WO2022269734A1

WO2022269734A1 - Relay and manufacturing information management system

Info

Publication number: WO2022269734A1
Application number: PCT/JP2021/023504
Authority: WO
Inventors: 久米隆司
Original assignee: 久米機電工業株式会社
Priority date: 2021-06-22
Filing date: 2021-06-22
Publication date: 2022-12-29
Also published as: JP7015086B1; JPWO2022269734A1

Abstract

[Problem] To provide a relay capable of relaying external information, such as biometric authentication information, upstream or downstream by interrupting the external information even when used with a PLC manufacturing device or a device connected only to a local LAN. [Solution] The connection of external information interruption means to relays allowing communication between downstream devices with preset IP addresses and upstream devices connected to an upstream network is enabled, and the downstream devices are connected to the upstream network through only a single line. The relays have first communication means and first addresses for communicating with the upstream devices, second communication means and second addresses for communicating with the downstream devices, and address setting means. The two addresses are used discriminately by the address setting means, thus making it possible to relay data such as user information having the external information interruption means as a transmission source to either the upstream devices or the downstream devices. Furthermore, the relays are configured to be in one-to-one correspondence with the downstream devices, thus making it easy to set the IP addresses.

Description

Repeater and manufacturing information management system

The present invention relates to repeaters that are attached one by one to devices that have not been connected to a network or devices that have been connected only to a local LAN. The present invention relates to a repeater capable of relaying information to a network, and a manufacturing information management system capable of centrally managing manufacturing information.

Specifically, downstream devices can be easily relayed to a LAN controlled by a single server computer (hereinafter referred to as a server), and external information such as user information can be sent upstream or downstream of the network from the relay. The present invention relates to a repeater and a manufacturing information management system capable of interrupting a network and relaying processing information, manufacturing information, etc. processed on the upstream side or downstream side of a network based on external information.

Login of manufacturing equipment driven by a programmable logic controller, etc., which was used independently of the network (hereafter referred to as PLC manufacturing equipment), and manufacturing equipment, etc. for which spoofing authentication was possible due to unauthorized use of IC cards is guaranteed to be a genuine login based on the user's biometric information, and is suitable for a manufacturing information management system that is required to centrally manage authentication information, manufacturing information, etc. as data for audit trails.

Specifically, it is a PLC manufacturing device or an existing manufacturing device that has a unique IP address for the local LAN (hereinafter referred to as a unique address) set, and WINDOWS (registered trademark) or LINUX (registered trademark) is an OS ( The present invention relates to a repeater capable of easily adding a biometric authentication device even to a manufactured device that cannot be connected to a server with a general-purpose OS hereinafter. Here, the intra-premises LAN refers to a network constructed for a limited range.

For manufacturing equipment in the pharmaceutical field, it is required that manufacturing information cannot be tampered with in order to ensure that it has been manufactured and managed properly. Eliminate unauthorized use of IC cards and spoofing authentication, guarantee the authenticity of login authentication that the login is by the person with appropriate authority based on biometric authentication, and manage operation information etc. after login in one place. is an urgent issue.

However, pharmaceutical manufacturing equipment is not connected to the network against the background of "Good Manufacturing Practices (GMP)" that prohibits the connection and sharing of pharmaceutical manufacturing data via external networks. There are still many PLC manufacturing equipment that are used independently in the factory, and manufacturing equipment that is connected only to the local LAN without being connected to the centralized network.

On the other hand, if the user's identification information, operation authority, and operation details according to the authority level are managed for each piece of manufacturing equipment, personnel changes of the user, changes in the user authority level, and changes in the operation contents according to the authority level The registered information must be updated each time there is a need to update such information, and there is a problem that appropriate update management is troublesome.

By the way, IP addresses are assigned to devices connected to the same network so that they can identify each other. In the case of the IPv4 communication standard, which is one of the communication standards, an IP address consists of four segments, with 0 to 255 as one segment, and only when the upper first to third segments are common. Communication is possible. That is, if the first to third segments are common, communication is possible with an upper limit of 256 units that differ only in the fourth segment.

In large-scale offices with more than 256 devices, a DNS (Domain Name System) server is used to avoid duplication of IP addresses for many OA devices such as personal computers and printers that are integrated with a general-purpose OS. , OA devices are assigned domain names different from IP addresses.

However, the manufacturing equipment with unique addresses that make up the manufacturing line connected to the premises LAN cannot be assigned domain names and managed by a DNS server that operates only with a general-purpose OS. Therefore, it has been difficult to connect all devices to one network and centrally manage authentication information on a server.

Patent Literature 1 discloses technology for a repeater that adds a user authentication function to manufacturing equipment. According to the technique described in this document, a user authentication server and a plurality of manufacturing devices are communicated via a repeater called a proxy, and an access request for user authentication is issued to the repeater. Sometimes they relay that information to a server. Then, the server performs user authentication, and if the user is determined to be an authorized user, the result of the authentication is relayed from the repeater to the manufacturing equipment, and the manufacturing equipment is operated.

However, the technique described in this document is a technique of simply adding a repeater to a device that constitutes a conventional network. It was necessary to reassign IP addresses downstream of the device. Further, according to the configuration of this technology, since a plurality of manufacturing devices are connected downstream of the repeater, even if the server grants access rights, the access rights are not granted to all of the plurality of downstream manufacturing devices. There was a problem that it was not possible to identify which manufacturing equipment was granted access rights.

Patent Document 2 discloses a plant management technique in which a monitoring terminal for remotely controlling local equipment is connected to a server via a monitoring LAN, while an operator verification unit for login authentication is connected to a server via an authentication LAN. there is According to the technique described in this document, an authentication information acquisition device is attached to each local facility, and login authentication information is relayed from the authentication information acquisition device to a server from an operator verification unit connected to an authentication LAN. there is On the other hand, operation information and the like are relayed to the server from a monitoring terminal connected to a monitoring LAN different from the authentication LAN.

