JP2003167606A - Programmable controller or programmable display unit and its user authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a programmable controller or a programmable display unit whose security is improved by effectively preventing any illegal operation based on the leakage of a password or the like and to provide its user authentication method. <P>SOLUTION: After a memory card 20 which stores a user authentication table in which user information including user ID, password, and access level is stored is mounted on a PLC (programmable controller) 10, a log-in request command in which user information including user ID and a password is described is transmitted from a tool 30 or a tool 60 to a PLC 10, and when the user ID and password of the user authentication table of the memory card 20 are matched with the user ID and password of the log-in request command, access to the PLC 10 by the tool 30 or the tool 60 is permitted. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a programmable controller or programmable display which is connected to a tool via a network or directly and permits access based on user information transmitted from the tool, and a user authentication method thereof. In particular, the present invention relates to a programmable controller or a programmable display device and a user authentication method for the programmable controller or device, in which security is enhanced by effectively preventing unauthorized operation due to leakage of a password or the like.

[0002]

2. Description of the Related Art Conventionally, when a user operates a programmable controller (hereinafter referred to as PLC) or a programmable display (hereinafter referred to as PT) using a predetermined programming device (hereinafter referred to as tool), an arbitrary password is used. The PLC or PT can be accessed by inputting the character string of from the tool.

That is, in the conventional PLC or PT, the password is stored in advance in the internal memory of the PLC or PT, and when the predetermined password is input from the tool for operating the PLC or PT, the password is input. The password is collated with the password stored in advance in the internal memory of the PLC or PT, and only when they match, it is possible to access the internal memory in the PLC or PT by the tool and create a user program. ing.

[0004]

However, recently,
Access to PLC or PT by the above tools,
It is possible not only from a tool directly connected to PLC or PT, but also via a network such as the Internet. In this case, 1) If the password is leaked, PLC by a third party
Or, unauthorized access to the PT becomes possible, which may lead to plagiarism or data destruction of the PLC or PT's internal data. 2) Those who know the above password are in all areas of the PLC or PT. However, there is a risk that the internal data and parameters of PLC or PT, and even the program may be destroyed due to erroneous operation. 3) The password is a single password, so PL
There is a problem that it is impossible to perform flexible setting such as setting an access level for each C or PT user.

Therefore, an object of the present invention is to enhance security of the PLC or PT by effectively preventing unauthorized operation due to leakage of a password or the like.

Another object of the present invention is to enable flexible setting corresponding to each user by setting an access level for each user.

It is another object of the present invention to provide a PLC or PT and a user authentication method for the PLC or PT, in which security is enhanced by effectively preventing unauthorized operation due to leakage of a password or the like.

[0008]

A programmable controller or a programmable display according to the present invention is a programmable controller to which a tool is connected via a network or directly and which permits access based on user information transmitted from the tool. Memory card mounting means for detachably mounting a memory card storing a user authentication table storing user information for authenticating a user; and the memory card being mounted, and
Control means for permitting access by the tool when the user information transmitted from the tool matches the user information in the user authentication table stored in the memory card.

Here, the tool connected directly via a network includes a programming device for accessing the internal memory of the programmable controller and creating a user program. Further, the access includes access at the time of login and access during login.

Further, the user information stored in the user authentication table includes a user identification code, a password, or an access level, and the control means includes a user identification code and a user identification code included in the user information transmitted from the tool. When the password matches the user identification code and password stored in the above user authentication table, the access by the tool is permitted, and when the access level of the access target is within the permission range of the access level, the access is permitted. .

The control means is transmitted from the tool when the user identification code and password included in the user information transmitted from the tool match the user identification code and password stored in the user authentication table. The user identification code included in the user information and the transmission source address of the tool are recorded, and the access level of the user authentication table stored in the memory card is transcribed corresponding to the user identification code and the transmission source address. It has a login user table.

