Method and device for securely accessing industrial automation component
Generate and transmit specific electronic access information through mobile devices, combining biometrics and Internet connections, solves the security and efficiency of identity verification and access in industrial automation systems, and achieves secure, fast and efficient access in emergencies and Operation automation components.
Patent Information
- Application Number
- CN202410872389.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-07-04
- Filing Date
- 2024-07-01
- Publication Date
- 2025-01-07
AI Technical Summary
In industrial automation systems, existing authentication methods have problems such as simple and easy guessing passwords, PIN brute force cracking, electronic ID card theft and forgetting, unauthorized access, lack of multi-factor authentication, and difficult to achieve external maintenance in emergencies. Especially in the event of failure or abnormal events, there is a lack of optimized access settings and enhanced ergonomic input and output means.
Generate and transmit specific electronic access information through mobile devices, combine mobile devices' biometrics and Internet connections to achieve secure access to industrial automation components, use radio modules and data networks to transmit access information, support multi-factor authentication and time limits, and ensure that only Authorized personnel can access and operate automation components under certain circumstances.
Simplifies authentication of external operators, improves access efficiency and security in emergencies, ensures that only authorized personnel can access and operate automation components in specific situations, reduces the risk of unauthorized access, and provides Necessary input and output means to deal with faults and maintenance needs.
Smart Images
Figure CN119272266A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a method according to the invention for secure access to an industrial automation component and to a device according to the invention for secure access to an industrial automation component. Background Art
[0002] In industrial automation systems, a large number of computer-controlled automation components, such as operating devices and monitoring devices (HMI, Human Machine Interface), programmable logic controllers (PLC), computers, machines, etc., have a graphical user interface and are operated by employees (OP, operators).
[0003] Particularly in larger or more difficult to protect manufacturing environments, production machines or other automated components are often protected from unauthorized access such that a person (hereinafter also referred to as an operator) must first be authenticated before they can access critical information or initiate critical operations.
[0004] Traditionally, authentication has been achieved in most cases by entering a username and password (e.g. on a common HDMI (High Definition Multimedia Interface) panel) or by means of a personalized ID card and an associated wireless card reader (which usually works wirelessly over short distances using RFID (Radio Frequency Identification) technology. An example is the Simatic RF 1000 system from the manufacturer Siemens).
[0005] It is well known that each of the common measures for access control has certain disadvantages. In the case of common passwords, users tend to use passwords that are too simple or easy to guess; in the case of PIN entry, access can be forced by brute force attacks, access information (so-called credentials) can be forgotten; and in the case of displays without a touch interface, additional input devices such as a keyboard or a computer mouse are required.
[0006] In the case of the electronic ID cards already mentioned, it can happen that these cards are stolen and misused by unauthorized persons, these cards can also be forgotten, or the certificates stored on these access cards can expire and thus become invalid. Furthermore, a disadvantage of the described method of authentication and authorization is that the persons concerned, for example in service or emergency situations, must first be created / registered as users in the system and then access information (cards, user names, passwords, etc.) must be generated and distributed to the persons.
[0007] The described disadvantages are particularly disruptive in the event of a machine failure or other abnormal events, if an automation component presents an operating state for which a special external maintenance person must be called in at short notice and approval of the corresponding automation component is required. In the prior art, no optimized settings for industrial "guest access" are known, and furthermore, the methods described in the prior art do not allow for multi-factor authentication, as is known, for example, from online banking and other applications.
[0008] A further disadvantage of known automation components and graphical user interfaces of automation components is that, although they are dimensioned adequately for everyday operation, the required enhanced ergonomics in the event of an alarm or maintenance cannot be achieved, in particular only too little situation-specific information is displayed and there are also insufficient input and output means (e.g. only a touch display without a keyboard etc.) which could be helpful or even necessary in special cases. Summary of the invention
[0009] It is therefore an object of the present invention to simplify authentication in industrial automation components, in particular authentication of external operators, and to improve access to industrial automation components, in particular in emergency situations and similar operating states.
