JP5994265B2 - Security system and communication control method - Google Patents

Description

  The present invention relates to a security system and the like for ensuring the security of communication through a maintenance port of devices constituting a field control system.

  Some controller devices constituting the control system include a maintenance port by communication such as USB, Ethernet (registered trademark), RS232C or the like for maintenance. Normally, maintenance ports are used by maintenance personnel to acquire device status, change device parameters, update firmware, etc., and devices are accessed via the maintenance port while the control system is operating. In some cases.

JP 2007-148609 A

  In personal computers, security can be strengthened, for example, when communicating via Ethernet (registered trademark), but compared to this, maintenance support for controller equipment, etc. has sufficient security considerations. It cannot be said that it has been done. The controller device is stored in a dedicated cabinet and has a certain level of security, but there is a risk of malicious access.

  In recent years, the risk of cyber terrorism on control systems has increased, and the need to take security measures at the maintenance port of controller devices has also increased.

  In many cases, a large number of modules such as communication modules and I / O modules are installed for one controller device, and human errors such as accidental operation of other modules during maintenance The possibility cannot be excluded.

  An object of the present invention is to provide a security system or the like that can prevent unauthorized access via a maintenance port, misuse of devices to be operated, and the like.

The security system of the present invention is a security system that ensures security of communication through a maintenance port of a device constituting a field control system, a receiving unit that receives designation of the device from an external computer connected to the maintenance port; Blocking communication through the maintenance port of the device from the time of startup of the device and enabling the communication through the maintenance port of the device that has received the specification when the specification is received through the receiving means Control means, wherein the accepting means accepts an authentication code input via the external computer from the external computer, and the control means only when the authentication code takes a predetermined value. Communication through the maintenance port of the device And the possible state, the accepting unit may accept the designation and the authentication code of said device via another communication from the communication through the maintenance port from said external computer.
According to this security system, communication via the maintenance port of the device is blocked from the time the device is started, and communication via the maintenance port of the device that has received the designation is enabled, so unauthorized access via the maintenance port It is possible to prevent mistakes in the operation target devices.

  The reception unit and the control unit may be provided in a host device connected to the control network of the field control system with the device.

  A history storage unit that stores a reception history by the reception unit may be provided.

  When the state where communication through the maintenance port of the device can be continued for a certain period of time by the control unit, a notification unit that notifies the fact may be provided.

The communication control method of the present invention is a communication control method for ensuring the security of communication through a maintenance port of a device that constitutes a field control system, and a reception step of receiving designation of the device from an external computer connected to the maintenance port; The communication through the maintenance port of the device is interrupted from the time of activation of the device, and the communication through the maintenance port of the device that has received the specification is possible when the specification is received through the receiving step. A control step for setting a state, and in the accepting step, an authentication code input via the external computer is accepted from the external computer, and in the control step, the authentication code takes a predetermined value. Only if the The communication through the tenancy port is made possible, and in the receiving step, the designation of the device and the authentication code are received from the external computer through communication different from the communication through the maintenance port. .
According to this communication control method, communication via the maintenance port of the device is blocked from the time of startup of the device, and communication via the maintenance port of the device that has received the designation is enabled. It is possible to prevent misuse of devices to be accessed or operated.

  According to the security system of the present invention, communication through the maintenance port of the device is blocked from the time of startup of the device, and communication through the maintenance port of the device that has received the designation is enabled. Can be prevented from being mistakenly accessed or mistakenly operated.

  According to the communication control method of the present invention, the communication through the maintenance port of the device is cut off from the time of starting the device, and the communication through the maintenance port of the device that has received the designation is made possible. Unauthorized access and mix-up of devices to be operated can be prevented.

The block diagram which shows the structure of the field control system to which the security system of one Embodiment is applied. The flowchart which shows operation | movement of the security system of one Embodiment.

  Hereinafter, an embodiment of a security system according to the present invention will be described.

  FIG. 1 is a block diagram showing the configuration of a field control system to which the security system of this embodiment is applied.

  As shown in FIG. 1, the field control system includes a plurality of field controllers 10 (only one field controller 10 is shown in FIG. 1) distributed in the plant, and operations on the plant via the field controller 10. An operation monitoring device 20 for monitoring. The plurality of field controllers 10 and the operation monitoring device 20 are connected to each other by the control network 4. In addition, the operation monitoring device 20 is connected to a host device via the external network 5.

  A field controller 10 shown in FIG. 1 includes a communication module 11 having a communication function with a field device via the field network 1, a data input / output function with the operation monitoring apparatus 20, and other functions, and an I / O module. A module group having various functions such as 12, modules 13... Is mounted.

  The field controller 10 is provided with a maintenance port 10p, the communication module 11 with a maintenance port 11p, the I / O module 12 with a maintenance port 12p, and the module 13 with a maintenance port 13p.

