Communication system for processing network request of client and industrial automation equipment

Abstract

The invention provides a communication system for processing a web request of a client and industrial automation equipment. The communication system includes: a web server for receiving a web request from a client and for transmitting a web response converted based on the web request back to the client; a proxy unit arranged separately from and downstream of the web server in the communication system, coupled with the web service, where the web server has a proxy adapter configured to couple the web server to the proxy unit arranged separately from and downstream of the web server, where the proxy unit is configured to couple the web server to the proxy unit arranged separately from and downstream of the web server, where the proxy unit is configured to couple the web server to the proxy unit. The proxy adapter is further configured to convert the web request to a web response according to a proxy unit disposed separately from and downstream of the web server and according to the web service.

Description

Technical Field

[0001] The present invention relates to a communication system and industrial automation equipment for processing a web request from a client. Background Art

[0002] Today, attempts are being made to transfer the idea of ​​open application systems (“applications”) into the automation world. One aspect on the path to the Industry 4.0 world is network solutions, which are used, for example, for startup, parameterization and diagnostics and which also provide interfaces for operator control / observation.

[0003] As network technologies are used, challenges quickly arise in open systems once multiple subsystems of a device bring their own web servers or network solutions. These independent web servers need to be integrated so that the web server provides only one network access point per device for the end user, as people are used to in previous automation devices and from ad hoc networks such as the Internet.

[0004] Existing network integration solutions, so-called reverse proxies (proxy units), try to provide a single access point to the device (e.g., on the known network port 80 or 443), but do not provide support for integration on the content page (i.e., the web page itself). Therefore, each subsystem developer follows their own ideas about content presentation in the network environment. This situation causes such automation solutions to look fragmented from the outside, rather than a unified global solution from a "unified whole".

[0005] A meaningful path from integrating different independent network solutions to a solution that supports content coordination is the so-called portal web server. The portal web server itself is the unified access point for the device for the user. The system-compliant network solutions of the individual components can be integrated into the portal web server, thus helping to create a unified solution for the end customer. Integration in a compliant way means that the web pages of the subcomponents also look like "system web pages" for system and platform management. The end customer thus gets the impression of a unified system.

[0006] Figure 1 The network platform of the prior art is shown, and the network platform includes the following architectural features:

[0007] The Industrial App Store Runtime "IAR" makes it possible to run apps from a central (official) Industrial App Store. For the app store operator, this runtime ensures that only apps that have been granted the appropriate permissions can be executed.

[0008] The local application runtime "LAR" enables the user to additionally operate applications with other properties. Such applications are, for example, user applications that the user does not wish to import into the central industrial application store.

[0009] While the IAR in the prior art implements a central management model (i.e., applications are pushed from a central device management to the device (or its IAR)), the LAR in combination with the first platform enables decentralized application management. That is, applications are pulled from an app store onto the device itself, which is common today for client devices (e.g., smartphones). In both cases, the management of the runtime is usually done via a web server and / or via a network API of a network (web) service. Even in such a simple configuration, the two independent management web servers already run into each other:

[0010] The first web server unit for LAR (the first management web server), and

[0011] A second web server unit for IAR (second management web server).

[0012] According to the prior art, these two management web servers will be integrated through an upstream proxy unit.

[0013] In the proxy unit, each subsequent child web server is assigned a child URL (URL prefix), wherein the web server can be accessed from the outside through the proxy unit. Therefore, in the prior art, the central entry point into the "application cluster" of web servers is always the proxy unit. The proxy unit is responsible for distributing the incoming requests on the child web servers. This "split" is based on the URL prefixes assigned to the downstream web servers in a dedicated manner.

[0014] For this purpose, the proxy unit has a configuration file in which (among other things) the provided URLs for the downstream web servers and their IP addresses are defined.The management requests from the IAR and the management requirements from the LAR meet in an uncoordinated manner at this configuration point.

[0015] In summary, besides visibility issues in the area of ​​user interface and operator control principles, the prior art proxy units raise a number of problems compared to the portal server approach:

[0016] The first web server unit in the first administrative domain is used for the configuration of the system and therefore very generally also for the configuration of the reverse proxy belonging to the system. In the event of an automatic or manual misconfiguration of the reverse proxy, the first web server unit of the device is no longer accessible. Therefore, such a misconfiguration cannot be corrected using this first web server unit either.

[0017] The reverse proxy must be fully managed, that is, for each new root page in the portal server and the store runtime the configuration must be tracked in the reverse proxy. Manual configuration of any communication path is a potential source of errors and weaknesses.

[0018] Many existing web applications are not designed for reverse proxies. Such web applications on different web servers cannot check in a simple way whether they are operating behind a reverse proxy. For example, the cookies of the web applications can overwrite each other in the browser. Example: If the web server of a programmable logic controller runs behind a reverse proxy, this can lead in particular to login cookies overwriting each other. Therefore, when a user changes web servers, the user must log in again each time.

[0019] In the IP packets that arrive at the first web server unit behind the reverse proxy, the client's IP address is no longer visible (the reverse proxy always recognizes the reverse proxy's IP address as the source address), which significantly reduces the value of the protocol in the first web server unit, in particular. This limited visibility of client requests passing through the reverse proxy makes troubleshooting more difficult and has an adverse impact on the security of the system.

[0020] The system stipulates that terminating the TLS tunnel at the reverse proxy side will lead to reduced security. The reverse proxy is conceptually a man-in-the-middle "attacker" because, as an ISO Layer 7 gateway, it interrupts the secure tunnel to the target web server (e.g., the first web server unit). Therefore, by destroying the reverse proxy, the attacker can access unencrypted data traffic. In addition to this destruction of end-to-end security, there are other problems in the certificate processing between the reverse proxy and the target web server. The reverse proxy must trust all web servers behind it (i.e., their (different) certificates) so that after interrupting the tunnel on the entry side, it can at least establish a secure tunnel again on the other side (to the endpoint web server). Due to the processing overhead, the connection between the reverse proxy and the destination web server is usually even operated in an insecure manner. Therefore, these connections can be directly attacked, which can cause problems depending on the security policy. Summary of the invention

[0021] In this context, it is an object of the present invention to improve the management of web services accessible via a web server.

