WO2017145526A1

WO2017145526A1 - Communication control apparatus and communication control method

Info

Publication number: WO2017145526A1
Application number: PCT/JP2017/000363
Authority: WO
Inventors: 淳也藤田; 山田　勉; 山田　弘道
Original assignee: 株式会社日立製作所
Priority date: 2016-02-22
Filing date: 2017-01-10
Publication date: 2017-08-31
Also published as: JP2019083355A

Abstract

The purpose of the present invention is to easily add a security function to an existing control apparatus, and especially to detect or avoid DoS attacks without affecting the real-time property of communication between control apparatuses. A communication control apparatus relays a communication frame to be transmitted to a control apparatus from a network, the communication frame being constituted by small frames that follow a predetermined order. The communication control apparatus is provided with: an IFG measurement unit that measures an IFG of the communication frame; a communication frame scan unit that scans data in the communication frame without storing the data and that acquires the scanned data and data relating to the arrangement of the communication frame; an allowable-IFG determination unit that determines an allowable IFG of the communication frame that is to be received next, on the basis of the scanned data of the current communication frame acquired by the communication frame scan unit; an allowable-IFG list that stores the allowable IFG obtained by the allowable-IFG determination unit; an abnormal communication frame determination unit that determines that the communication frame is a DoS attack from an IFG measurement value acquired by the IFG measurement unit, data relating to the arrangement of the small frames of the communication frame acquired by the communication frame scan unit, and the content of the allowable-IFG list stored in the allowable-IFG list; and a network control unit which, in accordance with a determination result from the abnormal communication frame determination unit, adds to the communication frame security information signifying discarding of or a warning about the communication frame and transmits the communication frame to the control apparatus. The communication control apparatus is characterized in that the abnormal communication frame determination unit determines that the communication frame is a DoS attack by comparing the allowable IFG stored in the allowable-IFG list with the IFG measurement value.

Description

Communication control device and communication control method

The present invention relates to a communication control device and a communication control method for improving cyber security tolerance in a communication network that requires real-time performance.

In recent years, threats related to cyber security (hereinafter simply referred to as security) for critical infrastructure control systems (hereinafter referred to as control systems) have become serious.

Among the control system components, the control devices that play the core role in the control mechanisms such as the controller for control and the network for control communication are designed in pursuit of high real-time characteristics, and many are configured by embedded systems.

Embedded systems include dedicated software and hardware such as RTOS (Real-Time Operating System), microcomputer (microcontroller), ASIC (Application Specific Integrated Circuit), and FPGA (Field Programmable Gate Array). As a result of pursuing high real-time performance, the embedded system mounted with these components has a design that eliminates redundancy and has poor expandability.

Therefore, it is difficult to implement additional security functions especially for existing embedded systems.

On the other hand, attacks on control systems have become more sophisticated in recent years, and control devices are often not targeted for security because they are often not equipped with security functions. In addition, the control device executes processing closely linked with other devices, and there is a high risk that a failure at one place will spread to the entire control system. As a result of the attack on the control device, the entire system can go down and can be severely impacted on safety and business aspects.

Based on the above, there is a need for technology to add security functions to existing control systems that are considered embedded systems.

When adding security functions to a control system, in many cases, security devices such as FW (Fire Wall) and AAA (Authentication, Authorization and Accounting) servers are deployed at the boundaries that can be intrusions from external networks. A security function is implemented.

However, this approach can prevent intrusions from outside the system, but attacks against attackers who can bypass these security functions, such as those that enter the system due to vulnerabilities of these security devices or internal criminals. May be forgiven.

Therefore, the security risk of the control system can be further reduced by adopting the technology that directly implements the security function for the existing control device.

As a method of directly implementing a security function for an existing control device, there is a method of securing a device that receives communication by installing a device that relays communication between a communication port of a control device or a network.

As a known example of this method, Patent Document 1 discloses a network relay device that relays communication in a communication network that performs communication between a plurality of clients. The network relay device is a network LSI (Large-Scale Integration). A network relay device is proposed, which includes a transfer engine unit configured as follows and a central control unit that controls the operation state of the network relay device.

Furthermore, the network relay device disclosed in Patent Document 1 includes a plurality of functional blocks that realize a function for individually transferring data inside, a load determining unit that determines a load applied to each functional block, and a load on the line. And a clock supplied to each functional block from each functional block or line load determined by the load determining unit, and a frequency voltage control unit for individually switching at least one of the operating voltages. In the load determination unit in this network relay device, the instantaneous load is measured from the packet communication interval (IFG: Inter-Frame Gap), and the clock supplied to each functional block and the availability of the operating voltage are determined from the result. It is determined by the frequency voltage control unit.

Also, as a means for securing a device that receives communication, a countermeasure against a DoS (Denial of Service) attack can be realized.

Since DoS attack is normal communication when viewed from the communication data alone, it is difficult to detect with FW and the like, and it is relatively easy to execute the attack.

As a known example of a countermeasure against a DoS attack, Patent Document 2 proposes a synchronous message processing method that avoids the influence of an attack under a DoS attack in which a large number of messages (synchronization messages) sent to a certain terminal are sent. ing.

