Method and system for managing user of automation engineering field device

Abstract

The invention relates to a method and a system for managing a user of an automation engineering field device. The method comprises: establishing a first communication link between a transmission medium and a user database; transmitting a ticket created by the user database from the user database to a transmission medium via a first communication link, wherein the ticket includes first user data in a format that is not processable by the field device, second user data in a format that is processable by the field device, and identification information of the field device; authenticating the user to the transmission medium based on the first user data; creating an operating telegram specific to the field device using the transmission medium in the event that the user has successfully authenticated to the transmission medium, the operating telegram containing second user data; transmitting the operation telegraph from the transmission medium to the field device via a second communication link; verifying the second user data by means of the field device; and granting access to the field device from the transmission medium based on the validated valid second user data.

Description

Technical Field

[0001] The invention relates to a method for managing users of automation engineering field devices. The invention also relates to a system designed to carry out the method according to the invention. Background Art

[0002] Field devices used in industrial facilities are already known from the prior art. Field devices are generally used in process automation engineering and manufacturing automation engineering. In principle, all devices that are process-oriented and supply or process process-related information are referred to as field devices. Therefore, field devices are used to detect and / or influence process variables. Measuring devices or sensors are used to detect process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, filling level measurement, etc., and detect corresponding process variables of pressure, temperature, conductivity, pH value, filling level, flow, etc. Actuators are used to influence process variables. These are, for example, pumps or valves that can influence the flow of a fluid in a pipe or the filling level in a tank. In addition to the above-mentioned measuring devices and actuators, field devices are also understood to include remote I / O, radio adapters, or devices that are generally arranged at the field level.

[0003] A plurality of such field devices are produced and sold by the Endress+Hauser group.

[0004] In modern industrial plants, field devices are usually connected via a fieldbus ( , , The superordinate unit is connected to a superordinate unit via a communication network (such as a control system, a control unit ...

[0005] The mobile control unit can also be used to operate field devices that have implemented the FDT frame application. For example, there are control units that are connected to a fieldbus network. However, the control unit can also communicate with the field device via a wireless communication connection (particularly based on the Bluetooth standard). The applicant produces and sells equipment that allows the control unit to be coupled to the field device as a so-called Bluetooth gateway. The field device is connected to the Bluetooth gateway in a wired manner, particularly using the HART or CDI communication standard. Alternatively, the field devices themselves have their own Bluetooth interface.

[0006] When using a mobile device such as a smartphone or tablet as control unit for wireless communication with field devices, application programs - so-called apps - are available which provide the mobile device with operating functions for the field devices.

[0007] In industrial environments, most installed field devices have no or only very basic protection against unauthorized access. In these field devices, it is usually possible to access all device parameters directly or, for example, after entering an unlock code. As part of the federal security act, more and more field devices are entering the market with individual user accounts and role-based authorization. For access via a user interface or machine interface, an authorization that is "permanent" in a sense is required, which is usually granted by a previous authentication. The authorization must be selected so that the accessing user (permanently) has all the authorization they need to perform their tasks. Standards such as IEC 62443-4-2 describe how to implement the authentication mechanisms of the prior art.

[0008] Due to the enormous management workload caused by the login data for field devices, technologies for central user management are emerging, as has been common practice in the IT field for many years with regard to IT devices (e.g. printers, workstations, etc.). An example of such a concept is disclosed in DE 10 2018 1026 08 A1, in which a transmission medium is provided, to which user data are transferred from a user database, wherein access to a field device is granted after checking its user data.

[0009] There is also the idea of ​​limiting the access rights required by people to a minimum. For example, DE102019131860 A1 discloses providing a digital order ticket transmitted from a server to a mobile device, which order ticket contains access rights and authorization tasks for field devices. When a connection is established with a field device, the order ticket is transmitted. If authorization is available, the tasks contained in the order ticket, such as the execution of parameterized actions or functional tests, can be processed using the field device.

[0010] The problem is that such concepts often cannot be implemented in a base installed in field devices (so-called "brownfield"). This is because in addition to the software implemented outside the device, special communication interfaces that are provided in the field device are required. This means that the installation operator can only manage new field devices centrally, while older devices still need to be managed manually. This means that different security levels continue to exist between different field device generations. Summary of the invention

[0011] Starting from this problem, the object of the invention is to propose a concept which allows central user management of existing field devices.

