Controller, method, and storage medium

Abstract

Controller, method, and storage medium provide a communication environment that can ensure communication security. A controller of factory automation (FA) judges whether a session start request transmitted from an information processing device indicates a security level lower than a prescribed security level, judges whether the session start request satisfies prescribed conditions for indicating the legitimacy of the request when judged to indicate a security level lower than the prescribed security level, sets a low security level for a session established by the session start request when judged to satisfy the prescribed conditions, and sets the prescribed security level for the session when judged to indicate the prescribed security level.

Description

Technical Field

[0001] This invention relates to controllers, methods, and storage media for FA (Factory Automation). Background Technology

[0002] The controller of the FA (Automatic Facilitator) installed at the production site communicates with an information processing device that receives user instructions from the operation controller. For example, Japanese Patent Application Publication No. 2003-241805 or Japanese Patent Application Publication No. 2005-38063 disclose a development aid device for communicating with the controller of the FA.

[0003] In the production environment, a unified communication protocol is desired to ensure secure communication between the FA's controller and the information processing unit. However, this expectation is not easily met due to varying levels of proficiency among users in operating the information processing unit or related communication functions. Summary of the Invention

[0004] Therefore, one object of this disclosure is to provide a communication environment that can ensure communication security even in the presence of the above-mentioned circumstances.

[0005] The controller disclosed herein is a controller for FA (Factory Automation), comprising: a communication interface for connecting to a network to which an information processing device belongs; a level determination unit for determining whether a session start request sent from the information processing device indicates a specified security level or a security level lower than the specified security level; a condition determination unit for determining whether the session start request satisfies the specified conditions for indicating the legitimacy of the request if the level determination unit determines that the session start request indicates a lower security level; and a setting unit for setting a security level on a session established based on the session start request, wherein the setting unit sets a specified security level for the session when the level determination unit determines that the session start request indicates a specified security level, and sets a lower security level for the session when the level determination unit determines that the session start request indicates a lower security level and the condition determination unit determines that the specified conditions are met.

[0006] According to the above disclosure, even if a user or information processing device wants to use a session with a security level lower than the prescribed security level, it may be possible to set a low security level for the session corresponding to the session start request.

[0007] Furthermore, such a low security level setting is permitted only if the session initiation request meets the prescribed conditions that demonstrate the legitimacy of the request; otherwise, the setting is not permitted. Therefore, even with a low security level set for a session, communication security within that session can still be ensured.

[0008] In the above disclosure, the aforementioned conditions for indicating legitimacy include conditions indicating the legitimacy of the request source for the session initiation request.

[0009] According to the above disclosure, the conditions indicating the legitimacy of the request source can be applied to the conditions indicating the legitimacy of the request to initiate a session.

[0010] In the above disclosure, the controller and the information processing device exchange communication frames. The communication frame requesting the start of the session contains identification information that identifies the source of the communication frame. The condition determination unit determines whether the identification information contained in the communication frame requesting the start of the session satisfies the condition for legitimacy of representation.

[0011] According to the above disclosure, the controller is able to obtain identification information for determining the legitimacy of the request along with the session start request.

[0012] In the aforementioned disclosure, the specified conditions include a validity period for which the specified conditions can be utilized. According to the aforementioned disclosure, the controller, for session initiation requests that have exceeded the validity period included in the specified conditions, does not determine whether to permit a low security level setting, regardless of whether the necessary legitimacy conditions are met. Therefore, secure communication over the session can be ensured.

[0013] In the above disclosure, before the session start request is requested, the information processing device sends a negotiation request to the controller. The negotiation request has data indicating that the information processing device can use one or more security levels for the session. The controller compares one or more security levels indicated by the data in the negotiation request received from the information processing device with one or more security levels that the controller can use for the session, and sends the comparison result to the information processing device.

[0014] According to the above disclosure, the controller can compare one or more security levels available to the information processing device with one or more security levels available to the controller before the session start request, and send the result of the comparison to the information processing device.

