JP2005301935A - Process controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve a problem wherein a complete check is not implemented because it is checked dependently upon an external device whether a user is authorized to change a program and data, and a system in which a connection to a communication bus is switched by a hardware switch, is a troublesome operation. <P>SOLUTION: The user transmits a security state change report together with a password when changing the program and data. A process controller collates the password and changed a present security state in the case of coincidence. Then the user transmits a change request, and the process controller refers to the present security state to check whether the received change request is permitted, and change is executed when it is permitted. The process controller itself manages and controls the security. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a process control apparatus connected to a network, and relates to a process control apparatus capable of managing and controlling security by itself.

  Today, the plant has grown to a large scale, and process control devices have been connected to various devices, including other companies, via a network. For this reason, it has become necessary to place importance on security so that it will not be invaded from the network and internal programs and data will be destroyed.

  FIG. 5 shows a configuration of a process control system connected to the network. In FIG. 5, a personal computer 61 is connected to a network such as Ethernet (registered trademark). A control station 7 is connected to the communication bus 64. Reference numeral 63 denotes a console, which connects a network 62 such as Ethernet (registered trademark) and a communication bus 64. Data setting and application change are performed by the console 63.

  In such a process control system, an application program and data can be changed by accessing the control station 7 from a personal computer 61 connected to the network 62. In this case, an unauthorized user cannot access the control station 7 by the login mechanism.

  FIG. 6 shows the configuration of the control station 7. Reference numeral 71 denotes a communication interface, which is connected to a host device via a communication bus 64. The communication interface 71 issues a request for changing the received data to the request reception task 72, and the request reception task 72 transmits this request to the request processing task 73. The request processing task 73 accesses the database 74 to process the transmitted request.

  In such a configuration, the request received by the communication interface 71 may be abnormal. Therefore, when the request is a data change or a program change, the request reception task 72 and the request processing task 73 check whether the program or the database is not destroyed.

  FIG. 7 shows the configuration of the safety instrumented system. The engineering PC 81 and the control station 9 are connected by a communication bus 82, and the data or program of the control station 9 can be changed using the engineering PC 81.

  In the control station 9, a safety function means 92, a program 93 and a database 94 are incorporated. The safety function unit 92 is connected to the communication bus 82 and changes the program 93 and the database 94 in response to a request from the engineering PC 81.

  In such a configuration, if an unauthorized request is input to the safety function means 92, the program 93 and the database 94 may be destroyed. Therefore, the security switch 91 is inserted between the communication bus 82 and the safety function means 92 so that the communication bus 82 is connected to the safety function means 92 only when necessary.

  That is, the user manually turns on the security switch 91 when rewriting the program 93 or the database 94 from the engineering PC 81, and turns it off when the change is completed. By doing so, it is possible to prevent an unauthorized user from logging in and rewriting the program 93 and the database 94.

Japanese Patent Laid-Open No. 9-218837 Japanese Patent No. 2698877

  However, the control station shown in FIG. 6 checks the validity of the request by the request reception task 72 and the request processing task 73. This check is performed whether the program or database is destroyed or the control station malfunctions. There is a problem that it is only possible to check whether or not the request is intended by the user.

  In addition, since it is left to the external device such as the personal computer 61 to check whether or not there is an authority to change, there is a problem that a reliable check cannot be performed because it is not determined in the control station.

  Since the security instrumentation system of FIG. 7 is configured to turn on the security switch 91 only when changing, it is possible to prevent rewriting at an unintended timing. However, in order to rewrite, the security switch 91 has to be turned on every time in the field, and there is a problem that the operation is troublesome.

Further, since various changes are accepted while the security switch 91 is on, there is a problem that it is difficult to prove whether or not only the changes that the user really intended are accepted. Further, there is a problem that even an unauthorized user can operate the security switch 91, the security switch 91 may break down, and lack of certainty.
Therefore, the problem to be solved by the present invention is to provide a process control device in which the control device itself controls and monitors security, and permits only a change intended at a timing intended by a user.

In order to achieve such a problem, the invention according to claim 1 of the present invention is:
Security status information means for storing the current security status;
A password storage means for storing the password;
A security status change notification is input, the password sent simultaneously with the security status change notification is compared with the password stored in the password storage means, and if the comparison result matches, based on the security status change notification Security management means for rewriting the current security status of the security status information means;
When a change request is input, referring to the current security state stored in the security state information means, and when the input change request is permitted, a request receiving means for outputting the change request;
A request processing means for inputting the change request output by the request receiving means and processing the change request;
A process control device comprising: Unintentional changes from external devices can be prevented.