[0012] This object is achieved by a method according to claim 1 and a system according to claim 12 .

[0013] The method according to the present invention is used for user management of automation engineering field devices and comprises the following method steps:

[0014] - establishing a first communication link between the transmission medium and the user database, in particular via a local network or via the Internet;

[0015] - sending a ticket created by the user database from the user database to a transmission medium via the first communication link, wherein the ticket comprises at least password protection information, first user data and identification information of the field device, wherein the ticket comprises second user data, wherein the first user data is in a format that cannot be processed by the field device, and wherein the second user data is in a format that can be processed by the field device;

[0016] - authenticating the user to the transmission medium based on the first user data;

[0017] - creating a field-device-specific operating telegram using the transmission medium, if the user has successfully authenticated the transmission medium, wherein the operating telegram contains the second user data;

[0018] - sending the operating telegram from the transmission medium to the field device via the second communication link;

[0019] - verifying the second user data by means of the field device; and

[0020] - Granting access to the field device from the transmission medium based on the verified valid second user data.

[0021] The method can also implement the method known from DE102019131860 A1 for central user management of existing field devices (so-called "brownfield" field devices) without changing the software or hardware of the field devices for this purpose. The core of the method is that the transmission medium performs a "mapping" process, that is, a conversion between a ticket created and transmitted by a user database and an operating telegram transmitted to the field device. The ticket contains first user data, which enables the user to log in to or be authenticated to the transmission medium. Different users and their authorizations for the individual field devices are stored in the user database. In addition, the ticket already contains second user data, which are integrated into the operating telegram and enable the transmission medium to be registered with the field device. Based on the identification information of the field device also included in the ticket, an operating telegram is created specifically for the field device.

[0022] Generally speaking, a ticket is characterized as a data packet containing cryptographically protected information. Therefore, the recipient of the ticket can verify the authenticity and integrity of the ticket.

[0023] An operating telegram is a data packet addressed to a field device and containing second user data and optionally at least one operating command for the field device. The operating telegram is created in a specific data format that can be understood by the field device. The specific data format depends on the communication protocol by means of which the field device can be operated.

[0024] Examples of field devices mentioned in connection with the present invention have already been listed in the introductory part of the description.

[0025] According to an advantageous embodiment of the method, the first user data contain a user name and a password. After receiving the ticket by the transmission medium, the user is asked to enter these first user data. The method only continues after the first user data entered by the user and the user data contained in the ticket have been compared and matched. Alternatively, the first user data can also contain a request for the user to authenticate himself to the transmission medium in an alternative manner (for example, by means of a biometric feature such as a fingerprint).

[0026] According to an advantageous embodiment of the method, the second user data contain a password or a PIN. The second user data corresponds to a format that can be understood and accepted by the field device. At least one password or PIN is stored on each field device, which is also stored in the user database. The user does not know anything about the second user data when executing the method, and therefore only the central administrator who manages the user database is in contact with the second user data. There is at least one password, namely COABA, which is also a tool for automatically managing local management data (maintenance PW, expert password). Only the central administrator is in contact with the device PW.

[0027] One embodiment of the method provides that the second communication link is established before or after the step of creating a field-device-specific operating telegram.

[0028] According to an advantageous development of the method according to the invention, the field device comprises a plurality of operable functions, wherein the availability of the operable functions is grouped into different authorization groups. Examples of operating functions include, in particular, reading out and / or changing parameters of the field device, performing (self) diagnostic tests of the field device, reading out measured values, etc. An authorization group comprises at least one permitted function. Examples of authorization groups include maintenance personnel (permitted functions include reading parameters, running diagnostic tests, etc.) and commissioning service personnel (permitted functions correspond to the functions of maintenance personnel plus write access to parameters).

[0029] In particular, it is provided that the second user data are designed so that they allow logging into the field device according to the authorization group of the user, which allows logging into the field device according to the authorization group of the user. For example, separate second user data can be used for each authorization group. Alternatively, separate second user data can also be available to each user.

