CN207937845U - A kind of information spy device and industrial control system - Google Patents

A kind of information spy device and industrial control system Download PDF

Info

Publication number
CN207937845U
CN207937845U CN201820397216.XU CN201820397216U CN207937845U CN 207937845 U CN207937845 U CN 207937845U CN 201820397216 U CN201820397216 U CN 201820397216U CN 207937845 U CN207937845 U CN 207937845U
Authority
CN
China
Prior art keywords
data
industrial control
filtered
control system
packet
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201820397216.XU
Other languages
Chinese (zh)
Inventor
杜文博
杜晓光
文天杰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Benz Automotive Co Ltd
Original Assignee
Beijing Benz Automotive Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Benz Automotive Co Ltd filed Critical Beijing Benz Automotive Co Ltd
Priority to CN201820397216.XU priority Critical patent/CN207937845U/en
Application granted granted Critical
Publication of CN207937845U publication Critical patent/CN207937845U/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Abstract

The utility model provides a kind of information spy device and industrial control system, is related to the technical field of industrial control system, including hardware firewall, data collector, protocol converter and storage server;Hardware firewall is arranged in industrial control network;Data collector is connected by industrial control network with target device;Protocol converter is connected with data collector and storage server respectively;Storage server is connected with protocol converter;Hardware firewall is used to be filtered the data for entering industrial control network, the data packet after being filtered;Operational data of the data collector for acquiring target device in data packet after filtration;Protocol converter is used to operational data carrying out format conversion, is converted into the target operation data of same protocol format;Storage server alleviates the relatively low technical problem of existing industrial control system safety for being stored to target operation data.

Description

A kind of information spy device and industrial control system
Technical field
The utility model is related to the technical field of industrial control system, more particularly, to a kind of information spy device and Industrial control system.
Background technology
Complication, ITization and the generalization of industrial control system exacerbate the security risk of system, and potential bigger threatens It is that industry control industry synthesized competitiveness in China's is not strong, the core technologies such as embedded software, bus protocol, industrial control software are limited by state Outside, lack the standards such as autonomous communication security, information security, security reliability test.And manufacture system is connected to system of enterprise The trend of system and internet is increasingly apparent.For example, remote maintenance and management, industrial cloud service is that more chances are created in attack. And traditional hardware and software is designed for internet, is particularly susceptible to attack.
Industrial control system is based on Windows, those specially crack the Method and kit for of Windows account informations It can be applied on industrial control system.The OPC systems on WindowsOLE and DCOM are especially operated in, as long as passing through host Certification can control OPC environment comprehensively.If underlying protocol certification can not be obtained, control can also be cracked by enumerating mode Other users and role in system.Such as HMI user, ICCP servers authority (magic list), host node address (any master/slave work Industry agreement), previous database authentication information etc..Into HMI, so that it may to directly control the process of HMI management, and steal information; Into ICCP servers, so that it may with steal or manipulation and control center between transmission data.Thus, functionally physics is set Standby and logical device is all isolated to safety zone and is very important.
Utility model content
In view of this, the purpose of this utility model is to provide a kind of information spy device and industrial control system, To alleviate the relatively low technical problem of existing industrial control system safety.
In a first aspect, the utility model embodiment provides a kind of information spy device, including:Hardware firewall, Data collector, protocol converter and storage server;The hardware firewall is arranged in industrial control network;The data Collector is connected by the industrial control network with target device;The protocol converter respectively with the data collector It is connected with the storage server;The storage server is connected with the protocol converter;The hardware firewall is used It is filtered in the data for entering the industrial control network, the data packet after being filtered;The data collector is used The operational data of the target device is acquired in the data packet after the filtering;The protocol converter is used for will be described Operational data carries out format conversion, is converted into the target operation data of same protocol format;The storage server is used for institute Target operation data are stated to be stored.
Further, described device further includes:Timer, the timer are arranged in the inside of the storage server.
Further, the hardware firewall is to support the hardware firewall of following agreement:Profinet agreements, MODBUS Agreement, OPC agreements and File Transfer Protocol.
Further, described device further includes:Industrial switch, wherein the industrial switch will be for realizing will be described Hardware firewall is attached with the industrial control network, and realize by the data collector and the target device into Row connection.
Further, the target device includes at least one of:Industrial robot, live input/output unit, holds Row device and sensor.
Further, the hardware firewall includes:Packet filtering, wherein the packet filtering is used for Data to entering the industrial control network are filtered, the data packet after being filtered.
Further, the packet filtering includes:Controller, filter and logger module, wherein the control Device processed is used to be filtered the configuration of rule, and the filter is used to carry out the data for entering the industrial control network Filter, the data packet after being filtered, the logger module is for carrying out packet content record.
Further, the quantity of the data collector is multiple, each data collector and passes through the industry Control network is connected with corresponding target device, and each data collector is used in the data packet after the filtering Acquire the operational data of corresponding target device.
Further, the quantity of the protocol converter is multiple, wherein a protocol converter and a data acquire Device is connected, and the protocol converter is used to turn the coupled collected operational data of data collector into row format It changes, is converted into the target operation data of same protocol format.
Second aspect, the utility model embodiment provide a kind of industrial control system, including information described above peace Full monitoring device, further includes industrial control equipment, and described information safety monitoring device is used for the industrial control system boundary And/or it is protected inside the industrial control system.
In the utility model embodiment, the data for entering industrial control network are filtered by hardware firewall, Data packet after being filtered;Then, by acquiring the work of target device in data collector data packet after filtration Make data;Next, being used to operational data carrying out format conversion by protocol converter, it is converted into the mesh of same protocol format Mark operational data;Furthermore by storage server for being stored to target operation data.By the above-mentioned means, can be right Different control domains directly carry out boundary protection inside industrial control system boundary and industrial control system, and then alleviate existing The relatively low technical problem of industrial control system safety.
Other feature and advantage of the utility model will illustrate in the following description, also, partly from specification In become apparent, or understood by implementing the utility model.The purpose of this utility model and other advantages are illustrating Specifically noted structure is realized and is obtained in book, claims and attached drawing.
To enable the above objects, features, and advantages of the utility model to be clearer and more comprehensible, preferred embodiment cited below particularly, and The appended attached drawing of cooperation, is described in detail below.
Description of the drawings
It, below will be right in order to illustrate more clearly of specific embodiment of the present invention or technical solution in the prior art Specific implementation mode or attached drawing needed to be used in the description of the prior art are briefly described, it should be apparent that, it is described below In attached drawing be that some embodiments of the utility model are not paying creativeness for those of ordinary skill in the art Under the premise of labour, other drawings may also be obtained based on these drawings.
Fig. 1 is the schematic diagram according to a kind of information spy device of the utility model embodiment;
Fig. 2 is the schematic diagram according to second of information spy device of the utility model embodiment;
Fig. 3 is the schematic diagram according to the third information spy device of the utility model embodiment;
Fig. 4 is the schematic diagram according to the 4th kind of information spy device of the utility model embodiment.
Specific implementation mode
To keep the purpose, technical scheme and advantage of the utility model embodiment clearer, below in conjunction with attached drawing to this The technical solution of utility model is clearly and completely described, it is clear that described embodiment is that the utility model part is real Example is applied, instead of all the embodiments.Based on the embodiments of the present invention, those of ordinary skill in the art are not making The every other embodiment obtained under the premise of creative work, shall fall within the protection scope of the present invention.
Embodiment one:
According to the utility model embodiment, a kind of embodiment of information spy device is provided.
Fig. 1 is according to a kind of schematic diagram of information spy device of the utility model embodiment, as shown in Figure 1, should Information spy device includes:Hardware firewall 10, data collector 20, protocol converter 30 and storage server 40;
Wherein, the hardware firewall 10 is arranged in industrial control network;
The data collector 20 is connected by the industrial control network with target device;
The protocol converter 30 is connected with the data collector 20 and the storage server 40 respectively;It is described to deposit Storage server is connected with the protocol converter.
Specifically, the hardware firewall 10 is used to be filtered the data for entering the industrial control network, obtains Data packet after filtering;
The data collector 20 is used to acquire the work number of the target device in the data packet after the filtering According to;
The protocol converter 30 is used to the operational data carrying out format conversion, is converted into the mesh of same protocol format Mark operational data;
The storage server 40 is for storing the target operation data.
In the utility model embodiment, the data for entering industrial control network are filtered by hardware firewall, Data packet after being filtered;Then, by acquiring the work of target device in data collector data packet after filtration Make data;Next, being used to operational data carrying out format conversion by protocol converter, it is converted into the mesh of same protocol format Mark operational data;Furthermore by storage server for being stored to target operation data.By the above-mentioned means, can be right Different control domains directly carry out boundary protection inside industrial control system boundary and industrial control system, and then alleviate existing The relatively low technical problem of industrial control system safety.
By foregoing description it is found that in the present embodiment, hardware firewall is provided in industrial control network, wherein Information security technology is deployed in industrial control system the hardware firewall in a distributed manner.Then, pass through the hardware firewall pair The content for commonly using industrial control protocols in industrial control network (for example, industry control Ethernet) is analyzed, and common industry control The integrality of agreement processed is checked.The controlling behaviors of industrial control protocols can be preferably monitored by analyzing and checking.
In the present embodiment, depth analysis is mainly carried out to industrial control protocols by hardware firewall, to prevent puppet The malicious code for dressing up normal communication protocols content enters inside industrial control system network internal or region, abnormal to prevent The malicious codes such as shape code intrusion are attacked in the inside of industrial control network.
In the present embodiment, hardware firewall can support the hardware firewall of following agreement:Profinet agreements (new one Generation the automation bus standard based on industrial Ethernet technology), MODBUS agreements (Modbus protocol), OPC (Object Linking and Embedding (OLE) for Process Control) agreement and File Transfer Protocol (File Transfer Protocol, Chinese:File Transfer Protocol).
Optionally, when hardware firewall carries out depth analysis to industrial control protocols, hardware firewall can be according to entrance Initial address and destination address to the data of industrial control system check the data packet, to determine the number by inspection result According to packet whether be malicious code data packet.If it is determined that the data packet is the data packet of malicious code, then the number is not allowed It is entered in industrial control system according to packet.It, can be to industrial control system boundary and Industry Control by above-mentioned monitor mode Internal system difference control domain directly carries out boundary protection, and then alleviates the existing lower skill of industrial control system safety Art problem.
In the present embodiment, it is also configured with for hardware firewall and suitably spits rate, avoided to the real-time of industrial control network Property impacts.Wherein, handling capacity is to weigh the most important index of a fire wall or route exchange device, it refers to net Network equipment handles the maximum capacity of data packet within each second.Handling capacity means that this equipment can be handled within each second Each in other words second interior energy of maximum stream flow processing data packet number.Device throughput is higher, can be provided using to user Bandwidth it is bigger, just as described in Bucket Principle, the maximum throughput of network depends on the minimum throughput device in network, foot Enough handling capacities can ensure that fire wall will not become the bottleneck of network.
As shown in Fig. 2, the device further includes:Timer 50, the timer 50 are arranged in the storage server 40 It is internal.
In the present embodiment, the effect of timer be control storage server 40 every preset time by protocol converter 30 The target operation data obtained later are converted to be stored.In the present embodiment, timer is additionally operable to control protocol converter 30 The operational data is subjected to format conversion every preset time, is converted into the target operation data of same protocol format.
Fig. 3 be according to the schematic diagram of another information spy device of the utility model embodiment, as shown in figure 3, The information spy device further includes:Industrial switch 60.
Wherein, the industrial switch 60 connects for realizing by the hardware firewall and the industrial control network It connects, and realizes and be attached the data collector and the target device.
From figure 3, it can be seen that hardware firewall can be linked into industrial control network by industrial switch 60, so that Hardware firewall can directly protect different control domains inside industrial control system boundary and industrial control system into row bound Shield.It can also find out from Fig. 3, industrial switch 60, which can also be realized, is attached data collector and the target device.
In the present embodiment, target device includes but not limited to following at least one equipment:Industrial robot, scene input Output device, actuator and sensor.Wherein, actuator includes Electric Actuator and/or pneumatic actuator.
Fig. 4 be according to the schematic diagram of another information spy device of the utility model embodiment, as shown in figure 4, The hardware firewall 10 includes:Packet filtering 11.
In the present embodiment, the packet filtering 11 is used to carry out the data for entering the industrial control network Filter, the data packet after being filtered.
In the present embodiment, packet filtering 11 is used to carry out depth analysis to industrial control protocols, to prevent from pretending It is entered inside industrial control system network internal or region at the malicious code of normal communication protocols content, to prevent deformity A variety of malicious codes such as code intrusion are attacked in the inside of industrial control network.
Optionally, when packet filtering 11 carries out depth analysis to industrial control protocols, packet filtering 11 can be with Check the data packet according to the initial address for the data for entering industrial control system and destination address, with by inspection result come Determine the data packet whether be malicious code data packet.If it is determined that the data packet is the data packet of malicious code, then not The data packet is allowed to enter in industrial control system.By above-mentioned monitor mode, can to industrial control system boundary and Different control domains directly carry out boundary protection inside industrial control system, and then alleviate existing industrial control system safety Relatively low technical problem.
In an alternative embodiment, as shown in figure 4, packet filtering 11 includes:Controller 111, filter 112 With logger module 113.
Wherein, the controller 111 is used to be filtered the configuration of rule;
The filter 112 is used to be filtered the data for entering the industrial control network, after being filtered Data packet;
The logger module 113 is for carrying out packet content record.
Specifically, user can be filtered the configuration of rule by controller, wherein filtering rule is filter 112 Filtering rule when data to entering the industrial control network are filtered.
When filter 112 is filtered the data for entering the industrial control network according to filtering rule, detailed process It is as follows:Filter 112 checks the data packet according to the initial address and destination address for the data for entering industrial control system, with The data packet is filtered by inspection result, specifically determines whether the data packet is malicious code by filtering Data packet.If it is determined that the data packet is the data packet of malicious code, then the data packet is not allowed to enter Industry Control system In system.It, can be straight to different control domains inside industrial control system boundary and industrial control system by above-mentioned monitor mode Row bound protection is tapped into, and then alleviates the relatively low technical problem of existing industrial control system safety.
In another optional embodiment of the present embodiment, the quantity of the data collector 20 is multiple, Mei Gesuo It states data collector and is connected with corresponding target device by the industrial control network, each data collector is used The operational data of corresponding target device is acquired in the data packet after the filtering.
May include a large amount of target device, at this point it is possible to which multiple numbers are arranged in a large-scale industrial control system According to collector, then, adopting for operational data is carried out to certain a kind of target device by one or more data collector Collection.The data acquisition modes of multiple data collectors can also be set according to the working region in industrial control system.For example, The operational data of target device in workspace 1 is acquired by data collector A1;Mesh in workspace 2 The operational data of marking device is acquired by data collector A2.
In another optional embodiment of the present embodiment, the quantity of the protocol converter 30 is multiple, wherein one A protocol converter is connected with a data collector, and the protocol converter is used for coupled data collector Collected operational data carries out format conversion, is converted into the target operation data of same protocol format.
In the present embodiment, an optional embodiment is to be correspondingly arranged an agreement for each data collector to turn Parallel operation.In addition to this it is possible to be correspondingly arranged a protocol converter for one group of data collector.It specifically can be according to practical need It is set, the present embodiment is not specifically limited.
Embodiment two:
The utility model embodiment additionally provides a kind of embodiment of industrial control system.
The industrial control system, including the information spy device described in above-described embodiment one, further include industrial control Control equipment, described information safety monitoring device are used for in the industrial control system boundary and/or the industrial control system It is protected in portion.
In the utility model embodiment, by the hardware firewall in information spy device to entering Industry Control The data of network are filtered, the data packet after being filtered;Then, it is acquired by the data in information spy device The operational data of target device is acquired in the data packet of device after filtration;Next, by information spy device Protocol converter is used to operational data carrying out format conversion, is converted into the target operation data of same protocol format;Furthermore it is logical The storage server crossed in information spy device is for storing target operation data.By the above-mentioned means, can Boundary protection is directly carried out to different control domains inside industrial control system boundary and industrial control system, meets particular industry The fire wall of environment and functional requirement, and then alleviate the relatively low technical problem of existing industrial control system safety.
In addition, in the description of the utility model embodiment unless specifically defined or limited otherwise, term " installation ", " connected ", " connection " shall be understood in a broad sense, for example, it may be being fixedly connected, may be a detachable connection, or integrally connect It connects;It can be mechanical connection, can also be electrical connection;It can be directly connected, can also indirectly connected through an intermediary, it can To be the connection inside two elements.For the ordinary skill in the art, it can understand above-mentioned term with concrete condition Concrete meaning in the present invention.
It is in the description of the present invention, it should be noted that term "center", "upper", "lower", "left", "right", " perpendicular Directly ", the orientation or positional relationship of the instructions such as "horizontal", "inner", "outside" is to be based on the orientation or positional relationship shown in the drawings, and is only The utility model and simplifying describes for ease of description, do not indicate or imply the indicated device or element must have it is specific Orientation, with specific azimuth configuration and operation, therefore should not be understood as limiting the present invention.In addition, term " the One ", " second ", " third " are used for description purposes only, and are not understood to indicate or imply relative importance.
It is apparent to those skilled in the art that for convenience and simplicity of description, the system of foregoing description, The specific work process of device and unit, can refer to corresponding processes in the foregoing method embodiment, and details are not described herein.
The unit illustrated as separating component may or may not be physically separated, aobvious as unit The component shown may or may not be physical unit, you can be located at a place, or may be distributed over multiple In network element.Some or all of unit therein can be selected according to the actual needs to realize the mesh of this embodiment scheme 's.
In addition, each functional unit in each embodiment of the utility model can be integrated in a processing unit, Can be that each unit physically exists alone, it can also be during two or more units be integrated in one unit.
Finally it should be noted that:Embodiment described above, only specific embodiment of the present utility model, to illustrate this The technical solution of utility model, rather than its limitations, the scope of protection of the utility model is not limited thereto, although with reference to aforementioned The utility model is described in detail in embodiment, it will be understood by those of ordinary skill in the art that:It is any to be familiar with this skill The technical staff in art field within the technical scope disclosed by the utility model, still can be to the skill recorded in previous embodiment Art scheme modify or can readily occur in variation or equivalent replacement of some of the technical features;And these modifications, Variation is replaced, the spirit and model of the utility model embodiment technical solution that it does not separate the essence of the corresponding technical solution It encloses, should be covered within the scope of the utility model.Therefore, the scope of protection of the utility model is answered described is wanted with right Subject to the protection domain asked.

Claims (10)

1. a kind of information spy device, which is characterized in that including:Hardware firewall, data collector, protocol converter and Storage server;
The hardware firewall is arranged in industrial control network;The data collector passes through the industrial control network and mesh Marking device is connected;The protocol converter is connected with the data collector and the storage server respectively;It is described to deposit Storage server is connected with the protocol converter;
The hardware firewall is used to be filtered the data for entering the industrial control network, the data after being filtered Packet;
The data collector is used to acquire the operational data of the target device in the data packet after the filtering;
The protocol converter is used to the operational data carrying out format conversion, is converted into the target operation of same protocol format Data;
The storage server is for storing the target operation data.
2. the apparatus according to claim 1, which is characterized in that described device further includes:Timer, the timer setting In the inside of the storage server.
3. the apparatus according to claim 1, which is characterized in that the hardware firewall is to support the hardware of following agreement anti- Wall with flues:Profinet agreements, MODBUS agreements, OPC agreements and File Transfer Protocol.
4. the apparatus according to claim 1, which is characterized in that described device further includes:Industrial switch, wherein described Industrial switch is attached for realizing by the hardware firewall and the industrial control network, and realizes the number It is attached according to collector and the target device.
5. the apparatus according to claim 1, which is characterized in that the target device includes at least one of:Industrial machine Device people, live input/output unit, actuator and sensor.
6. the apparatus according to claim 1, which is characterized in that the hardware firewall includes:Packet filtering, In, the packet filtering is used to be filtered the data for entering the industrial control network, the number after being filtered According to packet.
7. device according to claim 6, which is characterized in that the packet filtering includes:Controller, filter and Logger module, wherein the controller is used to be filtered the configuration of rule, and the filter is used for entering the work The data of industry control network are filtered, and the data packet after being filtered, the logger module is for carrying out data packet Content record.
8. the apparatus according to claim 1, which is characterized in that the quantity of the data collector be it is multiple, it is each described Data collector and it is connected with corresponding target device by the industrial control network, each data collector is used for The operational data of corresponding target device is acquired in the data packet after the filtering.
9. device according to claim 8, which is characterized in that the quantity of the protocol converter is multiple, wherein one Protocol converter is connected with a data collector, and the protocol converter is for adopting coupled data collector The operational data collected carries out format conversion, is converted into the target operation data of same protocol format.
10. a kind of industrial control system, which is characterized in that including the information security described in any one of the claims 1 to 9 Monitoring device, further includes industrial control equipment, described information safety monitoring device be used for the industrial control system boundary and/ Or it is protected inside the industrial control system.
CN201820397216.XU 2018-03-22 2018-03-22 A kind of information spy device and industrial control system Expired - Fee Related CN207937845U (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201820397216.XU CN207937845U (en) 2018-03-22 2018-03-22 A kind of information spy device and industrial control system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201820397216.XU CN207937845U (en) 2018-03-22 2018-03-22 A kind of information spy device and industrial control system