A terminal equipped with this synchronization message processing method holds and transmits synchronization message data, an application unit that accepts user-side processing, a synchronization processing unit that interprets the meaning of the synchronization message data, and sends and receives synchronization messages to and from the network. And a protocol processing unit that executes communication protocol processing.

The above-described protocol processing unit measures the IFG (Inter frame Gap) with the previously received synchronization message, and discards the synchronization message if the IFG is within a certain time.

Patent No. 5060607 JP 2009-57190 A

The network relay device disclosed in Patent Document 1 determines the load on the network by measuring the IFG of the communication data as the load determination process, but performs statistical processing as the load determination, and the communication data is instantaneously abnormal. It is difficult to determine whether there is.

The synchronous message processing method of Patent Document 2 is a mechanism for determining a DoS attack based on the condition whether or not the IFG is below a threshold value.

The IFG threshold determination means determines a DoS attack by registering a fixed value in advance, or changing the threshold depending on whether or not a white list of a communication transmission source registered in advance or a black list is described.

In the case of this method, when the sender listed in the white list or the sender not listed in the black list is the attack source of the DoS attack, the DoS attack cannot be detected or avoided.

In particular, in the case of a control system, the terminals that can be connected to the network are often limited, and RTU (Remote Terminal Unit) or HMI (Human-Machine Interface), which is the transmission source of permitted communication, is a stepping stone for DoS attacks. Is likely to be.

In addition, it is not possible to determine the DoS attack for short IFG communications that the system executes as needed only by setting a certain threshold.

In addition, the synchronous message processing method disclosed in Patent Document 2 uses the synchronous message as a discarding unit, and buffers the synchronous message in a memory area in the apparatus including the synchronous message processing method disclosed in Patent Document 2. After determining whether or not it is a message, data necessary for determining whether or not a synchronous message is acceptable, such as transmission source information, is acquired.

When this method is applied to an existing control device, a delay occurs due to a process of buffering received data in a memory area in the device, which may hinder real-time processing of the existing control device.

From the above, the problem to be solved by the present invention is to easily add a security function to an existing control device, and in particular, to detect a DoS attack without affecting the real-time property of communication between control devices. Or to avoid.

The present invention is for solving the above-described problem, relays a communication frame transmitted from the network to the control device, and the communication frame is a communication control device configured by small frames following a predetermined order, The communication control device includes: an IFG measurement unit that measures IFG of a communication frame; a communication frame scan unit that scans communication frame data without storing data; and obtains scan data and communication frame array data; and communication frame scan Based on the scan data of the current communication frame acquired by the unit, an allowable IFG determination unit that determines an allowable IFG of a communication frame to be received next, an allowable IFG list that stores the allowable IFG obtained by the allowable IFG determination unit, The IFG measurement value acquired by the IFG measurement unit and the communication frame acquired by the communication frame scan unit. The abnormal communication frame determination unit for determining that the communication frame is a DoS attack and the determination result of the abnormal communication frame determination unit from the data of the small frame arrangement data of the system and the content of the allowable IFG list stored in the allowable IFG list. In response, the network control unit includes a network control unit that transmits the communication frame discarding or security information indicating a warning to the communication frame and transmits it to the control device. The abnormal communication frame determination unit stores the allowable IFG and IFG stored in the allowable IFG list. The measurement value is compared to determine that the communication frame is a DoS attack.

In addition, the present invention is a communication control method in a communication control apparatus configured to relay a communication frame transmitted from a network to a control apparatus, and the communication frame is composed of small frames that follow a predetermined order. If the IFG measurement value during the period is less than or equal to the threshold, any data is extracted from the communication frame, checked against one or more rules based on the extracted data, and whether there is an abnormality in the communication data based on the result And an arbitrary item in one or more rule lists related to the next communication frame is updated.

According to the present invention, it is possible to realize a function of detecting or avoiding a DoS attack with respect to an existing device among devices that are components of a control system.

In addition, according to the embodiment of the present invention, it is possible to detect a DoS attack with high accuracy and to realize a packet discarding process that does not affect the real-time property, thereby ensuring system security without affecting the operation of the control system. it can.

The figure which shows the structural example of the communication control apparatus T which concerns on this invention. The figure which shows the example of application to the control system of the communication control apparatus of this invention. The figure which shows the basic flowchart of the communication control apparatus T which concerns on this invention. The figure which shows the structure of the communication frame based on IEEE802.3 as an example of a communication frame. The figure which shows the example of the allowable IFG list 200 handled by the communication control apparatus T. The figure which shows the case where the receiving interval of the communication frame F1 is short and the measured average IFG is short. The figure which shows the case where the receiving interval of the communication frame F1 is long and the measured average IFG is long. The figure which shows the example of the allowable IFG list at the time of determining the communication which disturbs the periodicity of the communication control apparatus T as abnormality. The figure which shows the example which sets the time less than period time to permissible IFG corresponding to a some communication frame. The figure which shows the example of the allowable IFG list | wrist 200 containing the information of the reception frequency of the communication frame F1. The figure which shows the communication control apparatus structural example which considered the information of the reception frequency. The figure which shows the basic flowchart of the communication control apparatus T of FIG.