The invention according to claim 2 is the invention according to claim 1,
The object to be changed by the change request is at least one of a program and data. It is possible to prevent malfunction of the process control device.

The invention according to claim 3 is the invention according to claim 1 or claim 2,
Security status notifying means is provided, and this security status notifying means notifies that when the current security status stored in the security status information means is changed. Know unintended changes in security status.

The invention according to claim 4 is the invention according to any one of claims 1 to 3.
Security state monitoring means for monitoring a current security state stored in the security state information means, and a state in which the current security state permits at least one of the change requests is predetermined. When this time is continued, the fact is notified. You can prevent forgetting to reset the security status.

The invention according to claim 5 is the invention according to claim 3 or claim 4,
The notification is made via at least one of a message and a user application. Easy to implement.

As is apparent from the above description, the present invention has the following effects.
In the present invention, when a program or data is rewritten, the current security state is first changed, and then a program or data change request is issued. Also, the password is verified when the current security status is changed.

  Since the program and data can be changed only at the timing intended by the user, there is an effect that these unintended changes from the external device can be prevented. In addition, since only the change intended by the user is permitted, there is an effect that it is possible to prevent a user's operation mistake.

  In addition, since it can be realized by software, it can be realized at a low cost and can be easily changed. Furthermore, there is an effect that operation and monitoring can be performed in a remote place. In addition, since the password is verified when the current security state is changed, there is an effect that it is possible to eliminate the operation of the user who does not have the authority to change.

  Further, by implementing a security status notification means and notifying when the current security status is changed, it is possible to know an unintended change in the security status. Furthermore, by implementing security state monitoring means so that a non-reset state does not continue for a predetermined period or more, there is an effect that it is possible to prevent forgetting to reset.

  The process control device must ensure an emergency stop when an abnormality occurs in the plant. Therefore, it is important that the control device itself can guarantee that the program and data are correctly changed, and the present invention is very effective in that respect.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of a process control apparatus according to the present invention. In FIG. 1, reference numeral 1 denotes an engineering PC, which is connected to a communication bus 2. A control station 3 is a process control apparatus. In this figure, parts not related to security management are omitted.

  The control station 3 is referred to by a communication interface 31 that is an interface of the communication bus 2, a security state information unit 32 that takes a plurality of states, a security management unit 33 that changes the security state information unit 32, and a security management unit 33. The password storage means 34 in which the security password is stored, the request receiving means 35 to which the change request received by the communication interface 31 is input, the request processing means 36 activated by the request receiving means 35, and the request processing means 36 The program 37 and the database 38 are configured. The request receiving means 35 and the request processing means 36 are each composed of a plurality of tasks.

  The communication interface 31 is connected to the communication bus 2, receives a security change request output from the engineering PC 1 and a change request for the program 37 or the database 38, and outputs it to the security management means 33 or the request processing means 35.

  The security management means 33 compares the password sent together with the security change request sent from the engineering PC 1 and the password stored in the powered storage means 34, and if they match, the security status information means 32 present Change the security state.

  The request change received by the communication interface 31 is input to the request receiving means 35. When receiving the request change, the request receiving unit 35 refers to the current security state stored in the security state information unit 32 and outputs a change request to the request processing unit 36 if permitted. The request processing means 36 resets the program 37 and / or the database 38 according to the input change request.

  Next, the concept of the operation of this embodiment will be described with reference to FIG. In FIG. 2, 4 is a control station, 41 is a firewall of this control station 4, 421 and 422 are security gates whose state changes depending on the current security state in the security state information means 32, 43 is security management means, 44, Reference numerals 45 denote accepting tasks for change requests B and C, respectively. The security management means 43 is the same as the security management means 33 in FIG. 1, and the change B reception task 44 and the change C reception task 45 are part of the request reception means 35 in FIG.

  The change request A is a request that should not be accepted in any case, and the change requests B and C are requests that are desired to be received only at a timing designated by the user.

  FIG. 2A shows a steady state, that is, a state when no change request is made. The change request A is not accepted in any case because the firewall 41 itself is closed. The change requests B and C are not accepted because the firewall 41 is open but the security gates 421 and 422 are closed.