According to this technology, the authentication information and the operation information are relayed to the server by separate LANs, and the authentication LAN and the monitoring LAN coexist. , an IP address is required for each, which makes it difficult to introduce biometric authentication equipment into existing facilities.

In Patent Document 3, the present applicant does not modify the monitoring equipment applied to the manufacturing equipment, and makes the existing monitoring equipment function only in a state where genuine login authentication is guaranteed, and the monitoring target equipment. A technique for monitoring support equipment is disclosed that stores records, login authentication information, and operation information together with time information, and guarantees the authenticity of electronic data output by existing monitoring equipment.

According to this technology, the function of the operation means is activated so that the operation means of the monitoring equipment can be operated only when the authenticator determination means validates the login authentication. However, there is a problem that it cannot be applied to manufacturing equipment that does not have monitoring equipment.

Therefore, the inventors of the present application have found that even if a biometric information acquisition device is added to a device that has been authenticated by spoofing or a PLC manufacturing device, the biometric information acquisition device can be easily introduced and connected to the PLC manufacturing device or the local LAN. I have invented a repeater that can be integrated into a general-purpose OS network even if the manufacturing equipment that was previously used is integrated.

Patent Document 1: JP-A-2006-99777 Patent Document 2: JP-A-2012-194762 Patent Document 3: Japanese Patent Application No. 2020-161581

The problem to be solved by the present invention is to allow external information such as user information to be interrupted upstream or downstream of the network from a repeater, even if it is a PLC manufacturing device or a device connected only to a local LAN. To provide a repeater capable of relaying processing information, manufacturing information, etc. processed on the upstream side or downstream side of a network based on the above, guaranteeing authentic login authentication, and allowing operation information, etc. after login authentication It is to provide a manufacturing information management system that manages at the location.

According to a first aspect of the present invention, a downstream device in which a downstream communication identifier is set in advance for communication with a repeater and an upstream device connected to an upstream network are communicated with each other, and external information interrupting means includes A connectable repeater comprising a first communication means, a first address, a second communication means, a second address, and an address setting means, wherein the first communication means is connected to an upstream network. , the second communication means is connected to the downstream device, the first address differs only in the individual identifier part that distinguishes it from the upstream distribution credit identifier of another device connected to the upstream network, and the second address is the downstream device setting means for connecting the downstream device to the upstream network through only one line, and setting means for causing the address setting means to set the communication identifier of the transmission source. When the first information whose transmission source is the external information interrupting means is transmitted to the upstream side, the first address is set to the upstream distribution credit identifier of the repeater and transmitted, and the first information is transmitted to the downstream side. The second address is set to the identifier for downstream communication of the repeater and transmitted to the other side.

A repeater is arranged between an upstream device connected to an upstream network, such as a server, and a downstream device to which a downstream communication identifier has been assigned in advance, such as a drug manufacturing device. The communication standard of the network to which the repeater is connected is not limited, and the communication standard of the upstream network may be different from the communication standard of the downstream device and the repeater. For example, the upstream network may adopt a communication system based on the IPv6 communication standard, and the downstream device and the repeater may adopt a communication system based on the IPv4 communication standard.

The individual identifier part that identifies the device is the fourth segment in the case of the communication system based on the IPv4 communication standard, and either four digits of Roman letters or numbers that identify the device in the case of the communication system based on the IPv6 communication standard. It is a part consisting of If a new network standard is developed, it may be the individual identifier part that identifies the device in that standard.

The external information interrupting means is a device connected to the repeater. For example, it may be a non-contact electromagnetic wave reader connected to the repeater via a USB connection, but is not limited. The external information may be, for example, user authentication information acquired by the non-contact electromagnetic wave reader, error diagnosis information of downstream equipment, maintenance diagnosis information, and the like.

The repeater is provided with address setting means, and when data is transmitted from the source and communicated with the upstream device through the upstream network, the data is given a first address and communicated with the downstream device. When communicating, the data is given a second address and communicated.

Since the downstream device communicates with the upstream network through only one line and there are no duplicate communication paths between the downstream device and the upstream network, the information sent and received between the downstream device and the upstream device is It becomes unique information, and it is guaranteed that the information is authentic.

According to the repeater of the first invention, the repeater properly uses two addresses, the repeater and the downstream device are associated on a one-to-one basis, the external information is transmitted upstream or downstream through the repeater, and the repeater When incorporating into a network, there is an advantageous effect that has never existed in the past that address setting is easy.

According to a second aspect of the present invention, in the repeater according to the first aspect, when the first communication means and the second communication means are based on the IPv4 communication standard, the first address is for upstream distribution of other devices. The identifier is an IP address that is different only in the fourth segment, and the second address is an IP address that is different only in the fourth segment from the identifier for downstream communication of the downstream device.

If the upstream communication standard of the repeater is based on the IPv4 communication standard, the downstream communication identifier assigned in advance will be An arbitrarily set IP address consisting of four segments (hereinafter referred to as an independent IP address) will suffice. Any address (hereinafter referred to as a local IP address) may be used.

If the upstream communication standard of the repeater is based on the IPv4 communication standard, the first address may be an IP address that differs from other devices connected to the upstream network only in the fourth segment. The address may be an IP address that differs from the downstream device only in the fourth segment.

When connecting PLC manufacturing equipment to the network via a repeater, the first address is an address that differs from other equipment connected to the network only in the fourth segment, and the second address is an arbitrary independent IP address. and the fourth segment should have different addresses.

If a repeater is added between the on-premises LAN and the downstream device without changing the on-premises LAN area, the same IP address as the on-premises IP address is given to the first address of the repeater, and the on-premises IP address is given to the second address. It is sufficient to assign an address that is different only in the IP address and the fourth segment, and address setting is very easy.

When a device connected to a local LAN is connected to a new network, the first address of the repeater is set to an address that differs from other devices connected to the new network only in the fourth segment. Just do it. The IP address of the device connected to the local LAN may be left unchanged, and the second address may be an address that differs from the local IP address only in the fourth segment.