Hereinafter, a communication control device and a communication control method according to the present invention will be described with reference to the drawings. Note that the communication control method means a method for realizing the following processing which is performed by the communication control in the present invention. Although the configuration and effects of the present invention will be described by taking a control system as an example, the present invention is also applied to a system that requires real-time performance comparable to that of the control system.

FIG. 2 shows an application example of the communication control apparatus of the present invention to a control system.

The communication control device T according to the present invention shown in FIG. 2 is installed between the network NW that performs real-time communication in the control system and the control device E that is a protection target from the DoS attack. Note that the installation mode includes a mode of relaying between networks, a mode of directly connecting to a NIC (Network Interface Card) of the control device E, or a mode of directly mounting inside the control device E. Any of the mobile phones can be applied. In short, it may be installed on the control device entrance side on the communication path including the network.

FIG. 1 shows a configuration example of a communication control apparatus T according to the present invention.

The communication control apparatus T takes in the communication frame F1 from the network NW from the input interface I / F1, and outputs the communication frame F2 after the security processing from the output interface I / F2.

The communication data D of the communication frame F1 is first captured by the IFG measurement unit 201. The IFG measurement unit 201 measures the IFG of the communication frame at the data link level, and sends the IFG measurement value D1 to the abnormal communication frame determination unit 203. It is done.

The communication data D constituting the communication frame F1 is then taken into the communication frame scanning unit 202, and the communication frame scanning unit 202 scans the data without storing the data of the communication frame F1, and the scan data D3 and the communication frame F1 are arranged. Data D2 is acquired. The data D2 of the arrangement of the communication frames F1 is sent to the abnormal communication frame determination unit 203, and the scan data D3 is sent to the allowable IFG determination unit 205.

The allowable IFG determination unit 205 determines the allowable IFG of the communication frame F1 (t + 1) to be received next based on the scan data D3 of the current communication frame F1 (t) acquired by the communication frame scanning unit 202. The allowable IFG of the communication frame F1 determined by the allowable IFG determination unit 205 is sent to the allowable IFG list 200 as update information D4, and the allowable IFG set for each header information and reception frequency of the communication frame F1 in the allowable IFG list 200. Form a list. The list content D5 of the allowable IFG list 200 is sent to the abnormal communication frame determination unit 203.

In the abnormal communication frame determination unit 203, the IFG measurement value D1 acquired by the IFG measurement unit 201, the communication frame array data D2 acquired by the communication frame scan unit 202, and the allowable IFG list content D5 acquired from the allowable IFG list 200. From this, it is determined whether or not the communication frame F1 is a DoS attack.

The network control unit 204 generates security information indicating permission, discard or warning of the communication frame F1 based on the determination result generated by the abnormal communication frame determination unit 203, and outputs it from the output interface I / F2. Reflected in the frame F2. As a result, the downstream control device E side can determine whether or not data can be adopted using the security information of the received communication frame F2.

The communication frame F1 handled by the communication control device T in FIG. 1 may be various, but here, for example, a description will be given with reference to the structure of the communication frame F1 compliant with IEEE802.3 shown in FIG.

An IEEE 802.3-compliant communication frame F1 taken as an example of a communication frame includes a preamble F11, SFD (F12), destination address F13, source address F14, Type (F15), payload / upper protocol F16, FCS (F17) from the top. ). In the present invention, each part of F11 to F17 constituting the communication frame F1 is collectively referred to as a small frame, and will be described separately from the communication frame F1 as a whole.

FIG. 5 shows an example of the allowable IFG list 200 handled by the communication control apparatus T in FIG. FIG. 5 shows an allowable IFG (bit time) set for main small frames after the destination address F13 in FIG. In the example of FIG. 5, the destination address F13, source address F14, Type (F15), and data part (IP source address) are taken up as main small frames after the destination address F13 stored in the allowable IFG list 200. The allowable IFG (bit time) is 500, 400, 300, and 200 (bit time), respectively. The permissible IFG for each small frame described in the permissible IFG list 200 is a set of permissible IFGs that are successively shorter from the small frame closer to the head of the communication frame F1 to the subsequent stage.

FIG. 3 shows a flowchart of basic processing of the communication control apparatus T according to the present invention. Note that the communication control device T in FIG. 1 receives the communication data D of the communication frame F1 as information necessary for internal processing at an appropriate timing, and further, with the execution of the flowchart in FIG. Derived from D, IFG measurement value data D1, communication frame data D2, scan data D3, and the like are generated.

In the first processing step S300 of the flowchart of FIG. 3, the communication frame F1 from the network NW received by the input side communication interface I / F1 of the communication control device T is detected. Note that the detection of the communication frame F1 can be performed as reception detection by detecting, for example, a preamble that is the leading portion of the communication frame F1 and an SFD (Start Frame Delimiter). For example, in the case of a communication frame conforming to IEEE 802.3, the preamble is 56 bits and the SFD is 8 bits, and the reception of the communication frame F1 can be detected by detecting the pair of the preamble and the SFD.