[0010] The core idea of achieving this object according to the invention is that, in particular when a special operating state occurs (e.g. in the event of a fault), specific electronic access information is generated for the operator required for the specific situation and transmitted to the mobile device of the notified operator together with specific information about the current situation, for example information about the current fault and information about instructions or resources on how to correct the fault and stored on the mobile device. When the operator arrives at the affected automation component, the operator can now log in to the automation component using the access information. This is similar to using an RFID-enabled access card or paying with a contactless payment method at a supermarket checkout. The operator can use the mobile device to access the previously transmitted specific information and can also use the mobile device as an operating device or input device for the automation component, for example by entering and transmitting commands, downloading diagnostic software or new operating software, etc. The last-mentioned steps do not necessarily have to be performed by the RFID radio module of the automation component, but can be transmitted to the plant and thus to the automation component via the Internet connection of the mobile device, for which purpose the corresponding address information etc. is advantageously already transmitted to the mobile device together with the specific information.
[0011] This object is achieved in particular by the method according to the invention and the device according to the invention.
[0012] A method for secure access to an industrial automation component via a mobile device is proposed, wherein unauthorized access to the automation component is prevented, wherein the automation component is equipped with a radio unit for receiving wirelessly transmitted access information, and wherein valid access information is stored on the mobile device and transmitted to the radio unit when located in the vicinity of the automation component and detected in the automation component, and then access to the automation component is enabled in the affirmative. In a first step, at least one operator responsible for the current operating state is selected, in a second step, specific or personalized access information for the selected operator is selected or created by the automation component or an associated server component, and in a third step, specific information about the operating state and the valid access information is transmitted to the operator's mobile device, and in a fourth step, the operator obtains access to the automation component with the aid of the access information and performs inputs or other operating actions on the automation component via the mobile device with the aid of the specific information. By means of this method, in particular for maintenance purposes, operators can obtain access to specific instances of the automation component in question, obtain the necessary information provision and authenticate themselves to the automation component with the aid of the operator's personal mobile device and operate the automation component.
[0013] The object is also achieved by a device for securely accessing an industrial automation component using a mobile device. The automation component is equipped with a radio module for exchanging access information with a mobile device, wherein the automation component or a server linked to the automation component is used to generate access information for a selected operator based on the current operating state of the automation component and to create specific information about the operating state, and is arranged to transmit the access information and the specific information to the mobile device, wherein the mobile device is arranged to authenticate the operator to the automation component by means of transmitting the access information to the radio module, and wherein the mobile device is arranged to display and / or use the specific information to operate or influence the automation component. With this arrangement, the advantages already discussed according to the method can be achieved.
[0014] Advantageous embodiments of the method according to the invention are described in detail in the present invention. The features and advantages specified here also apply to the device or arrangement according to the invention in a meaningful manner. The embodiments explained in this way can be realized both individually and in a meaningful way in combination with each other.
[0015] The method can be used particularly advantageously if the operating state is a fault, error, alarm state or other event and the method steps are initiated when such an event occurs. In this case, for example, an external consultant or expert can be called in as an operator, wherein the required information and the required access authorization are then advantageously sent to the operator together with the authorization in the form of electronic access information to the operator's personal mobile device (e.g., smartphone or tablet). For personnel who cannot regularly access the production site or a specific automation component, the access information can also be time-limited. The time limit can be stored in the access information digitally (e.g., digital certificate), but can also be stored in the plant infrastructure, in particular in the relevant automation component, so that access is not granted outside the specified time window. Advantageously, the access information is personalized so that the access information can only be activated together with the operator's personal mobile device or with the operator's biometric input (e.g., fingerprint, facial recognition). In another embodiment, other secret information (e.g., activation PIN) can be sent to the operator as a multi-factor authentication in different ways, wherein the other secret information must then be entered on the mobile device to activate the access information or on the relevant automation component. Advantageously, the access information or other access information sent virtually in parallel makes it possible to temporarily gain access to a building or a location and thus to access an automation component by means of an automatic access control system.