Further, the control means prohibits access by the tool when the access level of the access target included in the user information transmitted from the tool is not included in the access levels stored in the login user table. And the login user table is stored within the login user table within a preset time after the login information including the user identification code, the sender address and the access level is stored in the login user table. Deleting means for deleting the stored login information.

Further, the user authentication method for the programmable controller or programmable display according to the present invention is a programmable controller or a programmable controller which is connected to a tool via a network or directly and permits access based on user information transmitted from the tool. In the user authentication method on the display,
A memory card storing user information for authenticating a user is attached to a programmable controller or a programmable display, and when the user information transmitted from the tool matches the user information stored in the memory card, the tool It is characterized in that access is permitted by.

Here, the tool directly connected via a network includes a programming device for accessing the internal memory of the programmable display and creating a user program.

Further, when the user identification code and password of the user authentication table stored in the memory card match the user identification code and password contained in the user information transmitted from the tool, access by the tool is performed. Allow it.

If the user identification code and password in the user authentication table stored in the memory card match the user identification code and password contained in the user information transmitted from the tool, the tool is transmitted. The user identification code included in the user information, the transmission source address of the tool, and the access level of the user authentication table stored in the memory card corresponding to the user identification code and the transmission source address are recorded in the login user table, When the access level of the access target included in the user information transmitted from the tool is within the permission range of the access level, the access by the tool is permitted.

If there is no access from the tool within a preset time after the login information including the user identification code, the sender address and the access level is stored in the login user table, the login user table is stored. The stored login information is deleted.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of a programmable controller or programmable display and a user authentication method thereof according to the present invention will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a block diagram showing the overall configuration of an embodiment in which the present invention is applied to a programmable controller.

In FIG. 1, the programmable controller (PLC) 10 includes an MPU (Micro Processing Unit) 11, a memory card interface (memory card I / F) 12, a display unit 1.
3, internal memory 14, data memory 15, system program memory 16, tool interface (tool I /
F) 17, a bus interface (bus I / F) 18, and a bus 19.

The memory card I / F 12 is constructed so that the memory card 20 can be freely attached, and the tool I / F 17 is constructed so that the tool 30 can be connected. The bus I / F 18 has a tool 60 via a network interface unit (network I / F unit) 40 and the Internet 50.
Are configured to be connectable. In addition, this tool 60
May be connected to the bus I / F 18 of the PLC 10 via a network such as a serial line or Ethernet.

Here, the MPU 11 operates based on the system program stored in the system program memory 16 and controls the overall operation of the PLC 10 in an integrated manner.

Further, the memory card I / F 12 is
It constitutes an interface for reading desired information from the memory card 20 attached to the LC 10.

Here, the memory card 20 stores a user authentication table that stores a user ID (user identification information), a password, an access level, and the like.

The display unit 13 displays various information such as the operating state of the PLC 10, and the internal memory 14 stores various information related to the operation of the PLC 10. The relevant login user table is stored in this internal memory 14.

The data memory 15 is composed of a RAM (Random Access Memory) which is a volatile memory, and stores the user program of the PLC 10 and various parameter data, and the system program memory 16 is , A non-volatile memory ROM
It is composed of (Read Only Memry) and stores the system program of the PLC 10.

The tool I / F 17 is the PLC 1
0 is connected to the tool 30. The bus I / F 18 is connected to the bus 19 of the PLC 10 and forms an interface with the network I / F unit 40 and the like.

Now, the PLC 10 shown in FIG.
The data is stored in the data memory 15 of the PLC 10 by using the tool 30 connected via the / F17 or the tool 60 connected via the bus I / F 18, the network I / F unit 40, and the Internet 50. It is configured to be able to access various data and user programs.

When accessing the PLC 10 using the tool 30 or the tool 60, 1) the memory card 20 storing a user authentication table storing user information including a user ID, a password, and an access level is attached to the PLC 10. 2) From the tool 30 or the tool 60, an operation of transmitting a login request command in which user information including a user ID and a password is described is performed to the PLC 10. Here, the user ID, password and login request command of the user authentication table of the memory card 20 If the user IDs and passwords of the
0 or the tool 60 is permitted to access the PLC 10, and the user ID and password of the user authentication table of the memory card 20 and the user I of the login request command
If D and the password do not match, access to the PLC 10 by the tool 30 or the tool 60 is prohibited.