Next, in processing step S301, IFG which is a time difference between the previous communication frame reception time and the communication frame reception time received this time is measured. As a specific means for measuring IFG, for example, it can be measured by an internal clock of the communication control device T or the like. In the following description, the case where the measured IFG is 600 (bit time) and the case where the measured IFG is 250 (bit time) will be described as an example.

Next, in processing step S302, the measured IFG measured in processing step S301 is compared with the maximum allowable IFG (hereinafter referred to as the maximum allowable IFG) among the allowable IFGs stored in the allowable IFG list 200 of FIG. If the measurement IFG is larger than the maximum allowable IFG (N in processing step S302), the processing on the processing step S309 side is performed. If the measurement IFG is smaller than the maximum allowable IFG (Y in processing step S302), the processing step S303 is performed. Side processing.

For example, when the measurement IFG is 600 (bit time) and is larger than 500 (bit time) which is the maximum allowable IFG in FIG. 5 (N in processing step S302), the processing step S306 is described. The current communication frame F1 (t) is permitted in step S309. Before the passage of the communication frame F1 (t) is permitted, in step S309, the allowable IFG list of the communication frame F1 (t + 1) to be acquired next is received. Scan data D3, which is information necessary for updating 200, is acquired from the communication frame F1 (t).

If it is determined that the measurement IFG is 250 (bit time) and the measurement IFG is smaller than 500 (bit time) that is the maximum allowable IFG in processing step S302 (Y in processing step S302), the processing IFG in processing step S303 is performed. By processing, the data of the current communication frame F1 (t) after the preamble is acquired from the head, and the data of the communication frame F1 (t) (communication frame data D2) is acquired as needed. The processing in the processing step S303 will be described later with reference to FIG. 4, but in short, for each small frame below the preamble constituting the communication frame F1 (t), data necessary to determine that the small frame is acquired. Is.

The process of processing step S304 is executed when data until the corresponding list in the allowable IFG list 200 can be selected is obtained from the communication frame F1 (t), and the allowable IFG and measurement IFG of the list are obtained. Compare More specifically, for a small frame below the preamble constituting the communication frame F1 (t), when the small frame can be detected, a list corresponding to the small frame in the allowable IFG list 200 is selected, The allowable IFG described in the selected list is compared with the measured IFG.

If the measured IFG is larger than the allowable IFG in the corresponding list (N in process step S304), the process on the process step S311 side is performed. When the measurement IFG is smaller than the allowable IFG in the corresponding list (Y in process step S304), the process in process step S305 is performed.

In the processing of step S311 when the measured IFG is larger than the allowable IFG of the corresponding list (N in processing step S304), the sequential repeated determination is executed for sequential small frames.

According to the previous explanation example, the measurement IFG is 250 (bit time), and the allowable IFG determined by the source address F14 which is the first small frame after the destination address F13 is 400 (bit time). In this case, the measurement IFG becomes equal to or less than the allowable IFG, and the communication data F1 is discarded and an alert is generated in processing step S305. These determinations are executed with reference to the permissible IFG list 200 each time a small frame can be confirmed. However, once the communication data F1 has been discarded and alert generation has been confirmed, determination of subsequent frames is performed. Is not necessarily required.

As a specific method of discarding a communication frame, for example, there is a method of replacing an FCS (frame check sequence) attached to the end of the communication frame with another value by bit inversion or the like. By doing so, it is discarded when the frame check process is executed in the NIC of the control device E which is a communication frame receiving side device. By replacing the FCS with another value, not only the data of the entire frame excluding the FCS can be acquired, but also a communication filtering process by cut-through can be realized.

In processing step S307, after the series of communication frame F1 (t) abnormality determination processing is completed, the allowable IFG list is updated based on the acquired communication frame data (scan data D3). This update process needs to be completed before the next communication frame F1 (t + 1) is received. For example, in the case of a protocol conforming to IEEE 802.3, it is determined in the specification that it is 96 bit time, and the update of the allowable IFG list may be completed within this time.

In the process of processing step S308, after the update of the allowable IFG list is completed, the reception of the next communication frame is awaited. When the communication frame F1 (t + 1) is received, the process returns to process step S300, and the series of processes described above is performed. Repeat for communication frame F1 (t + 1).

The abnormal communication frame determination unit 203 in FIG. 1 that executes the step of the processing step S304 in FIG. 3 is described in the target allowable IFG list based on the small frame data obtained sequentially from the top of the communication frame. A plurality of allowed IFG items can be sequentially compared.

In the case of the communication frame F1, in the processing step S300 in the communication control device T, the destination address F13 is detected after the reception of the communication frame F1 is detected by detecting the preamble F11 and the SFD (F12) which are the heads of the communication frame F1. Get the data.