[0015] In the above disclosure, the controller, in response to a negotiation request sent from the information processing device prior to the session initiation request, notifies the information processing device of one or more security levels that the controller can be used for the session.

[0016] According to the above disclosure, the controller can notify the information processing device of more than one security level that the controller can use for the session before the session start request.

[0017] The method disclosed herein is implemented by a controller of an FA (Factory Automation) having a communication interface for connecting to a network to which an information processing device belongs. The method includes: a level determination step, determining whether a session start request sent from the information processing device indicates a specified security level or a security level lower than the specified security level; a condition determination step, if the level determination step determines that the session start request indicates a lower security level, determining whether the session start request satisfies a specified condition for indicating the legitimacy of the request; and a step of setting a security level on a session established based on the session start request, the setting step including: setting a specified security level for the session when the level determination step determines that the session start request indicates a specified security level; and setting a lower security level for the session when the level determination step determines that the session start request indicates a lower security level, and when the condition determination step determines that the specified condition is met.

[0018] The program disclosed herein is a program for causing the processor of a controller of a factory automation (FA) to execute a method, the controller having a communication interface for connecting to a network to which an information processing device belongs, the method comprising: a level determination step, determining whether a session start request sent from the information processing device indicates a specified security level or a security level lower than the specified security level; a condition determination step, if the level determination step determines that the session start request indicates a lower security level, determining whether the session start request satisfies a specified condition for indicating the legitimacy of the request; and a step of setting a security level on a session established based on the session start request, the setting step comprising: setting a specified security level for the session when the level determination step determines that the session start request indicates a specified security level; and setting a lower security level for the session when the level determination step determines that the session start request indicates a lower security level, and when the condition determination step determines that the specified condition is satisfied.

[0019] When implementing the above methods or procedures, even if the user or information processing device wants to use a lower security level in the session than the prescribed security level, it may be possible to set a lower security level for the session corresponding to the session start request.

[0020] Furthermore, such a low security level setting is permitted only if the session initiation request meets the prescribed conditions that demonstrate the legitimacy of the request; otherwise, the setting is not permitted. Therefore, even with a low security level set for a session, communication security within that session can still be ensured.

[0021] The above and other objects, features, aspects and advantages of the present invention will become clear from the following detailed description, which is understood in conjunction with the accompanying drawings and is relevant to the present invention. Attached Figure Description

[0022] Figure 1 This is a diagram used to illustrate an example of the application of this disclosure.

[0023] Figure 2 This is a schematic diagram illustrating the FA system of this embodiment.

[0024] Figure 3 This is a schematic diagram showing the hardware structure of the supporting device in this embodiment.

[0025] Figure 4 This is a schematic diagram showing the hardware structure of the processing unit of the controller in this embodiment.

[0026] Figure 5 It means stored in Figure 4 A schematic diagram of an example of information in non-volatile memory.

[0027] Figure 6 This is a diagram that schematically illustrates the background of this embodiment.

[0028] Figure 7 This is a diagram that schematically illustrates the background of this embodiment.

[0029] Figure 8 This is a diagram that schematically illustrates the background of this embodiment.

[0030] Figure 9 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0031] Figure 10 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0032] Figure 11 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0033] Figure 12 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0034] Figure 13 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0035] Figure 14 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0036] Figure 15This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0037] Figure 16 This is a diagram that schematically illustrates the operation flow of the pre-registration process in this embodiment.

[0038] Figure 17 This is a diagram that schematically illustrates an example of the structure of a communication frame in this embodiment.

[0039] Figure 18 This is a diagram schematically representing the management table of this embodiment.

[0040] Figure 19 This is a diagram schematically representing the management table of this embodiment.

[0041] Figure 20 This is a diagram schematically representing the management table of this embodiment.

[0042] Figure 21 This is a diagram schematically representing the management table of this embodiment.

[0043] Figure 22 This is a diagram schematically representing the management table of this embodiment.

