Segment management system, segment management device, segment management terminal, segment management program, and segment management method

Abstract

A segment management system (1) comprises segment setting units (31, 41) that, on the basis of a connection relationship which is between a control apparatus (5) and OT apparatuses (6-1 to 6-5) serving as control target apparatuses subjected to control by a control instruction from the control apparatus (5) and is based on the control instruction in a production management system including the control apparatus (5) and the OT apparatuses (6-1 to 6-5), sets a segment, which serves as a unit for implementing security management, for a network to which the control target OT apparatuses (6-1 to 6-5) are connected.

Description

Segment management system, segment management device, segment management terminal, segment management program, and segment management method

[0001] The present disclosure relates to a segment management system, a segment management device, a segment management terminal, a segment management program, and a segment management method used for network security.

[0002] Conventionally, for improving network security, segment separation has been performed. Segment separation restricts unnecessary communication by restricting access between different segments, minimizing intrusion by malicious third parties. These days, not only security in the IT (Information Technology) field but also OT (Operational Technology) security is required with the networking of manufacturing sites. In OT security, if inadvertent segment separation is performed, the control network may be disconnected, possibly causing unexpected problems.

[0003] Regarding OT security, for example, Patent Document 1 discloses a technology for a rule management device for a control device network that manages rules arranged in a network security device. In Patent Document 1, the rule management device for a control device network is provided in a control device network including a plurality of control devices having different software configurations and a plurality of different communication media. The rule management device for a control device network in Patent Document 1 arranges the security inspection rules of the network security device that inspects the security of the control device network based on the software configuration of the control device and the configuration of the communication media corresponding to the control device. That is, the rule management device for a control device network in Patent Document 1 suppresses inadvertent network separation by providing network rules based on the control device and the communication media..

[0004] Japanese Unexamined Patent Application Publication No. 2021 - 90106

[0005] In OT security, the problem of unintentional segment separation is that necessary controls are blocked. While the conventional technology described above suppresses unintentional network separation based on the software configuration of the control device and the configuration of the communication medium corresponding to the control device, it does not set network rules based on control. Therefore, the conventional technology described above has the problem that it cannot solve the problem of unintentional segment separation in its essence.

[0006] This disclosure is made in view of the above, and aims to provide a segment management system that enables segment isolation without blocking the controls necessary for network security.

[0007] To solve the aforementioned problems and achieve the objectives, the segment management system of this disclosure is characterized by comprising a segment setting unit that sets segments, which are units to which security management is performed for the network to which controlled devices are connected, based on the connection relationship between the controlled devices and controlled devices based on control instructions in a production management system that includes control devices and controlled devices controlled by control instructions from the control devices.

[0008] The segment management system disclosed herein has the effect of enabling segment isolation without interrupting the controls necessary for network security.

[0009] Figures showing an example configuration of the segment management system according to Embodiment 1. Figures showing an example connection between a PLC (Programmable Logic Controller), which is a control device, and an OT (Operational Technology) device, which is a controlled device, in a production management system to which the segment management system according to Embodiment 1 is applied. Figures showing an example configuration of the segment management terminal and control device according to Embodiment 1. Figures showing an example configuration of the segment management system's central server, segment management device, and engineering tool according to Embodiment 1. Figures showing examples of segments and zones based on the connection relationships between control devices and OT devices set by the segment management device of the segment management system according to Embodiment 1. Figures showing examples of segments based on the connection relationships between control devices and OT devices set by the segment management device of the segment management system according to Embodiment 1. Figures showing an example of external hierarchical management of segments by the segment management system according to Embodiment 1. Figures showing an example of internal hierarchical management of segments by the segment management system according to Embodiment 1. Figures showing an example of content displayed on the management screen of the display unit by the zone setting unit of the segment management system according to Embodiment 1. A flowchart showing the operation of the segment management system according to Embodiment 1. Figures showing an example of hardware configuration for realizing the segment management system of Embodiment 1. Figures showing an example configuration of the segment management system according to Embodiment 2.

[0010] The following describes in detail, with reference to the drawings, a segment management system, a segment management device, a segment management terminal, a segment management program, and a segment management method according to embodiments of the present disclosure.

[0011] Embodiment 1. Figure 1 shows an example of the configuration of the segment management system 1 according to Embodiment 1. The segment management system 1 performs network segment separation based on the connection relationships within the control target range of control devices 5-1 and 5-2. That is, when the segment management system 1 blocks a network based on a segment, it blocks the network to an extent that does not affect other controls. Figure 1 shows an example in which the segment management system 1 is applied to the production management system 9. As shown in Figure 1, the production management system 9 is composed of the information system layer Lv4 / 5, the control monitoring layer Lv2 / 3, and the control field layer Lv0 / 1. In the production management system 9, the information system layer Lv4 / 5 is the upper layer, and the control field layer Lv0 / 1 is the lower layer.

[0012] The segment management system 1 comprises a segment management system central server 2, a segment management device 3, and segment management terminals 4-1 and 4-2. In the following description, when segment management terminals 4-1 and 4-2 are not distinguished, they may be referred to as segment management terminal 4. In Figure 1, the segment management system 1 has two segment management terminals 4, but the segment management system 1 can also have one or more segment management terminals 4. The segment management device 3 is located in the control monitoring layer Lv2 / 3. The segment management terminals 4-1 and 4-2 are located in the control field layer Lv0 / 1. The segment management system central server 2 is located so as to be connected to the information system layer Lv4 / 5 from outside the production management system 9 via the internet 7. That is, of the segment management system 1, the segment management terminals 4 and the segment management device 3 are installed in the production management system 9.

[0013] As mentioned above, the segment management system central server 2 is located outside the production management system 9. The segment management system central server 2 has management functions in the segment management system 1, and performs tasks such as updating the firmware (F / W) of the segment management device 3 and the segment management terminal 4, and updating parameters.

