JP2005252947A - Remote maintenance access control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a remote maintenance access control system which enables a security policy to be dynamically applied and to realize a high security level operation of a distributed control system with saved labor. <P>SOLUTION: A remote maintenance access control system which determines a transfer capability to a distributed control system of a maintenance message which communicates between a remote maintenance site 110 and a distributed control system 123 through a network 100, and controls a communication is provided with an engineering server 124 holding a device arrangement management table of the distributed control system, a security policy server 125 generating a security policy which is a condition combination of maintenance processing adaptable to the distributed control system based on the device arrangement management table, and an access control portion 122 which receives a maintenance message from the remote maintenance site 110 to the distributed control system 123, matches the message with the security policy, and passes only a maintenance massage permitted to the distributed control system 123. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  This invention detects and rejects unauthorized access to a distributed control system by a third party or dangerous remote operation when a remote control system such as a plant or factory is remotely controlled from a maintenance terminal connected to the Internet or the like. The present invention relates to a remote maintenance access control system.

  Conventional remote maintenance access control systems have been dealt with by detecting and rejecting unauthorized access from outside by installing a security device such as a firewall that inspects maintenance messages between the distributed control system and the external network connection. (For example, refer to Patent Document 1).

JP 2002-358380 A

  In the conventional technology, a security device for inspecting a maintenance message is added to the distributed control system. However, a security policy which is a condition for permitting remote maintenance, for example, address information between the maintenance terminal and the distributed control system, user information However, there is a problem that maintenance work condition definitions such as maintenance work commands need to be finely defined in advance according to the operation of the distributed control system, which is very troublesome. Security policies should be applied dynamically according to operations such as periodic plant inspections and subsequent inspections. However, the remote maintenance access control system is not linked to the engineering information of the distributed control system, so the security policy There was a problem that it took time to change the setting of.

  The present invention has been made to solve the above-described problems, and can dynamically apply a security policy, and can realize a high security level operation for remote maintenance access to a distributed control system with less labor. The purpose is to obtain a remote maintenance access control system.

  The present invention relates to a remote maintenance access control system that judges whether or not transfer of a maintenance message communicated between a maintenance terminal connected to a network and a distributed control system to the distributed control system via the network and performs communication control. Generate a security policy that is a condition combination of the engineering server that holds the device configuration management table that can grasp the device and data configuration of the device and the maintenance message that is permitted to be transferred to the distributed control system based on the device configuration management table A security policy server to be held, and an access control unit that receives a maintenance message from the maintenance terminal to the distributed control system and passes only the maintenance message that is permitted by collating with the security policy.

  The remote maintenance access control system according to the present invention is a remote maintenance access control for judging whether or not to transfer a maintenance message to a distributed control system for communicating between the maintenance terminal connected to the network and the distributed control system via the network, and controlling the communication. This is a condition combination related to an engineering server that holds a device configuration management table that can grasp the configuration of devices and data in the distributed control system and a maintenance message that is permitted to be transferred to the distributed control system based on the device configuration management table. A security policy server that generates and holds a security policy, and an access control unit that receives a maintenance message from the maintenance terminal to the distributed control system and passes only the permitted maintenance message against the security policy; So equipped, startup of the distributed control system, repair and refurbishment, it is possible to dynamically enforce security policies depending on the situation, such as during periodic inspection and disorders, it is possible to realize a high security level while saving effort.

Embodiment 1 FIG.
1 is a block diagram showing the configuration of a remote maintenance access control system and a maintenance terminal according to Embodiment 1 of the present invention, and FIG. 2 is a block diagram showing the configuration of the remote maintenance access control system shown in FIG. In FIG. 1, a remote maintenance site 110 as a maintenance terminal and a plurality of factories (plants) 120 as maintenance target terminals are connected to a network 100 composed of the Internet or an external network. In the remote maintenance site 110, a maintenance terminal 113 is connected to a maintenance-side intranet 111 of the maintenance site, and the maintenance-side intranet 111 is connected to the network 100 via an access router 112. In the factory 120, a distributed control system 123, an engineering server 124, and a security policy server 125 are connected to a plant intranet (or control network) 121. Further, the plant intranet 121 is connected to the network 100 via an access control unit 122. Is done.

