JP7680946B2 - Industrial network system, network management method, and network service providing system - Google Patents

Description

The present invention relates to an industrial network system, a network management method, and a network service providing system, and is suitable for application to an industrial network system, a network management method, and a network service providing system that connects an OT network and an IT network.

In recent years, with the advancement of digital transformation (DX), there is a demand for network systems that connect on-site OT (Operational Technology) networks with OA (Office Automation) IT (Information Technology) networks, even at production sites such as factories.

For example, Patent Document 1 discloses a technology for a hot forging press equipped with a press body, a programmable logic controller (PLC) that holds an operation pattern program for the press body and sequentially controls the press body in accordance with the program, and a wireless communication device that connects the PLC to a network via a public wireless communication line, whereby the operation pattern program held in the PLC is updated by remote control from a maintenance terminal connected to the network.

JP 2013-22626 A

While it has traditionally been the norm for IT networks to be constructed by information systems departments in a way that conforms to security policies, there have been cases where factory sites did not initially consider networking, or the operating systems (OS) of devices and equipment were old and not supported, making it difficult to conform to the same security policies as IT networks. For this reason, in network systems that connect OT and IT networks, it is now necessary to physically separate and manage the two networks.

Here, in factories and the like, IT devices and OT devices are often installed together, and when separating the IT network from the OT network, it is necessary to determine whether each device is on the OT side or the IT side. For example, when realizing with a wired connection, it is necessary to determine and separate each cable, which is very cumbersome. Also, for example, when realizing with a wireless connection using a wireless LAN or the like specified in the IEEE 802.11 series, it is difficult to determine which device has joined the network, so stronger defense measures are required to prevent spoofing, etc. As a strong defense measure, for example, it is necessary to install a firewall at the boundary between the OT network and the IT network, and it is also necessary to install a firewall between each switch in a conventional OT network with a low security level, which is very costly and makes it difficult to build a practical network.

The conventional technology disclosed in Patent Document 1 connects to a network from a wireless communication device on the PLC side via an external public wireless communication line, but since no particular consideration is given to ensuring security at the connection point to the IT network and within the OT network, it was unable to solve the above-mentioned problem.

The present invention has been made in consideration of the above points, and aims to propose an industrial network system, a network management method, and a network service provision system that can build a network in which an OT network and an IT network are connected while ensuring security in the OT network.

In order to solve this problem, the present invention provides an industrial network system in which a plurality of local area networks are constructed separately, the industrial network system comprising: a first local area network to which a first electronic device is connected under a mobile closed network capable of monitoring communications passing through the first local area network; a second local area network constructed separately from the first local area network and to which a second electronic device is connected; and a specified closed network connecting the first local area network and the second local area network, the first local area network being connected to the specified closed network by the mobile closed network, and the industrial network system being configured such that communications by the first electronic device, whether communications with another first electronic device in the first local area network or communications with the second electronic device, pass through the mobile closed network and do not go outside the specified closed network.

To solve this problem, the present invention provides a network management method for an industrial network system in which a plurality of local area networks are constructed separately, the industrial network system having a first local area network to which a first electronic device is connected under a mobile closed network capable of monitoring communications passing through the industrial network system, a second local area network constructed separately from the first local area network and to which a second electronic device is connected, and a predetermined closed network connecting the first local area network and the second local area network, the first local area network being connected to the predetermined closed network by the mobile closed network, and the network management method is configured so that communications by the first electronic device, whether communications with another first electronic device in the first local area network or communications with the second electronic device, pass through the mobile closed network and do not go outside the predetermined closed network.

In order to solve the above problem, the present invention provides a network service providing system that provides a network service that constructs a first local area network used by a customer within a specified closed network, the network service comprising a mobile closed network that is connected to the specified closed network and capable of monitoring communications passing through it, and a second local area network that is connected to the specified closed network and constructed separately from the first local area network, and when providing the network service to the customer, the first local area network is connected to the mobile closed network, and the network service providing system is configured so that communications by electronic devices connected to the first local area network, whether communications with other electronic devices in the first local area network or communications with electronic devices in the second local area network, pass through the mobile closed network and do not go outside the specified closed network.