[0016] It is advantageously provided that the respective access authorizations (for a particular purpose and time) of the respective operators are assigned according to the identity or according to the stored qualifications or according to the assigned personal restrictions, in particular to the user interface of the automation component, and that the assigned access authorizations are linked to the respective access information, so that the subsequent access operations of the respective operators are restricted or enabled accordingly. This makes it possible to restrict the access of the selected persons to the information and functions of the automation component which correspond to the general authorizations of the persons and are necessary for solving the current problem. Depending on the specific situation, these restrictions or permissions can also be different for the same person, depending on the event for verifying the current generation of the access authorization.
[0017] The method is advantageously applied to industrial operating devices and monitoring devices or control devices for industrial processes or manufacturing automation systems as automation components. The automation components usually already have the required computing power and can be easily equipped with a radio module or reader for wireless access to information. In addition, the automation components are usually connected to a data network, so that the operations performed on the mobile device do not necessarily have to be performed by means of a radio connection for logging into the device or another direct radio coupling (for example, using the Bluetooth protocol), but rather a further data exchange between the mobile device and the relevant automation component can be achieved via the described data network. For example, a web server can be started on the automation component or on a server connected to the automation component, and a web browser can be started on the mobile device so that after configuring the corresponding access information and URL (Uniform Resource Locator), the user interface of the automation component can be displayed on the mobile device. In this way, files (especially software installations) can be uploaded from the mobile device to the automation component and installed on the automation component. Of course, such software transfer can also be achieved in other ways.
[0018] In an alternative variant, the specific information can also contain or reference a specific application, a so-called App, which is started on the mobile device and serves as a user interface for operating or "repairing" the automation component. The resulting data traffic between the automation component and the mobile device can take place via the Internet and the plant intranet described, but can also take place directly, for example by means of a Bluetooth connection or an ad-hoc WLAN (temporary network) connection between the automation component and the mobile device.
[0019] As mentioned above, the radio unit is configured to exchange information using the RFID (Radio Frequency Identification) protocol, in particular for bidirectional data exchange. Alternative solutions are possible, in particular using the Bluetooth protocol or other short-range radio connections. The use of such short-range radio connections is particularly advantageous, since they ensure that the operator is nearby when accessing the automation component and that the automation component cannot be accessed accidentally or even mistakenly from a distance. In particular, a QR code can be displayed as access information on the display of the mobile device, which is read by a camera in the automation component and, if there is a corresponding match, access is granted. In another advantageous variant, the automation component can also be provided with a QR code, which is scanned by the camera of the mobile device and then, after a comparison with the access information in the mobile device or by a server connected to the mobile device, access to the automation component is initiated via the data connection of the mobile device, the corresponding gateway of the automation network and thus via the plant's own data network.
[0020] Advantageously, the specific information and the access information are transmitted to the mobile device, in particular to the industrial application of the mobile device, in the form of a bundle. In the simplest case, the information is transmitted as a text message, an e-mail or a social network message. The bundling ensures that one of the two information units cannot be separated from the other by accident or technical error and that one of the two information units cannot be transmitted or otherwise transferred. It is particularly advantageous if a small application, i.e. a special application, is run on the mobile device, which receives the bundled information, stores the access information in a special storage area or information memory ("wallet") of the mobile device and makes the further information available to the user via a special graphical user interface. In particular, such an application or app can also be presented as a specially designed graphical user interface for industrial automation components, wherein it is also possible to select and configure a suitable or correct graphical user interface from a plurality of available user interfaces based on the specific information.
[0021] As already mentioned, the special storage area or information storage ("wallet") can advantageously be protected with biometric information or a property of the respective operator, with the operator identifying himself on the mobile device with the aid of this biometric information or property before the access information is transmitted to the automation component. Further information or user interfaces displayed by the described application or by the browser on the mobile device can also be additionally protected by such biometric information, personal property, password or PIN.