[0014] The segment management system 1 is configured in the production management system 9 to segment-separate networks below the control monitoring layer Lv2 / 3. In the segment management system 1, a segment management device 3 located in the control monitoring layer Lv2 / 3 manages and instructs the segment separation of the network by the segment management terminal 4, and a segment management terminal 4 located in the control field layer Lv0 / 1 performs the segment separation of the network based on instructions from the segment management device 3. It is also possible for the segment management system 1 to target the control monitoring layer Lv2 / 3 as a network for segment separation. In this case, the production management system 9 may either place the segment management terminal 4 in the control monitoring layer Lv2 / 3, or the segment management device 3 located in the control monitoring layer Lv2 / 3 may be equipped with a function to perform segment separation similar to that of the segment management terminal 4.

[0015] Segment management terminal 4-1 is connected to control device 5-1, such as a PLC, which controls the controlled devices, such as OT devices 6-1 to 6-4. Segment management terminal 4-2 is connected to control device 5-2, such as a PLC, which controls the controlled devices, such as OT devices 6-5 to 6-8. In the following explanation, control devices 5-1 and 5-2 will be referred to as control device 5 when not distinguished, and OT devices 6-1 to 6-8 will be referred to as OT device 6 when not distinguished. In the example in Figure 1, there are four OT devices 6 connected to each control device 5, but control device 5 can also be connected to three or fewer, or five or more OT devices 6. Also, in the example in Figure 1, a segment management terminal 4 is connected to each control device 5, but there may be control devices 5 to which a segment management terminal 4 is not connected.

[0016] The segment management terminal 4 analyzes the control program of the control device 5 and understands the connection relationship between the control device 5 and the OT device 6 that it controls, thereby suppressing the occurrence of unintentional segment separation. In other words, the segment management terminal 4 can identify appropriate network segments that do not affect control.

[0017] The segment management device 3 manages the segments analyzed by the segment management terminal 4 and, if necessary, uses the segment management terminal 4 to perform network segment isolation. The segment management device 3 can manage desired segments from the set segments as zones. For example, by managing a desired production line as a zone, the segment management device 3 can easily perform segment management for each production line, i.e., security management for each production line. Security management includes, but is not limited to, blocking the network of the production management system 9.

[0018] In the segment management system 1, the segment management terminal 4 performs packet filtering to implement segments, zones, etc. By preventing packets other than those specified by the segment management terminal 4 from passing through, the segment management system 1 can implement segmentation and zoneization where the segments are electrically connected but logically not.

[0019] As shown in Figure 1, the production management system 9 includes, in addition to the segment management device 3, segment management terminal 4, control equipment 5, and OT equipment 6 described above, a Firewall (FW), Switch (SW), ERP (Ethernet® Ring Protection), Personal Computer (PC), Manufacturing Execution System (MES), Human Machine Interface (HMI), Supervisory Control and Data Acquisition (SCADA), Engineering Work Station (EWS), and Gateway (G / W). However, the equipment included in the production management system 9 and the arrangement of each piece of equipment are not limited to the example in Figure 1.

[0020] Furthermore, in the example shown in Figure 1, control devices 5 such as a PLC are directly connected to multiple controlled devices, which are OT devices 6. However, it is also possible for control devices 5 to be connected to OT devices 6 via other control devices 5. Figure 2 shows an example of the connection between a control device 5, which is a PLC, and controlled devices, which are OT devices 6, in a production management system 9 to which the segment management system 1 according to Embodiment 1 is applied. Although not shown in the illustration, in Figure 2, a segment management terminal 4 is connected to the control device 5, which is a master PLC. The master PLC is a higher-level PLC that manages multiple PLCs. As shown in Figure 2, the master PLC, which is a control device 5, can also control OT devices 6-1 to 6-16 located in zones 1 to 4 via two other control devices 5, which are PLCs. The number of PLCs connected between the master PLC and the OT devices 6 may be the same for all OT devices 6, or it may differ depending on the OT device 6, depending on the configuration of the production management system 9.

[0021] The configuration and operation of each device in the segment management system 1 will be described. Figure 3 shows an example configuration of the segment management terminal 4 and control device 5 according to Embodiment 1. Note that the configuration of the segment management device 3 is simplified in Figure 3.

[0022] The control device 5 comprises a control device I / O (Input / Output) setting information storage unit 52, a control program storage unit 54, a control unit 56, and a communication unit 58. As shown in Figure 3, the control device I / O setting information storage unit 52 and the control program storage unit 54 constitute the storage unit 55.

[0023] The control device I / O setting information storage unit 52 stores the I / O setting information of the control device 5. In the following description, the I / O setting information may be simply referred to as setting information. The control program storage unit 54 stores the control program for controlling the control unit 56. The control unit 56 controls the OT devices 6-1 to 6-5 based on the control program stored in the control program storage unit 54. The communication unit 58 performs various functions such as sending and receiving information and sending control commands for controlling the OT devices 6-1 to 6-5. For example, the communication unit 58 sends the I / O setting information of the control device 5 stored in the control device I / O setting information storage unit 52 and the control program stored in the control program storage unit 54 to the segment management terminal 4. The communication unit 58 also outputs segment management instructions received from the segment management terminal 4 to the control unit 56 and sends the control commands obtained from the control unit 56 to the target OT devices 6-1 to 6-5. The communication method of the communication unit 58 may be wired communication, wireless communication, or a combination of wired and wireless communication.

[0024] The segment management terminal 4 comprises a segment analysis unit 40, a segment setting unit 41, a segment information storage unit 42, a zone setting unit 43, a zone information storage unit 44, a management implementation unit 46, a display unit 47, and a communication unit 48. As shown in Figure 3, the segment setting unit 41, the segment information storage unit 42, the zone setting unit 43, and the zone information storage unit 44 constitute the segment and zone management unit 45.