According to the present invention, it is possible to build and provide an industrial network in which an OT network and an IT network are connected while ensuring security in the OT network.

1 is a diagram illustrating an example of a configuration of an industrial network system 100 according to a first embodiment of the present invention. FIG. 2 is a block diagram showing an example of a hardware configuration of a centralized management device 31. FIG. 11 is a diagram illustrating an example of a configuration of an industrial network system 200 according to a second embodiment of the present invention. FIG. 13 is a diagram illustrating an example of a configuration of an industrial network system 300 according to a third embodiment of the present invention.

The following describes an embodiment of the present invention in detail with reference to the drawings.

In the following, as an example of an industrial network system in which multiple local area networks (OT network, IT network) are constructed separately, each embodiment will be described assuming a case in which an IT network is constructed in the office area of a production facility and an OT network is constructed in the production area of the production facility, isolated from the IT network, in a wide area network (global WAN 40) service used throughout a single company. However, the application of the industrial network system according to the present invention is not limited to this, and it can be applied to all network services in which a specific local area network (OT network) is constructed separately. Specifically, for example, the present invention can be applied to a service provision system in which a service provider that provides a closed network provides an industrial network system according to each embodiment to a customer who requires a secure OT network. In this case, the production area described in each embodiment corresponds to the customer's environment, and the head office area (and office area) corresponds to the service provider's environment.

(1) First Embodiment FIG. 1 is a diagram showing an example of the configuration of an industrial network system 100 according to a first embodiment of the present invention.

As mentioned above in the "Problem to be solved by the invention," in factories and other places where IT and OT devices may be installed together, if the OT network is wired, handling of cables during placement and switching becomes cumbersome, so there is a high demand for wireless connections. On the other hand, simply building an OT network using a conventional wireless network has the problem of high costs due to the need to prevent spoofing and respond when malware occurs. Therefore, in the first embodiment of the present invention, and the second and third embodiments described below, an OT network is built using wireless connections while ensuring security.

In the industrial network system 100 shown in FIG. 1, the production facility 1 includes one or more production areas 10 in which an OT network is constructed, and one or more office areas 20 in which an IT network is constructed. Although only one production facility 1 is shown in FIG. 1, there may be multiple production facilities 1. Note that the production area 10 and office area 20 shown in FIG. 1 (and FIG. 3 and FIG. 4 described later) are areas classified based on the type of network (OT network, IT network) and the electronic devices connected to the network, and the locations where the electronic devices are installed in each area do not necessarily need to be physically separated. The head office area 30 is an example of a management area that handles the management function for the industrial network system 100, and is where the core network of the industrial network system 100 is constructed.

In the first embodiment, each network constructed in the production area 10, the office area 20, and the head office area 30, as well as the external network 50, are connected to other networks via a global WAN 40. The external network 50 is, for example, the Internet, and can be connected to a cloud 60, etc., as shown in FIG. 1. For example, by linking with the cloud 60 via the external network 50, the customer can configure a data lake 61 that manages quality information such as inspection data and manufacturing data generated at the customer's production facility 1.

First, let us explain the production area 10 in detail.

In FIG. 1, one production area 10 means one segment. In this explanation, a "segment" is a division for separating and managing communication ranges, and an OT network is constructed for each segment. Then, as will be described in detail later, different segments (i.e., OT networks) are managed by a centralized management device 31 so that direct communication is not possible between them. Specifically, the allocation of segments can be, for example, by building or by department, but is not limited to these, and can be done by any classification, such as by product or process.

As shown in FIG. 1, in each production area 10 (each segment), one or more devices 11 are connected to the nearest 5G terminal 13 via a wired LAN.