  By connecting the external computer 3 to these maintenance ports, maintenance of each device can be performed. For example, the maintenance of the main body of the field controller 10 is connected by connecting the external computer 3 to the maintenance port 10p, the maintenance of the communication module 11 is connected by connecting the external computer 3 to the maintenance port 11p, and the external computer 3 is connected to the maintenance port 12p. The maintenance of the I / O module 12 can be performed by connecting, and the maintenance of the module 13 can be performed by connecting the external computer 3 to the maintenance port 13p. The purpose of the maintenance is to acquire the state of each device, change device parameters, update firmware, and the like.

  As shown in FIG. 1, the operation monitoring device 20 receives a designation of a specific device from the external computer 3, and the maintenance port of the specific device when the designation is received via the reception unit 21. And a storage unit 23 for storing a history of information such as the designation received through the receiving unit 21.

  The external computer 3 and the operation monitoring device 20 are provided with a communication function by wireless communication or the like, and by this communication function, information necessary for starting and ending maintenance can be transmitted from the external computer 3 to the operation monitoring device 20. it can.

  Next, the operation of the security system of this embodiment will be described.

  When maintenance is performed on a specific device, the maintenance staff via the external computer 3, a predetermined authentication code, designation information for designating the device to be maintained, and a command to open the maintenance port of the device Is transmitted to the operation monitoring apparatus 20. In response to this, when the maintenance port of the device to be maintained is opened, the maintenance staff can connect the external computer 3 and the device to be maintained via the maintenance port to perform necessary maintenance. After the maintenance is completed, the maintenance staff transmits a command to close the maintenance port of the device to the operation monitoring apparatus 20. In response to this, the maintenance port is closed, and thereafter, the device cannot be operated via the maintenance port, and the security of the device is ensured.

  Steps S1 to S8 and Steps S11 to S12 in FIG. 2 are flowcharts showing operations related to the present invention executed in the operation monitoring device 20.

  Steps S <b> 1 to S <b> 8 in FIG. 2 indicate processing for controlling opening / closing of the maintenance port and time measurement by a timer, and this processing is executed in response to an access or instruction from the external computer 3.

  When the connection from the external computer 3 is confirmed, in step S1 in FIG. 2, the accepting means 21 determines whether the user of the external computer 3 has system authority based on the authentication code transmitted from the external computer 3. The process proceeds to step S2 after waiting for a positive determination. In step S1, the accepting means 21 can determine the presence or absence of system authority based on whether or not the authentication code is correct (takes a predetermined value).

  Next, in step S <b> 2, the accepting unit 21 accepts the received command and stores the command in the storage unit 23 in association with the received designation information. Thereby, the history of the received command is recorded.

  Next, in step S3, the control means 22 determines whether or not the command received by the receiving means 21 in step S2 instructs to open the maintenance port. If the determination is affirmed, the process proceeds to step S4. If the determination is negative, the process proceeds to step S6.

  In step S4, the control means 22 issues and transmits an instruction to open the maintenance port via the control network 4 to the device indicated by the received designation information. For example, when the device indicated by the designation information is the communication module 11, the instruction is transmitted via the control network 4 and reaches the communication module 11 via the field controller 10. When the device indicated by the designation information is the main body of the field controller 10, the instruction reaches the main body of the field controller 10 via the control network 4.

  Next, in step S5, a timer indicating a time during which the maintenance port of the device indicated by the designation information is continuously opened is started, and the process returns to step S2.

  On the other hand, in step S6, the control unit 22 determines whether or not the command received by the receiving unit 21 in step S2 instructs to close the maintenance port. If the determination is affirmed, the process proceeds to step S7. If NO is determined, the process returns to step S3.

  In step S <b> 7, the control means 22 issues and transmits an instruction to close the maintenance port via the control network 4 to the device indicated by the received designation information. For example, when the device indicated by the designation information is the communication module 11, the instruction is transmitted via the control network 4 and reaches the communication module 11 via the field controller 10. When the device indicated by the designation information is the main body of the field controller 10, the instruction reaches the main body of the field controller 10 via the control network 4.

  Next, in step S8, the timer is stopped to reset timekeeping, and the process returns to step S1.

  Steps S11 to S12 in FIG. 2 show processing for monitoring the time during which the maintenance port of the device is continuously opened using the timer.

  The operation monitoring device 20 determines whether or not the time measured by the timer exceeds a predetermined set time in step S11, waits for a positive determination, and then proceeds to step S12. In step S12, the operation monitoring device 20 issues an alarm indicating that the maintenance port of the specific device is continuously open for a certain time (set time in step S11), and returns to step S11.

  The timer is prepared for each device having a maintenance port, and in the monitoring process by the timer (steps S11 to S12), when the maintenance port of any device is continuously opened for a certain time or more, Another alarm (step S12) is issued for each device.

  Steps S21 to S24 in FIG. 2 are flowcharts showing operations after activation of each field controller 10 and each module (communication module 11, I / O module 12, module 13, etc.).