[0022] According to a first aspect, a communication system, in particular an automated system, is proposed for processing a network (web) request from a client for retrieving a web service in a specific network. The communication system comprises:

[0023] A web server for receiving a web request from a client and for sending a network (web) response based on the web request conversion back to the client,

[0024] a proxy unit, which is arranged in the communication system separately from the web server and downstream of the web service, the proxy unit being coupled to the web service,

[0025] wherein the web server comprises a proxy adapter configured to couple the web server to a proxy unit arranged separately from the web server and arranged downstream of the web server,

[0026] The proxy adapter is further configured to convert the web request into a web response according to a proxy unit arranged separately from the web server and downstream of the web server and according to the web service.

[0027] According to the communication system of the first aspect, since the web server is no longer arranged after the proxy unit, but before the proxy unit, the management of web services reachable via the web server is improved. In other words, the proxy unit is arranged downstream of the web server. This situation means that, due to this particular arrangement, the web server now changes from a back-end server to a front-end server, and thus assumes the main role assigned to the proxy unit in the prior art. Therefore, the web server receives all web requests of the devices of the communication system as a central web server, and the central web server thus becomes a portal web server.

[0028] In order to still access the network solution of applications running on further local decentralized application runtime environments (IAR), the proxy unit is appropriately linked to the (portal) web server via a proxy adapter. The proxy unit is now located behind the web server and is now uniquely and exclusively assigned to the IAR.

[0029] This has the technical effect that the proxy unit is now no longer used for network access to the first administrative domain and is also no longer managed from the first administrative domain.

[0030] This situation has the advantage of creating a logical separation between the first management domain and the second management domain. The first management domain has the portal server and the agent adapter. The second management domain starts with the agent unit. Thus, management conflicts of the agent unit from multiple aspects are eliminated.

[0031] Automatic or manual misconfiguration can still occur even after the above-mentioned management conflict has been resolved, which now only involves the second management domain. The network access that is no longer functional on the part of the second management domain can advantageously be reset again to a functional initial state by the first management domain. Now in the case of automatic or manual misconfiguration of the proxy unit, the first management domain and the web server are at least still accessible, and possibly only the applications in the second management domain are no longer accessible. The first management domain and the web server can thus be operated independently of the proxy unit.

[0032] Due to the upstream arrangement of the web server, it is further advantageous that the IP address of the client is now visible again in the IP packets arriving at the web server. This situation facilitates troubleshooting and increases the security of the communication system.

[0033] Since the proxy unit is now arranged downstream of the web server, the termination of the TLS tunnel specified by the system at the proxy unit is avoided, which also increases the security of the communication system.

[0034] Furthermore, the performance and latency (transaction delay) of the communication system increases, since the downstream proxy units no longer have to act as layer 7 translators and TCP connections and TLS connections do not have to be terminated on one side and reestablished again on the other side.

[0035] The communication system can be implemented in particular in an automation device or as an automation device. The automation device can be a device from the process industry, the chemical industry, the pharmaceutical industry, the petrochemical industry, or a device from the food and beverage industry. This also includes any device from the manufacturing industry and the production industry and devices in which, for example, cars or any kind of goods are produced. In addition, the automation device can also be implemented as an energy generating device, such as a wind turbine, a solar device or a power plant and / or an energy distribution device.

[0036] A web request (English: Web-Request) is a request sent by a client (such as a web browser) to a web server in order to retrieve a web service. A web request is especially sent via the Hypertext Transfer Protocol (HTTP), so a web request can also be called an HTTP request.

[0037] As a reaction to the transmitted web request from the web server, a web response (English: Web-Response) is delivered back to the client again, and the web server processes the transmitted web request and converts the web response. The web response is especially an HTTP response.

[0038] A client (also referred to as a client-side application, client application or client program) refers to a computer program that is executed on a terminal of a network and communicates with a server or web server. Preferably, the terminal that retrieves services from a server is itself a client.

[0039] A web service is any service that resides in or is connected to a specific network, such as a local network or the Internet (e.g. a web page, web application, application, or service, especially a microservice). A web service is identified with the help of a Uniform Resource Identifier (URI).

[0040] An ad hoc network is in particular a local network or the Internet. A local network can be designed as a corporate network or as a closed computer network.

[0041] A web server is in particular a server that transmits documents to a client, such as a web browser. A web server represents a computer with web server software or simply the web server software itself. Preferably, the web server is designed as a portal web server. A portal server is a central server that receives all web requests from the devices of the communication system and then selects and forwards them to the correct location.

[0042] The term "arranged downstream" particularly means that the web server is arranged before the proxy unit and the proxy unit is arranged after the web server. In other words, the web server rather than the proxy unit first receives the web request, and the web server can then forward the web request to the proxy unit via the proxy adapter.

[0043] Preferably, the term "separate arrangement" means that the web server and the proxy unit are arranged in a logically separate manner from each other. "Logical separation" means in particular that the web server has a first assigned logical address in the communication system, such as a TCP-IP address, and the proxy unit has a second assigned logical address in the communication system.

[0044] A proxy unit is a communication interface in a communication system. The proxy unit operates in particular as a mediator, which receives a web request on one side in order to then establish a connection to the other side via the mediator's own address. The proxy unit is designed in particular as a reverse proxy.