[0030] One embodiment of the method provides that the field device is registered in advance in a user database, wherein the registration process includes adding first user data and second user data. For example, various users are created in the user database and assigned to the field device, wherein the second user data of the field device is assigned to each user via a user list.

[0031] In this case, it is advantageously provided that the second user data of the field device is changed in the user database, a ticket is created by the user database, and the ticket contains an operation command for the field device to change the second user data in the field device. Such a modification of the second user data can, for example, only be performed by a special authorized group, and therefore the input of special second user data (for example, a special "change password") is provided for changing the second user data. After receiving the operation command, an advantageous embodiment of the method provides that the field device transmits the second user data and a confirmation to a transmission medium, wherein the transmission medium transmits the ticket containing the confirmation to the user database. The data in the user database is then updated.

[0032] An advantageous development of the method provides that the ticket exchanged between the user database and the transmission medium is encrypted or signed. In particular, each piece of cryptographically relevant information is transmitted from the user database to the transmission medium and from the transmission medium to the user database, wherein the ticket is encrypted or signed based on the exchanged cryptographically relevant information. The cryptographically relevant information comprises, for example, a public key of a key pair (wherein the key pair comprises a private key and a public key which is retained in the user database or on the transmission medium). Alternatively, this information is information required for a so-called "challenge", by means of which the transmission medium and the user database establish a trust relationship.

[0033] By signing the ticket, the transmission medium can verify the authenticity and integrity of the ticket. Together with the user's authentication of the transmission medium, the method achieves high security.

[0034] With regard to the system according to the invention, the method is designed to carry out the method according to the invention, and the system comprises an automation engineering field device, a transmission medium and a user database.

[0035] An advantageous embodiment of the system provides that the transmission medium is a computer unit or a mobile device, in particular a smartphone or a tablet. The transmission medium has special software or a special application which is able to read and understand the ticket, authenticate the user and create and transmit the operating telegram.

[0036] According to an advantageous embodiment of the system, the second communication link between the transmission medium and the field device is established via a wired, in particular proprietary connection. An example of a proprietary connection is the CDI ("Common Data Interface") protocol used by the applicant in field devices. Alternatively, the wired connection can be an automation engineering fieldbus - for example, according to one of the common protocols such as HART, Foundation Fieldbus, Profibus PA / DP, etc.

[0037] An advantageous embodiment of the system provides that the user database is a cloud-based database. In this case, the connection between the transmission medium and the user database is carried out via the Internet.

[0038] Alternatively, the user database can be located near the system and, for example, integrated into the control center of the facility. In this case, the connection between the transmission media is made via a local network - for example, a wired Ethernet connection or via a wired WLAN. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The invention is explained in more detail with reference to the following drawings:

[0040] Figure 1 is a schematic overview of an exemplary embodiment of the method according to the invention compared to the prior art. DETAILED DESCRIPTION

[0041] exist Figure 1 In FIG. 1 , the left frame shows a solution known from the prior art for managing users of field devices in automation engineering. The right frame shows an exemplary embodiment of a method according to the invention.

[0042] A solution known from the prior art is known from DE 10 2018 1026 08 A1 and DE 10 2019 131 860 A1. Various user accounts, authorization groups and field devices are stored in a central user database DB. The user account contains first user data, for example, in the form of login information such as a username and a password. The three data records are linked in such a way that the user account is assigned to the authorization group for each field device. In order to operate the field device FG', the user database DB creates a ticket TI' after the user has successfully logged into the user database using the first user data. The ticket TI' contains a cryptographically signed data field, which contains an operating command for the field device FG', assuming that the user account of the user is in the corresponding authorization group of the field device FG'. The ticket is transmitted to a transmission medium TM' via a local network or via the Internet, which transmission medium TM' is, for example, a laptop or a mobile device, in particular a smartphone or a tablet. Alternatively, the transmission medium can also be a passive storage medium, such as a USB stick or an SD card.

[0043] The transmission medium TM' is connected to the communication interface KS' of the field device FG' and transfers the ticket TI' to the field device FG'. For example, the transmission medium TM' is connected via Bluetooth to the Bluetooth-enabled communication interface KS' of the field device FG. If the transmission medium TM' is a passive storage medium, the connection process includes inserting the storage medium into the communication interface, which is designed as a card slot, for example.

