communication connection.

[0066] (Fourth Embodiment) The first to third embodiments described above assumed that the upper limit of communication connections used in the decision in step S304 is predetermined, but the upper limit may be set by the user.

[0067] Figure 9 is a block diagram showing a control device 10C according to the fourth embodiment. A user interface 14A is provided. The reference numeral for the connection management unit has also been changed to 11C. Elements with the same names as in Figure 1 are given the same reference numerals, and detailed explanations are omitted except for modified or extended processes.

[0068] The connection management unit 11C reads user-defined upper limit information from the user interface 14A and sets the upper limit for communication connections. When the connection management unit 11C determines in step S304 whether the number of communication connections is less than the upper limit, it uses the upper limit set in the user interface 14A.

[0069] Figure 10 shows an example of the settings screen for the user interface 14A. On this screen, the user sets the maximum number of communication connections for each communication device. In this example, the screen is set to a common upper limit for all communication devices, and the upper limit is set to "8". Therefore, a maximum of 8 communication connections can be established per communication device. It is also possible to change the upper limit setting for each communication device. In this case, a screen for setting the upper limit for each communication device should be used.

[0070] As described above, according to this embodiment, the number of communication connections can be limited for each communication device by the user setting an upper limit on the number of communication connections. This suppresses the total number of communication connections established between multiple communication devices and reduces the load on the control device. For example, it prevents a reduction in the speed at which the control device processes connection requests for communication protocols or encryption protocols.

[0071] (Fifth Embodiment) Figure 11 is a block diagram showing a control device 10D according to the fifth embodiment. A connection source management unit 15 is provided. The reference numeral of the connection management unit has been changed to 11D. Elements with the same names as in Figure 1 are given the same reference numerals, and detailed explanations are omitted except for modified or extended processes.

[0072] If the connection management unit 11D detects an error (e.g., a timeout error or a certificate error) in response to a connection request for an encrypted protocol, it obtains the hostname or Internet Protocol (IP) address of the communication device that initiated the connection using the communication protocol. The obtained hostname or address corresponds to the identification information of the communication device (attack device 40) where the error was detected.

[0073] The connection source management unit 15 stores and retains the acquired hostname or address in an attacker list. The attacker list stores the identification information of one or more attack devices. The timing for retaining the identification information of attack devices may be subject to various conditions, such as when the number of errors occurring within a certain period of time exceeds a predetermined number, or when the cumulative number of errors exceeds a predetermined number.

[0074] The attacker list may be stored in the memory area of ​​the connection source management unit 15, or in another memory area accessible from the connection source management unit 15. The attacker list may also be made available to the connection source management unit 15 from outside the control device 10 via an Application Programming Interface (API) or the like. The attacker list may also be saved in a file or the like.

[0075] Figure 12 shows an example of an attacker list. In this example, an IP address is used as the identification information for the attacking device. Other types of identification information, such as a hostname, may also be used instead of an IP address.

[0076] When the connection management unit 11D receives a connection request for an encrypted protocol, it determines whether the identification information of the communication device that sent the connection request matches any of the identification information included in the attacker list. If there is a match, it detects a communication partner error (third error) and disconnects the connection for the communication protocol.

[0077] Furthermore, the connection management unit 11D may filter packets sent from attack devices included in the attacker list by hostname or IP address.

[0078] Furthermore, when a connection request for a communication protocol is received, the connection management unit 11D may determine whether the identification information of the communication device that sent the connection request matches any of the identification information included in the attacker list. If there is a match, it may detect a communication partner error (third error) and reject the connection request for the communication protocol (i.e., not establish a connection for the communication protocol).

[0079] It should be noted that the present invention is not limited to the embodiments described above, and the components can be modified and implemented in practice without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining the multiple components disclosed in the embodiments described above. For example, a configuration in which some components are removed from all the components shown in each embodiment is also conceivable. Moreover, components described in different embodiments may be appropriately combined.

[0080] 1 Control System 10 Control Device 10A Control Device 10B Control Device 10C Control Device 10D Control Device 11 Connection Management Unit 11A Connection Management Unit 11B Connection Management Unit 11C Connection Management Unit 11D Connection Management Unit 12 Control Calculation Unit 13 Communication Unit 14 User Interface 14A User Interface 15 Connection Source Management Unit 20 Communication Device 20 Edge Server 30 Internet 40 Attack Device 50 Controlled Device

Claims

1. A control device comprising: a communication unit that receives a connection request for a communication protocol from a communication device; a connection management unit that establishes a connection between the communication device and the communication protocol based on the connection request for the communication protocol; establishes a connection between the communication device and the encryption protocol in response to the communication unit receiving a connection request for an encryption protocol from the communication device within a certain period of time after the establishment of the connection for the communication protocol; and disconnects the connection for the communication protocol in response to the communication unit not receiving a connection request for the encryption protocol within the certain period of time after the establishment of the connection for the communication protocol.

2. The control device according to claim 1, wherein when the connection management unit receives a connection request for the encryption protocol from the communication device, it authenticates the legitimacy of the communication device based on the certificate of the communication device, and if it determines that the communication device is not legitimacy, it disconnects the connection for the communication protocol.

3. A control device according to claim 2, comprising a user interface for setting conditions for determining whether or not to accept a connection request for the encryption protocol, wherein the connection management unit disconnects the connection for the communication protocol if, when the first conditions are set by the user interface, a connection request for the encryption protocol is not received from the communication device within a certain period of time after the establishment of the connection for the communication protocol, and when the connection management unit receives a connection request for the encryption protocol from the communication device, it authenticates the legitimacy of the communication device based on the certificate of the communication device, and if it determines that the communication device is not legitimacy, it disconnects the connection for the communication protocol.

4. The control device according to claim 1, wherein when the connection of the communication protocol is disconnected because a connection request for the encryption protocol is not received within a certain period of time, the control device is further comprising a connection source management unit that holds identification information of the communication device that is the source of the connection of the communication protocol, and when a connection request for the encryption protocol is received from the communication device, the connection management unit determines whether the identification information of the communication device matches the identification information held by the connection source management unit, and disconnects the connection of the communication protocol if they match.

5. The control device according to claim 2, wherein when the connection to the communication protocol is disconnected because the communication device is authenticated as not being legitimate, the control device further comprises a connection source management unit that holds identification information of the communication device that is the source of the connection to the communication protocol, and when the connection management unit receives a connection request for the encrypted protocol from the communication device, it determines whether the identification information of the communication device matches the identification information held by the connection source management unit, and disconnects the connection to the communication protocol if they match.

6. The control device according to claim 1, wherein the connection management unit establishes a connection for the encryption protocol, thereby establishing a communication connection between the communication protocol and the encryption protocol, the communication unit transmits data to the communication device based on the communication connection, and when the connection management unit receives a connection request for the encryption protocol from the communication device, it determines whether the number of communication connections established with the communication device has reached an upper limit, and if the upper limit has been reached, it disconnects the communication protocol connections that are waiting to be established for the encryption protocol.

7. The control device according to claim 6, comprising a user interface for setting an upper limit on the number of communication connections, wherein the connection management unit determines whether the number of communication connections established in the communication device has reached the upper limit using the upper limit set by the user interface.

8. A control method comprising: receiving a connection request for a communication protocol from a communication device; establishing a connection between the communication device and the communication protocol based on the connection request for the communication protocol; establishing a connection between the communication device and the encryption protocol if a connection request for an encryption protocol is received within a certain period of time after the establishment of the connection for the communication protocol; and disconnecting the connection for the communication protocol if a connection request for the encryption protocol is not received within the certain period of time after the establishment of the connection for the communication protocol.

Images