In short, in the communication control apparatus T, in the processing step S302, the allowable IFG corresponding to the destination address F13 is obtained by referring to the allowable IFG list 200 and compared with the measured IFG and the maximum allowable IFG described in the destination address F13. . In the processing of processing step S302, since the allowable IFG (bit time) of the destination address F13 is 500 (bit time), it is determined whether the measurement IFG is larger or smaller than 500 (bit time).

After the communication frame is acquired in the processing step S303, the comparison process executed in the processing step S304 specifically proceeds as follows. The premise of the processing here is that the measurement IFG is confirmed to be smaller than the permissible IFG (500) corresponding to the destination address F13 by the processing in the processing step S302, and therefore the comparison processing executed in the processing step S304. Then, the allowable IFG (400) corresponding to the source address F14 is acquired from the allowable IFG list 200. As a result, when the measurement IFG of the source address F14 is smaller than the allowable IFG (400) corresponding to the source address F14, it corresponds to the type F15 (type) information and the payload part F16 (including higher level protocols such as Internet Protocol). The permissible IFG (200) to be acquired is acquired from the permissible IFG list 200, and the comparison processing with the type I15 (type) information and the measurement IFG of the payload portion F16 is sequentially executed.

If it is determined that the communication frame F1 is abnormal in the process of comparing the allowable IFG in the allowable IFG list 200 and the measurement IFG, the processing step S305 separates the FCS (F17) data at the end of the communication frame F1. Replace with the data. Thereby, the communication frame F1 can be discarded in the NIC of the control device E.

As described above, by sequentially comparing the allowable IFG list 200 and the data acquired from the communication frame F1 for each unit of the small frame constituting the communication frame F1, the DoS attack can be increased without storing the communication frame F1. Since the determination can be made with accuracy, the control device E can be resistant to DoS attacks without affecting its real-time processing.

In the second embodiment, some ideas for determining an allowable IFG for each small frame constituting the communication frame F1 will be described.

First, detailed specifications of the allowable IFG list 200 illustrated in FIG. 5 will be described. The minimum configuration of the allowable IFG list 200 includes two attributes of “data condition” and “allowable IFG”.

Of these, the data condition corresponds to data information of a communication frame, for example. In the case of the example of the allowable IFG list 200 shown in FIG. 5, the conditions of the destination address F13 and the source address F14 of the communication frame correspond to this. In other words, the destination address F13 and the source address F14, which are small frames after the preamble F11 and the SFD (F12), which are used to detect the reception of the communication frame F1, are the head part of the communication frame F1. Corresponds to the “data condition”.

On the other hand, the value (bit time) set in the “allowable IFG” should be determined in consideration of the system requirements and the processing performance of the apparatus. The communication control device T scans the communication frame F1 from the head by cut-through, and refers to the allowable IFG corresponding to the data condition attribute of the allowable IFG list 200 as soon as a small frame after the destination address F13 is acquired as necessary information. Then, the measurement IFG is compared. For this reason, the allowable IFG is determined according to the system requirements and the processing performance of the apparatus. This is because the criterion for determining a DoS attack depends on system specifications and device processing performance.

For example, in the case of a system specification that executes processing of 100 milliseconds when a certain control device E receives a communication frame F1 of a specific pattern, every time the communication frame F1 corresponding to the pattern is received, 100 milliseconds. Processing occurs. When such a communication frame is received with a frequency of 100 milliseconds or less, there is a risk that processing resources of the control device E are occupied and other processing is hindered.

In addition, the processing performance of the communication frame of the device will also be affected. For example, a communication frame processing platform used in an enterprise server has sufficient performance for processing a communication frame F1 of the order of several hundred Gbps. On the other hand, the control device E constituting the control system has limited resources in many cases, and often cannot process a communication frame F1 of 100 Mbps or more. That is, depending on the processing performance of the communication frame receiving terminal, a certain type of communication may or may not be a DoS attack.

Based on the above contents, the communication control device T of the present invention executes a process of dynamically updating the allowable IFG list according to the communication status and the processing performance of the device. For example, in the control device E, when the time related to processing of a certain communication frame F1 can be evaluated in advance, a DoS attack is detected by setting a value equal to or longer than the processing time as the allowable IFG in the data pattern of the communication frame, or There is a possibility that it can be avoided.

For example, when the communication frame F1 having the same data pattern received continuously during the processing of the target communication frame F1 arrives and the communication frame F1 is queued, the control device E is queued The communication frame F1 is processed, and processing resources are occupied.

In particular, in the case of a control system, it is not considered in a normal system design that a large amount of communication frames F1 that hinder the real-time property of the control device E in the system are received in a short time. The communication frame F1 can be regarded as a DoS attack. The above-described countermeasure in the present invention can cope with such a DoS attack.

FIG. 6a shows a case where the reception interval of the communication frame F1 is short and the measured average IFG is short. FIG. 6b shows the case where the average IFG is long. In the case as shown in FIG. 6a, it is preferable to set a shorter value (200, 150, etc.) than that in FIG. 5 as each allowable IFG registered in the allowable IFG list 200. In the case as shown in FIG. It is preferable to set a longer value (4000, 2500, etc.) than that in FIG. 5 as each allowable IFG registered in the allowable IFG list 200.