According to such a configuration, even if the operator of the tool 30 or the tool 60 illegally acquires the password, the PLC 10 is not provided without the memory card 20.
No access to.

That is, in this embodiment, the memory card 20 is configured to function as a physical key for accessing the PLC 10, and unless the memory card 20 is attached to the PLC 10, the PLC 1
It is configured not to log in to 0.

Further, in the internal memory 14 of the PLC 10,
By logging in to the PLC 10, the user ID and the sender address of this login are written.
A login user table to which the access level of the user authentication table of the memory card 20 is transferred is stored, and when accessing the PLC 10 from the tool 30 or the tool 60, each login user table is stored based on the access level stored in the login user table. Access is restricted by the user.

FIG. 2 is a diagram showing an example of a user authentication table stored in the memory card 20 shown in FIG.

The user authentication table 21 shown in FIG. 2 stores passwords and access levels corresponding to user IDs.

That is, in the user authentication table 21 shown in FIG. 2, the password "PLCPASSWD" and the access level are stored corresponding to the user ID "USER012", and the user ID "SUZUKI5" is stored.
55 "corresponding to the password" SYSTEM_MAN "
And the access level is stored.

Here, the access level indicates an access range permitted by each user identified by the user ID, and an example of specific contents thereof is shown in FIG.

In FIG. 3, for example, the ID "USER"
The content of the access level corresponding to the user identified by "012" is shown.

In FIG. 3, the access level is described by the items of "address range", "read", "write", and "execution permission" corresponding to the "area type" to be accessed.

That is, in FIG. 3, for the area type "data memory", the address range "00000" is set.
-65000 "is read and write enabled,
For the area type “Program”, reading and writing of the address range “Tasks 1 and 2” is “No”, but execution is “Yes”, and for the area type “Timer”, the address range “0” -150 ”is read and write, and area type“ drawing data ”
This indicates that the reading and writing of the address range “1, 2, 5” are “enabled”.

Here, the area type "data memory" is
1 corresponds to the data memory area of the data memory 15 shown in FIG. 1, and the area type “program” corresponds to the user program stored in the data memory 15 shown in FIG.
The area type “timer” is the data memory 1 shown in FIG.
Corresponding to 5 timer areas, area type "drawing data"
Corresponds to the drawing data storage area of the data memory 15 shown in FIG.

In the PLC 10 of this embodiment, the tool 30 or the tool 60 is connected to the PLC 1
0 is accessed using a command message in the format shown in FIG. 4, and a reply from the PLC 10 to the tool 30 or the tool 60 in response to this command message is performed using a response message in the format shown in FIG. Be done.

Here, the command message shown in FIG. 4 is composed of a header part and a data part, and the header part has message information indicating a message type (in this case, indicating a command) and a destination address which is the address of the PLC 10. , The source address, which is the address of the tool 30 or the tool 60, and the data part includes a command code indicating the requested service.

The response message shown in FIG. 5 is also composed of a header part and a data part, and the header part is message information indicating the message type (in this case, indicating a response), the address of the tool 30 or the tool 60. It includes a transmission destination address and a transmission source address that is the address of the PLC 10, and the data portion includes a command code indicating the requested service and a response code indicating the result of the requested service such as normal execution or error termination. There is.

The command message and the response message are those of the application layer. When the command message and the response message actually flow through the serial line or the network, the physical layer and the data link layer corresponding to each communication network are used. , Headers such as the network layer are added to the above command message and response message.

FIG. 6 is a diagram showing an example of a login user table stored in the internal memory 14 of the PLC 10 shown in FIG.

In FIG. 6, this login user table 600 stores the source address and access level corresponding to the user ID.