[0025] The segment analysis unit 40 performs segment analysis using the I / O setting information and control program of the control device 5 acquired from the control device 5. The segment setting unit 41 sets segments for the control device 5 connected to the segment management terminal 4 and the OT devices 6-1 to 6-5 controlled by the control device 5, based on the analysis results of the segment analysis unit 40. The segment information storage unit 42 stores segment information for the segments set by the segment setting unit 41. The zone setting unit 43 sets a zone that includes the control device 5 connected to the segment management terminal 4 and the OT devices 6-1 to 6-5 controlled by the control device 5, based on the segments set by the segment setting unit 41, in order to manage a desired production line as a zone. The zone setting unit 43 sets a zone for the control device 5 in order to manage one or more separable segments as zones that indicate the division of an actual production area. The zone information storage unit 44 stores zone information for the zones set by the zone setting unit 43.

[0026] In the segment management terminal 4, the segment information storage unit 42 and the zone information storage unit 44 are configured as relational databases. The segment information storage unit 42 and the zone information storage unit 44 manage the control equipment 5 and OT equipment 6-1 to 6-5 based on the relationships between the main control equipment and the subordinate controlled equipment, and segments and zones are set up for the relationships between each piece of equipment.

[0027] The management implementation unit 46, as an essential function of the segment management terminal 4, for example, performs network segment separation at a desired timing. That is, the management implementation unit 46 performs network security management of the production management system 9 for each segment. The display unit 47 displays information such as the analysis results of the segment analysis unit 40, the segments set by the segment setting unit 41, and the zones set by the zone setting unit 43. Note that the segment management terminal 4 can be configured without the display unit 47 if the display of the aforementioned information is not required. The communication unit 48 performs various functions such as sending and receiving information. For example, the communication unit 48 receives I / O setting information and control programs from the control device 5. The communication unit 48 also transmits segment management instructions to the control device 5. The communication method of the communication unit 48 may be wired communication, wireless communication, or a combination of wired and wireless communication.

[0028] In the segment management terminal 4, the segment analysis unit 40 can understand the connection relationship between control device 5 and other control devices 5 and OT devices 6-1 to 6-5, i.e., control device 5 and OT devices 6-1 to 6-5, based on the device information indicated by the I / O setting information of control device 5 obtained from control device 5. Furthermore, the segment analysis unit 40 can understand the connection relationship between control device 5 and OT devices 6-1 to 6-5 by confirming the target control device 5 or OT devices 6-1 to 6-5 based on the argument section in the control program of control device 5 obtained from control device 5. In this way, the segment analysis unit 40 can understand the range in which segment separation is possible based on the connection relationship between control device 5 and OT devices 6-1 to 6-5. The connection relationship between control device 5 and OT devices 6-1 to 6-5 refers to information about the connection relationship that connects devices via telecommunications, such as I / O setting information and arguments. Furthermore, if network communication in the production management system 9 is performed using tokens, the segment analysis unit 40 will produce analysis results such that the devices connected to the network are set to the same segment. The segment analysis unit 40 may also analyze at least one of the I / O setting information and control programs held by the control device 5 obtained from the control device 5 to understand the connection relationship between the control device 5 and the controlled devices, which are OT devices 6-1 to 6-5. The segment analysis unit 40 transmits the obtained analysis results to the segment management device 3 via the communication unit 48.

[0029] In the segment management terminal 4, the segment setting unit 41 sets segments for the control device 5 connected to the segment management terminal 4 and the OT devices 6-1 to 6-5, which are controlled devices controlled by the control device 5, based on the analysis results of the segment analysis unit 40. At this time, the segment setting unit 41 may set segments using at least one of the analysis results of the I / O setting information and the analysis results of the control program.

[0030] Figure 4 shows an example configuration of the segment management system central server 2, segment management device 3, and engine tool 8 according to Embodiment 1. Although the engine tool 8 is not shown in Figure 1, it is assumed to be connected to the segment management device 3 as shown in Figure 4. In addition to being directly connected to the segment management device 3 as shown in Figure 4, the engine tool 8 can also be connected to the segment management device 3 via other equipment, such as control equipment 5 including a PLC.

[0031] The segment management system central server 2 comprises a control unit 26, a display unit 27, and a communication unit 28.

[0032] The control unit 26 controls the updating of the firmware and parameters of the segment management device 3 and the segment management terminal 4. The display unit 27 displays the details of the work performed when updating the firmware, parameters, etc., of the segment management device 3 and the segment management terminal 4. The display unit 27 may also display the operating status of the segment management device 3 and the segment management terminal 4. The segment management system central server 2 can be configured without the display unit 27 if the above-mentioned information can be displayed on the display unit of another device. The communication unit 28 performs various functions such as sending and receiving information. For example, the communication unit 28 sends firmware, parameters, etc., to the segment management device 3 or the segment management terminal 4 and receives information such as the operating status from the segment management device 3 and the segment management terminal 4. The communication method of the communication unit 28 may be wired communication, wireless communication, or a combination of wired and wireless communication.

[0033] The engine tool 8 comprises a system configuration information storage unit 82, a network configuration information storage unit 84, a control unit 86, and a communication unit 88. As shown in Figure 4, the system configuration information storage unit 82 and the network configuration information storage unit 84 constitute the storage unit 85.

[0034] The system configuration information storage unit 82 stores system configuration information that shows the overall system configuration of the production management system 9. The network configuration information storage unit 84 stores network configuration information that shows the configuration of the information system layer Lv4 / 5, control monitoring layer Lv2 / 3, and control field layer Lv0 / 1 of the production management system 9, i.e., the network configuration of the production management system 9. The control unit 86 performs monitoring and status setting of the production management system 9. The communication unit 88 performs sending and receiving of various types of information. For example, the communication unit 88 transmits the system configuration information stored in the system configuration information storage unit 82 and the network configuration information stored in the network configuration information storage unit 84 to the segment management device 3. The communication method of the communication unit 88 may be wired communication, wireless communication, or a combination of wired and wireless communication.

