JP2017010494A - Industrial device functioning as web server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent session hijack by simple processing in an industrial device functioning as a Web server.SOLUTION: An industrial device functioning as a Web server comprises: a session management unit which identifies a series of access processing by using a session ID and, when picking up the session ID, records the session ID and device specification information of an access source in association with each other; and a determination unit which, with respect to an access for which a session ID is specified, determines whether device specification information of an access source of this access coincides with device specification information associated with the session ID or not. If the determination unit determines non-coincidence, the session management unit determines the access to be unauthorized.SELECTED DRAWING: Figure 1

Description

  The present invention relates to session management in industrial equipment that functions as a Web server.

  Industrial equipment such as a paperless recorder, a data logger, and a waveform display device that are connected to a computer network and function as a Web server has been put into practical use. By using an industrial device that functions as a Web server, it is possible to monitor the industrial device or make various settings for the industrial device via a general-purpose Web browser that operates on a terminal device such as a PC. become able to.

  In general, industrial equipment provides a web service using HTTP (Hypertext Transfer Protocol), which is a standard protocol for content transmission and reception in a computer network. HTTP is a stateless protocol, Processing is completed by response. For this reason, a mechanism for identifying a series of processes must be prepared separately.

  In a Web server or the like that provides electronic commerce such as online shopping, it is necessary to manage a series of processes with a specific Web client. Therefore, session management for identifying a series of processes by a session ID is widely performed. For session management, for example, a mechanism called Cookie is used.

  Conventional session management using Cookie will be described with reference to the block diagram of FIG. 4 and the flowchart of FIG. As shown in FIG. 4, it is assumed that a server device 430 and a terminal device 410 are connected via a computer network 480. In the terminal device 410, a general-purpose web browser unit 420 is operating and accessing a web site provided by the server device 430.

  The server device 430 includes a web server unit 440, a login processing unit 450, a user management unit 460, and a command processing unit 470. The web server unit 440 functioning as a web front end is provided with a session management unit 441. ing. The user management unit 460 manages user IDs and passwords of registered users.

  When a user of the terminal device 410 inputs a user ID and a password according to an input request on a Web site accessed using the Web browser unit 420 (FIG. 5: S401), the user management unit 460 of the server device 430 displays the user ID and password. User authentication is performed (S402). Here, it is assumed that the user of the terminal device 410 has completed user registration and is authenticated as a user.

  The session management unit 441 assigns a session ID for identifying a series of processes related to this access (S403), and stores it in a predetermined storage area (S404). The session ID is stored in a table format, for example. In addition to the session ID, for example, a timeout time, an expiration date, a used / unused flag, etc. are recorded in the table. Instead of the table format, the file may be stored as an individual file for each session ID.

  Then, the Web server unit 440 sets the numbered session ID in Cookie (S405), and transmits information including Cookie as a response to user authentication to the Web browser unit 420 (S406). The web browser unit 420 displays a web page corresponding to the response and stores a cookie.

  When the user performs an operation such as menu click on the Web page, the Web browser unit 420 transmits a command corresponding to the operation and a session ID set in Cookie to the Web server unit 440 (S407).

  The session management unit 441 of the Web server unit 440 refers to the session management table, identifies the session based on the received session ID, and recognizes that this is a series of processing (S408). At this time, the expiration date, timeout, etc. are also checked. Then, the command processing unit 470 performs command processing corresponding to the identified session (S409), and the Web server unit 440 transmits a response including the session ID to the Web browser unit 420 (S410).

  In this way, session management can be performed by using Cookie, and the server device 430 identifies the session by the session ID, and determines that the same session of the same user is continuing if the session ID is the same. can do.

JP 2009-140163 A JP2015-52883A

  Session management of Web access can be performed by using the session ID. However, in industrial equipment, since it is Web access to perform monitoring and various settings, it is necessary to manage sessions. In the past, session management was not performed.

  However, due to the recent increase in security awareness and the requirement of standard rules to be observed by the industry, the necessity of session management has been recognized even for industrial equipment. For example, by performing session management with an industrial device, an operation log for each user accepted via a computer network can be recorded, and information useful for safety management can be accumulated.

  By the way, if session management is performed with an industrial device, an attack on session management must be considered in order to increase the reliability of session management. A typical session attack is a session hijack in which a session ID is illegally acquired and communication is performed by impersonating a party using the acquired session ID.