According to the repeater of the second invention, the repeater can be easily incorporated in the communication standard that has been widely applied in the past, and the external information can be transmitted upstream or downstream through the repeater. It has no beneficial effect.

A third aspect of the present invention is the repeater according to the first or second aspect, wherein the address setting means uses an upstream device as a transmission source, which is generated according to the first information transmitted to the upstream side. The second information is characterized in that the second address is set in the downstream communication identifier of the repeater and transmitted to the downstream device.

According to the third invention, the repeater not only causes the external information interrupting means to transmit the external information, but also causes the upstream device to transmit the first information transmitted to the upstream side, for example, the user information. The second information, such as login information, operation authority, operation contents according to the authority level, etc., is transmitted to the downstream device.

As a result, important information such as user identification information, operation authority, and operation details according to the authority level can be collectively stored only in the upstream device, and transmitted according to external information. By managing the information as such, it is possible to prevent the occurrence of inconsistency of important information and the occurrence of troublesome labor.

According to a fourth aspect of the present invention, in the repeater according to the third aspect, the address setting means sets the first address to the upstream distribution credit identifier of the repeater for the third information whose transmission source is the downstream device. It is characterized by transmitting to the upstream device.

According to the fourth invention, the third information originating from the downstream device can be transmitted to the upstream device via the repeater. The third information is information generated in the downstream equipment, for example, defective product occurrence information, manufacturing condition change information, operator information, operation time information, manufacturing equipment error information, consumption This is information such as product replacement timing information. According to the fourth invention, there is an effect that the information generated in the downstream device is transmitted upstream and collectively managed.

According to a fifth aspect of the present invention, in the repeater according to the fourth aspect, the downstream device is a manufacturing device, the upstream device is a server, the first information is user information, and the second information is login authentication. information, the third information is manufacturing information, and user information, login authentication information, and manufacturing information are stored only in the server together with time information.

According to the fifth invention, user information, login authentication information, and manufacturing information are collectively managed by the server together with time information. As a result, even if an audit trail associated with manufacturing is required, it is possible to extract genuine information that has not been tampered with from the server.

A sixth invention of the present invention is a manufacturing information management system including the repeater of the fifth invention and a biological information acquisition device, wherein the external information interrupting means is a non-contact electromagnetic wave reader. the biometric information acquisition device includes biometric information acquisition means, storage means, determination means, and communication means; When it is determined that the user determination information stored in the means matches, the user information is generated by electromagnetic waves by the communication means, and the user information received by the external information interruption means is It is characterized in that it is relayed to the server and login authentication is performed in the server.

In the sixth invention, the biometric information acquisition device acquires the user's biometric information, and when it is determined that the biometric information matches the user determination information, the user information is generated by electromagnetic waves. The biometric information of the user is not limited, and biometric information unique to the user such as fingerprint, iris, pulse wave, gait, face, myoelectric potential, voiceprint, etc. may be used. The biometric information acquisition device is not limited to a wearable terminal device, and may be a device that acquires a user's unique face, voiceprint, or the like, or an IC card that stores a user's fingerprint. The user information is not limited to a personal ID identifying the user, and may be a device ID generated by the biometric information acquisition device only when a specific user is identified.

The electromagnetic wave from the biometric information acquisition device is relayed to the server as the first information by a non-contact electromagnetic wave reader, for example, an RFID reader, which serves as external information interrupting means, and the user information is authenticated by the server. According to the sixth aspect, since the user information is generated by reading the user's biometric information, there is an effect that the possibility that the user information is genuine is extremely high.

A seventh aspect of the present invention is the manufacturing information management system according to the sixth aspect, wherein the biometric information acquisition device acquires two types of biometric information of the user, and the user determination information is also the biometric information. The user information is generated when the determining means determines that both of the biometric information match the biometric information for determination. It is characterized by

In the manufacturing information management system of the seventh invention, the biometric information acquisition device only needs to acquire two types of biometric information of the user, and the type of biometric information is not limited. Since user information is generated by judging the match between two types of biometric information, the authenticity of user information is guaranteed, spoofing authentication can be reliably eliminated, and the authenticity of login authentication processing on the server is ensured. can be guaranteed.

An eighth invention of the present invention is the manufacturing information management system of the sixth or seventh invention, wherein the server is a virtual computer by a cloud computing service, and the repeater and the virtual computer are public It is characterized by being connected by a virtual private network that allows the line to be used as a virtual leased line.

According to the eighth invention, the repeater and the virtual computer are connected by a virtual private network that virtually uses a public line as a dedicated line. As a result, even when manufacturing pharmaceuticals, it is possible to collectively manage manufacturing data from dispersed factories while complying with "Good Manufacturing Practices for Pharmaceutical Manufacturing". Even if there is, the loss of manufacturing data can be prevented.

According to the first invention, the repeater uses two addresses properly, the repeater and the downstream device are associated on a one-to-one basis, the external information is transmitted upstream or downstream through the repeater, and the repeater is connected to the network. It has an advantageous effect that has never existed in the past that address setting is easy when it is incorporated into a system.
・According to the second invention, a repeater can be easily incorporated in a communication standard that has been widely applied in the past, and external information can be transmitted upstream or downstream through the repeater, which is unprecedented in the past. have a beneficial effect.

- According to the third invention, important information can be collectively stored only in the upstream device and transmitted according to external information. It has an advantageous effect of preventing occurrence of unification and occurrence of troublesome labor.
- According to the fourth invention, there is an effect that the information generated in the downstream device can be transmitted upstream and managed.

- According to the fifth invention, even if an audit trail accompanying manufacturing is required, it is possible to extract genuine information that has not been falsified from the server.
- According to the sixth invention, since the user information is generated by reading the user's biometric information, there is an effect that the possibility that the user information is genuine is extremely high.