[0045] In particular, the proxy adapter receives web requests. The proxy adapter is used to link or couple downstream proxy units. Preferably, web requests that are not processed in the previous components (ie, the URL handler chain) are forwarded from the proxy adapter to the proxy unit of the second management domain.

[0046] Each unit (e.g., agent unit) can be implemented in the form of hardware and / or in the form of software. In the case of hardware implementation, each unit can be designed as a device or a part of a device, such as a computer or a microprocessor. In the case of software implementation, each unit can be designed as a computer program product, a function, a routine, a part of a program code, or an executable object.

[0047] According to an embodiment, the web server is arranged in a first administrative domain and the proxy unit arranged separately from and downstream of the web server is arranged in a second administrative domain, wherein the first administrative domain and the second administrative domain are logically separated from each other.

[0048] The above explanation of the term "logical separation" also applies similarly to this embodiment.

[0049] In particular, in the communication system according to the first aspect, the first administrative domain and the second administrative domain can be arranged at different locations and / or devices spatially separated from each other.

[0050] According to a further embodiment, the first administrative domain is designed as a local decentralized application runtime environment comprising a local or remote application store with at least one local application, and the second administrative domain is designed as a further local decentralized application runtime environment comprising a central application store with at least one centrally stored application.

[0051] The first management domain is specifically the “local application runtime”, or “LAR” for short. Local applications are specifically applications that are not imported into a central application store.

[0052] The second management domain in particular is the “Industrial Application Store Runtime”, or “IAR” for short.

[0053] In particular, the term "remote application store" means that the application store is not arranged in the first administrative domain, but is connected to the first administrative domain so that applications of the application store can be accessed.

[0054] According to another embodiment, the web server comprises a uniform resource locator handler chain having a plurality of uniform resource locator handlers, wherein the proxy adapter in the web server is arranged at the end of the uniform resource locator handler chain.

[0055] According to another embodiment, multiple uniform resource locator handlers of the uniform resource locator handler chain are arranged in series in the web server, wherein each uniform resource locator handler of the uniform resource locator handler chain is configured to forward the received web request to the next uniform resource locator handler in the series, wherein the last uniform resource locator handler in the series is configured to send the forwarded received web request to the proxy adapter and receive the converted web response from the proxy adapter.

[0056] The arrangement of the proxy adapter at the end of the URL handler chain according to this embodiment has the following advantages:

[0057] This special arrangement of the proxy adapter results in that all web requests, especially URL requests, not processed in the first management domain are received by the proxy adapter, whereas in the prior art, without this special arrangement, an http error 404 message would be returned for each unprocessed web request.

[0058] Furthermore, the URL handlers of the URL handler chain and thus the web pages of the first administrative domain are given a higher priority than the proxy unit and thus also given a higher priority than the web server and its applications behind the proxy unit in the IAR. This situation is especially desirable for the management web pages of the first administrative domain, since the IAR is only a downstream subsystem behind the first administrative domain.

[0059] Furthermore, the placement of the proxy adapter as the last URL handler in the URL handler chain prevents the high delays inevitably associated with proxy elements from negatively impacting the URL handlers of the URL handler chain and thus the web pages of the first administrative domain.

[0060] In particular, the last uniform resource locator handler in the chain is configured to send a forwarded received web request to the proxy adapter and receive a transformed web response from the proxy adapter as part of the response chain.

[0061] Preferably, the plurality of uniform resource locator handlers of the handler chain include a first URL handler and a second URL handler, wherein the second URL handler can also be referred to as a next URL handler. In particular, the first URL handler and the second URL handler are implemented by a backend network framework. An example of such a network framework is Express.js based on Node.js.

[0062] Additionally, the first URL handler can be responsible for static web pages, while the second URL handler can be responsible for dynamically generated web pages.

[0063] According to another embodiment, a proxy adapter for converting a web request into a web response is configured to convert the web request into a network request, in particular into an HTTP request, send the network request to a proxy unit that is arranged separately from and downstream of the web server, receive a network response, in particular an HTTP response, from the proxy unit that is arranged separately from and downstream of the web server according to the web service and based on the network request, and convert the received network response into a web response.

[0064] The term "transformation" specifically describes a transformation of information because the data content of the medium to be transformed is changed, ie the data content of a web request becomes the data content of a web response.

[0065] The term "conversion" preferably describes a format conversion, since the format of the medium to be transmitted or converted changes. Here, for example, a network request in a computer format such as a source code or software code (programming code) is converted into a web request in HTTP format. The medium to be transmitted or converted here in particular changes from a computer format in the form of a web request to a network format in the form of a network request such as HTTP format.

[0066] According to another embodiment, the proxy unit is configured to, based on the received network request and according to a configuration file of the proxy unit for obtaining a forwarding result, check whether a specific web service requested by means of the network request exists in the second management domain, so as to forward the network request to the specific web service, wherein if the specific web service exists in the second management domain, the forwarding result is positive, wherein if the specific web service does not exist in the second management domain, the forwarding result is negative, wherein if the obtained forwarding result is positive, the network response is designed as a positive message, wherein if the obtained forwarding result is negative, the response is designed as an error message, in particular an HTTP error message.

[0067] In other words, the proxy unit checks with the help of the configuration of the proxy unit whether the converted network request can be forwarded to the specific web service assigned to it for processing, and if the check result is positive (positive forwarding result), the proxy unit performs the forwarding. The proxy unit then receives a positive message from the specific web service or a web server connected to the specific web service. The proxy unit in turn forwards the positive message to the proxy adapter in the form of a network response. If the specific web service does not exist, (depending on the situation) the proxy unit or a web server downstream of the proxy unit generates an error message, in particular an HTTP error message (negative forwarding result).