[0044] Figure 23 This is a flowchart of the controller's processing in this embodiment.

[0045] Figure 24 This is a flowchart of the controller's processing in this embodiment.

[0046] Figure 25 This is a flowchart of the controller's processing in this embodiment.

[0047] Figure 26 This is a flowchart of the controller's processing in this embodiment.

[0048] Figure 27 This is a flowchart of the controller's processing in this embodiment.

[0049] Figure 28 This is a diagram that schematically illustrates the sequence of negotiations in this embodiment. Detailed Implementation

[0050] Embodiments of this disclosure will be described in detail with reference to the accompanying drawings. Furthermore, identical or corresponding parts in the drawings will be labeled with the same reference numerals, and their descriptions will not be repeated.

[0051] <§. Application Examples>

[0052] First, an example of a scenario in which the present invention is applied will be described. Figure 1 This is a diagram used to schematically illustrate an application example of this disclosure. Figure 1In the diagram, a communication sequence between the controller 100 of the FA and the support device 200, which is an example of an information processing device, is shown in relation to the processing.

[0053] In this disclosure, when the controller 100 successfully authenticates the support device 200, a communication session is established between the controller 100 and the support device 200. Once a communication session is established, it can be maintained from the beginning to the end of the communication. In this disclosure, a secure communication protocol is applied to each communication session (hereinafter, a communication session is also simply referred to as a "session") established between the controller 100 and the support device 200. In this disclosure, a secure communication protocol may represent, for example, version V1, version V2 which has a higher security level than version V1, or version V3 which has a higher security level than version V2.

[0054] The security level of a communication protocol can be determined, for example, based on the type, number, or combination of elements used in the authentication of the connection destination. Such elements may include, for example, at least one of attribute information representing the attributes of the connection destination, information representing the reliability of the connection destination (e.g., electronic certificates), encryption algorithms, encryption keys, and tamper detection algorithms. More specifically, the security level can differ between communication protocols, for example, by varying at least one of the following: whether attribute information is used in the authentication of the connection destination; whether information representing the reliability of the connection destination is used in the authentication of the connection destination; the type of attribute information used (password, biometric information, etc.); the type of encryption algorithm used; the type of encryption key used in that encryption algorithm; and the type of tamper detection algorithm used. Furthermore, the elements used for the authentication method of the connection destination are not limited to the types described above.

[0055] In this disclosure, "setting a security level" means being able to conduct communication in a session according to any of the communication protocols from versions V1 to V3. Furthermore, the security level is not limited to versions V1, V2, and V3; it can also be versions V1 and V2, or more than four versions that can provide four or more security levels.

[0056] The controller 100 controls the objects (production equipment, etc.) of the FA by executing a control program. The controller 100 may include, for example, a PLC (Programmable Logic Controller) or an IPC (Industrial Personal Computer). The support device 200 provides a development environment for the application containing the control program and assists user operation that includes the settings of the controller 100.

[0057] exist Figure 1In the diagram, versions V1 and V2 are shown as security levels. The controller 100 has a security level 111 representing the security level available in sessions of versions V1 and V2, and the support device 200 has a security level 211 representing the security level available in sessions of version V1.

[0058] exist Figure 1 During this process, the controller 100 establishes a connection with the support device 200, and performs a pre-registration process on the connection (step R0). In the pre-registration process, information stored (registered) in the management table 185, which includes the condition table 270 described later, is exchanged. Then, the connection ends (step R1).

[0059] During the pre-registration process, the controller 100 is set with a recommended security level (hereinafter also referred to as the prescribed security level) for use in the session. More specifically, the controller 100 sets, for example, the highest of the two security levels, versions V1 and V2, shown in security level 111, as the prescribed security level (in...). Figure 1 (In the case of "V2"). Furthermore, the security level is not limited to one; it can be two or more levels representing a higher security level.