According to the seventh invention, the authenticity of user information is guaranteed, spoofing authentication can be reliably eliminated, and the authenticity of login authentication processing in the server can be reliably guaranteed.
・According to the eighth invention, even when manufacturing pharmaceuticals, it is possible to collectively manage manufacturing data of dispersed factories while complying with "good manufacturing practices for pharmaceutical manufacturing". Even in the event of a disaster, loss of manufacturing data can be prevented.

Explanatory drawing (Example 1) which applied this invention to the conventional apparatus. Explanatory drawing of a repeater (Example 1). FIG. 10 is a flow chart for setting a first address and a second address (Example 1); Explanatory drawing of the whole manufacturing information management system (Example 1). Explanatory drawing of a biometric information acquisition device (Example 1). Explanatory drawing of the other example of a biometric information acquisition device (Example 1). Explanatory drawing of interrupt processing and relay processing in a repeater (Example 1). FIG. 2 is a flow diagram up to driving of the manufacturing information management system (Example 1). FIG. 2 is a flow chart after driving the manufacturing information management system (Example 1). Explanatory drawing of the manufacturing information management system connected by the virtual private network (Example 2).

In order to facilitate understanding of the present invention, as Example 1, the IPv4 communication standard is used as an example to explain the individual identifier that identifies the device. The repeater 1 of the first embodiment is connected to a downstream device having an IP address set in advance and an upstream device connected to an upstream network based on the IPv4 communication standard, and external information interrupting means can be connected. At the same time, the downstream equipment is connected to the upstream network through only one line.

The repeater has a first communication means and a first address for communicating with the upstream device, a second communication means and a second address for communicating with the downstream device, and an address setting means. Two addresses are selectively used by the address setting means so that the external information transmitted from the external information interrupting means, such as data such as user information, can be relayed to either the upstream device or the downstream device. In addition, the repeater is associated with the downstream device on a one-to-one basis, making it easy to set the IP address.

In Embodiment 1, the repeater 1 will be described with reference to FIGS. 1 to 9. FIG. FIG. 1(A) shows a device layout diagram before applying the repeater of the present invention in a manufacturing plant. FIG. 1(B) shows a device layout diagram to which the present invention is applied. FIG. 2A shows a schematic diagram of a repeater. FIG. 2B shows a block diagram of the repeater. FIG. 3 shows a flow chart for setting the first address and the second address. FIG. 4 shows an explanatory diagram of the entire manufacturing information management system.

FIG. 5(A) shows an example of a biometric information acquisition device that acquires two types of biometric information. FIG. 5B shows a block diagram of a biometric information acquisition device that acquires two types of biometric information. FIG. 6A shows an example of an IC card type biometric information acquisition device for acquiring one type of biometric information. FIG. 6B shows a block diagram of the biometric information acquisition device. FIG. 7 shows an explanatory diagram of the interrupt processing of the first information and the relay processing of the second information and the third information. FIG. 8 shows a biometric authentication processing flow chart before driving the manufacturing information management system, and FIG. 9 shows a processing flow chart after driving the manufacturing information management system.

In the first embodiment, for ease of understanding, the case where the repeater 1 is introduced into the equipment of a chemical manufacturing plant 1000 is taken as an example, and the upstream equipment is the server 100, and the downstream equipment is the manufacturing equipment 200 or the research and development equipment 210. (See FIG. 1(B)). The first information interrupted by the relay device 1 from the external information interrupting means 10 is user information, the second information relayed from the server 100 to the manufacturing equipment 200 or the like is login authentication information, and the manufacturing equipment 200 or the like is relayed to the server 100. The third information will be described as manufacturing information. Also, as the external information interrupting means 10, a non-contact electromagnetic wave reader that obtains user information by electromagnetic waves by bringing a user's portable object close to it will be described as an example.

In the chemical manufacturing factory 1000, there are independent equipment that has not been connected to a network in the past (hereinafter referred to as PLC manufacturing equipment), PLC manufacturing equipment 201 including a monitoring device, manufacturing equipment 202 that is connected only to the premises LAN 300, and research and development equipment. Groups 210 and the like are arranged to suit the manufacturing process (see FIG. 1(A)). Taking a pharmaceutical manufacturing factory as an example, the PLC manufacturing equipment 201 is, for example, a tablet manufacturing machine that presses powder to manufacture tablets. It should be noted that the group of equipment surrounded by a frame indicates research and development equipment 210 with high confidentiality.

The PLC manufacturing equipment 201 including a monitoring device is, for example, a manufacturing device that stores tablets in a PTP sheet, and the monitoring device that is directly connected to the manufacturing equipment inspects for contamination of foreign matter, missing tablets, and the like. The group of manufacturing equipment 202 connected only to the on-premises LAN 300 is, for example, a packaging and conveying machine that stacks and wraps PTP sheets. It is connected to the local LAN 300 that is connected to the network.

Since the PLC manufacturing equipment 201 and the like are installed independently and do not have an IP address set, it was necessary to arbitrarily set an independent IP address in order to connect to the network. An IP address is an address in which one segment is an integer from 0 to 255, and four segments are one unit. For example, [192.168.40.1]. In order for devices to communicate, only the fourth segment is assigned a different value in all devices connected to the network. More specifically, the upper three segments have values common to all devices, and the fourth segment is assigned values that do not overlap among all devices. Hereinafter, this is referred to as "fourth segment difference".

A group of manufacturing equipment 202 and a group of research and development equipment 210 connected only to the on-premises LAN 300 or on-premises LAN 302 are managed by on-

premises servers

301 and 303, respectively, and are set with on-premises IP addresses that are different from the fourth segment (FIG. 1). (A) see figure). If a plurality of on-

premises LANs

300 and 302 are integrated as they are, there is a risk of communication failure occurring due to duplication or inconsistency of on-premises IP addresses. Therefore, it is necessary to reassign IP addresses so that each device is assigned a local IP address that is different from the fourth segment. Moreover, when adding a PLC manufacturing device to the local LAN, it was necessary to search for and assign a local IP address different from the fourth segment as an independent IP address. In either case, the task of re-assigning IP addresses is complicated.