That is, in the login user table 600 shown in FIG. 6, the user ID "USER012".
The source address "3A579F" and the access level are stored in correspondence with the user ID "SUZUK".
Source address "86CE53" corresponding to "I555"
And the access level is stored.

Here, the source address is stored based on the source address of the command message shown in FIG. 4 when the login command request is received from the tool 30 or the tool 60, and the access level is the memory card 20. It is a copy of the access level stored in the user authentication table 21 of the memory card 20 at the time of login using.

FIG. 7 shows P when the command message shown in FIG. 4 is received from the tool 30 or the tool 60.
It is a flow chart explaining operation of LC10.

In FIG. 7, first, whether a command is received,
That is, it is checked whether the command message shown in FIG. 4 is received (step 701). If the command message is not received (NO in step 701), the process returns to step 701 to wait for the reception of the command message.

Then, if it is determined in step 701 that the command message has been received (YES in step 701).
S) Next, whether the source address of the command message is logged in, that is, the source address of the command message is the internal memory 14 of the PLC 10.
Is checked in the login user table (step 702).

If the sender address of the command message is not stored in the login user table of the internal memory 14 of the PLC 10 (step 702).
NO), because this user has not logged in,
An error response is returned to the tool 30 or the tool 60 in the format shown in FIG. 5 (step 706), and this processing ends.

In this case, the tool 30 or the tool 60
Sends a login request command in which a user ID and a password, which will be described in detail later, are input.

If it is determined in step 702 that the source address of the command message is stored in the login user table (YES in step 702), the user of this source address has already logged in. Therefore, the counting timer that has already started is reset and restarted (step 70
3) Update the subsequent login duration. Next, referring to the login user table, it is checked whether the service requesting the command message is within the access level permitted by the user (step 704).

If the service requesting the command message is not within the access level permitted by the user (NO in step 704), the access by the command message cannot be permitted, and the tool 30 or tool 60 error occurs. A response is transmitted (step 706), and this processing ends.

If it is determined in step 704 that the service requesting the command message is within the range of the access level permitted to the user (YES in step 704), it is based on the service requesting the command message. Access is performed (step 705),
This process ends.

That is, in the process shown in FIG. 7, when the sender address of the command message from the tool 30 or the tool 60 is already stored in the login user table of the internal memory 14 of the PLC 10 and the login is completed, , Allow access based on this command message without requiring login again, but
The source address of the command message is PLC10.
If it is not stored in the login user table of the internal memory 14 of the user and the login is not completed, the tool 30
Alternatively, it is configured to send an error response to the tool 60 and request a login request command.

Even if the login has already been completed, if even one request service based on the command message is out of the access level range, access based on the command message is not permitted. , Tool 30 or tool 60 is configured to send an error response.

FIG. 8 is a flow chart showing a login process based on the login request command of the PLC 10 shown in FIG.

The tool 30 or the tool 6 shown in FIG.
When accessing PLC10 from 0 for the first time,
First, the memory card 20 is attached to the PLC 10, and then a user ID and a predetermined password are input from the tool 30 or the tool 60 to send a login request command message to the PLC 10.

Upon receipt of the login request command message from the tool 30 or the tool 60 (step 801), the PLC 10 first checks whether or not the memory card 20 is attached to this PLC 10 (step 8).
02).

Here, the memory card 2 is attached to the PLC 10.
If 0 is not attached (N in step 802
O) Since the login cannot be permitted, the response of the login failure is transmitted to the tool 30 or the tool 60 (step 807), and this processing ends.

In step 802, the PLC 10
If it is determined that the memory card 20 is installed in the memory card (YES in step 802), then there is a user authentication table in which a password is recorded in this memory card 20, that is, in this memory card 20. , A user authentication table that stores user ID, password, access level, etc. is checked (step 8).
03).

If there is no user authentication table in this memory card 20 (NO in step 803),
Since access cannot be permitted with this memory card 20, a response of login failure is transmitted to the tool 30 or the tool 60 (step 807), and this processing ends.