As an advantage of this measure, for example, depending on the state of a normal network that has not been attacked, there are cases in which the network becomes temporarily heavily loaded. In this case, in the case of a network that has not been attacked, the load increase is usually moderate.

On the other hand, since DoS attacks are artificial, a large number of communication frames are often generated instantaneously. That is, according to the above-described measures of the present invention, it is possible to automatically adjust the baseline of the allowable IFG when the system is temporarily heavily loaded, and the DoS attack misjudgment when the network is temporarily heavily loaded Can reduce the risk. In addition, since the optimum value of the allowable IFG is automatically applied according to the network, the work load at the time of setting can be reduced.

Specifically, for example, in a normal network state, when the allowable IFG has a value as shown in FIG. 5, a temporary high load state of the network is assumed in advance, and about 20% of these values are assumed. When it is determined that a gradual load increase is recognized, it is preferable that the allowable IFG value in FIG. 5 can be variably adjusted within this range. These adjustments are executed in the allowable IFG determination unit 205 in FIG. 1 or the processing step S307 in FIG.

In the third embodiment, a case where the control device E in the control system executes periodic processing will be described.

In many cases, the control device E in the control system periodically transmits and receives data. In particular, communication for real-time control is often periodic.

These communications often depend on the specifications of the system, and the processing resources of the control device E may be occupied for a certain period by receiving a specific communication frame F1. Such packets must always observe periodicity, and when communication that disturbs periodicity occurs, the periodicity of control of the entire system is disturbed, and as a result, the entire system may be down.

In order to detect communication that disturbs periodicity as a DoS attack, in the communication control apparatus T according to the third embodiment, after receiving a certain communication frame F1, an allowable IFG is set only for the communication frame F1 that may be received next. Set it and disable others.

Note that the setting for invalidating the corresponding communication frame F1 can be handled by setting a value equal to or greater than the cycle time (T _freq ) in the allowable IFG. An example of this is shown in FIG.

In the case of FIG. 7, the signal processed by the communication control device T according to the third embodiment of the present invention installed between the network NW and the control device E of FIG. 2 is periodically repeated every cycle time T _freq. Signal. In addition, in the period time T _freq , for example, communication is known to be received in advance in the order of the communication frame F1a, the communication frame F1b, the communication frame F1c, and the communication frame F1d. As for each example communication frame F1a as the communication frame, the communication frame F1a is the to be processed next, the period time T _freq there later, the relationship of the period is held similarly in other communication frame. However, the time between successive communication frames is arbitrarily set. Therefore, the IFG to be managed by the communication frame F1a is related to the communication frame F1a after one cycle, and is not the time between successive communication frames.

In the process of Example 3 From this, possess acceptable IFG list 200, all communication frames handled in the period time _{T freq} (communication frame F1a, communication frame F1b, communication frame F1c, a communication frame F1d) the allowable IFG about To do. The value of each allowable IFG in the allowable IFG list 200 is appropriately updated every time a communication frame is received.

In FIG. 7, the pattern P1 is the content of the allowable IFG list 200 after receiving the communication frame F1a, the pattern P2 is the content of the allowable IFG list 200 after receiving the communication frame F2b, and the pattern P3 is the allowable IFG list 200 after receiving the communication frame F1c. The contents are shown. According to this, after receiving the communication frame F1a, as shown in the pattern P1, only the communication frame F1b of the allowable IFG list 200 is set to a numerical value of T _freq or less, for example, 200, and other communication frames are set to T _freq . Shall. In this way, after the communication frame F1a has passed, only the communication frame F1b can be set to be permitted.

After receiving the communication frame F1b sets the allowable IFG communication frame F1c only _{T freq} following values as for example 300 in the list 200 as shown in the pattern P2, other communication frame shall be set to _{T freq.} By doing so, after the communication frame F1b passes, only the communication frame F1c can be set to be permitted.

Similarly, after receiving the communication frame F1c, as shown in the pattern P3, only the communication frame F1d of the allowable IFG list 200 sets, for example, 500 as a numerical value equal to or less than T _freq , and other communication frames set T _freq. And By doing so, after the communication frame F1c passes, only the communication frame F1d can be set to be permitted.

However, in periodic communication, for example, when there is a possibility of receiving the communication frame F1b or the communication frame F1c after receiving the communication frame F1a, both the communication frame F1b and the communication frame F1c in the allowable IFG list after receiving the communication frame F1a By setting a numerical value equal to or lower than T _freq to the allowable IFG, it is possible to cope with a case where any one of a plurality of received IFGs is received.

FIG. 8 shows an example in which a valid numerical value is set in the allowable IFG for both the communication frame F1b and the communication frame F1c in this case, and it is necessary to set a reception prohibition period of a certain time after receiving the communication frame F1a. In some cases, the reception prohibition period (400 bit time in the example of FIG. 8) is set as the allowable IFG of the communication frame F1c. With this measure, the communication control device T can finely control the next received communication frame F1 including its reception time, so that the DoS attack detection and defense accuracy can be improved.