[0068] If the forwarding result is negative because the specific web service does not exist in the second administrative domain, it may be the case that the specific web service requested by the network request is known to the proxy unit, but the proxy unit is not connected to the web service (e.g. via a downstream web server of the second administrative domain), and therefore an error message is generated. In other cases, in particular, the specific web service requested by the network request is unknown to the proxy unit, and therefore an error message is generated.

[0069] In particular, the response (positive message) or error message of the downstream web server behind the proxy unit arranged in the second management domain is returned to the proxy adapter again as a response to the network request generated by the proxy adapter. On this return path, the proxy adapter again converts the http response (network response) arriving from the proxy unit into a web response for the component of the web server of the first management domain, and feeds the web response into the response chain of the component of the web server. Finally, the basic web server in the portal web server can pass the corresponding web response to the requesting client, such as a web browser.

[0070] According to another embodiment, the communication system also includes a certificate memory for storing digital certificates, wherein the stored digital certificates include a first digital certificate for a web server and a second digital certificate for an agent unit, wherein the certificate memory is configured to store the first digital certificate according to the web server and provide it to the web server and to store the second digital certificate according to the agent unit and provide it to the agent unit.

[0071] The certificate store is used to secure digital certificates on the computer system. Since the first administrative domain and the second administrative domain use a shared certificate store, this facilitates the management of digital certificates of the two administrative domains in an advantageous manner.

[0072] In particular, the certificate store is connected to a certificate authority (CA). Preferably, the certificate authority is arranged outside the communication system. A certificate authority (CA) is an entity that stores, signs and issues digital certificates. A digital certificate proves the ownership of a public key by the subject mentioned in the certificate. A digital certificate is a digital data set, usually according to ITU-T or IETF standards, used to confirm specific attributes of a person or object, and its authenticity and integrity can be verified by cryptographic methods.

[0073] According to another embodiment, the web server and the proxy unit are configured according to the first digital certificate and the second digital certificate to establish an encrypted channel between the proxy adapter and the proxy unit for securely transmitting network requests and network responses between the proxy adapter and the proxy unit, wherein the encrypted channel is particularly securely protected by HTTPS.

[0074] The encrypted channel between the agent adapter and the agent unit increases the security of the communication system because end-to-end security protected by the encrypted channel is now established between the first management domain and the second management domain. In addition, the end-to-end security can no longer be compromised because any communication between the agent adapter and the agent unit is now conducted in a secure manner through HTTPS through the encrypted channel.

[0075] In general, the first digital certificate and the second digital certificate are signed by a common (i.e., by the first management domain and the second management domain) trusted (trustworthy) certificate authority. Mutual trust between the proxy adapter of the portal server of the first management domain and the proxy unit of the second management domain is thus ensured. An encrypted channel between the two can also be implemented on this basis. Preferably, no authentication of the proxy adapter with respect to the proxy unit is required, because the proxy adapter appears here as another client. The login information of the client can be related to the access rights to the other web server in the second management domain. The login information is especially forwarded from the proxy adapter to the proxy unit.

[0076] The establishment of the encrypted channel is specifically as follows:

[0077] First, the first certificate is signed by a superior certificate issuing authority outside the communication system. The first certificate is specifically designed as a CA certificate here.

[0078] Subsequently, the proxy unit retrieves the second certificate and the associated private key from the certificate storage. The second certificate is particularly designed as a server certificate here. In addition, the second certificate is preferably signed together with the first certificate.

[0079] The proxy unit then authenticates itself with respect to the proxy adapter or the web server using its signed second certificate. The proxy adapter verifies the signed first certificate, with the aid of which the second certificate was signed, based in particular on the certificates contained in the certificate store. The certificate store has all trustworthy certificates, for example CA certificates.

[0080] Since both the agent unit and the agent adapter trust the same certificate authority and therefore the signed first certificate is authentic, the authentication is successful.

[0081] Preferably, the agent unit and the agent adapter then negotiate a session key between each other, thereby establishing an encrypted channel.

[0082] According to a second aspect, an industrial automation device, in particular a process control device, is provided for processing a web request from a client for retrieving a web service in a specific network. The industrial automation device comprises:

[0083] A web server is used to receive a web request from a client and to send a web response converted based on the web request back to the client,

[0084] a proxy unit, which is arranged separately from the web server and downstream of the web server on the industrial automation device, the proxy unit being coupled to the web service,

[0085] wherein the web server comprises a proxy adapter configured to couple the web server to a proxy unit arranged separately from the web server and arranged downstream of the web server,

[0086] The proxy adapter is further configured to convert the web request into a web response according to a proxy unit arranged separately from the web server and downstream of the web server and according to the web service.

[0087] The process control device is in particular an IoT device or an edge device. It can be designed as a programmable logic controller (PLC). In particular, the process control device can be designed in the form of software, or components of the process control device can be designed as software. In addition, other parts of the process control device can also be implemented in hardware.

[0088] According to a second aspect, the first management domain and the second management domain are not arranged spatially separated from each other, but are implemented on a single device, namely the industrial automation device.

[0089] The technical effects and advantages described for the communication system according to the first aspect are also applicable to the industrial automation device according to the second aspect.

[0090] Furthermore, the embodiments and features described with reference to the communication system according to the first aspect are also applicable to the industrial automation device according to the second aspect.

[0091] According to an embodiment of the second aspect, the web server is arranged in a first administrative domain, and the proxy unit arranged separately from the web server and downstream of the web server is arranged in a second administrative domain, wherein the first administrative domain and the second administrative domain are logically separated from each other.

[0092] According to a further embodiment of the second aspect, the first administrative domain is designed as a local decentralized application runtime environment comprising a local or remote application store with at least one local application, and the second administrative domain is designed as a further local decentralized application runtime environment comprising a central application store with at least one centrally stored application.