In step 803, the memory card 20
If it is determined that there is a user authentication table in the folder (YES in step 803), the tool 30 or the tool 6
It is checked whether the user ID and password notified from 0 and the user ID and password in the user authentication table of the memory card 20 match (step 80).
4).

As a result of the collation, if the collation of the user ID and the password is OK, that is, if it is determined that they coincide (YES in step 805), the login user table of the internal memory 14 of the PLC 10 includes the user ID and the sender address. The login data is recorded, a response of successful login is transmitted to the tool 30 or the tool 60 (step 806), and this processing is ended.

If it is determined by the collation in step 804 that the user ID and password are not collated (NO in step 805), the PLC 10 is also used in this case.
Since the access cannot be permitted, the response of the login failure is transmitted to the tool 30 or the tool 60 (step 807), and this processing ends.

FIG. 9 is a flow chart showing details of the login data recording process when the collation of the user ID and the password is judged to be OK by the collation of step 804 shown in FIG.

In FIG. 9, first, the user ID and the sender address included in the login request command message received from the tool 30 or the tool 60 are set to P.
It is recorded in the login user table of the internal memory 104 of the LC 10 (see FIG. 10) (step 901), and the access level of the user stored in the user authentication table of the memory card is then stored in the internal memory 10 of the PLC 10.
It is transcribed in the login user table of No. 4 corresponding to the user ID (step 902).

Then, a timer in which a predetermined time is set is started (step 903). The timer then checks to see if it has timed out (step 904).

If it is determined in step 904 that the timeout has not occurred (NO in step 904),
Returning to step 904, it is checked again whether the command message of the same transmission source address has been received from the tool 30 or the tool 60.

Thus, in step 904, the command message having the same source address is received from the tool 30 or the tool 60, that is, step 9
If the command message of the same source address is received from the tool 30 or the tool 60 before the timer started at 03 times out (step 90).
(YES in step 4), the process returns to step 903 to restart the timer.

When it is determined in step 904 that the time-out has occurred, that is, during the time counted by the timer started in step 903, the tool 30 or the tool 60 is detected.
If the command message of the same transmission source address is not received from (YES in step 904), PLC10
The login data corresponding to this user is deleted from the login user table of the internal memory 104 of the user (step 9
05), the processing is ended.

That is, the tool 30 or the tool 60
Login data from the login request command from
If it is once recorded in the login user table of the internal memory 104 of the LC 10, access to the command from the same source address is permitted without logging in again using the memory card 20. If a new command is not transmitted within a certain time after the start of the login, the login data corresponding to this source address is deleted from the login user table of the internal memory 104.

In this case, the memory card 20 is again set to P
It is necessary to mount it on the LC 10 and input the user ID and password from the tool 30 or the tool 60 to transmit the login request command.

FIG. 10 is a block diagram showing the overall configuration of another embodiment in which the present invention is applied to a programmable display device.

In FIG. 10, the programmable display (PT) 100 is an MPU (microminiaturized arithmetic processing unit: Mi).
cro Processing Unit) 101, memory card interface (memory card I / F) 102, display unit 10
3, an internal memory 104, a data memory 105, a system program memory 106, a tool interface (tool I / F) 107, a network interface (network I / F) 108, and a bus 109.

Then, in the memory card I / F 102,
The memory card 200 is configured to be freely attachable, and the tool I / F 107 includes a tool 3
00 is connectable, and network I / F
108 includes tools 50 via the Internet 400.
0 is configured to be connectable. In addition, this tool 50
0 may be configured to be connected to the network I / F 108 of the PT 100 via a network such as a serial line or Ethernet.

Here, the MPU 101 operates based on the system program stored in the system program memory 106, and controls the overall operation of the PT 100.

The memory card I / F 102 constitutes an interface for reading desired information from the memory card 200 mounted on the PT 100.

Here, the memory card 200 stores a user authentication table that stores a user ID (user identification information), a password, an access level, and the like.