[0060] The support device 200 accepts a user operation (step R2) and transmits a communication frame containing a session start request 32 based on the user operation to the controller 100. The communication frame includes the session start request 32, a security communication version 31 indicating the security level requested by the support device 200 for use in the session, and attribute information for the session start request 32. The security communication version 31, for example, is... Figure 1 The symbol "V1" is used. The attribute information includes information indicating the legitimacy of the session initiation request 32. This legitimacy information may include, for example, identification information of the user or support device 200 as the request source. This identification information is, for example, information used to authenticate the request source, such as the user account (username, etc.) of the user or support device 200, or the communication address of the support device 200. The information used to identify the legitimacy of the request source is not limited to this; additionally generated identification information may also be used. For example, it is also possible to request a user with administrator privileges to issue a connection ticket or certificate to the controller 100 identifying the user as legitimate, and then, when the user operates the support device 200 and connects to the controller 100, request the session initiation using the combination of the connection ticket or certificate identification information and the aforementioned user account identification information.

[0061] The controller 100 determines whether the secure communication version 31 of the session start request 32 transmitted from the support device 200 represents a specified security level or a lower security level (step R3). If it is determined that the secure communication version 31 of the session start request 32 represents the lower security level, the controller 100 determines whether the session start request 32 meets the conditions specified in the condition table 270 used to indicate the legitimacy of the request (step R4). In step R4, for example, it is determined whether the identification information (user account or communication address) contained in the attribute information of the session start request 32 meets the specified conditions.

[0062] The controller 100 sets a security level for the session established according to the session start request 32 (step R5). More specifically, if the controller 100 determines that the secure communication version 31 represents a security level lower than the specified security level and the session start request 32 meets the specified conditions, it sets a lower security level for the session established according to the request; if the controller determines that the security level of the secure communication version 31 represents the specified security level, it sets the specified security level for the session established according to the request.

[0063] exist Figure 1 In this context, secure communication version 31 represents a security level "V1" that is lower than the specified security level "V2". However, since the specified conditions are met, the controller 100 sets the security level to "V1" for the session established based on the session start request 32 (step R6). Online data processing is performed on the session, and then the session is terminated (step R7).

[0064] exist Figure 1 Even if the controller 100 determines that the secure communication version of the session start request 32 transmitted from the support device 200 is lower than the security level recommended by the controller 100, the controller 100 still sets a low security level for the session established according to the session start request 32, provided that the session start request 32 meets the prescribed conditions. Therefore, for example, even if the security level available to the user or support device 200 is lower than the security level recommended by the controller 100, it may be possible to set a low security level for the session corresponding to the session start request 32.

[0065] Furthermore, such a low security level setting is permitted only if the session initiation request 32 meets the prescribed conditions used to demonstrate the legitimacy of the request; otherwise, it is not permitted. Therefore, even if a low security level is set for the session, communication security within that session can be ensured.

[0066] The following describes the more detailed structure and processing of the system or apparatus of this embodiment as a more specific application example of the present invention.

[0067] <A. System Configuration>

[0068] First, the system 1000 of the present embodiment will be described.

[0069] Figure 2 is a schematic diagram showing the FA system 1000 of the present embodiment. The system 1000 includes a plurality of controllers 100-1, 100-2, and 100-3 that are network-connected via a network 50. Regarding the controllers 100-1, 100-2, and 100-3, their common configurations will be collectively referred to as the controller 100 for description. In addition, the number of controllers 100 connected to the network 50 is not limited to multiple, and may be one or more.

[0070] The controller 100 includes a processing unit 10 as a main body for executing programs, a power supply unit 12 that supplies power to the processing unit 10 and the like, and an input / output unit 14 that exchanges signals between the controller 100 and the field. The input / output unit 14 is connected to the processing unit 10 via a system bus 11. Typically, the input / output unit 14 acquires an input signal from a detection sensor 6 as a field device, and drives a relay 7 as a field device according to the execution result of the program in the processing unit 10.

[0071] The support device 200 communicates with the controller 100 via a network 13. The support device 200 has a module for assisting the development of application programs executed by the controller 100, and a module for monitoring the operating status of the controller 100 connected via the network 13 or values of various data and the like.