[0093] According to another embodiment of the second aspect, the local distributed application runtime environment is configured to execute, according to the received web request, the extraction of the local application to the industrial automation device, wherein the other local distributed application runtime environment is configured to load the web service according to the network requirement received via the proxy unit and provide it to the proxy unit to provide it to the client.

[0094] The term "extracting a local application" can also be referred to as an application "extracted to" a local application. Further, the local distributed application runtime environment is configured to load a web service according to a network request received via the proxy unit and provide the web service to the client by the proxy unit, which can also be referred to as "pushing" or the process of "pushing" a web service or a centrally stored application to the proxy unit.

[0095] According to another embodiment of the second aspect, the proxy adapter for converting a web request into a web response is configured to convert the web request into a network request, in particular into an HTTP request, send the network request to a proxy unit that is arranged separately from the web server and downstream of the web server, receive a network response, in particular an HTTP response, from the proxy unit that is arranged separately from the web server and downstream of the web server according to the web service and based on the network request, and convert the received network response into a web response.

[0096] According to further embodiments of the second aspect, the local application and the centrally stored application are configured to execute an open-loop control process and a closed-loop control process according to the industrial automation device in the communication system.

[0097] According to further embodiments of the second aspect, the local application and the centrally stored application are configured to acquire, compress and / or process sensor data of the sensor from the communication system.

[0098] According to a further embodiment of the second aspect, the local application and the centrally stored application are configured to output at least control data from the industrial automation device.

[0099] According to further embodiments of the second aspect, the industrial automation device is configured to observe and / or control processes and / or devices of the communication system based on the web service.

[0100] According to further embodiments of the second aspect, the web server is further configured to observe and / or control further processes and / or further devices of the communication system based on the web service and based on the at least one local application.

[0101] According to further implementations of the second aspect, the web server is further configured to perform a management process in the first management domain and / or the second management domain.

[0102] Further feasible embodiments of the present invention also include the combination not explicitly mentioned of the features or embodiments described above or described below with respect to the exemplary embodiments. In this case, those skilled in the art will also add various aspects as improvements or supplements to each basic form of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0103] Further advantageous embodiments and aspects of the invention are the subject matter of the dependent claims and exemplary embodiments of the invention described below. The invention will be explained in more detail below on the basis of preferred embodiments with reference to the accompanying drawings.

[0104] Figure 1 A schematic block diagram of a network platform according to the prior art is shown;

[0105] Figure 2 A schematic block diagram of a communication system according to an embodiment is shown;

[0106] Figure 3 shows a schematic block diagram of a web server according to an embodiment; and

[0107] Figure 4 A schematic block diagram of an industrial automation device according to an embodiment is shown.

[0108] In the figures, identical or functionally identical elements are provided with the same reference symbols, unless indicated otherwise. DETAILED DESCRIPTION

[0109] Figure 1 A schematic block diagram of a network platform 90 according to the prior art is shown. As mentioned in the introduction, Figure 1 The network platform 90 in the embodiment includes a first administrative domain LAR designed as a local decentralized application runtime environment with a local application store L_store and a second administrative domain IAR designed as another local decentralized application runtime environment with a central application store I_store.

[0110] like Figure 1 As shown, the agent unit 10 is assigned to the first administrative domain LAR.

[0111] In the case of the first administrative domain LAR, the management of local or remote application stores L_store and their applications is performed by the first web server unit 35. In contrast, in the case of the second administrative domain IAR, the management of the central application store I_store and its applications is performed by the second web server unit 36.

[0112] exist Figure 1 In the example, two web server units 35 , 36 are integrated via an upstream proxy unit 10 .

[0113] In this case, in the proxy unit 10, each of the sub-web servers behind it, namely the first web server unit 35 and the second web server unit 36, is assigned a sub-URL at which the corresponding web server can be reached from the outside via the proxy unit 10. Therefore, in the prior art, entering Figure 1 The central point of the network platform 90 in FIG. 1 is the proxy unit 10. In this case, the proxy unit 10 is responsible for the distribution of incoming web requests, such as web requests W_Req, on individual sub-web servers, such as the first web server unit 35 or the second web server unit 36. Figure 1 In FIG. 4 , the web request W_Req is intended for the second administrative domain IAR, ie the web request is forwarded to the second web server unit 36 ​​.

[0114] Figure 2 A schematic block diagram of a communication system 100 according to an embodiment is shown. Figure 2 The communication system 100 in FIG. 1 is designed as an automated system designed to process a web request W_Req from a client C to retrieve a web service W_SER in a specific network. Figure 2 The communication system 100 in the embodiment includes a web server 30 and an agent unit 10.

[0115] exist Figure 2In the embodiment, a web server 30 is arranged in a first management domain LAR, wherein the first management domain LA is designed as a local decentralized application runtime environment, which includes a local or remote application store L_store with at least one local application. An agent unit 10 arranged separately from the web server 30 and arranged downstream of the web server is arranged in a second management domain IAR, wherein the second management domain IAR is designed as a further local decentralized application runtime environment, which includes a central application store I_store with at least one centrally stored application. Furthermore, the first management domain LAR and the second management domain IAR are logically separated from each other. Furthermore, the management of the central application store I_store and its applications is performed by the web server unit ( Figure 2 ), such as the second web server unit 36 ​​(see Figure 1 ) is performed, and the web server unit is arranged between the agent unit 10 and the central application store I_store (not shown).

[0116] Furthermore, the web server 30 is designed to receive a web request W_Req from the client C and to send a web response W_Resp converted based on the web request W_Req back to the client C. The proxy unit 10 is arranged separately from the web server 30 and arranged downstream of the web server 30 in the communication system 100, and the proxy unit is coupled to the web service W_SER. Figure 2 In the embodiment, the web server 30 is arranged upstream of the proxy unit 10.

[0117] Furthermore, the web server 30 includes a proxy adapter 20 configured for coupling the web server 30 to a proxy unit 10 arranged separately from the web server 30 and arranged downstream of the web server.