The device 11 is, for example, an electronic device such as a manufacturing device or quality control device used in the production area 10, and is an OT device connected to the OT network in the production area 10. A SIM (Subscriber Identity Module) is built into the device 11 in order to assign a different IP address to each device. The SIM built into the device 11 may be an eSIM that allows information to be written (or rewritten) remotely. When an eSIM is built into the device 11, the centralized management device 31 described later allows the IP address assigned to the eSIM to be written (or rewritten). The inspection device 12 is an example of a device that does not have a network communication function, and does not need to be built into such an inspection device 12, and is connected to the OT network via the device 11.

The 5G terminal 13 is one of the communication devices in the mobile closed network 70 constructed to cover the production area 10, and has a communication function via a 5G line (a function for wireless communication in a frequency band for 5G). The 5G terminal 13 exchanges transmission and reception packets of communication by one or more devices 11 installed nearby with the base station 14 by performing 5G communication with a 5G-compatible base station 14 installed in the same segment in the mobile closed network 70. Note that, as a modified example of the configuration in FIG. 1, some or all of the devices 11 may be configured to have the function as a 5G terminal.

The base station 14 is a base station that has the function of performing 5G communication with the 5G terminal 13 within the mobile closed network 70, and in the first embodiment, one base station is installed per segment (production area 10). Furthermore, the base station 14 is wired connected to the global WAN 40 via a gateway 15 in the same segment. Although not shown in FIG. 1 (and FIGS. 3 and 4 described below), an L3 switch or the like may be installed instead of or in addition to the gateway 15.

As mentioned above, the production area 10 is covered by the mobile closed network 70. In particular, in the first embodiment, the mobile closed network 70 has multiple devices 11 under its control in segments, and is connected to the global WAN 40 via a firewall 80 installed for each segment.

The mobile closed network 70 is a core network constructed independently by the telecommunications carrier, and allows communication between the devices 11 connected thereto without passing through an external network. The mobile closed network 70 is a secure network that does not accept access from any device other than that of a customer who has contracted for the industrial network system 100 service (devices in the production area 10, office area 20, and head office area 30). The mobile closed network 70 may be provided by a network service provider who rents it from the telecommunications carrier. The mobile closed network 70 is physically or logically separated (isolated) from the outside, and all communications passing through the mobile closed network 70 are monitored according to specifications.

In the following description, the mobile closed network 70 is described as a local 5G network, which is one of the carrier wireless communication networks. However, the mobile closed network 70 used to construct the OT network in the present invention is not limited to a local 5G network, and may be another carrier wireless communication network. Specific examples include a private LTE network. When the mobile closed network 70 is a private LTE network, the "5G terminal 13" is replaced with an LTE terminal having an LTE (4G) communication function, and the "base station 14" having a 5G communication function is replaced with a base station having an LTE communication function.

A local 5G network is a dedicated network in a limited local environment where a network of a fifth-generation mobile communication system (5G network) is deployed, and is characterized by ultra-high speed and ultra-low latency compared to wireless LAN networks that are widely used as wireless networks, and by the ability to connect multiple devices simultaneously. A private LTE (Long Term Evolution) network is a dedicated network in a limited local environment where an LTE network is deployed, and is characterized by high speed and low latency compared to wireless LAN networks, and by the ability to connect multiple devices simultaneously. A private LTE network is characterized by a wide coverage area per base station 14 and inexpensive network services, although it is inferior in communication speed and latency performance compared to a local 5G network.

As a result of the above configuration, the OT network in the production area 10 in the first embodiment is closed off by the mobile closed network 70 for each segment, and is connected to the global WAN 40 by one route per segment. However, since the security level of an OT network is generally lower than that of an IT network, it is preferable to install a firewall to increase the security level (for example, to prevent malware from spreading in an IT network to which a high security policy is applied). In this case, the firewall may be installed at the point (boundary) where the OT network connects to the global WAN 40. In other words, in the first embodiment, the connection route between the OT network and the global WAN 40 is limited to one per segment, so that the firewall 80 may be installed at one location per segment.