[0072] <B. Hardware Configuration>

[0073] (b1: Hardware Configuration of Support Device)

[0074] Figure 3 is a schematic diagram showing the hardware configuration of the support device 200 of the present embodiment. Reference is made to Figure 3 , the support device 200 is typically configured by a general-purpose computer. Such a computer may include an HMI (Human Machine Interface) device, a smartphone carried by a user, a tablet device, and the like. In addition, from the viewpoint of maintainability, the support device 200 is preferably a notebook-type personal computer with excellent portability.

[0075] Reference is made to Figure 3The supporting device 200 includes: a CPU (Central Processing Unit) 201, which executes various programs including an OS (Operating System); a ROM (Read Only Memory) 202, which stores the BIOS (Basic Input Output System) and various data; a RAM (Random Access Memory) 203, which provides a working area for storing data required by the CPU 201 to execute programs; and a hard disk drive (HDD) 204, which non-volatilely stores programs executed by the CPU 201.

[0076] The support device 200 also includes: a keyboard 205 and a mouse 206, which accept user operations on the support device 200; and a monitor 207, which is used to display information to the user. The support device 200 includes a communication interface (IF) 209 for communicating with the controller 100 (processing unit 10) and the like.

[0077] Various programs executed by the support device 200 are typically stored in a CD-ROM (Compact Disc Read-Only Memory) 300 for distribution. The programs stored in the CD-ROM 300 are read by a CD-ROM drive 208 and stored in a hard disk (HDD) 204 or similar device. Alternatively, the support device 200 can be configured to download programs from a host computer or similar device via a network.

[0078] Reference Figure 3 HDD 204 stores system programs 269 containing the OS, communication programs 271, 272, and 273 for communicating with the controller 100 according to various communication protocols from versions V1 to V3, GUI data 274 for displaying GUI (Graphical User Interface) screens, data representing application version 275 (described later), and multiple programs or data of support program 276. The various elements constituting the support device 200 exchange data via the internal bus 210.

[0079] (b2: Hardware structure of the controller)

[0080] Figure 4 This is a schematic diagram showing the hardware structure of the processing unit 10 of the controller 100 in this embodiment. (Refer to...) Figure 4The processing unit 10 includes a processor 101, a chipset 102, a main memory 104, a non-volatile memory 106, a system timer 108, a system bus controller 120, a network controller 140, and a USB (Universal Serial Bus) connector 110. The chipset 102 is connected to other components via various buses.

[0081] The processor 101 and chipset 102 are typically configured based on a general computer architecture. That is, the processor 101 interprets and executes command codes sequentially supplied from the chipset 102 according to its internal clock. The chipset 102 exchanges internal data with various connected components and generates the command codes required by the processor 101. Furthermore, the chipset 102 includes modules for caching data, etc., obtained as the results of computational processing within the processor 101.

[0082] The processing unit 10 has a main memory 104 and a non-volatile memory 106 as memory.

[0083] Main memory 104 is a volatile storage area that stores various programs that should be executed by processor 101 after power is supplied to processing unit 10. Main memory 104 is also used as working memory when processor 101 executes various programs. As such main memory 104, devices such as DRAM (Dynamic Random Access Memory) and SRAM (Static Random Access Memory) are used.

[0084] The non-volatile memory 106 non-volatilely stores data including system programs of the real-time OS, various application programs (modules) such as executable programs, and system setting parameters. These programs and data are copied to the main memory 104 as needed in a manner accessible to the processor 101.

[0085] The processing unit 10 has a system bus controller 120 and a network controller 140 as communication interfaces. These communication interfaces are used for sending output data and receiving input data.