[0118] In this case, the proxy adapter 20 is also configured to convert the web request W_Req into a web response W_Resp based on the proxy unit 10 arranged separately from and downstream of the web server 30 and based on the web service W_SER.

[0119] In this case, the proxy adapter 20 for converting a web request W_Req into a web response W_Resp is configured to convert the web request W_Req into a network request N_Req, which is an HTTP request here, send the network request N_Req to a proxy unit 10 that is arranged separately from and downstream of the web server 30, receive a network response N_Resp, which is an HTTP response here, from the proxy unit 10 that is arranged separately from and downstream of the web server 30 according to the web service W_SER and based on the network request N_Req, and convert the received network response N_Rep into a web response W_Resp.

[0120] Likewise Figure 2 As shown, the web server 30 includes a uniform resource locator handler chain 21 having a plurality of uniform resource locator handlers URL1 and URL2 , wherein the proxy adapter 20 in the web server 30 is arranged at the end of the uniform resource locator handler chain 21 .

[0121] In this case, a plurality of uniform resource locator handlers URL1, URL2 are sequentially arranged in series in the web server 30, wherein each uniform resource locator handler URL1, URL2 is configured to forward the received web request W_Req to the next uniform resource locator handler in the series. In this case, the last uniform resource locator handler in the series is configured to send the forwarded received web request W_Req to the proxy adapter 20, and receive the converted web response W_Resp from the proxy adapter 20.

[0122] also, Figure 2 The communication system 100 in FIG. 1 comprises a certificate storage 50 for storing digital certificates. The certificate storage 50 is connected to a certificate authority (not shown). These stored digital certificates include a first digital certificate CERT1 for the web server 30 and a second digital certificate CERT2 for the proxy unit 10 .

[0123] In this case, the certificate memory 50 is configured to store the first digital certificate CERT1 for the web server 30 and to provide the first digital certificate to the web server 30 , and to store the second digital certificate CERT2 for the agent unit 10 and to provide the second digital certificate to the agent unit 10 .

[0124] In addition, according to the first digital certificate CERT1 and the second digital certificate CERT2, the web server 30 and the proxy unit 10 are configured to establish an encrypted channel 60 between the proxy adapter 20 and the proxy unit 10 for securely transmitting network requests N_Req and network responses N_Resp between the proxy adapter 20 and the proxy unit 10, wherein the encrypted channel 60 is particularly protected by HTTPS.

[0125] Figure 3 A schematic block diagram of a web server 30 with a proxy adapter 20 according to one embodiment is shown. In addition, Figure 3 The web server 30 in the embodiment includes a basic web server 31, an application firewall 32, an authentication component 33, and a first URL handler URL1 and a second URL handler URL2, which form a URL handler chain 21 (see Figure 2 ). The first URL handler URL1 is responsible for static web pages, while the second URL handler URL2 is responsible for dynamic web pages.

[0126] Figure 3 shows that the network request W_Req is passed Figure 3 The path of the web server 30 in.

[0127] The basic web server 31 is responsible for accepting web requests W_Req or network requests and sending web responses W_Resp. The basic web server 31 is supplemented by a series of URL handlers URL1, URL2, which are registered in the web server 30 to handle specific network requests. One type of network request handler, for example, the first URL handler URL1, registers itself as, for example, a dedicated URL, such as a URL on a static web page. The arriving web request W_Req is forwarded from the basic web server 31 to the corresponding responsible registered URL handler. One or more responsible URL handlers then process the web request W_Req and generate corresponding responses. These responses (for example, web services W_SER such as web pages (see Figure 2 and Figure 4 )) is returned to the response sender 31b of the basic web server 31 and is sent to the client C by the response sender 31b.

[0128] This is explained in more detail below:

[0129] The client C sends a web request W_Req, which is received by the request receiver 31a of the base web server 31 after passing through a network firewall (not shown).

[0130] Subsequently, the web request W_Req is forwarded to the application firewall 32, which is optional but present in Figure 3 The application firewall 32, in particular the network application firewall, is used to protect the network application from attacks of the HTTP protocol. If the application firewall 32 rejects the web request W_Req, an error message ERR is sent back to the client C.

[0131] If the web request W_Req is not rejected by the application firewall 32, it is passed to the authentication component 33, which is optional but present in Figure 3 In which, client C is authenticated. If client C is not accepted, an error message ERR (usually in the form of an HTML page) is sent back to client C again.

[0132] If the authentication of client C succeeds, the web request W_Req is processed by a URL handler for static HTML pages, ie, the first URL handler URL1. If the web request W_Req is implemented by a static HTML page, a static response STA_Resp in the form of a static HTML page is delivered back to client C.

[0133] If the web request W_Req has not been positively processed in the first URL handler URL1, it is forwarded to the next URL handler and processed there. Figure 3 This is the second URL handler URL2, which generates dynamically generated content and processes dynamic web pages.

[0134] If the web request W_Req can be implemented in the second URL handler URL2, the dynamic response DYN_Resp is delivered back to the client C in the form of a generated HTML page or a data description in json format, for example. If the web request W_Req cannot be satisfied in the second URL handler URL2, a message (not shown) in the form of http error 404 ("not found") is returned to the client C in the prior art.

[0135] However, the web server 30 now includes a proxy adapter 20. This means that if the web request W_Req cannot be implemented in the second URL handler URL2, instead of passing a message in the form of http error 404 ("not found") back to the client C as in the prior art, the web request W_Req is simply forwarded to the proxy adapter 20. The proxy adapter 20 in turn converts the web request W_Req into a network request N_Req and forwards the latter to the second administrative domain IAR (see Figure 2 and Figure 4) of the agent unit 10 (see Figure 2 and Figure 4 ). The proxy unit 10 then checks with the aid of the configuration file of the proxy unit whether the network request N_Req can be forwarded to the web service W_SER assigned to it (see Figure 2 and Figure 4 ), such as a web server or a network application, for processing purposes to obtain a forwarding result. In the case of a positive forwarding result (positive message), the web service W_SER exists and the forwarding of the proxy unit 10 can be performed. If the forwarding result obtained is negative, the network response N_Resp is designed as an error message ERR, which is an HTTP error message here.