[0035] The segment management device 3 comprises a segment analysis unit 30, a segment setting unit 31, a segment information storage unit 32, a zone setting unit 33, a zone information storage unit 34, a management instruction unit 36, a display unit 37, and a communication unit 38. As shown in Figure 4, the segment setting unit 31, the segment information storage unit 32, the zone setting unit 33, and the zone information storage unit 34 constitute the segment and zone management unit 35.

[0036] The segment analysis unit 30 performs segment analysis using system configuration information and network configuration information obtained from the engineering tool 8. The segment setting unit 31 sets segments for the control device 5 connected to the segment management terminal 4 and the OT device 6, which is the controlled device controlled by the control device 5, based on the analysis results of the segment analysis unit 30 and the analysis results of the segment analysis unit 40 of the segment management terminal 4. The segment information storage unit 32 stores segment information for the segments set by the segment setting unit 31. The zone setting unit 33 sets a zone that includes the control device 5 connected to the segment management terminal 4 and the OT device 6, which is the controlled device controlled by the control device 5, based on the segments set by the segment setting unit 31, in order to manage a desired production line as a zone. The zone setting unit 33 sets a zone for the control device 5 in order to manage one or more separable segments as zones that indicate the division of an actual production area. The zone information storage unit 34 stores zone information for the zone set by the zone setting unit 33.

[0037] In the segment management device 3, the segment information storage unit 32 and the zone information storage unit 34 are configured as relational databases. The segment information storage unit 32 and the zone information storage unit 34 manage the control devices 5 and OT devices 6 based on the relationships between primary control devices and subordinate controlled devices, and segments and zones are set for the relationships between each device.

[0038] The management instruction unit 36, as an essential function of the segment management device 3, for example, instructs the segment management terminals 4-1 to 4-3 to separate network segments at a desired timing. The display unit 37 displays information such as the analysis results of the segment analysis unit 30, segments set by the segment setting unit 31, and zones set by the zone setting unit 33. Note that the segment management device 3 can also be configured without the display unit 37 if the display of the aforementioned information is not required. The communication unit 38 performs various functions such as sending and receiving information. For example, the communication unit 38 receives system configuration information and network configuration information from the engine tool 8, and receives segment information and zone information set by each segment management terminal 4-1 to 4-3 as analysis results from the segment analysis unit 40 of each segment management terminal 4-1 to 4-3. The communication unit 38 also transmits the segment separation instruction from the management instruction unit 36 ​​to the segment management terminals 4-1 to 4-3. The communication method of the communication unit 38 may be wired communication, wireless communication, or a combination of wired and wireless communication.

[0039] In the segment management device 3, the segment analysis unit 30 can understand the connection relationship between the control device 5 and the OT device 6, similar to the segment analysis unit 40 of the segment management terminal 4, because the system configuration information acquired from the engine tool 8 consists of information about the devices that constitute the production management system 9. Furthermore, the segment analysis unit 30 can understand the connection relationship between the control device 5 and the OT device 6, similar to the segment analysis unit 40 of the segment management terminal 4, because the network configuration information acquired from the engine tool 8 consists of information about the devices that connect to the network of the production management system 9. In this way, the segment analysis unit 30 can understand the range in which segment separation is possible based on the connection relationship between the control device 5 and the OT device 6. When network communication in the production management system 9 is performed using tokens, the segment analysis unit 30 will produce an analysis result such that the devices connected to the network are set to the same segment.

[0040] In addition, the segment analysis unit 30 can grasp the connection relationship between the control device 5 and the OT device 6 based on the simulation branching points of the production process simulator, such as Gemini or a logic simulator. Production process simulators are particularly suitable for grasping the connection relationship between the control device 5 and the OT device 6 because they manage design drawings that clearly show the connection relationship between the control device 5 and the OT device 6, as well as information on the connection relationship of processes, i.e., the continuity relationship of processes. In this way, the segment analysis unit 30 can grasp the range in which segment separation is possible based on the connection relationship between the control device 5 and the OT device 6. The segment analysis unit 40 of the aforementioned segment management terminal 4 can also grasp the connection relationship between the control device 5 and the OT device 6 based on the simulation branching points of the production process simulator, such as Gemini or a logic simulator, if information from the production process simulator is available. The segment analysis unit 30 may also grasp the connection relationship between the control device 5 and the controlled device, the OT device 6, by analyzing at least one of the configuration information of the production management system 9, the network configuration information of the production management system 9, and the simulation results of the production management system 9 obtained from an external source. The segment analysis unit 30 outputs the obtained analysis results to the segment setting unit 31.

[0041] Next, in the segment management device 3, the segment setting unit 31 sets segments using the analysis results from the segment analysis unit 30 of the segment management device 3 and the analysis results from the segment analysis unit 40 of the segment management terminal 4. As for the method of setting segments in the segment setting unit 31 of the segment management device 3, for example, the following methods (1) to (3) can be considered. (1) The segment setting unit 31 receives a segment setting request from a user and sets the segment setting request as a segment if it is acceptable based on the analysis results of the segment analysis unit 30. In this case, the segment setting unit 31 organizes separable segments based on the analysis results of the segment analysis unit 30 and sets the segment that matches the segment setting request from the organized segments. (2) The segment setting unit 31 notifies the user of the segments that can be set based on the analysis results of the segment analysis unit 30 and sets the segment upon user acceptance. In this case, the segment setting unit 31 organizes separable segments based on the analysis results of the segment analysis unit 30, notifies the user of the organized segments, and sets the segment selected by the user from the notified segments. (3) The segment setting unit 31 automatically sets a segment that meets a defined condition, for example, the condition of setting the smallest possible segment, based on the analysis results of the segment analysis unit 30. In this case, the segment setting unit 31 organizes the separable segments based on the analysis results of the segment analysis unit 30 and sets the smallest segment among the organized segments.