Next, we will explain the office area 20 and the head office area 30.

In the office area 20, an IT network using general wired connections is constructed. Specifically, for example, one or more devices 21 are connected to a hub 23 via a wired LAN, and the hub 23 is wired to a global WAN 40 via a gateway 24 or an L3 switch (not shown). The devices 21 are electronic devices that have been put into OA (Office Automation), and are IT devices that are connected to the IT network in the office area 20. The IT network in the office area 20 can be considered a known IT network, and is operated in accordance with a security policy appropriately formulated by the information systems department.

In the head office area 30, as in the administrative area, a centralized management device 31 and an administrator terminal 32 connected to an internal network are wired from a hub 33 to a global WAN 40 via a gateway 34 and an L3 switch (not shown).

The centralized management device 31 is an information processing device having a centralized management function that performs centralized management of communications for each device (e.g., each device 11 in the OT network) that communicates via the mobile closed network 70, and is realized by a server or the like on which dedicated management software (management software 317 shown in FIG. 2) runs. The centralized management device 31 monitors all communications that pass through the mobile closed network 70 by executing the management software. Specifically, for example, the centralized management device 31 uses a SIM embedded in the device 11 in the production area 10 as an authentication device for connection to the OT network. Also, for example, the centralized management device 31 identifies and manages devices that communicate via the mobile closed network 70 based on the IP address assigned to each device in each area.

The administrator terminal 32 is a terminal operated by an administrator who monitors and manages communications, and the centralized management function of the centralized management device 31 can be executed by operating the administrator terminal 32.

Figure 2 is a block diagram showing an example of the hardware configuration of the centralized management device 31. As shown in Figure 2, the centralized management device 31 has a processor 311, a storage device 312, an input device 313, an output device 314, and a communication interface (communication IF) 315. The processor 311, the storage device 312, the input device 313, the output device 314, and the communication IF 315 are connected by a bus 316, which is an internal communication line.

The processor 311 is a processor that controls the centralized management device 31, and is, for example, a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The storage device 312 is a device that provides a working area for the processor 311, and is a non-temporary or temporary recording medium that stores various programs (for example, the management software 317) and data. The storage device 312 is, for example, a read only memory (ROM), a random access memory (RAM), a hard disk drive (HDD), or a flash memory. The storage device 312 does not necessarily have to be a recording medium mounted inside the centralized management device 31, and may be configured such that some or all of the various programs and data are stored outside (for example, the cloud 60) where security is sufficiently ensured. The centralized management function of the centralized management device 31 is realized by the processor 311 reading and executing the management software 317. The input device 313 is a device for inputting data, and is, for example, a keyboard, a mouse, a touch panel, a numeric keypad, a scanner, a microphone, or a biosensor. The output device 314 is a device for outputting data, and specifically, for example, a display, a printer, or a speaker. The communication IF 315 is an interface that connects to a network and transmits and receives data to and from the outside of the centralized management device 31, and specifically, for example, a network interface card (NIC).

The global WAN 40 is a wide area network (WAN) that the client company uses across multiple bases, and communication between the production area 10, office area 20, and head office area 30 and the external network 50 is always carried out via the global WAN 40. The global WAN 40 is a wide area communication network that is connected only to those involved in the client's organization, and is a type of closed network.

In the industrial network system 100 of this embodiment having the above configuration, communication between each device 11 in the OT network (production area 10) is configured to always return via the mobile closed network 70 (return communication within the closed network). By realizing return communication within the closed network, peer-to-peer (P2P) communication can be eliminated, and all communication within the OT network can be monitored by the mobile closed network 70.