[0136] Figure 4 FIG. 4 shows a schematic block diagram of an industrial automation device 40 according to one embodiment. Figure 4 In the embodiment, the industrial automation device 40 is designed as a process control device, in particular a programmable logic controller. The industrial automation device 40 is designed to process a web request W_Req from a client C for retrieving a web service W_SER in a specific network.

[0137] Figure 4 The industrial automation device 40 in the embodiment includes a web server 30 and an agent unit 10 .

[0138] exist Figure 4 In the embodiment of the present invention, a web server 30 is arranged in a first administrative domain LAR, wherein the first administrative domain LAR is designed as a local decentralized application runtime environment, which includes a local or remote application store L_store with at least one local application. An agent unit 10 arranged separately from the web server 30 and arranged downstream of the web server is arranged in a second administrative domain IAR, wherein the second administrative domain IAR is designed as a further local decentralized application runtime environment, which includes a central application store I_store with at least one centrally stored application. Furthermore, the first administrative domain LAR and the second administrative domain IAR are logically separated from one another.

[0139] Furthermore, the web server 30 is designed to receive a web request W_Req from the client C and to send a web response W_Resp converted based on the web request W_Req back to the client C. The proxy unit 10 is arranged separately from the web server 30 and downstream of the web server 30 in the communication system 100, and the proxy unit is coupled to the web service W_SER. Figure 4 In the embodiment, the web server 30 is arranged upstream of the proxy unit 10.

[0140] Furthermore, the web server 30 includes a proxy adapter 20 configured for coupling the web server 30 to a proxy unit 10 arranged separately from the web server 30 and arranged downstream of the web server.

[0141] In this case, the proxy adapter 20 is also configured to convert the web request W_Req into a web response W_Resp based on the proxy unit 10 arranged separately from and downstream of the web server 30 and based on the web service W_SER.

[0142] In this case, the proxy adapter 20 for converting a web request W_Req into a web response W_Resp is configured to convert the web request W_Req into a network request N_Req, which is an HTTP request here, send the network request N_Req to a proxy unit 10 that is arranged separately from and downstream of the web server 30, receive a network response N_Resp, which is an HTTP response here, from the proxy unit 10 that is arranged separately from and downstream of the web server 10 according to the web service W_SER and based on the network request N_Req, and convert the received network response N_Rep into a web response W_Resp.

[0143] In addition, Figure 4 In the embodiment, the local distributed application runtime environment is configured to extract the local application to the industrial automation device 40 according to the received web request W_Req.

[0144] Figure 4 The other local decentralized application runtime environment in is configured to load the web service W_SER according to the network request N_Req received via the proxy unit 10 and provide it to the proxy unit 10 to provide to the client C.

[0145] In addition, the local application and the centrally stored application are configured to execute an open-loop control process and a closed-loop control process according to the industrial automation device 40 in the communication system 100 (see Figure 2 ), acquire, compress and / or process sensor data from the sensor from the communication system 100, and output control data from at least the industrial automation device 40.

[0146] Furthermore, the industrial automation device 40 is configured to observe and / or control processes and / or devices of the communication system 100 based on the web service W_SER.

[0147] Furthermore, the web server 30 is configured to monitor and / or control further processes and / or further devices of the communication system 100 based on the web service W_SER and based on at least one local application and to execute management processes in the first management domain LAR and / or the second management domain IAR.

[0148] Although the present invention has been described based on the embodiment, the present invention can be modified in various ways.

Claims

1. A communication system (100), in particular an automation system, for processing a network request (W_Req) ​​from a client (C) for retrieving a network service (W_SER) in a specific network, the communication system comprising: A network server (30) for receiving the network request (W_Req) ​​from the client (C) and for sending a network response (W_Resp) converted based on the network request (W_Req) ​​back to the client (C), a proxy unit (10), which is arranged separately from the network server (30) and which is arranged downstream of the network server (30) in the communication system (100), the proxy unit being coupled to the network service (W_SER), The network server (30) comprises a proxy adapter (20), the proxy adapter being configured to couple the network server (30) to the proxy unit (10), the proxy unit being arranged separately from the network server (30) and downstream of the network server, The proxy adapter (20) is further configured to convert the network request (W_Req) ​​into the network response (W_Resp) based on the proxy unit (10) arranged separately from the network server (30) and downstream of the network server and based on the network service (W_SER).

2. The communication system according to claim 1, It is characterized in that The network server (30) is arranged in a first administrative domain (LAR), and the proxy unit (10) arranged separately from the network server (30) and downstream of the network server is arranged in a second administrative domain (IAR), wherein the first administrative domain (LAR) and the second administrative domain (IAR) are logically separated from each other.

3. The communication system according to claim 2, It is characterized in that The first administrative domain (LAR) is designed as a local decentralized application runtime environment, which includes a local or remote application store (L_Store) with at least one local application, and the second administrative domain (IAR) is designed as a further local decentralized application runtime environment, which includes a central application store (I_Store) with at least one centrally stored application.

4. The communication system according to any one of claims 1 to 3, It is characterized in that The network server (30) comprises a uniform resource locator handler chain (21) having a plurality of uniform resource locator handlers (URL1, URL2), wherein the proxy adapter (20) in the network server (30) is arranged at the end of the uniform resource locator handler chain (21).