[0044] Since the user database DB and the field device FG' have exchanged cryptographically relevant information in advance, for example in the form of a public key of a key pair, the field device FG' is able to check the authenticity and integrity of the ticket TI'. If the check proves the authenticity and integrity of the ticket, the field device FG' processes the content of the ticket TI' and, for example, executes an operating command contained in the ticket TI'.

[0045] These steps clearly show that the method known from the prior art requires a modern field device FG', which must have a corresponding communication interface KS' for connecting the transmission medium TM', and correspondingly suitable resources (computing power, RAM, etc.) for checking and processing the ticket TI'. However, many process facilities often only contain old field devices that do not have the required components and resources.

[0046] The method according to the invention can overcome this disadvantage and can also apply the principles known from the prior art for managing users to older field devices.

[0047] The core of the invention lies in the (software-side) adaptation of the transmission medium TM, which mediates between the two worlds regarding authentication (user database DB and old field device). This adaptation is applicable to all types of active transmission media (laptops, mobile devices, etc.) and is independent of the type of communication interface KS of the field device FG. However, in contrast to the prior art, passive transmission media (memory cards, etc.) cannot be used, since the transmission medium TM plays an active role in the method.

[0048] In the first step 1., an old field device is created as a data record in the user database DB, i.e., a field device that is already in installation and to which the concept described in the prior art cannot be applied. One or more second user data and authorizations are added to each of these field devices FG newly entered in the user database DB. The second user data is a field device-specific login that is used to log in to the field device FG in a user role-specific manner. For example, these are (short) passwords or PINs (e.g., containing four digits). The authorization defines which functions can be performed on the field device FG after logging in certain second user data. The second user data and authorizations have been stored in the field device.

[0049] The user database DB also contains a plurality of user accounts, to which first user data (eg login and password) are assigned. The user accounts are linked to newly created field devices and associated entries (second user data, authorizations) according to the authorization groups assigned to the user accounts.

[0050] A ticket TI is then generated, which is transmitted from the user database DB to the transmission medium TM via a first communication link KV1, which is formed via a local network or via the Internet. The ticket is intended to enable the user to operate the field device FG using the transmission medium TM. The ticket has a password-protected data area that contains the identification information ID (e.g., serial number) of the field device FG to be operated, which has been selected based on the user role, the user's first user information BD1, and the second user information BD.

[0051] The transmission medium TM and the user database have previously established a trust relationship by exchanging cryptographic related information (e.g., the public key of a key pair). Using the cryptographic related information exchanged from the user database DB, the transmission medium TM checks the authenticity and integrity of the ticket TI in a second step 2. If the check confirms the authenticity and integrity of the ticket, the transmission medium asks the user to authenticate himself to the transmission medium by entering first user data (e.g., username and password).

[0052] After successful authentication of the user, the transmission medium processes the ticket TI. Based on the identification information of the field device FG, the transmission medium TM creates an operation telegram BT specific to the field device FG. The operation telegram is a data packet addressed to the field device FG and the second user data BD2. The operation telegram BT is created in a specific data format that the field device FG can understand. For example, the transmission medium TM has a list for this purpose, which contains all installed field devices and the protocols they use for communication. In the existing case, the field device has a communication interface KS' based on the CDI protocol, and the operation telegram is therefore constructed according to this protocol.

[0053] After the second, CDI-based, wired, communication link KV2 is established between the transmission medium TM and the field device FG, the transmission medium TM transmits the operating telegram BT to the field device FG. In method step 3., the field device processes the operating telegram, checks the second user data BD2, and then enables the transmission medium TM to access the functions defined in the user role. The field device FG can then be operated according to the user's role.

[0054] In order to increase security, the second user data BD2 is changed regularly. This must be done both in the user database DB and in the field device FG itself. To this end, the user changes the second user data BD2 in the user database DB.

[0055] The modified second user data is sent in the ticket TI to the transmission medium in a manner similar to the above, which transmits the modified second user data as an operation telegram BT to the field device FG. The modified second user data is additional data included in the ticket in addition to other data (except the first user data BD1, the second user data BD2 and the identification information ID) and the operation telegram (except the second user data BD2). Login to the field device FG is performed using the original second user data BD2.