[0086] System bus controller 120 controls data exchange via system bus 11. More specifically, system bus controller 120 includes DMA (Dynamic Memory Access) control circuitry 122, system bus control circuitry 124, and buffer memory 126. System bus controller 120 is internally connected to system bus 11 via system bus connector 130, which includes communication circuitry. Processing unit 10 exchanges control commands and status values ​​of the controlled object (as a field device, such as sensor 6 or relay 7) calculated through the execution of the control program with the controlled object via system bus connector 130.

[0087] Network controller 140 controls data exchange with other controllers 100 via communication connector 150 through network 50. That is, network controller 140 controls the transmission of output data and the reception of input data according to the network standard used. For example, system 1000 uses Ethernet, TCP / IP (Transmission Control Protocol / Internet Protocol), UDP / IP (User Datagram Protocol / Internet Protocol), or Common Industrial Protocol (CIP) for communication on network 50. The communication standards used on network 50 are not limited to these.

[0088] The network controller 140 includes a network control circuit 144, a DMA control circuit 142, and a buffer memory 146 for exchanging data with other controllers 100 connected to the network 50.

[0089] USB connector 110 is a communication interface for connecting the network 13 to which the support device 200 belongs to the processing unit 10. Typically, programs or data that can be executed by the processor 101 of the processing unit 10 and transmitted from the support device 200 are taken into the controller 100 via USB connector 110.

[0090] Figure 5 It means stored in Figure 4 A schematic diagram illustrating an example of information in non-volatile memory 106. (Refer to...) Figure 5 The non-volatile memory 106 of the controller 100 includes: system programs containing the OS, user-defined applications 170, communication programs 184, and management tables 185 referenced for session communication.

[0091] The user-defined application 170 includes: a setting program 171 for setting a security level for a session; a level determination program 172 for determining the security level indicated by a session start request; a condition determination program 173 for determining whether the session start request satisfies a condition; and a control program 174. When the setting program 171, the level determination program 172, and the condition determination program 173 are executed, modules respectively constituting a setting unit, a level determination unit, and a condition determination unit are formed. The communication program 184 includes, for each of the communication protocols of versions V1 to V3, communication programs 181, 182, and 183 for performing communication in accordance with the corresponding protocol.

[0092] <C. Session>

[0093] In the present disclosure, the "recommended version" refers to a version having a prescribed security level that is recommended for use in session communication between the controller 100 and the support device 200. More specifically, the "recommended version" is set in the controller 100 in the aforementioned pre-registration process. As the "recommended version", one version with the highest security level among multiple versions usable by the controller 100 in a session, or two or more versions with higher security levels can be set. In addition, the application version 275 refers to one version for use in a session among one or more versions that the support device 200 or a user can use for the session.

[0094] (c1. Description of Background of Embodiment)

[0095] Figures 6-8 is a diagram schematically showing the background of the present embodiment. In Figure 6 , for example, a connection when the support device 200 is connected to the controller 100 for the first time when the controller 100 is installed at a production site is shown. To simplify the description, the initial value of the "recommended version" pre-registered in the controller 100 at the time of factory shipment of the controller 100 or the like is set to V1, for example. In Figure 6 , there are shown the controller 100 whose "recommended version" represents the initial value V1, and the support device 200A and the support device 200B whose "application version" as the support device 200 represents V1. Furthermore, the initial value of the "recommended version" pre-registered in the controller 100 is not limited to V1.

[0096] The UI screen of the monitor 207 of the support device 200A includes an item 21 for setting a user (administrator) account (user name, password) in the controller 100. The UI screen of the monitor 207 of the support device 200B includes the aforementioned item 21 and a button 24. The user of the support device 200B operates the button 24 to set the "application version" of the support device 200 to V2 for subsequent sessions.

[0097] In Figure 6 In this process, the "application version" of supporting devices 200A and 200B is consistent with the "recommended version" (V1) of controller 100, thus enabling supporting devices 200A and 200B to exchange information with controller 100. When communicating with supporting device 200A, controller 100 registers the user of supporting device 200A as an administrator (step S1), and supporting device 200A sets the recommended version for subsequent sessions to version V1 or V2 in controller 100 (step S2), and then terminates the connection.

[0098] When communicating with the support device 200B, the controller 100 sets the recommended version for subsequent sessions to version V2 and sets version V1 to unusable (invalid) based on the user operation received by the support device 200B (step S4), and terminates the connection.

[0099] At the end Figure 6 After communication, the scenario where support devices 200A and 200B reconnect to controller 100 is as follows: Figure 7 and Figure 8 As shown. In Figure 6 During the period from the end of the connection to the reconnection, the recommended version of controller 100 can be changed (set) by the administrator. Figure 7 The image shows controller 100 with "Recommended Version" set to V2 and version V1 set to invalid. Figure 8 The diagram shows that the "Recommended Version" is V2 and Version V1 is set as a conditional controller 100.

[0100] Figure 7 The image shows a support device 200A with "Application Version" V1 and a support device 200B with "Application Version" V2. The UI screen of monitor 207 includes items 21A for accepting user account input operations and buttons 21B that are operated to indicate a session start request. Support devices 200A and 200B include user account and secure communication version 31 data in the communication frame of the session start request. More specifically, secure communication version 31 indicates the "Application Version" of support devices 200A and 200B, namely "V1" or "V2".

[0101] The controller 100 compares the secure communication version 31 of the session start request transmitted from the supporting devices 200A and 200B with the controller 100's recommended version "V2" to determine whether they are consistent. If the controller 100 determines that the secure communication version 31 of the session start request from the supporting device 200A is inconsistent, it does not establish a session based on the determination result (step S6), and determines that the secure communication version 31 of the session start request from the supporting device 200B is consistent, it establishes a session based on the determination result (step S7).

[0102] In Figure 7 the case where the "application version" and the "recommended version" do not match, the support device 200A cannot establish a session with the controller 100. In contrast, in Figure 8 is shown a scenario where even the support device 200A whose "application version" does not match the "recommended version" can establish a session with the controller 100. More specifically, in Figure 8 , the "recommended version" is set to V2 in the controller 100, and version V1 is set as a conditional version. In Figure 8 , the controller 100 determines that the secure communication version 31 in the session start request from the support device 200A does not match the "recommended version". In this case, when the controller 100 determines that the session start request satisfies the condition associated with version V1, it establishes a session (step S9). For the session start request from the support device 200B, the controller 100 determines that the secure communication version 31 matches the "recommended version", and thus establishes a session (step S10).

[0103] As shown in Figure 8 , even when the controller 100 determines that the secure communication version 31 indicated by the session start request has a security level lower than that of the recommended version, it can establish a session if the session start request satisfies the condition. In the following, an operation flow further including the operation of setting the condition in the controller 100 is presented.

[0104] <D. Specific Procedure>

[0105] Figures 9-16 is a diagram schematically showing the operation flow of the pre-registration processing of the present embodiment. This operation flow is represented by transitions of UI screens displayed on the monitor 207 of the support device 200.

[0106] (d1. Operation Flow of Pre-Registration Processing)

[0107] In the operation flow of d1, based on a user operation on the support device 200, information of an administrator is registered in the controller 100, and a recommended version is set. Pre-registration of other information is implemented through the operation flow of d2 described later. The other information includes information related to roles different from the administrator in the controller 100, or information on other versions that are available in the controller 100 and different from the recommended version.

[0108] Figures 9-12 shows the operation flow for transferring project files in the Figure 1 pre-registration processing. Figure 9In the offline state where the support device 200 is not communicating with the controller 100, it generates a project file based on user operations received in the UI screen (step S30). When the support device 200 receives an online user operation (step S31), it switches the screen of the monitor 207 to the UI screen for initial online processing. The project file may include, for example, a user-defined application 170 containing the controller 100's control program 174 or setting data. The project file is then transmitted to the controller 100 in the subsequent online state.