  In step S21 of FIG. 2, at the time of activation, the maintenance port gate is closed and communication via the maintenance port is interrupted.

  Next, in step S22, it is determined whether an instruction to open the maintenance port issued by the operation monitoring device 20 (step S4) is received. If the determination is affirmative, the process proceeds to step S23, and the determination is denied. Then, the process returns to step S21.

  In step S23, the maintenance port gate is opened to enable communication via the maintenance port. As a result, the maintenance staff can connect the external computer 3 and the device via the maintenance port and perform necessary maintenance. Note that the form of communication via the maintenance port is arbitrary, and Ethernet (registered trademark), RS232C, USB, infrared communication, or the like can be used.

  Next, in step S24, the process returns to step S21 after waiting for an instruction to close the maintenance port issued by the operation monitoring device 20 (step S7). As a result, subsequent operations through the maintenance port become impossible, and the security of the device is ensured.

  As described above, according to the security system of the present embodiment, the maintenance port of the device configuring the field control system is shut off from the time of startup of the device, and the maintenance port is opened only for the time required for maintenance. Access and careless access can be effectively suppressed.

  Also, only a person with maintenance authority can open the maintenance port, and an unauthorized person does not know the authentication code or the procedure for opening the maintenance port. In addition, operations on the operation monitoring device 20 from the external computer 3 remain as a history, and can be used for subsequent management. For this reason, it is possible to effectively prevent an unauthorized person from accessing the device or maliciously accessing the device.

  Further, only the maintenance port of the device to be maintained is opened based on a command from the external computer 3, and the maintenance ports of the other devices are kept in a blocked state. For this reason, it is possible to prevent a human error in which a maintenance staff mistakenly connects the external computer 3 to the maintenance port of another device and executes an unnecessary operation on the other device without intention.

  Furthermore, since an alarm is issued when the maintenance port remains open for a certain period of time or longer, forgetting to close the maintenance port after the maintenance is completed can be prevented.

  The opening and closing of the maintenance port in each device is not limited to a hardware method using a switch or the like, and whether to communicate via the maintenance port may be switched by software processing.

  Further, the method of instructing the opening / closing of the maintenance port for each device from the operation monitoring device 20 (step S4, step S7) is arbitrary. For example, the command code and instruction content (maintenance port) to be transmitted from the operation monitoring device 20 May be previously associated with each other.

  In addition, the form of an alarm when the communicable state via the maintenance port continues for a certain time or longer is arbitrary. For example, a method of displaying an error message on the monitoring screen of the operation monitoring device 20 or sounding a buzzer Can take.

  Further, the method for authenticating the user of the external computer 3 is arbitrary, and various authentication methods can be applied.

  The scope of application of the present invention is not limited to the above embodiment. The present invention can be widely applied to a security system that ensures security of communication via a maintenance port of devices constituting a field control system.

3 External computer 10 Field controller (equipment)
11 Communication module (equipment)
12 I / O modules (equipment)
13 modules (equipment)
20 Operation monitoring device (host device, notification means)
21 Accepting means (history saving means)
22 Control means 23 Storage section (history saving means)

Claims (5)

In a security system that ensures the security of communication through the maintenance port of the devices that make up the field control system,
Accepting means for accepting designation of the device from an external computer connected to the maintenance port;
A state in which communication via the maintenance port of the device is interrupted from the time of activation of the device, and communication via the maintenance port of the device that has accepted the designation is possible when the designation is accepted via the accepting unit. And control means
With
The accepting means accepts an authentication code input via the external computer from the external computer,
The control means enables communication via the maintenance port of the device only when the authentication code takes a predetermined value .
The security system , wherein the accepting unit accepts the designation of the device and the authentication code from the external computer via communication different from communication via the maintenance port .   The security system according to claim 1, wherein the reception unit and the control unit are provided in a host device connected to the control network of the field control system between the device and the device.   The security system according to claim 1, further comprising: a history storage unit that stores a reception history by the reception unit.   The information processing apparatus according to any one of claims 1 to 3, further comprising a notification means for notifying that when the control means continues to be able to communicate via the maintenance port of the device for a certain period of time. The security system described. In the communication control method for ensuring the security of communication through the maintenance port of the equipment constituting the field control system,
An accepting step of accepting designation of the device from an external computer connected to the maintenance port;
A state in which communication via the maintenance port of the device is cut off from the time of activation of the device and communication via the maintenance port of the device accepting the designation is possible when the designation is accepted through the accepting step. And a control step
The computer runs,
In the reception step, an authentication code input via the external computer is received from the external computer,
In the control step, only when the authentication code takes a predetermined value, the communication through the maintenance port of the device is enabled ,
The communication control method according to claim 1, wherein in the receiving step, the designation of the device and the authentication code are received from the external computer via a communication different from the communication via the maintenance port .

Images