In the fourth embodiment, a method will be described in which information on the reception frequency of communication frames is stored in the allowable IFG list 200 and used as a communication frame abnormality determination.

FIG. 9 shows an example of the allowable IFG list 200 including information on the reception frequency of the communication frame F1. The allowable IFG list 200 shown in FIG. 9 further includes information on allowable reception frequency as an attribute.

The permissible reception frequency is the number of received communication frames that can be determined that the communication frame is not abnormal with respect to a certain number of received communication frames. In other words, when the current communication frame reception frequency (hereinafter referred to as the current reception frequency) is larger than the allowable reception frequency, the communication frame is regarded as abnormal. The allowable reception frequency can be expressed in a format such as the number of communication frames received in 100 frames.

In the example of FIG. 9, the allowable reception frequencies (/ 100 frames) of the communication frames F1A, F1B, F1C, and F1D are set to 5, 10, 10, and 20. In the case of the communication frame F1A, the reception frequency is normal up to 5 times per 100 frames, and when the frequency exceeds 6 times, the communication frame F1A is regarded as abnormal.

FIG. 10 shows a part of the configuration of the communication control apparatus T having the allowable IFG list 200 having information on the allowable reception frequency.

The communication control device T in FIG. 10 counts the reception frequency for each communication frame data D2 received from the communication frame scanning unit 202 in addition to the configuration described in FIG. The communication frame statistics processing unit 206 that notifies the unit 203 is provided.

The abnormal communication frame determination unit 203 has a function of determining whether there is an abnormality in the communication frame including the reception frequency information of the communication frame, in addition to the function of the abnormal communication frame determination unit 203 of FIG.

FIG. 11 shows a flowchart in which the communication control device T according to the fourth embodiment determines the presence / absence of a communication frame including reception frequency information.

The process of the flowchart of FIG. 11 is basically the same as the process of FIG. 3 and is different only in that a reception frequency determination process step S310 is added.

In the flow of FIG. 11, both the measurement IFG comparison processing (processing step S304) and the reception frequency processing (processing step S310) are executed in parallel, and if any of them is determined to be abnormal (Y in processing step S304) Processing data discarding and alert generation processing (processing step S305) is executed in processing step S310 (N). If no abnormality is detected in the reception frequency process (Y in process step S310), the process proceeds to process step S307. If no abnormality is detected in the measurement IFG comparison process (N in process step S304), the process proceeds to process step S311. The process moves to a round process for small frames.

Through the processing described above, the communication control apparatus T according to the fourth embodiment illustrated in FIG. 10 can detect a DoS attack with higher accuracy than the communication control apparatus T illustrated in FIG.

Note that the application example of the present invention has been described by taking a communication frame conforming to IEEE 802.3 as an example, but the present invention is not limited to a communication frame conforming to IEEE 802.3, and can be applied to other communication protocols.

200: Allowable IFG list 201: IFG measurement unit 202: Communication frame scan unit 203: Abnormal communication frame determination unit 204: Network control unit 205: Allowable IFG determination unit 206: Communication frame statistics processing unit D: Communication data D1: IFG measurement value D2: Array data D3: Scan data D4: Update information F11: Preamble F12: SFD
F13: Destination address F14: Source address F15: Type
F16: Payload / upper protocol F17: FCS
F1, F2: Communication frame IF / 1: Input interface IF / 2: Output interface NW: Network T: Communication control device