[0022] Advantageously, a number of available personnel are stored in the overall system for a number of different practical situations, wherein a number of suitable operators are selected from the number of available operators depending on the current operating state and the specific information and the corresponding access information are transmitted to the mobile devices of these selected operators. It can also be provided that one of the notified persons accepts the order associated with the notification, in particular by confirming it on the person's mobile device, and the other notified persons receive a rejection accordingly. It is also possible to implement a hierarchical notification concept so that the most suitable person is notified first, and in the event that this person does not actively sign for the notification, the next most suitable person is notified by transmitting the mentioned information, and so on.
[0023] Advantageously, the operator is automatically suggested or selected based on stored previously manually selected operators or based on the skills assigned to the available operators in accordance with the operating state. This ensures that no unsuitable operators are consulted.
[0024] The specific information transmitted is advantageously adapted to the current situation and thus to the current operating state of the automation component or the associated digital plant, wherein in particular instructions and / or digital resources and / or software variants adapted to the current operating state or other files for the automation component are transmitted to the mobile device together with the specific information. For example, after approval by an operator, the adapted software variant or files or operating commands can be transmitted from the mobile device to the automation component. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] Exemplary embodiments of the method according to the invention and of the device according to the invention are explained below with reference to the drawings. Figure 1 The reference signs introduced in Figure 2 The figure shows:
[0026] Figure 1 A schematic diagram showing wireless access to automation components via a mobile device, and
[0027] Figure 2 The transmission and generation of access information to a mobile device is shown. DETAILED DESCRIPTION
[0028] Figure 1 The local access of an operator OP (operator) to an automation component HMI (human machine interface) is schematically shown. In the present case, the automation component HMI represents a conventional operator control and monitoring device for controlling a machine or the like, for example a robot. Figure 2 In the example shown in FIG. 1 , such a machine A is shown; in other embodiments, the user interface displayed on the automation component HMI can also be displayed directly by the correspondingly equipped machine A. Therefore, the automation component HMI in the context of the present invention means the machine A or the operable part of its user interface.
[0029] Basically, in Figure 1In the context of FIG. 1 , it is assumed that valid access information CR (credential) is stored on a mobile device SD (smart device) of an operator OP, for example in the manner of a virtual credit card on a mobile phone for wireless payment. When the mobile device SD approaches the radio module RFU (RFID unit) of the automation component HMI, the two devices touch each other in step A, after which the operator OP activates the use of the access information CR in step B, for example, by facial recognition, by entering a fingerprint, entering a PIN code, etc. In step C, a session is opened for this operator OP on the automation component HMI. The automation component HMI repeatedly checks whether the mobile device SD is still within the radio range of the radio module RFU; otherwise, the session is closed. The operator OP can now use the mobile device SD to operate the automation component HMI, for example using an application or another graphical user interface (for example in a browser), wherein the required data transmission does not necessarily have to take place via the radio module RFU. In addition, the operator OP can also access previously stored context information and other digital resources, files, etc. on the operator's mobile device SD, which have been stored according to the specific situation and with respect to the operating state of the specific automation component HMI or the connected machine A (such as Figure 2 ) and optionally also with respect to the knowledge (skills) of the operator OP.
[0030] Figure 2 By way of example, it is shown how, according to the invention, an employee of a support team ST can be selected as an operator OP as appropriate and provided with access information CR and specific information about the current operating status of a machine A.
[0031] Assume that a critical operating state occurs on machine A, for example an error or machine failure, wherein in step 1 information about this current operating state is transmitted from machine A to the automation component HMI in the form of an error message / error code. This error is displayed on the user interface of the automation component HMI, wherein the machine operator or other person present can press a button marked "Create CR" to call a qualified operator OP. In a variant not further described here, this step can also be omitted; the automation component HMI or the maintenance server (not shown) or the host system HS can be set up so that a qualified operator OP is automatically selected and called for a specific error without further manual intervention. In this case, the automation component HMI can perform the process of selecting this operator OP and generate a customized access information CR for the selected operator OP, compiling appropriate specific information about the error or operating state (machine information: name, location, problem; trace file, etc.), bundling it with the access information CR and transmitting it to the selected operator OP.