[0056] After the modification of the second user data BD2 in the field device FG, the transmission medium TM confirms the modification by means of a return ticket which is transmitted from the transmission medium TM via the first communication link KV1 to the user database DB and is registered thereby.

[0057] List of reference numerals

[0058] 1., 2., 3. Method steps

[0059] BD1 First User Data

[0060] BD2 Second user data

[0061] BT Operation Telegram

[0062] DB User database

[0063] FG, FG' field devices

[0064] ID Identification information of the field device

[0065] KS, KS' communication interface

[0066] KV1 First communication link

[0067] KV2 Second communication link

[0068] TI, TI' Notes

[0069] TM, TM' Transmission medium

Claims

1. A method for managing users of an automation engineering field device (FG), comprising: - establishing a first communication link (KV1) between the transmission medium (TM) and a user database (DB), in particular via a local network or via the Internet; - sending a ticket (TI) created by the user database (DB) from the user database (DB) to the transmission medium (TM) via the first communication link (KV1), wherein the ticket (TI) comprises first user data (BD1) and identification information (ID) of the field device (FG), wherein the ticket (TI) comprises second user data (BD2), wherein the first user data (BD1) is in a format that cannot be processed by the field device (FG), and wherein the second user data (BD2) is in a format that can be processed by the field device (FG); - authenticating the user to the transmission medium (TM) based on the first user data (BD1); - creating a field device-specific operating telegram (BT) using the transmission medium (TM) in case the user has successfully authenticated to the transmission medium (TM), wherein the operating telegram (BT) contains the second user data (BD2); - sending the operating telegram (BT) from the transmission medium (TM) to the field device (FG) via a second communication link (KV2); - verifying the second user data (BD2) by means of the field device (FG); and - granting access to the field device (FG) from the transmission medium (TM) based on the verified valid second user data (BD2).

2. The method according to claim 1, wherein: The first user data (BD1) includes a user name and a password.

3. The method according to claim 1 or 2, wherein: The second user data (BD2) comprises a password or a PIN.

4. A method according to any one of the preceding claims, wherein: The second communication link (KV2) is established before or after the step of creating the field-device-specific operating telegram (BT).

5. A method according to any one of the preceding claims, wherein: The field device (FG) contains a plurality of operable functions, wherein the availability of the operable functions is grouped into different authorization groups.

6. The method according to claim 5, wherein: The second user data (BD2) are designed in such a way that they allow a log-on to the field device (FG) according to an authorization group of the user.

7. A method according to any one of the preceding claims, wherein: The field device (FG) is registered in advance in the user database (DB), wherein the registration process includes adding first user data (BD1) and second user data (BD2).

8. The method according to claim 7, wherein: In the event that the second user data (BD2) of the field device (FG) is changed in the user database (DB), a change ticket is created by the user database (DB), the change ticket containing an operation command for the field device (FG) to change the second user data (BD2) in the field device (FG).

9. The method according to claim 8, wherein: After receiving the operating command, the field device (FG) modifies the second user data (BD2) and transmits a confirmation thereof to the transmission medium (TM), wherein the transmission medium (TM) transmits a confirmation ticket containing the confirmation to the user database (DB).

10. The method according to any one of the preceding claims, wherein: The ticket (TI) exchanged between the user database (DB) and the transmission medium (TM) is encrypted or signed.

11. A method according to any one of the preceding claims, wherein: Each time cryptographically relevant information is transmitted from the user database (DB) to the transmission medium (TM) and vice versa, wherein the ticket is encrypted or signed based on the exchanged cryptographic information.

12. A system designed to carry out the method according to any one of claims 1 to 11, comprising an automation engineering field device (FG), a transmission medium (TM) and a user database (DB).

13. The system according to claim 12, wherein: The transmission medium (TM) is a computer unit or a mobile device, in particular a smartphone or a tablet.

14. The system according to claim 12 or 13, wherein: The second communication link (KV2) between the transmission medium (TM) and the field device (FG) is established via a wired, in particular proprietary, connection.

15. The system according to any one of claims 12 to 14, wherein: The user database (DB) is a cloud-based database.

Images