Hereinafter, a specific configuration of the repeater 1 of the present invention will be described with reference to FIG. An example in which only the repeater 1 is introduced without extending the LAN 302 will be described with reference to FIGS. 1(B) to 3. FIG. Here, the general LAN refers to a network constructed over a wider area than the local LAN.

In the first embodiment, a case where the repeater 1 is composed of a single board computer will be specifically described as an example. A single-board computer is a small computer in which only the necessary functional parts are mounted on a single printed circuit board. Specifically, a central processing unit (hereinafter referred to as CPU), a main memory device (hereinafter referred to as RAM), two

LAN ports

20 and 21 based on the wired LAN communication standard, and a Universal Serial Bus (hereinafter referred to as USB) and a plurality of USB ports 22 based on the standard, and a power acquisition means 23 (see FIG. 2A).

The repeater 1 includes a first communication means 30 and a first address for communicating with an upstream device, a second communication means 40 and a second address for communicating with a downstream device, and an address setting means (Fig. 2 (B ) see figure). The CPU serves as control means 50 and functions as address setting means. The RAM functions as storage means 60 and stores a first address and a second address. The storage means 60 also stores an application for driving the control means.

A LAN cable 31 for communicating with a server as an upstream device and a LAN cable 41 for communicating with a manufacturing device as a downstream device are connected to the two LAN ports so that the first communication means 30 and the second It functions as communication means 40 . A USB cable 11 provided in the external information interrupt means 10 can be connected to the USB port 22 serving as an input/output means. The external information interrupting means 10 may be a non-contact electromagnetic wave reader, but is not limited to this.

The other USB port 22 is connected to a notebook-type terminal device 72 (see broken line in FIG. 2(A)) that functions as input means 70 and display means 71, and the like. The notebook type terminal device 72 can be connected at the time of initial setting when storing the first address, the second address, and the pre-created application in the storage means. The type terminal device may be removed.

The flow of setting the first address and the second address will be explained by comparing the flow charts of FIGS. 1(A), 1(B) and 3. FIG. 1A also shows the IP addresses of the

conventional LANs

300 and 302. FIG. Here, in order to facilitate understanding, specific values are shown for IP addresses for explanation. In the drawing, it is assumed that the group of devices connected to the on-premises LAN 302 surrounded by a frame and the on-premises LAN 300 integrated into the general LAN 400 have the same 10.20.30 from the first segment to the third segment. Of course, the values of the first to third segments may be different for each local LAN.

A group of manufacturing equipment 202 connected to a local LAN 300 with the first segment to the third segment set to 10.20.30 is integrated together with the PLC manufacturing equipment 201 into a general LAN 400 that controls the whole. A repeater 1 is attached to each piece of equipment (see FIG. 1(B)). On the other hand, the group of research and development equipment 210 connected to the on-premises LAN 302 with the first segment to the third segment set to 10.20.30 maintains the on-premises LAN 302 and each device is connected to one repeater. 1 is attached.

The first address of the repeater 1 that communicates with the upstream is an IP address that is different in the fourth segment from the IP addresses of other devices connected to the upstream network. Other devices include not only the server 100 but also other repeaters connected to upstream networks. The second address of the repeater that communicates with the downstream device is an IP address that is fourth segment different from the IP addresses of the manufacturing device 200 and the research and development device 210 to which the repeater is attached.

Since the manufacturing equipment 200 communicates with other equipment connected to the network only through the repeater 1, even if the IP address of the manufacturing equipment overlaps with that of other manufacturing equipment, network communication failure occurs. never. Therefore, the IP address of the PLC manufacturing equipment 201 can be set arbitrarily, and the manufacturing equipment 202 connected to the premises LAN can use the existing premises IP address as it is, facilitating the IP address setting work (Fig. 1(B) and S110 to S120 of FIG. 3).

In the IP address setting flow (see FIG. 3), it is first determined whether or not the device connected to the repeater is a downstream device that does not have an IP address (S100). Here, if the downstream device is a PLC manufacturing device with no IP address set, the process proceeds to step 110 (S110). Since the manufacturing equipment connected to the premises LAN has the premises IP address set, the process proceeds to step 120 (S120) (see FIG. 3).

First, set the device address for each downstream device. In step 110, the PLC manufacturing equipment is processed to set an arbitrary unique IP address (S110). For example, [A. B. C. D] is assigned. On the other hand, in step 120, the manufacturing equipment connected to the local LAN has been previously assigned, for example, [10.20.30. M] is stored (S120) (see FIG. 1(B)). A to D are arbitrary integers from 0 to 255.

After the device IP address is set, the process proceeds to step 130, where it is selected whether or not to connect the downstream manufacturing device to the general LAN 400 (S130). When connecting to the central LAN 400, the process proceeds to step 140 (S140), and as the first address of the repeater, a central IP address different in the fourth segment from the IP address of the server 100, for example, [192.168.30. N (N is an integer from 0 to 255 that is different from other upstream devices)].

Regarding the second address, when the downstream device is the manufacturing device 202 connected to the local LAN 300, the IP address of the fourth segment different from the device IP address, e.g. The IP address [10.20.30.0] of the server 301 is assigned, and in the case of the PLC manufacturing equipment 201, [A. B. C. E] is given (S140). [A. B. C. E] may be an arbitrary integer from 0 to 255, so for example, the same [10.20.30.0] as the on-premises server 301 may be given.

In step 130, if the repeater 1 is to be connected to the local LAN, proceed to step 150 (S150). When only the repeater 1 is introduced while maintaining the on-premises LAN 302 (see the equipment in the frame of FIG. 1B), the first address is the fourth segment for the other equipment connected to the on-premises LAN 302. A different local IP address, [10.20.30. M].

As for the second address, a device IP address different in the fourth segment from the downstream device (research and development device 210), for example, the same IP address [10.20.30.0] as that of the on-premises server 303 is assigned. is added to the premises LAN 302, the [A. B. C. E] is given (S150). [A. B. C. E] may be an arbitrary integer from 0 to 255, so the same [10.20.30.0] as the local server 303 may be given.