  In FIG. 2, the engineering server 124 includes device configuration information of the distributed control system 123, that is, the network address of the distributed controller, variable names and addresses on the controller such as tags and labels, manufacturers and model numbers of devices such as valves and sensors. A device configuration management table 1241 that can grasp device attribute information is held. The device configuration management table 1241 is composed of, for example, five elements such as device configuration management table: <device ID, manufacturer name, model number, controller ID, device address> as shown in FIG. 3 for each device ID. is there.

  A device is a plant control device such as a valve or a sensor, and can be identified by the manufacturer name, model number, and device ID. This device ID is an identifier for uniquely specifying a device in the distributed control system 123. The controller ID and device address are the controller that manages and controls the corresponding device and the address where the corresponding device data is stored on the controller. Since some devices, such as a field network, are connected without going through a controller, the controller ID is a field network address, and the device address is a node address on the field network. Such information is given to the engineering server 124 as design information when the distributed control system 123 is constructed, and is generated as an initial setting.

  When the access control unit 122 receives the maintenance message from the maintenance terminal 113, the access control unit 122 checks whether the content is a condition permitted as a security policy, passes if it is permitted, and rejects if it is not permitted. Is provided. The maintenance message here includes, for example, four elements such as maintenance message :: <user ID, device ID, command, option> as shown in FIG. A user refers to a user who operates maintenance terminal 113. The command defines a unit of operation for tagging / referencing / writing in remote maintenance (in FIG. 4, LockTag, ReadData, SetData).

  The security policy server 125 includes a standard security policy 1252, user definition information 1253, a security policy 1251, and a detailed setting dialog 1254. The standard security policy 1252 defines what remote maintenance is allowed for which manufacturer's device. For example, as shown in FIG. 5, it is composed of two elements such as a standard security policy :: <maker name, command>. The user definition information 1253 is a table that defines which manufacturer the user belongs to. For example, as shown in FIG. 6, it is composed of two elements such as user definition information :: <user ID, manufacturer name>.

  The security policy 1251 indicates a combination of permitted maintenance processing conditions applicable to the distributed control system 123, and is used to define which user can operate which device and how. Normally, since the number of devices installed in the distributed control system 123 ranges from several thousands to several tens of thousands, it is not easy to initialize the security policy 1251 for each device. However, here, since the engineering server 124 of the distributed control system 123 has a device configuration management table 1241 that defines which device is connected to which control device, the device ID list of the device configuration management table 1241 is present. Can be used to set the security policy 1251.

  Specifically, for each device in the device configuration management table 1241, a command is selected from the standard security policy 1252 using the manufacturer name as a key, and the manufacturer name is expanded to the user ID of the user definition information 1253 to automatically set the security policy 1251. Generate. By the above means, a security policy 1251 for each user ID is generated and composed of three elements such as security policy :: <user ID, device ID, command> as shown in FIG.

  Since the remote maintenance access control system of the first embodiment configured as described above can link the device configuration management table of the engineering server and the security policy of the security policy server, the security setting related to the remote maintenance of the distributed control system Can be saved. In addition, the setting information of the engineering server can be used to automate the setting of the security policy, and further labor saving of the security setting is possible.

  The security policy shown in the first embodiment is a standard example. As another example, a device model number is added to the standard security policy 1252 and the user-defined information 1253, and the security policy 1251 is automatically set for each manufacturer model number. It is also possible to set. It is also possible to add details of work indicating what kind of work the user is in charge of remote maintenance as an element, and to refine the permissible command for each user of the security policy 1251. Furthermore, it goes without saying that as a factor to be added, the date and time of remote maintenance, the time zone, the network address of the maintenance terminal, etc. may be added.

Embodiment 2. FIG.
FIG. 8 is a block diagram showing the configuration of the remote maintenance access control system according to the second embodiment of the present invention. This embodiment is an invention in the case where it is necessary to change the setting of the security policy 1251 of the corresponding device when the configuration change or addition of the controller or device of the distributed control system 123 is performed.

