Control device, unauthorized command detection method, and program
The present invention aims to provide a control device that reduces load and can provide early detection of program tampering. A main storage unit 102 stores a main application 107 and illegal command information 108 . The main application 107 is an extension program in which target commands, which are at least some of the commands included in a prescribed program, have been converted into extension commands. The illegal command information 108 indicates the target commands. A command monitoring unit 104 : compares executed commands, which are commands that have been executed by the CPU 103 , and target commands, which are indicated in the illegal command information 108 ; and determines whether or not an executed command is an illegal command, based on the comparison results.
1 . A control device comprising:
a processor;
a memory that stores an extension program executed by the processor and unauthorized command information indicating a target command that is at least a part of commands included in a predetermined program, the extension program being obtained by converting the target command into an extension command; and
a command monitoring circuit that compares an execution command that is a command executed by the processor with the target command indicated by the unauthorized command information, and determines whether or not the execution command is an unauthorized command based on the comparison result, wherein
the command monitoring circuit includes one or more command comparison circuits, each including a plurality of hardware comparators configured to compare bit values at fixed bit positions of a feature portion of the execution command with corresponding bit values at fixed bit positions of a feature portion of the target command, and a logic circuit configured to output an abnormality detection signal when all compared bit values match, and
the command monitoring circuit is configured such that, in response to output of the abnormality detection signal, an output control circuit of the control device is forcibly caused to stop output of the processor, wherein the comparison is performed for each execution command during execution of the extension program without recording or comparing behavior patterns, thereby providing early-stage unauthorized command detection in real-time
operation and reducing processing load, and wherein the comparison is limited to bit positions designating a calculation method of the command, and an output of the processor is forcibly stopped before execution output is transmitted, when those calculation-method bits fully match the target command, wherein
the target command includes a command conforming to a predetermined determination condition among the commands included in the predetermined program, and
the determination condition includes a condition related to a use frequency of each command in the predetermined program.
2 . The control device according to claim 1 , wherein the processor has an extended configuration for processing the extension command as a command equivalent to the target command.
3 . The control device according to claim 2 , wherein
the extension command is created based on the target command, and
the processor is designed based on the extension command.
4 . The control device according to claim 1 , wherein the command monitoring circuit includes a command comparison circuit that includes a comparator that compares specified bit ranges in feature portions having different values between the target command and the extension command in the execution command and the target command.
5 . The control device according to claim 1 , wherein the command monitoring circuit includes
a plurality of comparators that compare specified bit ranges of portions different from each other between the execution command and the target command, and
a selection circuit that selects a comparator associated with determining whether or not the execution command is the unauthorized command from among the plurality of comparators in accordance with a type of the target command.
6 . The control device according to claim 1 , wherein the command monitoring circuit is provided inside the processor.
7 . The control device according to claim 1 , wherein the command monitoring circuit uses the abnormality detection signal to stop an output of the processor in a case where the execution command is the unauthorized command.
8 . The control device according to claim 1 , wherein the extension program is a program for controlling an autonomous body.
9 . An unauthorized command detection method by a control device that includes a processor and a memory that stores an extension program executed by the
processor and unauthorized command information indicating a target command that is at least a part of commands included in a predetermined program, the extension program being obtained by converting the target command into an extension command, the method comprising:
comparing execution command information indicating an execution command that is a command executed by the processor with the unauthorized command information; and
determining whether or not the execution command is an unauthorized command based on the comparison result, wherein
the comparing includes comparing, using a plurality of hardware comparators, bit values at fixed bit positions of a feature portion of the execution command with corresponding bit values at fixed bit positions of a feature portion of the target command,
outputting an abnormality detection signal when all compared bit values match, and
forcibly stopping output of the processor by an output controller of the control device in response to the abnormality detection signal, wherein the comparing and stopping are performed for each execution command during execution of the extension program without recording or comparing behavior patterns, thereby providing early-stage unauthorized command detection in real-time operation and reducing processing load, and wherein the comparison is limited to bit positions designating a calculation method of the command, and an output of the processor is forcibly stopped before execution output is transmitted, when those calculation-method bits fully match the target command, wherein
the target command includes a command conforming to a predetermined determination condition among the commands included in the predetermined program, and
the determination condition includes a condition related to a use frequency of each command in the predetermined program.
10 . A non transitory computer readable storage program storing instructions, which when executed by a processor execute the unauthorized command detection method according to claim 9 .