Patent Application
20100031046
The invention relates to a method for authorizing access to at least one automation component of a technical system.
Modern technical systems generally comprise a plurality of so-called intelligent automation components, such as programmable controllers, field devices or drive controllers, for example, said automation components incorporating at least one processor and storage medium by means of which a desired automation solution can be executed by configuration and parameterization. Intelligent automation components of this kind are consequently flexible in their use and can be easily adapted to changing requirements corresponding to the changing requirements of the automation process.
Such work is generally carried out e.g. during commissioning by specially qualified personnel. The operations, settings and programming tasks involved are very sensitive, as they are crucially important for the proper, safe and efficient functioning of the entire technical system. In addition, secrecy aspects must be taken into account, as e.g. process engineering information or special recipes which are defined by the configuration, parameterization and programming must not be accessible to everyone.
Such work must therefore be carried out only by suitably trained and authorized personnel. This authorization can be multi-level and range from simple operator control tasks or adjustments through to in-depth interventions or inspections relating to the functioning of the system.
The ongoing maintenance of technical facilities is often assigned to third-party companies, an aspect where the checking of the authorization of the maintenance personnel is becoming an increasingly important consideration. In an age of increasing networking of system components by means of bus systems or an intranet or the Internet, the problem of authorization is assuming ever greater importance.
Moreover, the value of a technical system is increasingly determined by the functionality of the software used and not by the hardware components employed, which are often standardized and interchangeable.
System manufacturers therefore need to protect the automation components they have developed from unauthorized access to the developed software by means of suitable licensing and authorization methods.
In addition to the authorization of a user of the automation component, it is in many cases desirable or even mandatory to prepare a log detailing the actions carried out during a commissioning or maintenance procedure. This relates primarily to the food and pharmaceutical industry. Other reasons for logging of this kind can be the billing of services provided, the processing of warranty claims and the obtaining of statistical information about reliability, or else problem accumulation in the case of automated machines.
In order to check the authorization of an operator or of a service person to be authorized, mainly password-protected systems are currently used, the passwords either being hard coded into control software or freely selectable, and stored by the user. However, in both cases the problem arises that such passwords are unintentionally known to a comparatively large group of people and cannot therefore offer secure protection against unauthorized access. Particularly in cases of modifiable passwords, these would have to be documented at a suitable location, the documentation of said passwords constituting another source of problems in terms of unwanted divulgement of the passwords. In addition, the complexity in respect of maintaining in particular graduated access privileges is considerable here. Moreover, a password-enabled automation component is open for access by all connected communications partners, even though they may not possess the required qualification and authorization.
Another known possibility for protecting against unauthorized access is a mechanical barrier, e.g. by locking switch cabinet doors. However, modern systems may often be operated and maintained remotely, e.g. via a telephone line or the Internet, in which case mechanical protection of this kind is ineffective.
In the case of software licensing, there are currently likewise a number of solutions ranging from simple give-away software with vended hardware through to chargeable software functions. Particularly in the case of software, there is mainly the risk here of unchecked and illegal copying. In order to address this problem, so-called licensing codes are sometimes used which are calculated from complex licensing algorithms. For example, a customer can specify the serial number of the hardware on which a software package is to run, and then receives from the developer or manufacturer a license key with which he can activate the software on that hardware. However, licensing models of this kind are laborious to implement and a number of exception situations arise, e.g. if a defective hardware part with corresponding software must be changed and the old licensing code then no longer works.
Logging of parameterization, commissioning and maintenance operations, for example, is usually the responsibility of the personnel doing the work, e.g. by keeping plant log books in hardcopy or electronic form. Problems often arise here due to incomplete records. Sometimes logging also takes place automatically by an automation component itself, but this is totally detached from the person performing loggable actions on the system. Therefore, it cannot usually be established with certainty afterwards who has carried out particular actions.
An object of the invention is therefore to specify an improved method for authorizing access to at least one automation component of a technical system.
For some partial aspects, solutions already exist, such as, for example, so-called smart cards which e.g. check an access authorization, enable cash to be withdrawn from ATMs, or can be used as a stored-value card or telephone card.