  FIG. 5B shows a state in which the current security state in the security state information unit 32 is changed by the security change request and the change request B is accepted. Since the security gate 422 is opened, the change request B reaches the change B reception task 44 and is executed. Since security gate 421 remains closed, change request C is not accepted.

  Since FIG. 2 is schematically described, the change request is blocked by the security gates 421 and 422 so as not to reach the reception tasks 44 and 45. However, the reception tasks 44 and 45 are not included in the security status information means 32. It may be determined whether to accept with reference to.

  Next, the operation of the embodiment shown in FIG. 1 will be described with reference to FIG. In addition, the same code | symbol is attached | subjected to the same element as FIG. 1, and description is abbreviate | omitted. FIG. 3 shows the operations in order, and the time flows from top to bottom.

  In FIG. 3, the user who wants to change the program or database operates the engineering PC 1 in (A) and transmits a security state change notification to the control station 3. At this time, the password is also transmitted at the same time.

  Upon receiving the security status change notification, the security management means 33 compares the password sent at the same time with the password stored in the password storage means 34. In (D), the engineering PC 1 is notified that the change of the security state has been completed. If the passwords match, the security management unit 33 determines that the user is a special user having change authority.

  The user who has received the security state change completion notification transmits a change request using the engineering PC 1 in (E). This change request is received by the request receiving means 35. The request receiving means 35 refers to the current security status in the security status information means 32 in (F) and checks whether the received change request is permitted.

  Next, an operation of writing to the database 38 is performed in (G), and the engineering PC 1 is notified that the writing has succeeded or failed in (H). The user who has received this notification resets the security status information means 32 in (I) so that all change requests cannot be accepted.

  In addition, although the example of the write operation to the database 38 is shown in this figure, the program 37 may be changed or other operations.

  In the above-described embodiment, if the user forgets to reset the security status information means 32, there is a disadvantage that even a user who does not have a password can change the program 37 or the database 38. FIG. 4 shows an embodiment in which this defect is eliminated.

  In FIG. 4, reference numeral 5 denotes security state management means, which is built in the security management means 33. Reference numeral 51 denotes a security status notification unit, which is built in the security status management unit 5. When the current security state in the security state information unit 32 changes, the security state notification unit 51 notifies the user of the change through a message or a user application. As a result, the user can know that the security status information means 32 has been changed at an unintended timing.

  Reference numeral 52 denotes security status monitoring means, which is built in the security status management means 5 and also includes a timer 521. The security status monitoring unit 52 constantly monitors the security status information unit 32, and determines that the current security status is not safe, that is, if the status that is not in the state of FIG. The user is notified through 51 to notify the abnormality.

It is a block diagram which shows one Example of this invention. It is a figure for demonstrating the concept of this invention. It is a figure for demonstrating operation | movement of this invention. It is a block diagram which shows the other Example of this invention. It is a block diagram of a process control system. It is a block diagram of a control station. It is a block diagram of a safety instrumentation system.

Explanation of symbols

1, 4 Engineering PC
2 communication bus 3 control station 31 communication interface 32 security status information means 33, 43 security management means 34 password storage means 35 request reception means 36 request processing means 37 program 38 database 41 firewall 421, 422 security gate 44 change B reception task 45 change C reception task 5 security state management means 51 security state notification means 52 security state monitoring means 521 timer

Claims (5)

In a process control device that can change internal programs and data via a network,
Security status information means for storing the current security status;
A password storage means for storing the password;
A security status change notification is input, the password sent simultaneously with the security status change notification is compared with the password stored in the password storage means, and if the comparison result matches, based on the security status change notification Security management means for rewriting the current security status of the security status information means;
When a change request is input, referring to the current security state stored in the security state information means, and when the input change request is permitted, a request receiving means for outputting the change request;
A request processing means for inputting the change request output by the request receiving means and processing the change request;
A process control apparatus comprising:   The process control apparatus according to claim 1, wherein the object to be changed by the change request is at least one of a program and data.   The security status notifying unit is configured to notify that when the current security status stored in the security status information unit is changed. The process control apparatus according to claim 1 or 2.   Security state monitoring means for monitoring a current security state stored in the security state information means, and a state in which the current security state permits at least one of the change requests is predetermined. 4. The process control apparatus according to claim 1, wherein a notification to that effect is made when the time elapses. The process control apparatus according to claim 3, wherein the notification is performed through at least one of a message and a user application.

Images