5. The communication system according to claim 4, It is characterized in that The plurality of uniform resource locator handlers (URL1, URL2) of the uniform resource locator handler chain (21) are sequentially arranged in series in the network server (30), wherein each uniform resource locator handler (URL1, URL2) of the uniform resource locator handler chain (21) is configured to forward the received network request (W_Req) ​​to the next uniform resource locator handler in the series, wherein the last uniform resource locator handler in the series is configured to send the forwarded received network request (W_Req) ​​to the proxy adapter (20) and receive the converted network response (W_Resp) from the proxy adapter (20).

6. The communication system according to any one of claims 1 to 5, It is characterized in that The proxy adapter (20) for converting the network request (W_Req) ​​into the network response (W_Resp) is configured to convert the network request (W_Req) ​​into a network request (N_Req), in particular into an HTTP request, transmit the network request (N_Req) ​​to the proxy unit (10) arranged separately from the network server (30) and downstream of the network server, receive a network response (N_Resp), in particular an HTTP response, from the proxy unit (10) arranged separately from the network server (30) and downstream of the network server according to the network service (W_SER) and based on the network request (N_Req), and convert the received network response (N_Resp) into the network response (W_Resp).

7. The communication system according to any one of claims 1 to 6, It is characterized in that The communication system (100) further comprises a certificate memory (50) for storing digital certificates, wherein the stored digital certificates comprise a first digital certificate (CERT1) for the network server (30) and a second digital certificate (CERT2) for the agent unit (10), wherein the certificate memory (50) is configured to store the first digital certificate (CERT1) according to the network server (30) and provide the first digital certificate to the network server (30), and to store the second digital certificate (CERT2) according to the agent unit (10) and provide the second digital certificate to the agent unit (10).

8. The communication system according to claim 7, It is characterized in that The network server (30) and the proxy unit (10) are configured according to the first digital certificate (CERT1) and the second digital certificate (CERT2) to establish an encrypted channel (60) between the proxy adapter (20) and the proxy unit (10), wherein the encrypted channel is used to securely transmit the network request (N_Req) ​​and the network response (N_Resp) between the proxy adapter (20) and the proxy unit (10), wherein the encrypted channel (60) is protected in particular by means of HTTPS.

9. An industrial automation device (40), in particular a process control device, for processing a network request (W_Req) ​​from a client (C) for retrieving a network service (W_SER) in a specific network, the industrial automation device comprising: A network server (30) for receiving the network request (W_Req) ​​from the client (C) and for sending a network response (W_Resp) converted based on the network request (W_Req) ​​back to the client (C), a proxy unit (10) which is arranged separately from the network server (30) and which is arranged downstream of the network server (30) on the industrial automation device (40), the proxy unit being coupled to the network service (W_SER), The network server (30) comprises a proxy adapter (20) configured to couple the network server (30) to the proxy unit (10) which is arranged separately from the network server (30) and downstream of the network server. The proxy adapter (20) is further configured to convert the network request (W_Req) ​​into the network response (W_Resp) based on the proxy unit (10) arranged separately from the network server (30) and downstream of the network server and based on the network service (W_SER).

10. The automation device according to claim 9, It is characterized in that The network server (30) is arranged in a first administrative domain (LAR), and the proxy unit (10) arranged separately from the network server (30) and downstream of the network server is arranged in a second administrative domain (IAR), wherein the first administrative domain (LAR) and the second administrative domain (IAR) are logically separated from each other.

11. The automation device according to claim 10, It is characterized in that The first administrative domain (LAR) is designed as a local decentralized application runtime environment including a local or remote application store (L_Store) with at least one local application, and the second administrative domain (IAR) is designed as a further local decentralized application runtime environment including a central application store (I_Store) with at least one centrally stored application.

12. The automation device according to claim 11, It is characterized in that The local decentralized application runtime environment is configured to extract a local application to the industrial automation device (40) according to the received network request (W_Req), wherein the other local decentralized application runtime environment is configured to load the network service (W_SER) according to the network request (N_Req) ​​received via the proxy unit (10) and provide the network service to the proxy unit (10) to provide to the client (C).

13. The automation device according to any one of claims 9 to 12, It is characterized in that The proxy adapter (20) for converting the network request (W_Req) ​​into the network response (W_Resp) is configured to convert the network request (W_Req) ​​into a network request (N_Req), in particular into an HTTP request, transmit the network request (N_Req) ​​to the proxy unit (10) arranged separately from the network server (30) and downstream of the network server, receive a network response (N_Resp), in particular an HTTP response, from the proxy unit (10) arranged separately from the network server (30) and downstream of the network server according to the network service (W_SER) and based on the network request (N_Req), and convert the received network response (N_Resp) into the network response (W_Resp).

14. The automation device according to any one of claims 9 to 13, It is characterized in that The local application and the centrally stored application are configured to execute an open-loop control process and a closed-loop control process according to the industrial automation device (40) in the communication system (100).

15. The automation device according to any one of claims 9 to 14, It is characterized in that The local application and the centrally stored application are configured to acquire, compress and / or process sensor data of sensors from the communication system (100).

16. The automation device according to any one of claims 9 to 15, It is characterized in that The local application and the centrally stored application are configured to output control data at least from the industrial automation device (40).

17. The automation device according to any one of claims 9 to 16, It is characterized in that The industrial automation device (40) is configured to observe and / or control devices and / or processes of the communication system (100) based on the network service (W_SER).

18. The automation device according to any one of claims 9 to 17, It is characterized in that The web server (30) is also configured to monitor and / or control further devices and / or further processes of the communication system (100) based on the web service (W_SER) and based on at least one local application.

19. The automation device according to any one of claims 9 to 18, It is characterized in that The network server (30) is further configured to execute management procedures in the first administrative domain (LAR) and / or in the second administrative domain (IAR).

Images