Claims

While relaying a communication frame transmitted from the network to the control device, the communication frame is a communication control device composed of small frames according to a predetermined order,
The communication control device
An IFG measuring unit for measuring IFG of a communication frame;
A communication frame scanning unit that scans without storing communication frame data and obtains scan data and communication frame array data;
Based on the scan data of the current communication frame acquired by the communication frame scan unit, an allowable IFG determination unit that determines an allowable IFG of a communication frame to be received next;
An allowable IFG list for storing the allowable IFG obtained by the allowable IFG determination unit;
From the IFG measurement value acquired by the IFG measurement unit, the data of the arrangement of the small frames of the communication frame acquired by the communication frame scan unit, and the content of the allowable IFG list stored in the allowable IFG list, the communication frame is DoS. An abnormal communication frame determination unit that determines an attack, and
In accordance with the determination result of the abnormal communication frame determination unit, the communication control unit includes a network control unit that discards the communication frame or adds security information that means a warning to the communication frame and transmits the communication information to the control device.
The abnormal communication frame determination unit determines whether a communication frame is a DoS attack by comparing an allowable IFG stored in the allowable IFG list with an IFG measurement value.
The communication control device according to claim 1,
The abnormal communication frame determination unit determines whether a communication frame is a DoS attack by comparing an allowable IFG for each small frame stored in the allowable IFG list with an IFG measurement value.
The communication control device according to claim 1 or 2,
The allowable IFG determining unit determines an allowable IFG for each small frame of a communication frame to be received next based on scan data of a current communication frame acquired by the communication frame scanning unit. apparatus.
The communication control device according to any one of claims 1 to 3,
The communication frame composed of small frames according to a predetermined order includes a small frame for frame check at the subsequent stage, and the abnormal communication frame determination unit operates DoS by manipulating the data of the small frame. A communication control apparatus that notifies a subsequent control apparatus of an attack.
2. A plurality of types of communication frames are transmitted to the control device from the network via a communication control device, and the plurality of types of communication frames are transmitted while maintaining a predetermined control period. The communication control device according to any one of claims 1 to 4,
In the allowed IFG list, the allowed IFG list is prepared for each of the plurality of types of communication frames, and when the Nth communication frame is received within the predetermined control period, the N + 1th schedule is scheduled to arrive. A communication control apparatus, wherein only a communication frame scheduled to arrive at the (N + 1) th time can be processed by setting an allowable IFG only in the allowable IFG list of the communication frame.
The communication control device according to claim 5,
When a plurality of different communication frames are assumed as the communication frame scheduled to arrive at the (N + 1) th, the communication control is characterized in that an allowable IFG is set in the allowable IFG list of the plurality of different communication frames. apparatus.
The communication control device according to any one of claims 1 to 6,
The ratio of the number of receptions of the communication frame determined to be a DoS attack to the predetermined number of times is obtained, the ratio is compared with a preset allowable reception frequency, and the security information is added to the communication frame to the control device. A communication control device for transmitting.
A communication control method in a communication control apparatus configured to relay a communication frame to be transmitted from a network to a control apparatus, and the communication frame is composed of small frames according to a predetermined order,
If the IFG measurement value with the previously received communication frame is less than or equal to the threshold value, any data is extracted from the communication frame, checked against one or more rules based on the extracted data, and the result is And determining whether there is an abnormality in the communication frame and updating an arbitrary item in the rule list of one or more items related to the next communication frame.
The communication control method according to claim 8, comprising:
A communication control method characterized by extracting data from a communication frame by a cut-through method when extracting arbitrary data from the communication frame.
The communication control method according to claim 8 or 9, wherein
The rule list of one or more items includes a set of arbitrary data of a communication frame and an allowable IFG that corresponds to the arbitrary data of the communication frame and is an IFG value that determines that the communication frame is abnormal. A communication control method.
The communication control method according to claim 10, comprising:
Data is extracted sequentially using the cut-through method of communication frames, and the allowable IFG corresponding to the data obtained from the communication frames is sequentially verified based on a rule list of one or more items to determine whether there is an abnormality in the communication frame. A communication control method characterized by the above.
The communication control method according to claim 10 or 11,
A communication control method, comprising: comparing a measured IFG with an allowable IFG and determining an abnormality when the measured IFG is equal to or less than the allowable IFG as a method for determining whether there is an abnormality in the communication frame.
The communication control method according to any one of claims 10 to 12,
A communication control method, comprising: determining a network state from measured IFG or data extracted from a communication frame, and updating the contents of one or more rule lists according to the network state.
The communication control method according to claim 13, comprising:
When the average value of the measured IFG is high, when updating the contents of one or more rule lists, a high value is set as one or more allowable IFG values registered in the rule list, and the measured IFG A communication control method characterized by setting a low value as one or more permissible IFG values registered in the rule list when updating the contents of one or more rule lists when the average value is low.
The communication control method according to any one of claims 10 to 14,
When a device that receives a communication frame can grasp in advance the processing time required for processing the communication frame, the communication frame registered in the rule list is updated when updating the contents of one or more rule lists. A communication control method, wherein a numerical value equal to or greater than the processing time required for processing the communication frame is set as an allowable IFG value corresponding to.
The communication control method according to any one of claims 10 to 15,
After updating a periodically received communication frame, except for a data pattern of a communication frame that may be received next, when updating the contents of one or more rule lists, the one registered in the rule list A communication control method characterized in that, as one or more allowable IFG values, a numerical value of one or more periods of periodic communication is set as the allowable IFG.
The communication control method according to any one of claims 10 to 16, comprising:
As a rule list of one or more items, arbitrary data of a communication frame, an IFG value (allowable IFG) for determining that the communication frame is abnormal, corresponding to the arbitrary data of the communication frame, and a data pattern corresponding to the communication frame A communication control method characterized by including a set of a reception frequency value (allowable reception frequency) for determining that a communication frame is abnormal.
The communication control method according to claim 17, comprising:
A means for counting the communication frame reception frequency for each data pattern of the communication frame, and if the reception frequency of any communication frame exceeds the permitted reception frequency described in the rule list of one or more items, A communication control apparatus, characterized in that it is regarded as abnormal and warns the outside or discards the communication frame.
The communication control method according to any one of claims 10 to 18, comprising:
A communication control method characterized in that a communication frame format is a communication frame format conforming to IEEE 802.3, or a communication frame format similar to or derived from a communication frame format conforming to IEEE 802.3.
The communication control method according to any one of claims 10 to 19,
A communication control method characterized in that a process equivalent to a function connected by relay between a network and a terminal or executed by the communication control apparatus is executed in a network interface of the terminal.