In other words, with respect to the first address, when a plurality of local LANs are integrated and a new integrated LAN 400 is constructed, an IP address in a fourth segment different from that of the server 100 is assigned to the repeater 1, and may be used as the first address, and if the local LAN is to be maintained, the IP address of the original local LAN device may be assigned. As for the second address, the IP address assigned to the original

local servers

301 and 303 may be set regardless of whether the downstream device is a PLC manufacturing device or a local LAN device, making the address setting work easy. is.

Next, the configuration of the communication range of the entire manufacturing information management system 2 including the repeater 1 will be described with reference to FIG. Regarding the case where the range of the local LAN is maintained and the repeater is added, the configuration and operation of the repeater are the same, so the detailed description is omitted. The manufacturing information management system 2 includes a server 100 serving as an upstream device, a plurality of manufacturing devices 200 (A, B, C, . . . ) serving as downstream devices, and repeaters 1 (α, β , γ . . ), external information interrupting means 10, and a biometric information acquisition device 500 carried by the user. Assume that manufacturing equipment A is a PLC manufacturing equipment, and manufacturing equipments B and C are manufacturing equipment connected to the same local LAN.

Each manufacturing equipment 200 is connected to the upstream network, the general LAN 400, via one line via the repeater 1, and is capable of communicating with the server 100. The manufacturing equipment 200 is only connected to one repeater 1 through the dedicated second communication means 40, and is independent of other manufacturing equipment. In other words, the second address of the repeater α may be an IP address that is different in the fourth segment only from that of the manufactured device A. Even if the second address overlaps with that of the repeater β or repeater γ, communication failure does not occur.

The server 100 comprises control means 101, storage means 102, and communication means 103 for communicating with each repeater 1. The control means 101 is composed of a central processing unit (CPU), and the user information sent from the intermediary device 1 is collated with the user information for judgment, and the authentication processing means for performing login authentication processing, and the audit for creating an audit trail from the manufacturing information. It functions as a trail creation means.

The storage means 102 is not limited as long as it is a hard disk, RAM, or the like. The storage unit 102 stores in advance user information for determination, user name/authority information linked to the user information, an application that causes the control unit to function, and the like. When the authentication determining means performs the user login authentication process, the login authentication information is stored together with the time information as a history of the authentication process. The time information of the server may be obtained from the time information obtaining means 104 that obtains the desired standard time through the Internet, GPS, or the like.

When the manufacturing information forming the third information is sent from the manufacturing equipment to the server 100, the manufacturing information is stored together with the time information. When the audit trail creating means creates an audit trail based on manufacturing information and the like, the audit trail report is stored. Of course, the information stored in the storage means 102 is not limited to these. Further, it goes without saying that the server 100 may be provided with a display means 105 and an input means 106 .

The manufacturing equipment 200 (A, B, C, . The control means 220 may be a CPU or the like, and the storage means 221 may be a hard disk or the like. The display means 223 and the input means 224 may be touch screen panel devices.

The control means 220 functions as drive restriction means that prevents the manufacturing equipment 200 from being driven until login authentication information is acquired from the server 100 via the repeater 1 . After the manufacturing equipment is driven, the control means 220 functions as manufacturing information creating means, and every time manufacturing information is created, the updated manufacturing information is transmitted to the server 100 via the repeater 1. function as a means.

Next, the biometric information acquirer 500 for interrupting user information from the external information interrupting means 10 to the repeater 1 will be described with reference to FIG. A biometric information acquisition device 500 that acquires two types of biometric information is a combination of a mobile terminal 510 that acquires fingerprint information as biometric information and a shoe insole type gait information acquisition device 520 (FIG. 5A). Figure, see Figure (B)). Portable terminal 510 has control means 511 functioning as determination means, storage means 512 , short-range wireless communication means 513 , fingerprint sensor 514 , and electromagnetic wave communication means 515 . It also has a touch screen 516 that functions as display means and input means.

The storage means 512 stores an application of the control means 511, determination fingerprint information and determination gait information forming determination use biometric information, and user information. The short-range wireless communication means 513 is not limited as long as it can communicate with the gait information acquisition device. The fingerprint sensor 514 may have a fingerprint authentication function installed in the mobile terminal 510 . The electromagnetic wave communication means 515 is not limited as long as it can generate user information by electromagnetic waves and can be read by the non-contact electromagnetic wave reader forming the external information interrupting means 10 . For example, RFID tags and RFID readers are suitable.

The gait information acquisition device 520 includes a gait acquisition sensor 521 and short-range wireless communication means 522 for sending gait information to the mobile terminal. The gait acquisition sensor 521 is attached to the back surface of the insole, and is used by being inserted into the user's shoe together with the insole. Gait information refers to characteristic motion information in walking, and refers to general information obtained by estimating sex, age, body shape, step length, etc. from motion.

When two types of biometric information are acquired and transmitted to the mobile terminal 510, the control means 511 functions as a determination means, the biometric information for determination is read out from the storage means 512, and user determination processing is performed. If it is determined that all of the biometric information matches the biometric information for determination, the operator carrying the biometric information acquisition device 500 is determined to be an authentic person. The two types of biometric information are not limited to fingerprints and gait, and may be iris, pulse wave, face, myoelectric potential, voiceprint, etc. Even if the two biometric information acquisition devices are different devices, Of course it is good.

When the portable terminal 510 is brought close to the non-contact electromagnetic wave reader, the user information is read from the storage means 512 and the user information is generated by the electromagnetic wave communication means 515 by electromagnetic waves. The user information whose authenticity is guaranteed is interrupted by the external information interrupting means to the repeater, the repeater transmits the user information to the server, and the server authenticates the user information. This eliminates spoofing authentication and ensures the authenticity of login authentication by the server.