[0032] In the variant discussed below, after the detection of an operating state or an error and after pressing the "Create CR" button or alternatively without this confirmation step, the error message is transmitted to the workstation of the administrator ADM (step 2a). The administrator ADM is suggested by his / her workstation computer or server or host system HS from a database of employees of his / her support team ST, who are identified in the database as suitable for handling the detected operating state or error in the fault. Each of these employees is assigned a specific authorization category for accessing the automation component HMI, for example, administrator rights, normal user rights, limited user rights, etc., depending on their respective qualifications and permissions. Then, for each selected user, access information is retrieved or generated from the employee directory, wherein the corresponding access authorization (administrator, normal user, limited user, etc.) is assigned to the corresponding access information or directly incorporated therein.
[0033] Then, a list containing the assigned valid access information and the corresponding restrictions or permissions is transmitted to the HMI automation component; in the case where the restrictions are part of the digital access information CR, however, the latter information does not have to be transmitted to the automation component HMI. Then, the administrator ADM generates specific information about the current operating state, which includes, for example, a description of the existing error (issue), an extract from the electronic operating manual of the corresponding machine A, diagnostic software required for the current operating state or a reference to such software (link), a trace file (file with diagnostic information), etc. This additional specific information is advantageously provided partly or completely automatically by the computer or server of the administrator ADM, or in another variant by the automation component HMI. For example, it is possible to specify in the decision matrix not only which type of employee in the support team ST is eligible as the handler for which operating state or error, but also which information about the machine A is provided, which access rights are required, how long the access rights must be valid, etc. in which operating state or error.
[0034] The access information CR now generated (step 2b) is transmitted to the host system HS together with the specific information (or details or links or URLs related thereto) and is then transmitted by the host system HS in bundle with the specific information and in encrypted form separately to the selected employee of the support team ST or his personal mobile device SD (step 3). The selected employee of the support team ST now has the opportunity to view and accept the order on his mobile device, the type of order, the urgency and the estimated processing time of the order being specified. If necessary, the selected employees of the support team ST can also be notified in a specified order, for example in descending order of qualifications or in increasing order of cost, distance, etc. Once the employee accepts the order, a corresponding response message is sent to the host system HS, which cancels or suspends the order quotation of other employees. The access information CR transmitted with the data packet is received in the secure information storage WAL (wallet) of the mobile device SD of the employee who has affirmatively confirmed the service request. Depending on the type of information component, the specific information is either stored in the file system of the mobile device SD, displayed in a browser, or stored in a special service application (app). The selected employee can now access the plant with the machine A or the automation component HMI and access the automation component HMI as an operator OP, as has been done according to Figure 1 Explained as an example.
[0035] Using the method described above, it is also possible to grant external persons access to industrial equipment, machines or components according to the situation, making use of the fact that today almost everyone has a personal mobile device SD (e.g. mobile phone, tablet, laptop). This is a combination of access keys, HMI devices, help systems and data storage in one. Common operating and communication modes that are already familiar to every employee are used. The described infrastructure makes it possible to define the type, duration and scope of access authorization for each person individually and to create it together with all the necessary information and resources individually for the current situation or operating state and make it available to one or more employees selected in advance. With the proposed method or the proposed infrastructure, it is also possible to integrate a wide range of security measures (e.g. two-factor authentication, use of biometric authentication, etc.) into the concept. The concept allows both internal and external employees to obtain permanent access or temporary access (full access, limited access).