In addition, in the industrial network system 100, communication between each device 11 in the OT network (production area 10) and each device 21 in the IT network (office area 20) is always performed via the mobile closed network 70 and within the global WAN 40. This configuration makes it possible to limit the connection points between the OT network and the IT network.

Here, when monitoring communications within an OT network, it is necessary to be able to identify the OT device (device 11) connected to the OT network.

To achieve this, first, a SIM is built into each device 11 that will connect to the OT network, and a different IP address is assigned to the SIM for each device. By using this SIM as an authentication device, only devices 11 equipped with an authentication device issued, distributed, or written by an administrator can join the OT network. In other words, since only devices approved by SIM authentication of device 11 can connect to the OT network, simply procuring a device will not allow it to connect to the OT network, preventing spoofing.

The centralized management device 31 manages the IP addresses assigned to the SIM of each device 11 by registering them in an IP address allocation table. Furthermore, the centralized management device 31 manages the IP addresses of each device 11 by dividing them into segments using the IP addresses assigned to the SIM of each device 11. The centralized management device 31 then controls so that IP communication (opposite communication) is possible between devices 11 in the same segment.

The method of allocating and managing IP addresses and segments by the centralized management device 31 is not limited to a specific method, and various known methods may be adopted. As an allocation method, for example, an IP address allocation range may be set for each segment, and an IP address for the segment belonging to each device 11 may be allocated. In this case, IP addresses may be automatically allocated within the IP address allocation range set for each segment. As a management method, for example, a segment management table that manages the IP address allocation range for each segment may be stored separately from the IP address allocation table, or segment allocation information may be added to and stored in the IP address allocation table.

As mentioned above, the unit for allocating segments can be determined appropriately according to the operational environment, and may be by building, department, product, process, etc. For example, if the segments allocated to devices 11 are divided by product, even devices 11 that are physically located next to each other will be in different segments if they are for different products, and communication between devices 11 can be managed by segment without being subject to physical constraints.

As described above, in the industrial network system 100 according to this embodiment, the mobile closed network 70 is placed between the OT network and the IT network, and communication not only between the OT network and the IT network, but also within the OT network must go through the mobile closed network 70, so that the OT network and the IT network can be constructed safely and separately. Furthermore, by incorporating a SIM into the device 11 in the OT network and managing the IP address assigned to the SIM and the segment to which the IP address belongs using the centralized management function of the centralized management device 31, communication in the OT network can be monitored individually for each device, and a secure OT network can be realized.

In addition, the industrial network system 100 utilizes 5G communications, which are ultra-fast and have ultra-low latency compared to conventional wireless communications, in the OT network, thereby significantly improving the communication performance of the OT network.

In addition, the centralized management device 31 centrally manages the communications of OT devices (devices 11) connected to the OT network using the mobile closed network 70. If any of the devices 11 becomes infected with malware, the IP address assigned to the SIM of that device 11 can be changed to an IP address that is not approved by SIM authentication, making it easy to disconnect each device individually from the OT network.

As another isolation method, the centralized management device 31 may temporarily disable communication with the IP address assigned to the segment to which the malware-infected device 11 belongs, either alone or prior to the above isolation method. Disabling communication on a segment-by-segment basis not only prevents the spread of malware from the OT network to other networks (such as the IT network in the office area 20 or the core network in the head office area 30), but also prevents the spread of malware between devices within the OT network.

In addition, when the target devices within a segment are replaced due to the rearrangement of devices 11 at the production site, the centralized management device 31 assigns an IP address belonging to that segment to the device 11 newly placed in the segment, and changes the IP address of the device 11 that is leaving the segment to one other than the one belonging to the segment, thereby enabling a secure OT network to be built immediately in response to the rearrangement.

As described above with respect to the firewall 80, in this embodiment, the connection path between the OT network and the global WAN 40 is limited to one per segment, so that the firewall 80 only needs to be installed at one location per segment. In this case, the number of firewalls 80 required can be significantly reduced compared to a configuration in which a firewall 80 or equivalent security device must be installed in each device 11, which not only reduces the installation effort but also allows security investments and security monitoring points to be concentrated. As a result, the security of the entire industrial network system 100 can be improved while the costs required for network construction can be reduced.

(2) Second embodiment Fig. 3 is a diagram showing an example of the configuration of an industrial network system 200 according to a second embodiment of the present invention. Note that in the second embodiment, the configuration is the same as that of the first embodiment, except for the internal configuration in the production area 10 and the connection configuration between the OT network in the production area 10 and the global WAN 40. Therefore, the same reference numerals are used for the common configuration, and the description thereof will be omitted. This also applies to the third embodiment described later.

As shown in FIG. 3, in the industrial network system 200, the production area 10 in which the OT network is constructed is managed in segments as in the first embodiment. However, the mobile closed network 70 in the second embodiment connects each OT network (the equipment 11 in the production area 10) to the global WAN 40 in a wider area unit than in the first embodiment. In FIG. 3, as an example of this wider area unit, the mobile closed network 70 is shown covering the entirety of multiple production areas 10, but this is not limited thereto, and for example, it may cover the entirety of the production facility 1. Considering the expansion of the coverage area in this way, it is also assumed that the mobile closed network 70 in the second embodiment is preferably a private LTE network rather than a local 5G network.

As described above, in the second embodiment, since the OT network and the global WAN 40 are connected on a wide-area basis, a set of base stations 14 and gateways 15 (including L3 switches, etc.) is installed in multiple production areas 10 (or the entire production facility 1) rather than for each segment. That is, in the second embodiment, the route from the equipment 11 in the production area 10 to the global WAN 40 is various routes until it passes through the nearest 5G terminal 13, but thereafter the route from the base station 14 to the gateway 15 is limited to one.

In the industrial network system 200, as in the first embodiment, communication between devices 11 in the OT network (production area 10), and communication between devices 11 in the OT network and devices 21 in the IT network (office area 20) are all configured to pass through the mobile closed network 70 and take place within the global WAN 40.

Furthermore, in the industrial network system 200, as in the first embodiment, a SIM is embedded in each device 11 in the production area 10, and an individual IP address is assigned corresponding to the segment to which it belongs. The centralized management device 31 then identifies each device 11 based on the IP address assigned to the SIM and the segment to which the IP address belongs, and centrally manages the communications of the devices.

According to the above-described industrial network system 200, like the industrial network system 100 according to the first embodiment, the OT network and the IT network can be safely separated and constructed, and communications in the OT network can be monitored individually for each device, thereby realizing a secure OT network. In addition, the communication performance of the OT network can be improved.

Furthermore, in the industrial network system 200, the number of base stations 14, gateways 15, L3 switches, etc. installed between the OT network and the global WAN 40 only needs to be one set for the entire production area 10 (or one production facility 1), so it is expected that the installation effort and costs can be reduced even more than in the first embodiment.

In addition, because the firewall 80 only needs to be installed at the boundary between the mobile closed network 70 and the global WAN 40, the number of firewalls required per production facility 1 can be limited to one. This not only reduces the installation effort, but also allows security investment and security monitoring to be concentrated at one point for each production facility 1, which is expected to further improve the security of the entire industrial network system 300.

(3) Third Embodiment FIG. 4 is a diagram showing an example of the configuration of an industrial network system 300 according to a third embodiment of the present invention.

In the second embodiment, the mobile closed network 70 is configured to connect the OT network and the global WAN 40 for multiple production areas 10 (or the entire production facility 1), but the industrial network system 300 according to the third embodiment shows a configuration example in which the coverage is further expanded. That is, in the industrial network system 300, the mobile closed network 70 is constructed for a wide area including multiple production facilities 1 and even the outside (referred to as the central area).

In the third embodiment, since the coverage area required for the mobile closed network 70 is expanded, a specific industrial communication service provided by a service provider may be used instead of the local 5G network or private LTE network described above. Such industrial communication services generally have a set number of available lines and IP addresses, so that customers sign a contract for the service content that meets their needs.

As shown in FIG. 4, in the industrial network system 300, the production area 10 in which the OT network is constructed is managed as one or more segments, as in the first to third embodiments.

In the industrial network system 300 shown in FIG. 4, one base station 91 is installed in a central area, with the mobile closed network 70 covering multiple production facilities 1 (e.g., the entire company). In this way, the third embodiment has the potential to further reduce the number of base stations required across the entire company compared to the first and second embodiments. Note that the number of base stations 91 installed is not necessarily limited to one, and a configuration may be adopted in which multiple base stations 91 are installed without exceeding the total number of production facilities 1.

As shown in FIG. 4, the 5G terminals 13 installed in the production area 10 of each production facility 1 communicate wirelessly with the 5G terminals 92 installed in the central area via the base station 91 in the mobile closed network 70. The required number of 5G terminals 92 to be installed (this is the minimum number required, and may be more) is determined based on the number of devices 11 on the OT network side. For example, one 5G terminal 92 is prepared for every 10 devices 11. The number of 5G terminals 13 to be installed on the OT network side may be considered in the same way.

The multiple 5G terminals 92 are connected to the global WAN 40 via one gateway 93 (including an L3 switch, not shown). As in the first and second embodiments, it is sufficient to install one firewall 80 near the gateway 93.

In the industrial network system 300, as in the first and second embodiments, communication between the devices 11 in the OT network (production area 10) and communication between the devices 11 in the OT network and the devices 21 in the IT network (office area 20) are all configured to pass through the mobile closed network 70 and take place within the global WAN 40.

Furthermore, in the industrial network system 300, as in the first and second embodiments, a SIM is embedded in each device 11 in the production area 10, and an individual IP address is assigned corresponding to the segment to which it belongs. The centralized management device 31 then identifies each device 11 based on the IP address assigned to the SIM and the segment to which the IP address belongs, and centrally manages the communications of the devices.

According to the above-described industrial network system 300, like the industrial network systems 100 and 200 according to the first and second embodiments, the OT network and the IT network can be safely separated and constructed, and communications in the OT network can be monitored individually for each device, thereby realizing a secure OT network. In addition, the communication performance of the OT network can be improved.

Furthermore, in the industrial network system 300, the number of base stations 91 and gateways 93 installed between the OT network and the global WAN 40 needs to be one set for all of the multiple production facilities 1, and the number of 5G terminals 13, 92 installed can be significantly less than the number of devices 11 installed. Therefore, in the third embodiment, it is expected to have the effect of reducing installation effort and costs even more than in the other embodiments.

In addition, since the firewall 80 only needs to be installed at the boundary between the mobile closed network 70 and the global WAN 40, the number of firewalls required can be kept to a minimum of one for multiple production facilities 1 (the entire company). This not only reduces the installation effort, but also allows security investments and security monitoring to be concentrated at one point for the entire company (all of the multiple production facilities 1), which is expected to result in improved security for the entire industrial network system 300.

The present invention is not limited to the above-described embodiments, but includes various modified examples. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those having all of the configurations described. It is also possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

In addition, although the centralized management functions of the centralized management device 31 are realized by management software in which the processor interprets and executes a program that realizes the function, some or all of them may be realized in hardware, for example by designing an integrated circuit. In addition, information such as programs, tables, and files that realize the functions may be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

REFERENCE SIGNS LIST 1 Production facility 10 Production area 11, 21 Equipment 12 Inspection device 13, 92 5G terminal 14, 91 Base station 15, 24, 34, 93 Gateway 20 Office area 23, 33 Hub 30 Head office area 31 Centralized management device 32 Administrator terminal 40 Global WAN
50 External network 60 Cloud 61 Data lake 70 Mobile closed network 80 Firewall 100, 200, 300 Industrial network system 311 Processor 312 Storage device 313 Input device 314 Output device 315 Communication interface 316 Bus 317 Management software

Claims (9)

An industrial network system in which a plurality of local area networks are constructed separately,
a first local area network to which a first electronic device is connected under a mobile closed network capable of monitoring communications passing through the first local area network;
a second local area network that is constructed separately from the first local area network and to which a second electronic device is connected;
a predetermined closed network connecting the first local area network and the second local area network;
a centralized management device that executes a program for centrally managing communications via the mobile closed network;
Equipped with
the first local area network is connected to the predetermined closed network by the mobile closed network;
the centralized management device manages the communication range of the first local area network by dividing it into segments and restricting communication between the first electronic devices belonging to different segments;
A first communication device which performs wireless communication in the mobile closed network on behalf of the first electronic device of the segment, a second communication device which performs the wireless communication with the first communication device on the side of the predetermined closed network, and a third communication device which performs the wireless communication with the first communication device on the side of the predetermined closed network using the second communication device as a repeater are connected to the mobile closed network;
a predetermined number or more of the first communication devices and the third communication devices are installed based on a total number of the first electronic devices,
a firewall is installed between the second communication device in the mobile closed network and the predetermined closed network;
an industrial network system configured such that communication by the first electronic device, whether communication with another first electronic device in the first local area network or communication with the second electronic device, passes through the mobile closed network and does not go outside the specified closed network. Each of the first electronic devices is equipped with a Subscriber Identity Module (SIM) capable of assigning an IP address,
2. The industrial network system according to claim 1 , wherein the centralized management device authenticates the connection of the first electronic device to the first local area network using a SIM embedded in the first electronic device. Each of the first electronic devices is assigned a different IP address to the SIM from within an IP address assignment range set for the segment to which the first electronic device belongs;
3. The industrial network system according to claim 2 , wherein the centralized management device identifies the first electronic device connected to the first local area network based on the IP address and manages the connection. When a malware infection is detected in any of the first electronic devices,
4. The industrial network system according to claim 3 , wherein the centralized management device separates the first electronic device from the first local area network by changing an IP address assigned to a SIM of the first electronic device. The industrial network system according to claim 1 , wherein one of the second communication devices is installed for each of the segments. The industrial network system according to claim 1 , wherein one second communication device is installed for each of the segments. The industrial network system according to claim 1 , wherein the mobile closed network is a local 5G network. The industrial network system according to claim 1 , wherein the mobile closed network is a private LTE network. A network management method for an industrial network system in which a plurality of local area networks are constructed separately, comprising the steps of:
The industrial network system includes:
a first local area network to which a first electronic device is connected under a mobile closed network capable of monitoring communications passing through the first local area network;
a second local area network that is constructed separately from the first local area network and to which a second electronic device is connected;
a predetermined closed network connecting the first local area network and the second local area network;
a centralized management device that executes a program for centrally managing communications via the mobile closed network;
having
the first local area network is connected to the predetermined closed network by the mobile closed network;
the centralized management device manages the communication range of the first local area network by dividing it into segments and restricting communication between the first electronic devices belonging to different segments;
A first communication device which performs wireless communication in the mobile closed network on behalf of the first electronic device of the segment, a second communication device which performs the wireless communication with the first communication device on the side of the predetermined closed network, and a third communication device which performs the wireless communication with the first communication device on the side of the predetermined closed network using the second communication device as a repeater are connected to the mobile closed network;
a predetermined number or more of the first communication devices and the third communication devices are installed based on a total number of the first electronic devices,
a firewall is installed between the second communication device in the mobile closed network and the predetermined closed network;
a network management method configured so that communication by the first electronic device, whether communication with another first electronic device in the first local area network or communication with the second electronic device, passes through the mobile closed network and does not go outside the specified closed network.

Images