  The engineering server 124 includes a monitoring unit 1242 for a device configuration management table 1241 that notifies the security policy server 125 of information on a corresponding device ID when the device configuration table 1241 is updated by changing or adding a device. The security policy server 125 displays a detailed setting dialog 1254 that prompts the administrator to reset the security policy of the corresponding device ID. Then, the administrator confirms and resets the security policy 1251 at the corresponding location according to the display contents of the detailed setting dialog 1254.

  As another method, when the security policy server 125 does not display an instruction in the detailed setting dialog 1254 but when a new device is added or device configuration information is changed, the standard security policy 1252 and the user definition information 1253 are used. The security policy 1251 may be automatically set according to the device configuration management table 1241.

  As another method, there is a method of monitoring a change in the device configuration management table by the monitoring unit 1242 of the device configuration management table 1241 and confirming the change in the device configuration management table at a constant cycle. In this case, the security policy server 125 compares the contents of the device configuration management table 1241 read out in advance with the contents of the device configuration management table 1241 read out after notification, and detects a change in the device configuration management table 1241. Good.

  The remote maintenance access control system according to the second embodiment configured as described above has the same effect as that of the first embodiment, but when the configuration of the distributed control system is changed, the configuration is changed. The security policy of the selected device can be set automatically. Therefore, labor saving of security setting can be achieved.

Embodiment 3 FIG.
FIG. 9 is a block diagram showing the configuration of the remote maintenance access control system according to the third embodiment of the present invention. In general, remote maintenance is required for periodic inspections of distributed control systems, such as diagnosis of device operation, adjustment for aging, or setting adjustment after periodic replacement of parts. is there. According to the security policy 1251 of the first embodiment, an authorized user can perform remote maintenance at any time, but can perform remote maintenance only during periodic inspections, and in other cases, the security policy cannot be accessed by anyone. The higher the security level against unauthorized access and malicious access, the higher the setting. Therefore, in the present invention, a method for determining the security policy 1251 corresponding to the contents of the maintenance schedule will be described.

  First, the engineering server 124 includes a maintenance schedule 1243 that plans which controller and device to periodically inspect. The period represents a period such as a date and time when the corresponding device is remotely maintained in a periodic inspection and a work time zone. For example, as shown in FIG. 10, it is composed of three elements such as maintenance schedule :: <controller ID, command, period>. The security policy 1251 has a period as an element corresponding to the maintenance schedule 1243. For example, as shown in FIG. 11, it is configured and generated from four elements such as security policy :: <user ID, device ID, command, period>.

  As described above, the security policy server 125 reads the device configuration management table 1241 and the maintenance schedule 1243 of the engineering server 124 in the initial setting of the security policy 1251, and performs the initial setting of the security policy 1251. In general, in the distributed control system 123, a controller is assigned to each subsystem that is meaningful as a plant such as a cooling system or an exhaust heat repair system, and the periodic inspection is generally performed for each subsystem. The controller ID is an identifier for identifying a plurality of controllers and matches the controller ID in the device configuration management table 1241. Therefore, the security policy 1251 is expanded for all device IDs connected to each controller. However, the maintenance schedule can be expanded in units of device IDs on the engineering server 124 side.

  Further, when the maintenance schedule 1243 is changed, the engineering server 124 includes a maintenance schedule monitoring unit 1244. The maintenance schedule monitoring unit 1244 notifies the security policy server 125 of the maintenance schedule change, and the security policy server 125 performs security. A default setting and detailed setting dialog display 1254 of the policy 1251 is performed. Needless to say, the maintenance schedule 1243 may be in a server or database different from the engineering server 124.

  As described above, the security policy 1251 is set, and the access control unit 122 checks the maintenance message according to the generated security policy 1251 and determines whether the message is passed or discarded. Although there is no time information in the message, the current message held by the access control unit 122 and the period of the security policy 1251 are compared to determine whether to pass the maintenance message. It is also possible to consider a method in which the transmission time from the remote maintenance terminal is built in the maintenance message itself and does not depend on the time of the access control unit 122.

Embodiment 4 FIG.
FIG. 12 is a block diagram showing the configuration of the remote maintenance access control system according to the fourth embodiment of the present invention. Remote maintenance is required in addition to the periodic inspection when a failure occurs in the distributed control system 123. In the third embodiment, the security policy is linked to the maintenance schedule. However, the maintenance schedule change and the security policy resetting confirmation are administrator tasks. Here, by preparing a remote maintenance plan for post-maintenance when a failure occurs in the distributed control system 123, a security policy 1251 that permits only remote maintenance of the corresponding device in conjunction with the occurrence of the failure is applied. be able to.

  As shown in FIG. 12, a post-maintenance schedule 1245 of the engineering server 124 is prepared. The configuration is the same as the maintenance schedule, but the start of the period is insignificant, and the completion is the number of days and the elapsed time from the start. When a failure occurs in the distributed control system 123, the controller of the distributed control system 123 (functioning as a detection unit that detects the failure) notifies the engineering server of a failure 1231. Since the failure notification 1231 includes a controller ID or device ID so that the location where the failure has occurred can be specified, the engineering server 124 sets the start of the post-maintenance schedule 1245 related to the controller at the current time and the completion from the current time. Set after the specified date and time.

  The engineering server 124 notifies the content of the post-maintenance schedule 1245 to the security policy server 125, and the security policy server 125 changes the security policy 1251. At this time, it is not necessary to display the detailed setting dialog 1254 for the administrator and confirm the setting, but the administrator may confirm the setting as necessary. The access control unit 122 permits remote maintenance of the failure location by the security policy 1251 reflecting the subsequent maintenance schedule 1245.

  The remote maintenance access control system of the fourth embodiment configured as described above has the same effects as those of the above-described embodiments, and is linked to a failure when a failure is detected in the distributed control system. Thus, the security policy can be automatically changed so that the remote maintenance of the failure location is possible.

Embodiment 5 FIG.
FIG. 13 is a block diagram showing the configuration of the remote maintenance access control system according to the fifth embodiment of the present invention. In the fifth embodiment, unlike the fourth embodiment, the engineering server 124 does not have a post-maintenance schedule, and the security policy server 125 in which the controller issues a failure notification 1231 includes the post-maintenance setting unit 1255. 1255 receives the failure notification 1231 and sets the maintenance period for the failed device in the security policy 1251 from the current time to a specified date and time (within several hours to several days). Even if comprised in this way, there can exist an effect similar to the said Embodiment 4. FIG.

Embodiment 6 FIG.
FIG. 14 is a block diagram showing the configuration of the remote maintenance access control system and maintenance terminal according to the sixth embodiment of the present invention. In each of the embodiments described above, the engineering server 124 and the security policy server 125 are formed in different configurations and interlocked. However, the present invention is not limited to this, and the functions of both the engineering server and the security policy server are provided. It can also be configured as a single security engineering server 126 having the same effects as the above-described embodiments.

Embodiment 7 FIG.
In each of the above-described embodiments, the standard security policy 152 included in the security policy server 125 is configured with a manufacturer name and a command. However, the standard security policy 1252 is configured with a device type and a command, and the engineering server 124 includes A configuration in which a device type is added to the device configuration management table 1241 may be used. For example, as shown in FIG. 15, the device configuration management table is composed of six elements such as: <device ID, manufacturer name, model number, controller ID, device address, device type>. Also, as shown in FIG. 16, it is composed of two elements such as standard security policy :: <device type, command>. The device type is a device type such as a valve or a flow meter that is defined.

  The security policy server 125 selects a command from the standard security policy 1252 using the device type of the device configuration management table 1241 as a key, expands it to the user ID of the user definition information 1253, and automatically generates the security policy 1251. Then, as shown in FIG. 7, each user ID is composed and generated from three elements such as security policy :: <user ID, device ID, command>. Thus, even if the security policy 1251 is generated, the same effects as those of the above embodiments can be obtained.