The display section 103 is for performing a graphic display regarding the state of an external device (not shown) connected to the PT 100, and the internal memory 104.
Stores various information related to the operation of the PT100. The login user table according to the present invention is
It is stored in the internal memory 104.

The data memory 105 is composed of a RAM (Random Access Memory), which is a volatile memory, and stores various data of the PT 100. The system program memory 106 is a non-volatile memory. It is composed of a ROM (Read Only Memory), which stores the system program of the PT 100.

The tool I / F 107 uses the PT1
00 is connected to the tool 300, the network I / F 108 is connected to the bus 109 of the PT 100, and the Internet 4
It constitutes an interface with 00.

Now, the PT 100 shown in FIG. 10 uses the tool 300 connected via the tool I / F 107 or the tool 500 connected via the network I / F 108 and the Internet 400 to make the PT 100.
It is configured so that various data stored in the data memory 105 of 100 can be accessed.

Then, the tool 300 or the tool 50
When accessing the PT 100 using 0, 1) attach the memory card 200 storing the user authentication table storing the user information including the user ID, the password, and the access level to the PT 100 2) the user from the tool 300 or the tool 500 I
D, the login request command in which the user information including the password is described is transmitted to the PT 100. Here, the user ID of the user authentication table of the memory card 200, the password and the user I of the login request command are input.
D, if the passwords match, access to the PT 100 by the tool 300 or the tool 500 is permitted, and if the user ID of the user authentication table of the memory card 200, the password and the user ID of the login request command, and the password do not match, the tool 300 or the tool 500.
Access to the PT 100 is prohibited.

With such a configuration, even if the operator of the tool 300 or the tool 500 illegally acquires the password, if the operator does not have the memory card 200, the PT
You cannot access 100.

That is, also in this embodiment, the memory card 200 is configured to function as a physical key for accessing the PT 100, and unless the memory card 200 is attached to the PT 100,
It is configured not to log in to 100.

Further, the user ID is stored in the internal memory 104 of the PT 100 by logging in to the PT 100.
Also, a login user table in which the source address of this login is written and the access level of the user authentication table of the memory card 200 is stored is stored, and the P from the tool 300 or the tool 500 is stored.
When accessing T100, each user restricts access based on the access level stored in the login user table.

The user authentication table stored in the memory card 200 may have the same structure as the user authentication table 21 described with reference to FIGS. 2 and 3, and the PT 100 and the tool 300 or the tool 5 may be used.
The communication with 00 can be performed using the same message as the command message shown in FIG. 4 and the response message shown in FIG.

The login user table stored in the internal memory 104 of the PT 100 may have the same structure as the login user table 600 shown in FIG.

Furthermore, the command message is sent to the tool 300.
Or PT1 when received from the tool 500
The operation of 00 is the same as that described in the flowchart of FIG. 7 regarding the PLC 10.

FIG. 11 is a flow chart showing a login process based on the login request command of the PT 100 shown in FIG.

When the PT 100 is first accessed from the tool 300 or the tool 500 shown in FIG. 10, first, the memory card 200 is attached to the PT 100, and then the user ID and the predetermined password from the tool 300 or the tool 500. Is input to send a login request command message to the PT 100.

When the PT 100 receives the login request command message from the tool 300 or the tool 500 (step 1101), first, the PT 100
It is checked whether or not the memory card 200 is attached (step 1102).

Here, the memory card 2 is attached to the PT100.
If 00 is not attached (step 1102: N
O), and since the login cannot be permitted, the response of the login failure is transmitted to the tool 300 or the tool 500 (step 1107), and this processing is ended.

In step 1102, the PT10
If it is determined that the memory card 200 is attached to the memory card 0 (YES in step 1102), next, whether there is a user authentication table in which the password is recorded in this memory card 200, that is, in this memory card 200 It is checked whether or not a user authentication table storing a user ID, a password, an access level, etc. is stored (step 1103).

If there is no user authentication table in this memory card 200 (N in step 1103).
O), since access cannot be permitted in this memory card 200, a response of login failure is transmitted to the tool 300 or the tool 500 (step 117), and this processing is ended.

In step 1103, this memory card 2
If it is determined that there is a user authentication table in 00 (YES in step 1103), the user ID and password notified from the tool 300 or the tool 500 and the user ID and password in the user authentication table of the memory card 200 are the same. It is checked whether they match (step 1104).

As a result of the above collation, if the collation of the user ID and the password is OK, that is, it is determined that they match (YES in step 1105), the login user table of the internal memory 104 of the PT 100 includes the user ID and the sender address. The login data is recorded, and the response of successful login is transmitted to the tool 300 or the tool 500 (step 1106), and this processing is ended.

When it is determined by the collation in step 1104 that the collation of the user ID and the password does not match (NO in step 1105), PT1 is also set in this case.
Since the access to 00 is not permitted, the response of the login failure is transmitted to the tool 300 or the tool 500 (step 1107), and this processing is ended.

The details of the login data recording process when the collation of the user ID and the password is determined to be OK by the collation of step 1104 shown in FIG. 11 are the same as the process of the flowchart shown in FIG.

As described above, in the present invention, an operator who does not have a user ID in the memory card cannot use the PLC or PT, and an inexpensive security system is constructed. By changing the access level for each user, such as system personnel and system users, the range that can be operated can be limited according to the duties and proficiency of the user, and data loss due to erroneous operation, destruction or inadvertent rewriting of data can be performed. Can be prevented. Further, by preparing and using a plurality of memory cards having different contents of the user authentication table according to the purpose of use, etc., it is possible to easily change the accessible user and the access level according to the purpose of use.

In the above-mentioned embodiment, the case where the user first logs in by the login request command and then accesses again during the login and performs the process within the access level range by the command message will be described. did. However, according to the present invention, even when the user sends the login request command and the command message together at the first login, the PLC or P
The user may perform the login process by the login request command on the T side and subsequently process the command message.

[0105]

As described above, according to the present invention: 1) Since the memory card is configured to function as a physical key for accessing the PLC or PT, an illegal operation based on leakage of a password or the like is performed. Can be effectively prevented, and thereby security of PLC or PT can be enhanced. 2) By setting an access level for each user, flexible setting corresponding to each user becomes possible. .

[Brief description of drawings]

FIG. 1 is a block diagram showing an overall configuration of an embodiment in which the present invention is applied to a programmable controller.

2 is a diagram showing an example of a user authentication table stored in the memory card shown in FIG.

FIG. 3 is a diagram showing a specific example of access levels stored in a user authentication table shown in FIG.

FIG. 4 is a diagram showing an example of a format of a command message transmitted from the tool shown in FIG. 1 to a PLC.

5 is a diagram showing an example of a format of a response message transmitted from the PLC shown in FIG. 1 to a tool.

6 is a diagram showing an example of a login user table stored in an internal memory of the PLC shown in FIG.

FIG. 7 is a flowchart illustrating the operation of the PLC when the command message shown in FIG. 4 is received from the tool.

8 is a flowchart showing a login process based on the login request command of the PLC shown in FIG.

9 is a flowchart showing details of the login data recording process when the collation process shown in FIG. 8 determines that collation of the user ID and password is OK.

FIG. 10 is a block diagram showing an overall configuration of another embodiment in which the present invention is applied to a programmable display.

11 is a flowchart showing a login process based on the login request command of the PT shown in FIG.

[Explanation of symbols]

10 Programmable Controller (PLC) 11 MPU (Micro Processing Unit: Micro Processi)
ng Unit) 12 Memory card interface (Memory card I
/ F) 13 Display unit 14 Internal memory 15 Data memory 16 System program memory 17 Tool interface (tool I / F) 18 Bus interface (bus I / F) 19 Bus 20 Memory card 21 User authentication table 30 Tool 40 Network interface unit ( Network I / F Unit) 50 Internet 60 Tool 100 Programmable Display (PT) 101 MPU (Micro Processing Unit: Micro Proces)
sing Unit) 102 memory card interface (memory card I / F) 103 display unit 104 internal memory 105 data memory 106 system program memory 107 tool interface (tool I / F) 108 network interface (network I / F) 109 bus 200 memory card 300 tool 400 Internet 500 tool 600 Login user table

   ─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 5B058 CA27 KA02 KA04 KA31 KA33                       YA20                 5B085 AE02 AE03 AE06 AE12 BC01                 5H220 BB09 BB11 CC09 CX06 FF01                       FF03 GG01 JJ12 JJ26 KK04                       LL04 MM03

Claims (9)

[Claims] 1. A programmable controller or programmable display, to which a tool is connected via a network or directly and which permits access based on user information transmitted from the tool, stores user information for authenticating a user. Memory card mounting means for detachably mounting a memory card storing a user authentication table, and a user of the user authentication table in which the memory card is mounted and the user information transmitted from the tool is stored in the memory card A programmable controller or a programmable display device, comprising: a control unit that permits access by the tool when the information matches. 2. The user authentication table stored in the memory card stores a user identification code and a password as the user information, and the control means includes a user identification code included in the user information transmitted from the tool. 2. The programmable controller or programmable display according to claim 1, wherein access by the tool is permitted when the password and the password match the user identification code and the password stored in the user authentication table. 3. The user authentication table stored in the memory card stores a user identification code, a password, and an access level as the user information, and the control means is included in the user information transmitted from the tool. When the user identification code and password match the user identification code and password stored in the above user authentication table, and the access level of the access target included in the user information sent from the above tool is within the permitted range of the above access level. 2. The programmable controller or programmable display according to claim 1, wherein access by the tool is permitted. 4. The control means is transmitted from the tool when the user identification code and password included in the user information transmitted from the tool match the user identification code and password stored in the user authentication table. The user identification code included in the user information and the transmission source address of the tool are recorded, and the access level of the user authentication table stored in the memory card is transcribed corresponding to the user identification code and the transmission source address. 4. A login user table for login is provided.
The programmable controller or programmable display described. 5. The control means prohibits access by the tool if the access level of the access target included in the user information transmitted from the tool is not included in the access levels stored in the login user table. Prohibiting means, and if there is no access from the tool within a preset time after the login information including the user identification code, the sender address and the access level is stored in the login user table, the login user table is displayed. 5. The programmable controller or programmable display according to claim 4, further comprising: a deleting unit that deletes the stored login information. 6. A user authentication method in a programmable controller or a programmable display, which is connected to a tool via a network or directly and permits access based on user information transmitted from the tool, a user for authenticating the user. A memory card storing information is attached to a programmable controller or a programmable display, and when the user information transmitted from the tool matches the user information stored in the memory card, access by the tool is permitted. A user authentication method in a programmable controller or a programmable display characterized by the above. 7. When the user identification code and password of the user authentication table stored in the memory card match the user identification code and password included in the user information transmitted from the tool, access by the tool is performed. 7. The user authentication method in the programmable controller or programmable display according to claim 6, wherein the user authentication is permitted. 8. The tool is transmitted when the user identification code and password in the user authentication table stored in the memory card match the user identification code and password included in the user information transmitted from the tool. The user identification code included in the user information, the transmission source address of the tool, and the access level of the user authentication table stored in the memory card corresponding to the user identification code and the transmission source address are recorded in the login user table, The programmable controller or programmable display device according to claim 7, wherein when the access level of the access target included in the user information transmitted from the tool is within the permission range of the access level, the access by the tool is permitted. In The authentication method. 9. If there is no access from the tool within a preset time after the login information including the user identification code, the sender address, and the access level is stored in the login user table, the login user table is stored in the login user table. 9. The user authentication method for a programmable controller or programmable display according to claim 8, wherein the stored login information is deleted.