Claims
1. A method for securely accessing industrial automation components (HMI) using a mobile device (SD), in, The automation component (HMI) is disabled to prevent unauthorized access, wherein the automation component (HMI) is equipped with a radio unit (RFU) for receiving wirelessly transmitted access information (CR), wherein valid access information (CR) is stored on the mobile device (SD) and, when located in the vicinity of the automation component, is transmitted to the radio unit (RFU) and checked in the automation component (HMI) and, if positive, access to the automation component (HMI) is then enabled, It is characterized in that In a first step, at least one operator (OP) is selected who is responsible for the current operating state. In a second step, the automation component (HMI) or the associated server component (HS) selects or creates personalized access information (CR) for the selected operator (OP). In a third step, specific information about the operating state and the valid access information (CR) are transmitted to the mobile device (SD) of the operator (OP), and In a fourth step, the operator (OP) gains access to the automation component (HMI) using the access information (CR) and performs inputs or other operating actions on the automation component (HMI) via the mobile device (SD) using the specific information.
2. The method according to claim 1, It is characterized in that The operating state is a fault, error, alarm state or other event, and method steps are initiated when the event occurs.
3. The method according to any one of the preceding claims, It is characterized in that The respective access authorization of the respective operator (OP) is specified based on identity or based on stored qualifications or based on assigned personal restrictions, and the specified access authorization is linked to the respective access information (CR), thereby correspondingly restricting or enabling subsequent access operations of the respective operator (OP).
4. The method according to any one of the preceding claims, It is characterized in that Industrial operating and monitoring devices or control devices for industrial process or manufacturing automation systems are used as automation components (HMI).
5. The method according to any one of the preceding claims, It is characterized in that The radio unit (RFU) is configured to exchange information, in particular to exchange data bidirectionally, using an RFID protocol.
6. The method according to any one of the preceding claims, It is characterized in that The specific information and the access information (CR) are transmitted in a bundled form to the mobile device (SD), in particular to an industrial application of the mobile device (SD).
7. The method according to any one of the preceding claims, It is characterized in that The access information (CR) is stored in a protected information memory of the mobile device (SD), in particular in an electronic wallet.
8. The method according to claim 7, It is characterized in that The information storage device is protected using corresponding biometric information or a property of the operator (OP), wherein the operator (OP) authenticates himself on the mobile device (SD) by means of the biometric information or the property before transmitting the access information (CR) to the automation component (HMI).
9. The method according to any one of the preceding claims, It is characterized in that For operating the automation component (HMI), the specific information is used to create or configure a graphical user interface suitable for the automation component (HMI) and / or the corresponding operating state on the mobile device (SD).
10. The method according to any one of the preceding claims, It is characterized in that Based on the current operation status, a plurality of suitable operators (OP) are selected from a plurality of available operators, and the specific information and the corresponding access information (CR) are transmitted to the mobile device (SD) of the selected operator (OP).
11. The method according to claim 10, It is characterized in that The operator (OP) is automatically suggested or selected based on a stored previous manual selection of an operator (OP) or based on skills associated with comparable operating conditions assigned to available operators (OP).
12. The method according to any one of the preceding claims, It is characterized in that The specific information is used to transmit action instructions and / or digital resources and / or a software version suitable for the current operating state or other files for the automation component (HMI) to the mobile device (SD).
13. The method according to claim 12, It is characterized in that The adapted software version or file or operating command is transmitted from the mobile device (SD) to the automation component (HMI) after being approved by the operator (OP).
14. A device for securely accessing an industrial automation component (HMI) using a mobile device (SD), It is characterized in that The automation component (HMI) is equipped with a radio module for exchanging access information (CR) with a mobile device (SD), The automation component (HMI) or a server component (HS) linked to the automation component is configured to generate the access information (CR) for a selected operator (OP) in relation to the current operating state of the automation component (HMI), to create specific information about the operating state, and to transmit the access information (CR) and the specific information to the mobile device (SD), The mobile device (SD) is configured to authenticate the operator (OP) at the automation component (HMI) by transmitting the access information (CR) to the radio module, and The mobile device (SD) is configured to display and / or use the specific information to operate or influence the automation component (HMI).