  As a technique for preventing session hijacking, for example, Patent Literature 1 discloses that a session ID is assigned for each request from a client, and Patent Literature 2 discloses a session ID under conditions managed by the server side. Is disclosed.

  Session hijacking can be prevented by applying these technologies to industrial equipment functioning as a Web server, but the session ID management processing in the industrial equipment becomes complicated. In industrial equipment, it is preferable that the load of session management is small in order not to affect the original processing such as measurement and recording.

  Therefore, an object of the present invention is to prevent session hijacking with a simple process in an industrial device that functions as a Web server.

In order to solve the above problems, an industrial device functioning as a Web server of the present invention identifies a series of access processing using a session ID, and at the time of numbering the session ID, the session ID and the access source A session management unit that records the device identification information in association with each other, and whether the device identification information of the access source matches the device identification information associated with the session ID for the access for which the session ID is identified. A determination unit that determines that the access is illegal when the determination unit determines that the determination units do not match.
Here, the device specifying information may be an IP address, for example.

  According to the present invention, session hijacking can be prevented with a simple process in an industrial device functioning as a Web server.

It is a block diagram which shows the network structural example containing the industrial apparatus of this embodiment. It is a figure which shows the structural example of the table for session management. It is a flowchart explaining operation | movement of the industrial equipment of this embodiment. It is a block diagram explaining the conventional session management using Cookie. It is a flowchart explaining the conventional session management using Cookie.

  Embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram illustrating an example of a network configuration including the industrial device 100 of the present embodiment. As shown in this figure, it is assumed that an industrial device 100 functioning as a Web server and a terminal device 200 are connected via a computer network 300.

  The industrial device 100 can be, for example, an instrument device such as a paperless recorder, a data logger, or a waveform display device, but is not limited to these devices as long as it is a device for industrial use.

  In the terminal device 200, a general-purpose web browser unit 210 is operating and can access the industrial device 100. As the terminal device 200, a general information processing device such as a desktop computer, a notebook computer, a tablet computer, or a smartphone can be used.

  The industrial device 100 includes a Web server unit 110, a login processing unit 120, a user management unit 130, and a command processing unit 140. Note that blocks for performing measurement processing, recording processing, and the like, which are the original operations of the industrial equipment 100, are omitted.

  The web server unit 110 that functions as a web front end is provided with a session management unit 111 and an IP address determination unit 112. When receiving an access from the terminal device 200, the session management unit 111 assigns a session ID and records it in the session management table.

  At this time, the IP address of the terminal device 200 as the access source is acquired and recorded in the session management table in association with the numbered session ID. However, instead of the session management table format, each session may be recorded in a separate file.

  FIG. 2 is a diagram illustrating a configuration example of a session management table. As shown in the figure, the session management table is a table that records a session ID, an IP address, and a timeout count in association with each other. Furthermore, other information such as login information, user authority, and used / unused information may be associated and recorded. The session management table is stored in a predetermined storage area that can be referred to by the Web server unit 110.

  The time-out count is a time-out timing until the next access from the web browser unit 210, which is represented by a count value of an internal timer. Of course, it is not limited to the timeout count, an expiration date may be set, a timeout time may be set, or a timeout may not be set.

  When receiving an access including a session ID from the terminal device 200, the session management unit 111 identifies a session from the received session ID and the session management table. If the accepted session ID is not registered in the session management table, access is denied because the session ID cannot be specified. Or you may handle as new access and number session ID.

  The IP address determination unit 112 determines whether or not the IP address related to the access for which the session ID is specified matches the IP address associated with the session ID in the session management table. If the IP addresses do not match as a result of the determination by the IP address determination unit 112, the session management unit 111 determines that the access is an unauthorized access that may cause session hijacking. If it is determined that the access is unauthorized, for example, an error response is returned without processing the command. Alternatively, the session may be terminated so as not to return a response to access, or an invalid response may be sent. Further, the Cookie may be set so as to delete the transmitted session ID without processing the command, and a response may be returned.

  The user management unit 130 manages the user ID and password of the registered user. Information such as a user name and user attributes may be added. The command processing unit 140 performs processing for a command received from the user via the Web browser unit 210 of the terminal device 200.