These smart cards contain an integrated circuit with microcontroller and a writable, nonvolatile memory. On the microcontroller, cryptographic algorithms can be executed which prevent unauthorized reading or modification of the data in the nonvolatile memory. In contrast to the hitherto commonly used magnetic stripe cards, these smart cards cannot be simply copied. Read/write devices can communicate with the smart cards via electronic contacts or, if suitably equipped (RFID), can also communicate wirelessly with the smart cards over short distances of a few centimeters. Near field communication of this kind is particularly convenient. The microcontrollers of these smart cards are mainly powerful enough to be able to calculate an asymmetrical encryption method using a public and a private key at least for a limited amount of data. This means that smart cards of this kind can also be used for verification and signature over nonsecure data links such as the Internet. As such smart cards can store a relatively large amount of information, and are protected against unauthorized copying, reading and modification of the stored information, this gives rise to their technical suitability in connection with the present invention. In particular, the authorization, licensing and logging of commissioning and maintenance actions in the case of automation components are to be improved. Only a single medium (the authorization unit/smart card) is required for all these tasks, while providing a high degree of flexibility for future upgrading.
The invention therefore results in a method for the authorization of access to at least one automation component of a technical system, comprising the following steps:
The invention is based on the consideration that, with the specified features, flexible, reliable and convenient authorization of access to the automation component is provided.
Said information and functions can be written to the smart card e.g. via appropriate write authorization codes both by the manufacturer of a technical system or automation component and by a system operator, an authorization unit advantageously also being able to contain a plurality of authorization keys for an individual person. These authorization keys can then be logically combined if e.g. a manufacturer authorizes a person for particular types of commissioning actions, as said person possesses appropriate knowledge. In addition, a system operator can authorize a person to access a number of technical systems of a particular type. These authorization keys mentioned by way of example can be stored on the same authorization unit, and the resulting detailed access privileges are derived from a logical combination of the individual privileges granted.
The connection of the authorization unit to the automation component advantageously takes place via an engineering system of the technical system, said system being designed to read and evaluate the authorization unit.
Complex technical systems comprise a large number of automation components and mostly contain an engineering system which is designed in particular to configure and parameterize all the automation components of the technical system. The engineering system is connected to the automation components e.g. via a bus system or an intranet or the Internet. Detection of the authorization unit can therefore take place centrally via the engineering system in order to access any automation components of the technical system.
In another advantageous embodiment of the invention, authorization to access the automation component is granted via the authorization unit in conjunction with an additional authorization/license server, at least some of the information contained in the authorization unit being storable and analyzable on the authorization/license server, i.e. the functionality of the authorization unit is distributed over the actual authorization unit (smart card) and the additional authorization/license servers.
Particularly in the case of internetworked authorization components which often have Internet capability, authorization via the authorization/license server specializing in performing authorization and licensing tasks is advantageous. For example, using the authorization/license server, a system operator can grant desired privileges to access particular automation components to individual persons identified by their respective authorization unit. This can be done online if the automation components and the authorization/license server are networked via the Internet. Here a system administrator can set up, block or adapt all access privileges from a central location at any time. Lost authorization units or deputization provisions are therefore no longer a problem. In addition, in the case of some in particular larger companies, the structures for integrating said authorization method are already in place, e.g. in the form of access authorization by means of smart card company ID cards. The same authorization unit that can authorize a parameterization, commissioning and maintenance action can also be used for a general operator control task which is subject to authorization if, for example, the automation component in question has a reading device for the authorization unit. In addition, the authorization unit can assume the access control function to the premises of the technical system.
For example, during commissioning or maintenance of a technical system the authorization unit is read in by the engineering system of the technical system, e.g. a notebook, which is equipped with a corresponding read/write device, thereby initially enabling access to any data records for the technical system that are already stored on the engineering system. Sensitive parameter and configuration files can be advantageously encrypted and decrypted via a crypto function on the authorization unit. In addition, the engineering system can undertake the forwarding of authorization unit information to the connected automation components in order to allow access to the automation components also. The access privileges can be graduated depending on the owner of the authorization unit.
Simpler, less complex automation components such as simple frequency converters, for example, are often put into service without an additional engineering system, e.g. simple numerical displays and some keys on the device itself being available for commissioning. Particularly in the case of less complex automation components of this kind, a possible solution is to incorporate an interface based on “near field communication” in order to establish a connection with the authorization unit from a distance of a few centimeters. A near field communication interface of this kind can then also be advantageously used for other commissioning sequences such as, for example, automation of the exchange of user pairings for installing Bluetooth and WLAN networks, automatic identification of order and serial numbers of components by means of RFID tags or making barcodes superfluous.