A non-contact IC card 530 is suitable for a biometric information acquisition device that acquires one type of biometric information (see FIG. 6). The contactless IC card 530 has an IC chip 531 on its surface for obtaining biometric information. The IC chip 531 includes control means 532 functioning as determination means, storage means 533 , fingerprint sensor 534 , and electromagnetic wave communication means 535 . Since these function in the same manner as the portable terminal described above except that they are integrated into the IC chip 531, the description thereof will be omitted.

When the non-contact IC card 530 is brought close to the non-contact electromagnetic wave reader while the finger registered with the fingerprint is in contact with the IC chip 531 (see FIG. 6A), induction power is generated by the electromagnetic wave. The IC chip is activated. Then, like a normal RFID tag, pre-stored user information is generated by electromagnetic waves, and the user information is read by a non-contact electromagnetic wave reader.

Here, the interrupt processing of the first information, the processing of the address setting means, and the relay processing of the second and third information will be briefly described with reference to FIG. 7A shows the flow of the external information interrupt means, FIG. 7B shows the relay processing of the second information, and FIG. 7C shows the flow of the relay processing of the third information. showing. When first information such as user information is sent from the external information interrupt means to the repeater, the repeater starts interrupt processing for the first information (S200). Next, it is determined whether to relay the first information upstream (S210).

Here, if it is determined that the first information is to be relayed upstream (Yes), the address setting means sets the first address as the source address in the first information and causes it to be transmitted to the upstream server. (S220). This is the stage before the login determination means is managed by the server, and if the login determination means is held in the manufacturing equipment, the first information is relayed downstream, so that a determination of (No) is made in step 210, The second address may be set as the address of the transmission source in the first information and communicated with downstream manufacturing equipment (S230).

When the second information generated according to the user information forming the first information, such as login authentication information, is communicated to the repeater with the upstream server as the transmission source (S300), the address setting means changes the second information. The second address is set as the address of the transmission source and transmitted to downstream manufacturing equipment (S310).

When the repeater acquires the manufacturing information forming the third information with the downstream manufacturing equipment as the transmission source (S400), the address setting means sets the first address as the transmission source address in the third information, Send it to the upstream server (S410).

Next, the control up to system activation of the manufacturing information management system will be described with reference to the flowchart of FIG. 8, and the control after system activation will be described with reference to the flowchart of FIG. First, an operator of manufacturing equipment, who is a user, wears a biometric information acquisition device (S500). Here, "wearing" means, for example, that the operator puts a finger on the fingerprint sensor of the portable terminal or puts on shoes in which the gait information acquisition device is inserted. A biometric information acquisition device generates first biometric information (S510). The determination means of the biometric information acquisition device collates whether the first biometric information of the operator and the biometric information for determination match, and determines the authenticity of the first biometric information (S520). If it is determined that the first biometric information is not authentic, the biometric authentication is terminated (S530).

If the first biometric information is authentic, second biometric information of the operator is generated (S540). Authenticity of the second biometric information is determined by the determination means of the biometric information acquisition device in the same manner as the first biometric information (S550). If it is determined that the second biometric information is not authentic, the biometric authentication is terminated (S560). If the second biometric information is also determined to be authentic, the user information stored in the biometric information device is generated by electromagnetic waves (S570). When the biometric information acquisition device is brought close to the non-contact electromagnetic wave reader in this state, the user information forming the first information is acquired (S580).

Subsequently, system drive processing of the manufacturing information management system is started (S600) (see FIG. 9). In FIG. 9, for ease of understanding, the processing of the repeater is indicated by enclosing it with a solid line, and the processing of other devices is indicated by enclosing it with a broken line. First, as an interrupt process for the first information, the user information is relayed from the repeater to the server (S610). When the server acquires the user information, login authentication processing is performed (S620). If the authentication process succeeds, the server communicates the login authentication information to the repeater (S630).

When the repeater acquires the login authentication information, the repeater relays the login authentication information to the manufacturing equipment as a second information relay process (S640). When the login authentication information is acquired by the manufacturing equipment, the driving regulation of the manufacturing equipment is released, and manufacturing information is generated in the manufacturing equipment (S650). Every time manufacturing information is newly generated, the manufacturing equipment communicates the generated manufacturing information from the manufacturing equipment to the repeater (S660). When the repeater acquires the manufacturing information, the repeater relays the manufacturing information to the server as third information relay processing (S670). When the server acquires the manufacturing information, the server stores the manufacturing information and stores the manufacturing information in such a manner that it can be identified by which manufacturing equipment the manufacturing information was generated (S680).

In the second embodiment, the manufacturing information management system 3 in which the server is a virtual computer provided by a cloud computing service will be described with reference to FIG. FIG. 10A shows an explanatory diagram of a virtual private network. FIG. 10B shows a block diagram of a server made up of virtual computers. In FIG. 10B, for easy understanding, the configuration different from that of the server of the first embodiment is enclosed with a thick dashed line.

The server 110 is a virtual computer based on a cloud computing service, and a virtual private network 111 that uses a public line as a virtual private line connects not only repeaters of a plurality of

manufacturing plants

112, 113, and 114 but also the head office building 115. , is also connected to a repeater installed in the branch office building 116 (see FIG. 10(A)). The storage means 102 of the server 110 stores the manufacturing information in a state in which each manufacturing plant can be identified, and the management information, which is one of the third information, is stored in a state in which each head office/branch office can be identified. points are different. Specific examples of the management information include, but are not limited to, important information such as order/delivery data, contract data, manufacturing information, and user information.

In the manufacturing information management system 3, one server 110 centrally manages the login authentication processing of a plurality of manufacturing plants, the head office, and branch offices, so it is easy to always keep user information up-to-date, and management effort is reduced. . In addition, it is possible to centralize and manage all manufacturing information across multiple manufacturing plants in remote locations, and to integrate management information in the head office and branch offices into one server.