[0042] Note that the method for setting segments in the segment setting unit 31 of the segment management device 3 is not limited to these. The segment setting unit 31 of the segment management device 3 can also set segments using only one of the analysis results from the segment analysis unit 30 of the segment management device 3 and the analysis result from the segment analysis unit 40 of the segment management terminal 4. Also, the segment setting unit 31 of the segment management device 3 can also use a combination of some of the aforementioned methods for setting segments. Further, the segment setting unit 31 may set segments using at least one of the analysis result of the configuration information of the production management system 9, the analysis result of the configuration information of the network of the production management system 9, and the analysis result of the simulation result.

[0043] After setting the segments, the segment setting unit 31 of the segment management device 3 stores the set content as segment information in the segment information storage unit 32 of the segment management device 3, and in order to store the corresponding segment information in the segment information storage unit 42 of the segment management terminal 4, it causes the segment information to be transmitted from the communication unit 38 to the segment management terminal 4.

[0044] Also, in the segment management device 3, the zone setting unit 33 manages a desired production line as a zone, and based on the segments set by the segment setting unit 31, sets zones for the control device 5 connected to the segment management terminal 4 and the OT device 6 which is the controlled device controlled by the control device 5. After setting the zones, the zone setting unit �3 of the segment management device 3 stores the set content as zone information in the zone information storage unit 34 of the segment management device 3, and in order to store the corresponding zone information in the zone information storage unit 44 of the segment management terminal 4, it causes the zone information to be transmitted from the communication unit 38 to the segment management terminal 4.

[0045] In the segment management device 3, the segment information stored in the segment information storage unit 32 and the zone information stored in the zone information storage unit 34 are configured as shown in FIGS. 5 and 6.

[0046] FIG. 5 is a diagram showing an example of segments and zones based on the connection relationship between the control device 5 and the OT device 6 set in the segment management device 3 of the segment management system 1 according to Embodiment 1. In the example of FIG. 5, the overall control device controls control devices A, B, and D, the control device A controls OT devices A and B, the control device B controls the control device C and the OT device D, the control device C controls the OT device C, and the control device D controls the control device B and the OT device E. Note that, as shown in the balloon in FIG. 5, the control device D can also control the control device B based on the result of the OT device E. Also, the control device B can receive control from the overall control device and the control device D.

[0047] FIG. 6 is a diagram showing an example of segments based on the connection relationship between the control device 5 and the OT device 6 set in the segment management device 3 of the segment management system 1 according to Embodiment 1. The connection relationship of the overall control device, the control device, and the OT device shown in FIG. 6 is the same as the connection relationship of the overall control device, the control device, and the OT device shown in FIG. 5. In FIG. 6, it can be shown that there is a two-way exchange of information between the control device D and the OT device E, so the information like the balloon shown in FIG. 5 becomes unnecessary.

[0048] Segments are set in the segment management device 3 and the segment management terminal 4 for an appropriate network range where segment separation does not affect control. In FIGS. 5 and 6, for example, since the control device B is in a mode of receiving instructions from the control device D, a segment according to the division of segment 1 in FIG. 5 is not set for the control device B, and segment C is set in the division of segment 2 in FIG. 5 with a wider network range. Regarding segments, as shown in FIGS. 5 and 6, the segments may not overlap with each other like segment A and segment C, or one segment may be included in the other segment like segment B and segment C.

[0049] Regarding zones, Zone A is assigned to Segment A. Also, since Segment B is included in Segment C, no separate zone is assigned to Segment B alone; instead, Zone B, which corresponds to Segment C, is assigned.

[0050] Figure 7 shows an example of external hierarchical management of segments by the segment management system 1 according to Embodiment 1. In the external hierarchical management shown in Figure 7, segments do not overlap with each other and are linked together like a chain, as seen in segments A and C in Figures 5 and 6. Figure 8 shows an example of internal hierarchical management of segments by the segment management system 1 according to Embodiment 1. In the internal hierarchical management shown in Figure 8, one segment is included in the other, as seen in segments B and C in Figures 5 and 6. In this way, when setting multiple segments, the segment setting unit 31 of the segment management device 3 and the segment setting unit 41 of the segment management terminal 4 set multiple segments in a hierarchical structure so that the segments do not overlap with each other, or set multiple segments in a hierarchical structure so that some segments contain other segments.

[0051] Although the description above has focused on the case where the segment management device 3 acquires analysis results from the segment analysis unit 40 of the segment management terminal 4, the device is not limited to this case. The segment management device 3 acquires segment information set in the segment setting unit 41 of each segment management terminal 4, and zone information set in the zone setting unit 43 of each segment management terminal 4. By storing the acquired segment information in the segment information storage unit 32 and the acquired zone information in the zone information storage unit 34, the device 3 can get an overview of the entire segment and zone system of the production management system 9 network.

[0052] In the segment management terminal 4, when the communication unit 48 receives segment information and zone information transmitted from the segment management device 3, it outputs the segment information to the segment setting unit 41 and the zone information to the zone setting unit 43. Here, the segment information storage unit 42 stores the segment information set by the segment setting unit 41 based on the analysis results of the segment analysis unit 40. The zone information storage unit 44 stores the zone information set by the zone setting unit 43 based on the segment information stored in the segment information storage unit 42.

[0053] Therefore, if the segment information received by the communication unit 48 is the same as the segment information stored in the segment information storage unit 42, the segment setting unit 41 discards the segment information received by the communication unit 48. If the segment information received by the communication unit 48 is different from the segment information stored in the segment information storage unit 42, the segment setting unit 41 updates the segment information stored in the segment information storage unit 42 with the segment information received by the communication unit 48. Similarly, if the zone information received by the communication unit 48 is the same as the zone information stored in the zone information storage unit 44, the zone setting unit 43 discards the zone information received by the communication unit 48. If the zone information received by the communication unit 48 is different from the zone information stored in the zone information storage unit 44, the zone setting unit 43 updates the zone information stored in the zone information storage unit 44 with the zone information received by the communication unit 48.