The authorization unit advantageously also includes a budget account by means of which payment can be made for automation component software functions to be activated, removed or modified.
For example, for installing software that is subject to license or enabling optional software functions that are subject to license on the authorization unit, license points can be stored in the budget account which are then debited by the software application in question. This then broadly corresponds to how a stored-value card works, the license points being able to be deposited in the budget account in various ways:
For software activation, for example, the authorization component then debits a corresponding points budget to the budget account of the authorization unit. Conversely, when software functions are deactivated, license points can also be recredited to the authorization unit in order, for example, to allow testing of a software installation. In addition, e.g. when replacing automation components, software-related license points can be transferred to new automation components.
Particularly advantageously, support services of the manufacturer on the automation component can be billed using the budget account of the authorization unit.
In another advantageous embodiment of the invention, the technical actions executed by the operator on the automation component include parametrizing and/or configuring and/or programming the automation component, which actions are logged and provided with a digital signature by means of the digital signature function.
It is advantageous here if the logging and signing takes place in a memory of the authorization unit or at least partly in an external memory.
The external memory can hold the log book data to be stored and can be provided in the automation component itself or in the engineering system.
A typical logging sequence as part of the commissioning of an automation component can look like this:
On the basis of the GUID, the data from which the latter was calculated can be uniquely identified. Any change to the underlying data results in a changed GUID. A list of the last GUIDs generated together with the respective creation date is advantageously stored on the automation component.
In addition, the GUID can be transmitted to an administration computer of the system operator by means of the authorization unit or the engineering system. The changed data, such as parameter values, for example, can then be stored on said administration computer.
By comparing the GUIDs stored in the automation component with the GUIDs stored on the administration computer, it can be verified, at any time, when and which changes have been made by which user.
In order to increase security against misuse of a person-related authorization unit, the latter can also be additionally provided with a personal identification number (PIN) or with the biometric data for identifying its owner.
Three exemplary embodiments of the invention will now be presented in greater detail.
In the accompanying drawings:
In addition, a selection function 9 is provided by means of which the currently required access privileges are selected from the access privileges granted. For this purpose the selection function 9 is connected by data link to the system identification data 19 of the automation component 1. The user can now perform actions on the automation component 1 optionally or as standard by means of an encryption unit 11 and his private key 13, in this case also providing a public key 15 for decrypting the data on the automation component 1.
The decryption of the transmitted data on the automation component 1 is undertaken by a decryption unit 23. To check the user's authorization, a verification unit 21 is provided which receives the decrypted transmitted data and the system identification data 19. In the event of a positive authorization check, an enable function 25 of the automation component 1 is triggered and the user's intended actions on the automation component 1 are approved. The user can initial the actions digitally by means of a digital signature function 37 and therefore attribute them unambiguously and bindingly to his person. A budget account 39 incorporated in authorization unit 3 contains license points in order to pay for any chargeable actions on the automation component 1, such as activating/unlocking a software function or service measure.
For the authorization of such actions, an authorization connection 33 is provided which connects the engineering system, which reads the authorization unit, to the authorization/license server 27 and connects the latter to the authorization component 1.
In this embodiment, the connection of the authorization unit 3 to the automation component 1 takes place via the engineering system 17 which can be connected to a number of automation components. This means that the connection of the authorization unit 3 to a number of automation components 1 can be implemented centrally. The authorization/license server 27 specializes in checking, administering, billing and enabling the access privileges.
Lastly,
The different embodiments of the invention have the following elements in common, alternatively or in combination:
| Number | Date | Country | Kind |
|---|---|---|---|
| 10 2007 005 638.0 | Feb 2007 | DE | national |
This application is the US National Stage of International Application No. PCT/EP2008/051246 filed Feb. 1, 2008 and claims the benefit thereof. The International Application claims the benefits of German Patent Application No. 10 2007 005 638.0 DE filed Feb. 5, 2007, both of the applications are incorporated by reference herein in their entirety.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/EP08/51246 | 2/1/2008 | WO | 00 | 8/4/2009 |