Publications (1)

Publication Number Publication Date
CN207937845U true CN207937845U (en) 2018-10-02

Family

ID=63655769

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201820397216.XU Expired - Fee Related CN207937845U (en) 2018-03-22 2018-03-22 A kind of information spy device and industrial control system

Country Status (1)

Country Link
CN (1) CN207937845U (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108375946A (en) * 2018-03-22 2018-08-07 北京奔驰汽车有限公司 A kind of information spy device and industrial control system

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108375946A (en) * 2018-03-22 2018-08-07 北京奔驰汽车有限公司 A kind of information spy device and industrial control system

Similar Documents

Publication Publication Date Title
EP2924569B1 (en) Device authentication to faciliate secure cloud management of industrial data
CN110460521A (en) A kind of edge calculations AnyRouter
CN106462137B (en) System and method for ensureing industrial control system
CN108370370A (en) System and method for passively assessing industrial security boundary
CN109922085B (en) Safety protection system and method based on CIP (common interface protocol) in PLC (programmable logic controller)
CN110990386A (en) Industrial internet platform monitoring data transmission and exchange method and system
CN101517501A (en) Handheld field maintenance bus monitor
KR20140118494A (en) Apparatus and method for detecting anomaly in a controller system
CN108375946A (en) A kind of information spy device and industrial control system
CN107786532A (en) The system and method that Virtual honeypot is used in industrial automation system and cloud connector
US11579592B2 (en) Systems and methods for control system security
CN108769076B (en) Data acquisition system, method and device with network isolation function
CN104660593A (en) Method for filtering OPC security gateway data packets
US10645167B2 (en) Distributed setting of network security devices from power system IED settings files
CN112799358A (en) Industrial control safety defense system
CN108279636A (en) Industrial machine room security protection system
CN107800722A (en) Isolate the method and device of industrial control equipment and external network server
CN207937845U (en) A kind of information spy device and industrial control system
CN106549792A (en) A kind of method of the security control of VNF, apparatus and system
CN112187791A (en) Data safety transmission system for industrial control
CN209805847U (en) Safety production data front-end processor
CN105959289A (en) Self-learning-based safety detection method for OPC Classic protocol
CN102469098B (en) Information safety protection host machine
CN105049403A (en) Power distribution network control system safety protection method and system
CN109167768B (en) Remote access and tamper-proof system for industrial field data in industrial Internet of things

Legal Events

Date Code Title Description
GR01 Patent grant
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20181002

Termination date: 20190322

CF01 Termination of patent right due to non-payment of annual fee