[0054] In the segment management system 1, segments and zones are configured in both the segment management device 3 and the segment management terminal 4. Therefore, it is possible that the segments and zones configured in the segment management device 3 may differ from those configured in the segment management terminal 4. In such cases, the segment management system 1 prioritizes the segments and zones configured in the segment management device 3.

[0055] In this way, the segment setting unit 31 of the segment management device 3 and the segment setting unit 41 of the segment management terminal 4 set segments that will be used to implement security management for the network to which the controlled OT equipment 6 is connected, based on the connection relationship between the control device 5 and the controlled OT equipment 6, which is a controlled device, based on the control instructions in the production management system 9, which includes the control device 5 and the controlled OT equipment 6 controlled by the control device 5.

[0056] Here, we will explain how to set zones in the zone setting unit 33 of the segment management device 3 and the zone setting unit 43 of the segment management terminal 4. In the following explanation, we will use the zone setting unit 33 of the segment management device 3 as an example. For example, the zone setting unit 33 of the segment management device 3 displays separable segments on the management screen of the display unit 37. Figure 9 is a diagram showing an example of what the zone setting unit 33 of the segment management system 1 according to Embodiment 1 displays on the management screen of the display unit 37. The zone setting unit 33 sets zones for the segments displayed on the management screen of the display unit 37.

[0057] The zone setting unit 33 accepts zone settings from the user using a drawing means for the management screen. When the zone setting unit 33 receives a zone setting that is appropriate as a division of the production area via the drawing means, it adopts the zone setting received by the drawing means. When the zone setting unit 33 receives a zone setting that is not appropriate as a division of the production area via the drawing means, it does not adopt the zone setting received by the drawing means. In Figure 9, the content displayed on the left is the same as the segment management system 1, production management system 9, etc. shown in Figure 1. In Figure 9, the content displayed on the right is the aforementioned drawing means. In Figure 9, it is shown that the user can set a zone for the production management system 9 on the left using the dotted frame or arrow indicated in the zone setting in the upper right. The zone setting unit 33 may accept zone settings from the user via a device such as a mouse or keyboard, or, if the display unit 37 is a touch panel, it may accept zone settings from the user via the display unit 37.

[0058] If the zone setting unit 33 does not adopt the zone setting received from the user by the drawing means, it may display an appropriate zone as a division of the production area to the user on the management screen. For example, if the zone setting unit 33 does not accept a zone setting from the user, it may automatically display an appropriate zone as a division of the production area to the user on the management screen, or it may display an appropriate zone as a division of the production area to the user on the management screen when the zone candidate display shown on the right side of Figure 9 is pressed by the user. When the zone confirmation shown on the right side of Figure 9 is pressed by the user, the zone setting unit 33 confirms the zone setting for the production management system 9 and stores the zone information indicating the set zone in the zone information storage unit 34.

[0059] Although the explanation used the zone setting unit 33 of the segment management device 3 as an example, the zone setting unit 43 of the segment management terminal 4 can perform the same operation by replacing the segment management device 3 with the segment management terminal 4, the zone setting unit 33 with the zone setting unit 43, the display unit 37 with the display unit 47, and the zone information storage unit 34 with the zone information storage unit 44.

[0060] Figure 10 is a flowchart showing the operation of the segment management system 1 according to Embodiment 1. In the segment management system 1, the segment analysis unit 40 of the segment management terminal 4 performs segment analysis using the I / O setting information and control program of the control device 5 acquired from the control device 5 (step S1). The segment setting unit 41 of the segment management terminal 4 sets segments based on the analysis results of the segment analysis unit 40 (step S2). The zone setting unit 43 of the segment management terminal 4 sets zones based on segments (step S3).

[0061] The segment analysis unit 30 of the segment management device 3 performs segment analysis using the system configuration information and network configuration information of the production management system 9 (step S4). The segment setting unit 31 of the segment management device 3 sets segments based on the analysis results of the segment analysis unit 30 and the analysis results of the segment analysis unit 40 of the segment management terminal 4 (step S5). The zone setting unit 33 of the segment management device 3 sets zones based on the segments (step S6).

[0062] The segment setting unit 41 of the segment management terminal 4 determines whether the set segment is the same as the segment set by the segment setting unit 31 of the segment management device 3 (step S7). If the set segment is different from the segment set by the segment setting unit 31 of the segment management device 3 (step S7: No), the segment setting unit 41 of the segment management terminal 4 updates the segment to the segment set by the segment setting unit 31 of the segment management device 3 (step S8). If the set segment is the same as the segment set by the segment setting unit 31 of the segment management device 3 (step S7: Yes), the segment setting unit 41 of the segment management terminal 4 does not update the segment.

[0063] The zone setting unit 43 of the segment management terminal 4 determines whether the set zone is the same as the zone set by the zone setting unit 33 of the segment management device 3 (step S9). If the set zone is different from the zone set by the zone setting unit 33 of the segment management device 3 (step S9: No), the zone setting unit 43 of the segment management terminal 4 updates the zone to the zone set by the zone setting unit 33 of the segment management device 3 (step S10). If the set zone is the same as the zone set by the zone setting unit 33 of the segment management device 3 (step S9: Yes), the zone setting unit 43 of the segment management terminal 4 does not update the zone.

[0064] In the segment management system 1, the case in which the segment management device 3 and the segment management terminal 4 each set segments and zones has been described, but the system is not limited to this. In the segment management system 1, it is also possible for only the segment management device 3 to set segments and zones, or for only the segment management terminal 4 to set segments and zones.

[0065] Furthermore, as shown in Figure 1, the segment management system 1 includes a segment management device 3 and a segment management terminal 4, but is not limited to this configuration. The segment management system 1 may also be configured to include a device that combines the functions of the segment management device 3 and the segment management terminal 4 into a single device. For example, the segment management system 1 may include multiple devices that combine the functions of the segment management device 3 and the segment management terminal 4 into a single device, with one of these devices acting as a coordinator and issuing instructions for segment management to the other devices.

[0066] Furthermore, while the segment management system 1 shows an example where the segment management terminal 4 is connected to a control device 5 such as a PLC, it is not limited to this. If a control device 5 such as a PLC can be implemented, the control device 5 may be configured to have the functions of the segment management terminal 4.

[0067] Next, the hardware configuration for realizing the segment management system 1 of Embodiment 1 will be described. In the segment management system 1, the segment information storage units 32, 42 and the zone information storage units 34, 44 are realized by memory. The display units 27, 37, 47 are realized by displays such as LCDs (Liquid Crystal Displays). The communication units 28, 38, 48 are realized by input / output interfaces capable of communication by at least one of wireless communication and wired communication. The control unit 26, segment analysis units 30, 40, segment setting units 31, 41, zone setting units 33, 43, management instruction unit 36, and management implementation unit 46 are realized by processing circuits. The processing circuits are realized by a processor and memory. Figure 11 is a diagram showing an example of the hardware configuration for realizing the segment management system 1 of Embodiment 1. The processing circuit 90 is realized by a processor 91 and memory 92. In Figure 11, the display 93 corresponds to the aforementioned display, and the input / output interface 94 corresponds to the aforementioned input / output interface.

[0068] The processor 91 is a CPU (Central Processing Unit). The processor 91 may also be an arithmetic unit, microprocessor, microcomputer, or DSP (Digital Signal Processor). The memory 92 is a volatile or non-volatile semiconductor memory, such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), or EEPROM® (Electrically Erasable Programmable Read Only Memory).

[0069] Memory 92 stores programs for operation as the control unit 26, segment analysis units 30, 40, segment setting units 31, 41, zone setting units 33, 43, management instruction unit 36, and management implementation unit 46. By reading and executing these programs, the processor 91 can realize the control unit 26, segment analysis units 30, 40, segment setting units 31, 41, zone setting units 33, 43, management instruction unit 36, and management implementation unit 46. The programs for operation as the control unit 26, segment analysis units 30, 40, segment setting units 31, 41, zone setting units 33, 43, management instruction unit 36, and management implementation unit 46, which are stored in memory 92, may be provided to the user, for example, by writing them on a storage medium such as a CD (Compact Disc)-ROM or DVD (Digital Versatile Disc)-ROM, or they may be provided via a network. The processor 91 also outputs data such as calculation results to the volatile memory of memory 92. Alternatively, the processor 91 saves data, such as calculation results, by outputting it to an auxiliary storage device via the volatile memory of the memory 92.

[0070] Figure 11 shows an example of hardware when the segment management system 1 is implemented using a general-purpose processor 91 and memory 92. However, the segment management system 1 may also be implemented using a dedicated processing circuit instead of the processor 91 and memory 92. Here, the dedicated processing circuit is a single circuit, a composite circuit, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a circuit combining these. Furthermore, a portion of the segment management system 1 may be implemented using the processor 91 and memory 92, and the remainder implemented using the dedicated processing circuit.

[0071] As described above, according to this embodiment, in the segment management system 1, at least one of the segment management device 3 and the segment management terminal 4 sets a segment that will be the unit to which security management will be performed for the network to which the OT device 6 is connected, based on the connection relationship between the control device 5 and the OT device 6, which is the controlled device, based on the control instructions in the production management system 9, which includes the control device 5 and the OT device 6, which is the controlled device controlled by the control instructions from the control device 5. As a result, the segment management system 1 is able to isolate appropriate network segments in the OT domain, and segment isolation is possible without blocking the controls necessary for network security.

[0072] The segment management system 1 performs network segment separation based on the connection relationships within the control range of the control device 5. In other words, when the segment management system 1 isolates a network based on segments, it can isolate the network to an extent that does not affect other controls.

[0073] Furthermore, the segment management system 1 can respond to malware and other intrusions into the production management system 9 from external sources such as the internet 7, and can also respond to malware and other intrusions from within the production management system 9, for example, from a storage medium connected to a certain device.

[0074] Embodiment 2. In Embodiment 1, one segment management system central server 2 targeted one production management system 9, but it is also possible for one segment management system central server 2 to target multiple production management systems 9a to 9c.

[0075] Figure 12 shows an example configuration of the segment management system 1a according to Embodiment 2. In Embodiment 2, the segment management system central server 2 can connect to a plurality of segment management devices 3 and segment management terminals 4 included in different production management systems 9a to 9c. The configurations of the production management systems 9a to 9c may be the same or different. Also, the number of segment management devices 3 and segment management terminals 4 included in the production management systems 9a to 9c may be the same or different. The segment management system central server 2 can perform firmware updates, parameter updates, etc., for the segment management devices 3 and segment management terminals 4 of each production management system 9a to 9c. The segment management system central server 2 is a common service provider for performing segment separation for a plurality of production management systems 9a to 9c.

[0076] The same effects as those of the segment management system 1 of Embodiment 1 can be obtained with the segment management system 1a having the configuration shown in Figure 12.

[0077] The configurations shown in the above embodiments are examples only, and it is possible to combine them with other known technologies, combine different embodiments, and omit or modify parts of the configuration without departing from the gist of the invention.

[0078] 1, 1a Segment management system, 2 Segment management system central server, 3 Segment management device, 4, 4-1 to 4-3 Segment management terminal, 5, 5-1, 5-2 Control equipment, 6-1 to 6-16 OT equipment, 7 Internet, 8 Engineering tool, 9, 9a to 9c Production management system, 26, 56, 86 Control unit, 27, 37, 47 Display unit, 28, 38, 48, 58, 88 Communication unit, 30, 40 Segment analysis unit, 31, 41 Segment setting unit, 32, 42 Segment information storage unit, 33, 43 Zone setting unit, 34, 44 Zone information storage unit, 35, 45 Segment and zone management unit, 36 Management instruction unit, 46 Management implementation unit, 52 Control equipment I / O setting information storage unit, 54 Control program storage unit, 55, 85 Storage unit, 82 System configuration information storage unit, 84 Network configuration information storage unit, 90 processing circuit, 91 processor, 92 memory, 93 display, 94 input / output interface.

Claims

1. A segment management system comprising a segment setting unit that sets a segment, which is a unit for implementing security management for the network to which the controlled equipment is connected, based on the connection relationship between the control equipment and the controlled equipment based on the control instructions in a production management system including a control equipment and controlled equipment controlled by control instructions from the control equipment.

2. The segment management system according to claim 1, further comprising a management implementation unit that performs security management of the network for each segment.

3. A segment management system according to claim 1 or 2, comprising: a segment analysis unit that analyzes at least one of the setting information and control program held by the control device obtained from the control device and grasps the connection relationship between the control device and the controlled device, wherein the segment setting unit sets the segment using at least one of the analysis results of the setting information and the analysis results of the control program.

4. A segment management system according to any one of claims 1 to 3, comprising: a segment analysis unit that analyzes at least one of the configuration information of the production management system obtained from an external source, the configuration information of the network, and the simulation results of the production management system to grasp the connection relationship between the control device and the controlled device; and a segment setting unit that sets the segments using at least one of the analysis results of the configuration information of the production management system, the analysis results of the configuration information of the network, and the analysis results of the simulation results.

5. The segment management system according to claim 4, characterized in that the segment setting unit receives a segment setting request from a user and sets the segment setting request as the segment if it is acceptable based on the analysis results.

6. The segment management system according to claim 4, characterized in that the segment setting unit notifies the user of the segments that can be set based on the analysis results, and sets the segments upon the user's acceptance.

7. The segment management system according to claim 4, characterized in that the segment setting unit automatically sets the segment that matches the conditions defined based on the analysis results.

8. The segment management system according to any one of claims 1 to 7, characterized in that, when setting up a plurality of segments, the segment setting unit sets up the plurality of segments in a hierarchical manner so that the segments do not overlap, or sets up the plurality of segments in a hierarchical manner so that some segments contain other segments.

9. A segment management system according to any one of claims 1 to 8, comprising a control device and a zone setting unit for setting the zones for the controlled device in order to manage one or more separable segments as zones indicating divisions of an actual production area.

10. The segment management system according to claim 9, characterized in that the zone setting unit displays the separable segments on a management screen.

11. The segment management system according to claim 10, characterized in that the zone setting unit sets the zone for the segment displayed on the management screen.

12. The segment management system according to claim 11, characterized in that the zone setting unit receives zone settings from a user using a drawing means for the management screen, adopts the zone settings received by the drawing means when the drawing means receives zone settings that are appropriate as divisions of the production area, and does not adopt the zone settings received by the drawing means when the drawing means receives zone settings that are not appropriate as divisions of the production area.

13. The segment management system according to claim 12, characterized in that, if the zone setting unit does not adopt the zone setting received by the drawing means, it causes the user to display a zone appropriate as a division of the production area on the management screen.

14. A segment management device comprising: a segment setting unit that sets a segment that will be used to implement security management for the network to which the controlled equipment is connected, based on the connection relationship between the control equipment and the controlled equipment based on the control instructions in a production management system including a control equipment and controlled equipment controlled by control instructions from the control equipment; and a segment management instruction unit that instructs a segment management terminal connected to the control equipment to implement security management for the network for each segment based on the set segments.

15. A segment management device according to claim 14, comprising: a segment analysis unit that analyzes at least one of the configuration information of the production management system obtained from an external source, the configuration information of the network, and the simulation results of the production management system to grasp the connection relationship between the control device and the controlled device, wherein the segment setting unit sets the segments using at least one of the analysis results of the configuration information of the production management system, the analysis results of the configuration information of the network, and the analysis results of the simulation results.

16. The segment management device according to claim 15, characterized in that the segment setting unit receives a segment setting request from a user and sets the segment setting request as the segment if it is acceptable based on the analysis results.

17. The segment management device according to claim 15, characterized in that the segment setting unit notifies the user of the segments that can be set based on the analysis results, and sets the segments upon acceptance by the user.

18. The segment management device according to claim 15, characterized in that the segment setting unit automatically sets the segments that match the conditions defined based on the analysis results.

19. A segment management terminal comprising: a segment setting unit that sets a segment which is a unit for implementing security management for the network to which the controlled equipment is connected, based on the connection relationship between the control equipment and the controlled equipment based on the control instructions in a production management system including a control equipment and controlled equipment controlled by control instructions from the control equipment; and a segment management implementation unit that implements security management for the network for each segment based on instructions from a segment management device that manages the security of the network for each segment.

20. A segment management terminal according to 19, comprising: a segment analysis unit that analyzes at least one of the setting information and control program held by the control device obtained from the control device and grasps the connection relationship between the control device and the controlled device, wherein the segment setting unit sets the segment using at least one of the analysis results of the setting information and the analysis results of the control program.

21. A segment management program characterized in that a segment setting unit causes a computer to perform a segment setting step, in which a segment setting unit sets a segment that will be the unit to which security management will be performed for the network to which the controlled devices are connected, based on the connection relationship between the control devices and the controlled devices based on the control instructions in a production management system including control devices and controlled devices controlled by control instructions from the control devices.

22. A segment management method characterized in that the segment setting unit sets a segment that will be the unit to which security management will be performed for the network to which the controlled equipment is connected, based on the connection relationship between the control equipment and the controlled equipment based on the control instructions in a production management system which includes a control equipment and controlled equipment controlled by control instructions from the control equipment.

Images