In addition, since the server 110 is a virtual computer and data is stored on the Internet, even if a large-scale disaster such as an earthquake occurs and the manufacturing plant, head office building, etc. Loss of certain past manufacturing information, user information, management information, etc. can be prevented. Since the server 110 and the repeater communicate with each other through the virtual private network 111, even when manufacturing pharmaceuticals, it is possible to collectively manage the manufacturing data of the dispersed factories while complying with the "Good Manufacturing Practices for Pharmaceutical Manufacturing". can be done.

(others)
- In the first embodiment, an example using a portable terminal and a gait information acquisition device, and an example using an IC card were shown, but the aspect of the biometric information acquisition device is of course not limited to this. For example, it may be a wristwatch-type or glasses-type wearable terminal. The combination of biometric information to be acquired is also not limited.
- In the first embodiment, each of the four parts that make up the IP address is called a segment, but it may be called an octet, for example, and the name is of course not limited.
- In the first embodiment, the communication standard is described as IPv4 both upstream and downstream of the repeater for ease of understanding, but the upstream may be IPv6 and the downstream may be IPv4. Moreover, it goes without saying that the communication standards are not limited to IPv6 and IPv4.

- Communication from the repeater to the upstream network is not limited to wired communication, and may be wireless communication. In the case of wireless communication, it is preferable to use an IC card (also called a SIM card) in which an ID number for identifying a subscriber is recorded for upstream communication from a repeater. Not limited.
- The embodiments disclosed this time are illustrative in all respects and should be considered not restrictive. The technical scope of the present invention is not limited to the above description, but is indicated by the scope of claims, and is intended to include all modifications within the scope and meaning equivalent to the scope of claims.

1... repeater, 2, 3... manufacturing information management system,
10... External information interrupting means, 100... Server, 200... Manufacturing equipment,
300... Premises LAN, 400... Overall LAN, 500... Biometric information acquisition device,
1000... Chemical manufacturing factory,
11...USB cable,
20, 21 LAN port, 22 USB port, 23 power acquisition means,
30... First communication means, 31... LAN cable,
40... second communication means, 41... LAN cable,
50... Control means, 60... Storage means,
70... input means, 71... display means, 72... notebook type terminal device,
101... Control means, 102... Storage means, 103... Communication means,
104... time information acquisition means, 105... display means, 106... input means,
201 ... PLC manufacturing equipment, 202 ... manufacturing equipment, 210 ... research and development equipment,
220... Control means, 221... Storage means, 222... Communication means,
223 ... display means, 224 ... input means,
301, 303... local server, 302... local LAN,
510... Portable terminal, 511... Control means, 512... Storage means,
513... short-range wireless communication means, 514... fingerprint sensor,
515... Electromagnetic wave communication means, 516... Touch screen,
520... Gait information acquisition device, 521... Gait acquisition sensor,
522... short-range wireless communication means, 530... non-contact IC card,
531 ... IC chip, 532 ... control means,
533... Storage means, 534... Fingerprint sensor, 535... Electromagnetic wave communication means,
110... server, 111... virtual private network,
112, 113, 114...manufacturing factory, 115...head office building, 116...branch office building

Claims

A repeater that allows communication between a downstream device, in which a downstream communication identifier is set in advance for communication with the repeater, and an upstream device connected to an upstream network, and is connectable to external information interrupt means. hand,
A first communication means, a first address, a second communication means, a second address, and an address setting means,
a first means of communication is connected to an upstream network and a second means of communication is connected to a downstream device;
The first address differs only in the individual identifier portion that distinguishes it from the upstream distribution credit identifier of other devices connected to the upstream network,
The second address differs only in the individual identifier part that distinguishes it from the identifier for downstream communication of the downstream device,
Connect the downstream device to the upstream network through only one line,
The address setting means functions as setting means for setting the communication identifier of the transmission source, and is for upstream distribution of the repeater when the first information whose transmission source is the external information interrupting means is transmitted to the upstream side. setting the first address to the identifier and transmitting, and setting the second address to the downstream communication identifier of the repeater and transmitting the first information to the downstream side;
A repeater characterized by:
When the first communication means and the second communication means are based on the IPv4 communication standard,
The first address is an IP address that differs only in the fourth segment from the upstream distribution credit identifier of another device,
the second address is an IP address that differs from the downstream communication identifier of the downstream device only in the fourth segment;
The repeater according to claim 1, characterized in that
The address setting means
setting the second address to the downstream communication identifier of the repeater in the second information generated in accordance with the first information transmitted to the upstream side and having the upstream device as the transmission source, and causing the downstream device to transmit the information;
3. The repeater according to claim 1 or 2, characterized by:
The address setting means
The third information originating from the downstream device is transmitted to the upstream device by setting the first address to the upstream distribution credit identifier of the repeater.
4. The repeater according to claim 3, characterized by:
The downstream device is a manufacturing device, the upstream device is a server, first information is user information, second information is login authentication information, third information is manufacturing information, user information and login authentication. information and manufacturing information are stored only on the server along with time information;
5. The repeater according to claim 4, characterized by:
A manufacturing information management system comprising the repeater according to claim 5 and a biometric information acquisition device,
the external information interrupting means is a non-contact electromagnetic wave reader,
The biometric information acquisition device includes biometric information acquisition means, storage means, determination means, and communication means,
causing the biometric information acquiring means to acquire the biometric information of the user;
if the determination means determines that the biometric information and the user determination information stored in the storage means match, the communication means generates the user information using electromagnetic waves;
the user information received by the external information interrupting means is relayed to the server, and login authentication is performed at the server;
A manufacturing information management system characterized by:
The biometric information acquisition device acquires two types of biometric information of the user,
The user determination information is also two types of biometric information for determination according to the type of the biometric information,
The user information is generated when the determining means determines that any of the biometric information matches the biometric information for determination.
7. The manufacturing information management system according to claim 6, characterized by:
The server is a virtual computer by a cloud computing service,
The repeater and the virtual computer are connected by a virtual private network that uses a public line as a virtual private line,
8. The manufacturing information management system according to claim 6 or 7, characterized by: