EP1428100A2 - Systeme serveur-ordinateur, et procede de controle des droits d'acces d'un usager - Google Patents

Systeme serveur-ordinateur, et procede de controle des droits d'acces d'un usager

Info

Publication number
EP1428100A2
EP1428100A2 EP02758157A EP02758157A EP1428100A2 EP 1428100 A2 EP1428100 A2 EP 1428100A2 EP 02758157 A EP02758157 A EP 02758157A EP 02758157 A EP02758157 A EP 02758157A EP 1428100 A2 EP1428100 A2 EP 1428100A2
Authority
EP
European Patent Office
Prior art keywords
user
rights
server computer
key
system server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP02758157A
Other languages
German (de)
English (en)
Inventor
Michael Schlereth
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Siemens AG
Original Assignee
Siemens AG
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Siemens AG filed Critical Siemens AG
Publication of EP1428100A2 publication Critical patent/EP1428100A2/fr
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer

Definitions

  • the invention relates to a method and a system server computer and a computer system for checking the rights for an input of a user from a client computer.
  • control system for example a programmable logic controller (PLC)
  • PLC programmable logic controller
  • client computer can load html pages from the server computer, for example to display process values on a user interface.
  • the link between an output field on the html page and the process value is permanently programmed, for example, using a JAVA script or using OCX (OLE Control Extension).
  • From US-A-6061603 is a system for remote access to a control system via a commercial communication known network.
  • 1 shows a block diagram of this previously known system.
  • the system includes a personal computer 8 with a browser program 10.
  • the browser 10 can be a commercially available Internet browser such as, for example, Netscape Communication Navigator or Microsoft Internet Explorer.
  • the browser program 10 is used to access a so-called website 4 via the Internet 14 to display the contents of the website 4 on the monitor 12 of the personal computer 8 for a user 2.
  • the website 4 contains a network interface 16 with a unique Internet address 18 as well as a server computer 20 and an application program 22.
  • the server computer 20 is used to interpret HTTP protocols and uses TCP / IP by means of the TCP / IP stack 24 to interact with the network interface 16 and the application program 22. This enables data transfer between the application program 22 and the user 2 via the Internet 14.
  • the application program 22 supplies data from a control system 6. This data can be used to monitor the control by the user 2, since this data is used by means of the TCP / IP stack 24 from the website 4 via the Internet 14 to the personal computer 8 of the user 2 can be transferred. This creates a human-machine interface on the personal computer 8.
  • the user 2 can establish a connection to the Internet 14 via a so-called Internet service provider and then enter the address of the website 4 in the browser program 10.
  • the user 2 can then read, for example, a homepage of the website 4 using the browser 10 and call up information from there.
  • the browser 10 sends commands to the website 4, which the application program 22 uses, for information generated by the Control system 6 are made available to display.
  • a disadvantage of these previously known systems is in particular that the application program 22 must be programmed specifically for a specific control system 6 and does not allow any flexibility.
  • the invention is based on the object of providing an improved method and an improved system server computer and a computer system for checking the rights for an input by a user.
  • the invention permits effective authentication and checking of the rights for an input by a user when using a client computer for operating, observing and / or projecting a plant, with the plant or its via a network, for example an intranet, extranet or Internet Plant server computer is accessed.
  • a client computer for operating, observing and / or projecting a plant, with the plant or its via a network, for example an intranet, extranet or Internet Plant server computer is accessed.
  • the client computer can be any type of electronic device which is suitable for loading a page in a markup language, for example using the HTTP protocol over the Internet.
  • the client computer can be a so-called thin client that uses a web browser as the user interface.
  • a mobile computer or a so-called webpad can also be used as the client computer.
  • the use of a mobile phone with a WAP browser as a client is also suitable.
  • a particular advantage of communication using an Internet protocol is the possibility of installing a so-called firewall in front of the system server computer in order to protect the system from unauthorized access.
  • Another particular advantage of the invention is that an Internet infrastructure can be used for user identification and rights assignment.
  • a cookie is assigned on the system side when the user first logs on to the system server computer. This cookie is transferred to the client computer and stored there. Each time the client computer accesses the plant server computer, the cookie is transmitted to the plant server computer. The system server computer then checks the cookie to determine whether the user has sufficient rights for his input. For this purpose, the cookie is mapped to automation-specific user rights.
  • an expanded URL (Uniform Resource Locator) is used for the user identification and the verification of the rights.
  • a user ID is first assigned.
  • This user ID is saved on the server side. After the user has logged on and the user ID has been assigned, the system server computer generates a client-specific page in a markup language which is loaded from the client computer via the Internet.
  • the URLs of the links each containing an extension.
  • the user ID is encoded or uncoded. If the user of the Client computer selects such a link on the client-specific side, the corresponding URL with the extension is transmitted to the system server computer. On the server side, the user identification is then carried out using the identifier contained in the extension and the extension is used to check whether the user is authorized to make the entry. This allows the user to offer a plant-specific view that is tailored to the rights that the user has.
  • FIG. 1 is a block diagram of a control system known from the prior art
  • FIG. 2 shows a block diagram of a first embodiment of a computer system according to the invention
  • FIG. 3 is a flowchart for the login of a user on the system server computer of the computer system of FIG. 2;
  • FIG. 4 is a flowchart for checking the rights for user input in the computer system of FIG. 2;
  • FIG. 5 shows a second preferred embodiment of a computer system according to the invention, in which an extension of the URLs is used to check the rights
  • FIG. 6 is a flowchart for logging in a user and checking rights in the computer system of FIG. 5.
  • FIG. 2 shows a computer system with a system server computer 25 for monitoring, control and / or project tion of a system 26.
  • the system server computer 25 communicates with the system 26, or with a programmable logic controller of the system 26 or with various units of the system 26 via a fieldbus 27.
  • the system server computer 25 contains a computer program 28 and a page 29 in a markup language.
  • the markup language can be, for example, the Hypertext Mark Up Language (HTML) or the Extended Hypertext Mark Up Language (XML).
  • a script 30 is encoded on page 29. This can be, for example, a JAVA script. Alternatively, a so-called applet can also be encoded on page 29.
  • the script is superfluous because cookie handling is integrated in the browser.
  • the browser checks whether there is a cookie for this server in its memory (e.g. hard drive, RAM) and automatically transfers the content of the cookie to the server with the page request).
  • a table 31 is stored on the system server computer, which assigns a password and system-specific access rights to each registered user.
  • a password In addition to a password, other authentication features such as the ID of a chip card can be used. In this case, the corresponding ID of the identification procedure used would be stored.
  • a table 32 is also shown on the system server computer 25.
  • the table 32 For each active connection between a client computer of one of the users and the system server computer 25, the table 32 contains a separate session which is identified by a session number. Each session number is assigned the user's rights, as well as a cookie with a key assigned to the session number. This key is stored in the cookie on the client. In Internet Explorer, for example, the cookie is a text file on the hard disk.
  • the computer system includes one or more client computers 33, which can communicate with the system server computer 25 via a network, for example the Internet.
  • client computers 33 can communicate with the system server computer 25 via a network, for example the Internet.
  • a network for example the Internet.
  • only one client computer 33 is online with the system server computer 25.
  • the client computer 33 contains a browser program 34 for accessing pages in a markup language on the system server computer and for interpreting scripts.
  • This can be a common browser, such as. B. Netscape Navigator or Microsoft Internet Explorer.
  • the user of the client computer 33 enters the URL of page 29 into the browser program 34.
  • the page 29 with the script 30 is then transmitted from the system server computer 25 to the client computer 33 and displayed there by means of the browser program 34; the script 30 is interpreted and executed by the browser program 34.
  • the user of the client computer 33 is then used to log on to the system server computer 25 Entered his user ID and password.
  • the program 28 of the system server computer 25 then checks whether there is a user with this user ID in the table 31 and whether the entered password is correct. If this is the case, the program 28 assigns a session number for the current connection of the client computer 33 to the system server computer 25 in table 32.
  • the program 28 also accesses the table 31 in order to determine the rights of the user. These calculations are stored in table 32 under the corresponding session number.
  • the program 28 also generates a cookie which contains a key for access to the rights of the session number in question, which are stored in the table 32.
  • This cookie is then transmitted from the system server computer 25 to the client computer 33 and stored there by the browser in a memory 35 of the client computer 33.
  • the memory 35 can be, for example, a hard disk or another volatile or non-volatile memory of the client computer 33.
  • the browser program 34 If the user of the client computer 33 makes an entry on the page 29 displayed by the browser program 34 and presses the enter key, the corresponding entry is transmitted to the system server computer 25. At the same time, the browser ensures that the cookie is read from the memory 35 and is transmitted to the system server computer 25 together with the input. The program 28 then reads the key from the cookie and uses the key in the table 32 to access the rights of the user.
  • the program 28 then checks whether the rights of the user are sufficient for the input. If this is the case, the Accepted input and, if necessary, transmitted to system 26 via fieldbus 27; otherwise the entry is rejected and the user is informed accordingly.
  • FIG. 3 shows a flow diagram for the login of a user - for example on the system server computer 25 of FIG. 2.
  • step 40 the user loads a page in a markup language, for example an html page.
  • the user then receives the request to enter his user ID and his password.
  • step 41 server access is then made to a database in which all the user IDs of the registered users, as well as the corresponding passwords and the access rights assigned to the user IDs are stored.
  • step 42 it is checked whether the user with the entered user ID exists in the database and whether the password or other authentication such as e.g. an inserted chip card is correct. If this is not the case, access is refused in step 43.
  • the password or other authentication such as e.g. an inserted chip card
  • a session for the user with a session number is generated in step 44.
  • the user rights are read from the database with the user ID as a key and saved together with the session number in a table.
  • a session key is also generated, which is used to access the user rights of the session in question in the table.
  • This session key is saved in a cookie.
  • the cookie is transferred to the client computer of the user and stored there in step 46.
  • Fig. 4 shows the corresponding process when entering a user.
  • the user is first entered on the page that was previously loaded in step 40 (cf. FIG. 3).
  • the corresponding input value is transmitted to the system server computer; at the same time, the browser ensures that the cookie (cf. step 46 of FIG. 3) is also read from the relevant memory of the client computer and is also transmitted to the system server computer.
  • step 51 there is access to the user rights in the table (cf. step 44 of FIG. 3), the key encoded in the cookie being used for the access.
  • Step 52 then checks whether the rights of the user are sufficient for the input. If this is not the case, this entry is rejected in step 53. In the opposite case, the input is accepted in step 54, processed by the system server computer and possibly transmitted to the system.
  • a particular advantage of this embodiment is that the storage and transmission of the cookie is invisible to the user and the user has no direct access to the cookie and the key contained therein and cannot pass the cookie on to other users. This provides a further protective function against unauthorized access.
  • FIG. 5 shows the block diagram of a further preferred embodiment, in which elements are the elements of FIG. 2 correspond, are identified by the same reference numerals.
  • a table 37 is shown on the system server computer 25 of FIG. 5, which contains a user ID and a corresponding password and the rights assigned to the user ID for each registered user. To log on to the system server computer 25, the user must in turn enter his user ID and password.
  • the program 28 assigns a further user ID (user ID) for the session in question, which is also shown in table 37.
  • This user ID is assigned to the user ID and serves as a key for access to the corresponding rights of the user concerned.
  • This dynamic user ID is only valid for the duration of a session and can no longer be used after the end of a session.
  • the program 28 then dynamically generates a page 29 in a markup language for the user concerned.
  • page 29 the user is provided with various links - when using an Internet infrastructure, so-called hypertext links - e.g. B. Link 1, Link 2, Link 3 - each offered for calling up additional pages of the web stored on the system server computer 25.
  • the links generated for the user on page 29 can be selected by the program 28 in accordance with the rights of the user, that is to say that a user with lower rights also receives only the links corresponding to his rights for selection.
  • Each of the links consists of a URL that contains an extension.
  • This extension can be attached to the URL, for example.
  • the extension includes the user ID.
  • the dynamically generated page 29 is transmitted from the system server computer 25 to the client computer 33 and displayed there by means of the browser 34.
  • the user selects one of the links offered on page 29 for calling up a further page, for example by double-clicking on link 1.
  • the page in question with the URL of link 1 is then loaded onto client computer 33 and displayed by means of the browser 34.
  • the user of the client computer 33 can then make an entry on this page with the URL of the link 1.
  • By pressing the enter key it is transmitted to the system server computer 25 together with the URL and its extension.
  • the program 28 checks on the basis of the user ID contained in the extension of the URL by accessing the table 37 whether the corresponding rights of the user are sufficient for the entry to be made.
  • step 60 the user first logs on to the system server computer.
  • step 61 the user is assigned a user ID on the server side. This user ID serves as a key for access to the user rights that are stored on the system server computer.
  • a page is then dynamically generated in a markup language for the user.
  • This page contains links whose URL is extended by the user ID.
  • This dynamically generated page is loaded by the client in step 63 and displayed by means of a browser program.
  • the user selects one of the links on the page so that the corresponding page is loaded and displayed on the client computer using the browser program.
  • the user makes an entry on the page with the link selected in step 64.
  • this input is transmitted together with the extended URL of the page to the system server computer, where a check of the rights of the user takes place in step 65.
  • the rights of the user are accessed with the user ID, which is included in the extension of the URL of the link of the page in question, in order to check whether these are sufficient for the entry to be made.
  • step 66 If the result of the decision in step 66 is that the rights are not sufficient, this entry is rejected in step 67.
  • step 68 the system server computer accepts and processes the input.
  • the invention relates to a computer system and method for checking the rights for an input of a user into a system server computer with the following steps:

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Computer And Data Communications (AREA)

Abstract

L'invention concerne un système d'ordinateur et un procédé de contrôle des droits d'accès d'un usager dans un système serveur-ordinateur (25) caractérisé en ce qu'il comprend les étapes suivantes : transmission d'un mouchard électronique, conjointement avec l'entrée d'un client-ordinateur (33) de l'usager au système serveur-ordinateur (25), ledit mouchard comprenant une clé d'accès aux droits de l'usager ; et contrôle des droits de l'usager pour l'entrée au moyen de la clé.
EP02758157A 2001-09-10 2002-08-23 Systeme serveur-ordinateur, et procede de controle des droits d'acces d'un usager Ceased EP1428100A2 (fr)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
DE2001144336 DE10144336A1 (de) 2001-09-10 2001-09-10 Anlagen-Server-Computer und Verfahren zur Überprüfung der Rechte für eine Eingabe eines Benutzers
DE10144336 2001-09-10
PCT/DE2002/003105 WO2003025714A2 (fr) 2001-09-10 2002-08-23 Systeme serveur-ordinateur, et procede de controle des droits d'acces d'un usager

Publications (1)

Publication Number Publication Date
EP1428100A2 true EP1428100A2 (fr) 2004-06-16

Family

ID=7698363

Family Applications (1)

Application Number Title Priority Date Filing Date
EP02758157A Ceased EP1428100A2 (fr) 2001-09-10 2002-08-23 Systeme serveur-ordinateur, et procede de controle des droits d'acces d'un usager

Country Status (3)

Country Link
EP (1) EP1428100A2 (fr)
DE (1) DE10144336A1 (fr)
WO (1) WO2003025714A2 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE10333888B3 (de) * 2003-07-22 2005-04-07 Siemens Ag Verfahren zum Steuern eines Datenaustauschs
DE102004055938A1 (de) * 2004-11-19 2006-05-24 Siemens Ag Generieren und Verwalten eines Rechte-Kontextes für die Auftragsabwicklung von technischen Prozessen

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6282454B1 (en) * 1997-09-10 2001-08-28 Schneider Automation Inc. Web interface to a programmable controller
US6185567B1 (en) * 1998-05-29 2001-02-06 The Trustees Of The University Of Pennsylvania Authenticated access to internet based research and data services
US6205480B1 (en) * 1998-08-19 2001-03-20 Computer Associates Think, Inc. System and method for web server user authentication
US6339423B1 (en) * 1999-08-23 2002-01-15 Entrust, Inc. Multi-domain access control
GB2357599B (en) * 1999-12-23 2004-08-04 Ibm Method for preventing parasitic usage of web page embedded files

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See references of WO03025714A3 *

Also Published As

Publication number Publication date
WO2003025714A3 (fr) 2004-01-22
WO2003025714A2 (fr) 2003-03-27
DE10144336A1 (de) 2003-04-03

Similar Documents

Publication Publication Date Title
DE69729356T2 (de) Verfahren und gerät zur sicherung des zugangs einer station zu mindestens einem server
DE69832786T2 (de) Vorrichtung und verfahren zur identifizierung von klienten die an netzwer-sites zugreifen
DE69838262T2 (de) Allgemeine benutzer-authentifizierung für netz-rechner
EP1559038A2 (fr) Procedes de pre-transmission de quantites de donnees structurees entre un dispositif client et un dispositif serveur
EP2340485A1 (fr) Procédé de configuration d'une application
DE69716548T2 (de) Verfahren und Anordnung zur Übertragung von elektrischen Datensignalen
WO2014044507A1 (fr) Procédé pour une manipulation sûre d'un appareil de terrain
EP1428100A2 (fr) Systeme serveur-ordinateur, et procede de controle des droits d'acces d'un usager
EP1953654A1 (fr) Procédé de détermination d'au moins deux pages Internet analogues
EP1374041A2 (fr) Surveillance de serveurs
EP2456157B1 (fr) Protection de la sphère privée lors de l'inscription d'un utilisateur à un service Web sécurisé à l'aide d'un téléphone mobile
WO2016206929A1 (fr) Système de fourniture et d'évaluation de messages
DE60111159T2 (de) Verfahren zur Steuerung des Zugangs zu einem Datenkommunikationsnetz
EP1419638B1 (fr) Procédé, serveur informatique et système de contrôle d'accès aux données
DE102012102399B4 (de) Verfahren und Telekommunikationsanordnung zur Bereitstellung von Daten an einem Client-Computer
WO2002067532A1 (fr) Procede pour transmettre des donnees, serveur mandataire et systeme de transmission de donnees
EP1435025B1 (fr) Systeme et procede pour acceder a un appareil, en particulier a un appareil d'automatisation pourvu d'une interface normalisee
WO2004090748A2 (fr) Procede et systeme pour produire des pages web adaptees a des caracteristiques de client
DE10036734A1 (de) Verfahren zum interaktiven Kommunizieren zwischen einem internetfähigen Endgerät und einem internetfähigen Webserver
WO2008113599A2 (fr) Supports de données portatifs en tant que serveurs web
EP3206357A1 (fr) Utilisation d'un procede cryptographique non-local apres authentifcation
DE10059931B4 (de) Verfahren und Vorrichtung zur Datenübertragung und ferngesteuerten Erzeugung von Ausgabedaten
DE102015118064A1 (de) Computersystem zur Kommunikation mit einer Industriemaschine
DE102015108714A1 (de) Verfahren zum Einstellen von Einstellungen innerhalb eines mobilen elektronischen Endgeräts
EP2905943A1 (fr) Procédé permettant de mettre à disposition des services de contrôle externes dans un réseau

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20040220

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR IE IT LI LU MC NL PT SE SK TR

17Q First examination report despatched

Effective date: 20040614

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20051113