It is a block diagram which shows the structure of the remote maintenance access control system and maintenance terminal of Embodiment 1 of this invention. It is a block diagram which shows the structure of the remote maintenance access control system shown in FIG. It is a figure which shows the device configuration management table of the remote maintenance access control system of Embodiment 1 of this invention. It is a figure which shows the maintenance message of the remote maintenance access control system of Embodiment 1 of this invention. It is a figure which shows the standard security policy of the remote maintenance access control system of Embodiment 1 of this invention. It is a figure which shows the user definition information of the remote maintenance access control system of Embodiment 1 of this invention. It is a figure which shows the security policy of the remote maintenance access control system of Embodiment 1 of this invention. It is a block diagram which shows the structure of the remote maintenance access control system of Embodiment 2 of this invention. It is a block diagram which shows the structure of the remote maintenance access control system of Embodiment 3 of this invention. It is a figure which shows the maintenance schedule of the remote maintenance access control system of Embodiment 3 of this invention. It is a figure which shows the security policy of the remote maintenance access control system of Embodiment 3 of this invention. It is a block diagram which shows the structure of the remote maintenance access control system of Embodiment 4 of this invention. It is a block diagram which shows the structure of the remote maintenance access control system of Embodiment 5 of this invention. It is a block diagram which shows the structure of the remote maintenance access control system and maintenance terminal of Embodiment 6 of this invention. It is a figure which shows the device configuration management table of the remote maintenance access control system of Embodiment 7 of this invention. It is a figure which shows the security policy of the remote maintenance access control system of Embodiment 7 of this invention.

Explanation of symbols

100 network, 110 remote maintenance site,
111 maintenance site intranet, 112 access router, 113 maintenance terminal,
120 factories, 121 plant intranets, 122 access control units,
123 distributed control system, 124 engineering server,
125 security policy server, 126 security engineering server, 1221 message inspection unit, 1231 failure notification,
1241 device configuration management table, 1242 monitoring unit,
1243 Maintenance schedule, 1244 Maintenance schedule monitoring unit,
1245 Ex-post maintenance schedule, 1251 security policy,
1252 Standard security policy, 1253 user-defined information,
1254 Detailed setting dialog, 1255 Post maintenance setting part.

Claims (6)

In a remote maintenance access control system for determining whether to transfer a maintenance message to a distributed control system communicating between the maintenance terminal connected to the network and the distributed control system via the network, and controlling the communication, a device of the distributed control system and Generates and holds a security policy that is a combination of conditions related to maintenance messages that are permitted to be transferred to the distributed control system based on the above-mentioned device configuration management table and an engineering server that holds a device configuration management table that can grasp the data configuration The security policy server that receives the maintenance message from the maintenance terminal to the distributed control system, and passes only the maintenance message that is permitted by collating with the security policy to the distributed control system. Remote maintenance access control system characterized by comprising a control unit. The engineering server includes a manufacturer name element in the device configuration management table, and the security policy server includes a standard security policy set by the manufacturer name and permitted maintenance commands, a user performing the maintenance operation, and a manufacturer name. The remote maintenance access control system according to claim 1, wherein the security policy is generated using the manufacturer name as a key. A device type is added as an element to be configured in the device configuration management table of the engineering server, and the security policy server performs a standard security policy set by the device type and a permitted maintenance instruction, and a maintenance operation. 2. The remote maintenance access control system according to claim 1, further comprising: user definition information set by a user to be performed and a manufacturer name, and generating the security policy using the device type as a key. The engineering server includes a monitoring unit that monitors a change / addition of a device configuration in the device configuration management table, and the monitoring unit detects the change / addition of the device configuration to the security policy server when detecting the change / addition of the device configuration. 4. The notification according to claim 1, wherein the security policy server regenerates / generates the security policy corresponding to the change / addition of the device configuration. Remote maintenance access control system. The remote maintenance access control system according to any one of claims 1 to 4, wherein a maintenance schedule of the distributed control system is held, and the security policy server generates a security policy corresponding to the maintenance schedule. . The failure information of the distributed control system is detected, and the engineering server regenerates a security policy related to the failure information of the detection unit according to the failure information. The remote maintenance access control system according to the above.

Images