  Next, operation | movement of the industrial equipment 100 of this embodiment is demonstrated with reference to the flowchart of FIG.

  When the user of the terminal device 200 inputs the user ID and password on the login screen provided by the Web server unit 110 (S101), the user management unit 130 of the industrial device 100 performs user authentication (S102). Here, it is assumed that the user of the terminal device 200 has completed user registration and is authenticated as a user.

  The session management unit 111 assigns a session ID for identifying a series of processes related to this access (S103). Then, the IP address of the access source terminal device 200 is associated with the assigned session ID and recorded in the session management table (S104).

  The Web server unit 110 sets the numbered session ID in Cookie (S105), and transmits information including Cookie to the Web browser unit 210 as a user authentication response (S106). The web browser unit 210 displays a web page corresponding to the response and stores a cookie.

  When the user performs an operation such as menu click on the Web page, the Web browser unit 210 transmits a command corresponding to the operation and a session ID set in Cookie to the Web server unit 110 (S107).

  The session management unit 111 of the Web server unit 110 refers to the session management table, identifies the session based on the received session ID, and recognizes that this is a series of processing (S108). Specifically, if a session ID that matches the received session ID is recorded in the session management table, it is determined that the processing is a series of processes.

  When the session is identified by the session ID, the IP address determination unit 112 determines whether the IP address of this access matches the IP address associated with the session ID identified in the session management table (S109). .

  As a result, if the IP addresses match (S109: Yes), the command processing unit 140 performs command processing corresponding to the identified session (S110), assuming that there is no possibility of session hijacking (S110). The Web server unit 110 transmits a response including the session ID to the Web browser unit 210 (S111). It is assumed that other conditions such as timeout are satisfied.

  On the other hand, if the IP addresses do not match (S109: No), the session management unit 111 determines that the access is an unauthorized access that may cause session hijacking. Then, the Web server unit 110 does not process the command and returns an error response (S112).

  As described above, the industrial device 100 according to the present embodiment records the session ID and the IP address in association with each other, and when the session ID is identified, the access source IP address is associated with the identified session ID. It is determined whether or not it matches the recorded IP address. If the IP addresses do not match, it is determined as unauthorized access. Thereby, session hijacking can be prevented with simple processing.

  In addition, the industrial apparatus of this invention is not restricted to said embodiment, A various deformation | transformation is possible. For example, the IP address is used as a material for determining that there is a possibility of session hijacking. However, the IP address is not limited to the IP address, and any information that identifies the access source communication device can be used. For this reason, instead of the IP address or in addition to the IP address, a device-specific identifier such as a MAC address may be recorded in the session management table to determine a match / mismatch.

  Further, by providing the industrial device 100 with a function of denying access from other than IP addresses registered in advance, it is possible to further ensure safety management. In this case, a permission IP address table in which the permission IP address is registered is separately provided, and when an access request is made, the permission IP is permitted only when the IP address related to the access is registered in the permission IP address table. An address management unit may be provided in the industrial device 100.

  In the above-described embodiment, in order to prevent session hijacking, the session ID and the IP address are recorded in association with each other. However, the referrer information indicating the link source at the time of access is recorded in association with each other. You may make it do.

  By recording the referrer information, even if the same session ID and the same IP address are used, cross referral request forgery measures can be taken by the referrer refusing different accesses.

  In addition, in order to cope with an access mode in which an IP address may change after login, such as a mobile terminal device, the IP address match determination function in the IP address determination unit 112 can be stopped by an administrator setting. May be.

DESCRIPTION OF SYMBOLS 100 ... Industrial equipment, 110 ... Server part, 111 ... Session management part, 112 ... Address determination part, 120 ... Login processing part, 130 ... User management part, 140 ... Command processing part, 200 ... Terminal apparatus, 210 ... Web browser 300, computer network

Claims (2)

An industrial device that functions as a Web server,
A session management unit that identifies a series of access processes using a session ID, and records the session ID and the device identification information of the access source in association with each other when the session ID is numbered,
A determination unit that determines whether or not the device identification information of the access source matches the device identification information associated with the session ID with respect to the access for which the session ID is identified;
The industrial device according to claim 1, wherein the session management unit determines that the access is illegal when it is determined that the determination units do not match.   The industrial device according to claim 1, wherein the device identification information is an IP address.