[0109] The support device 200 is operated by a user with administrator privileges. More specifically, when the support device 200 receives a user operation on item 521 of the UI screen (step S32), it switches the screen of the monitor 207 to... Figure 10 UI screen. Figure 10 In the process, when the support device 200 first receives the user operation and transmission instruction in the UI screen (step S33), it switches to displaying the UI screen that recommends version V2 as the secure communication version. When the user receives an "OK" operation after the operation of button 24 (step S34), V2 is set in application version 275 and a session is established with the controller 100 (step S35).

[0110] When a session is established (step S36), if the acceptance Figure 11 If the user interacts with item 561 of the UI screen, the support device 200 will transfer the item file to the controller 100 (step S38). In the controller 100, the item file transferred from the support device 200 will be stored in the non-volatile memory 106 (step S38a). Then, when the support device 200... Figure 12 When a user operation for item 581 is received on the UI screen, the support device 200 switches the working mode of the controller 100 to the execution mode for executing the program (step S39a).

[0111] During the pre-registration process, the support device 200 will... Figure 13 , Figure 14 , Figure 15 as well as Figure 16 The information received from the user is transmitted to the controller 100 according to the operation process. The controller 100 stores the information received from the support device 200 in the management table 185.

[0112] Figure 13The diagram illustrates the workflow for administrators to set user accounts or roles on controller 100. Application version 275 indicates that when the support device 200 of V2 is online and receives a user operation on item 601 of the UI screen, it transmits an account setting request to controller 100 (step S42). Controller 100 responds to this request by transmitting an account list 250 to support device 200. Support device 200 displays the information based on the account list 250 transmitted from controller 100 on UI screen 61.

[0113] In UI screen 61, usernames 611 and roles 612 are displayed for multiple users of controller 100, along with buttons 61a to 61c. Buttons 61a or 61b are used to add or delete accounts, button 61c is used to change passwords, and button 61d is used to change roles 612. Roles represent the scope of operation permissions of controller 100. Administrators have the widest scope. Administrators are permitted to use buttons 61a to 61d, while users with roles other than administrators are only permitted to use button 61c. When the support device 200 receives a user operation using button 61a, it switches from UI screen 61 to UI screen 62. Based on the user operation received by the support device 200 in UI screen 62, accounts and roles (administrators) are added (registered) in the account list 250 of controller 100.

[0114] Figures 14-16 This indicates the administrator's operation procedure for registering the recommended version in controller 100. Application version 275 indicates that the V2 support device 200 is online and accepts... Figure 14 When the user interacts with item 602 of the UI screen, for example, when displaying... Figure 14 UI screen 64 Figure 15 UI screen 66 or Figure 16 UI screen 67.

[0115] exist Figure 14 In the UI screen 64, user operations are performed to set the recommended version of the controller 100. Users can operate button 641 to set only one of versions V1 and V2 as the "recommended version," and can operate button 642 to set both versions V1 and V2 (with checkbox 642a attached) as the "recommended version." The "recommended version" setting operation is not limited to... Figure 14 The operation, for example, could also be Figure 15 The operation.

[0116] exist Figure 15The UI screen 66 displays a button 661 for accepting user operations to set the version of the controller 100. Button 661 includes an identifier 66a and a designation 66b for versions V1, V2, and V3 that can be used in a session. The values ​​that can be set in the designation 66b for each version include "Disallowed" (meaning the use of that version is not permitted), "Conditioned" (meaning the use of that version is permitted if certain conditions are met), and "Permitted" (meaning the use of that version is unconditionally permitted). The window 662 of the UI screen 66 contains objects configured to accept conditional setting operations from 66C to 66G.

[0117] Users can set "permission" in designated 66b of UI screen 66 through user operation, and can register the version represented by the identifier 66a corresponding to the designated 66b as "recommended version" in controller 100.

[0118] (d2. Other operational procedures for prior registration)

[0119] Through user operation, for versions other than the recommended version of UI screen 66, the user sets a value for the specified 66b corresponding to the identifier 66a of that version, thereby enabling the controller 100 to register each version as an "unlicensed" or "conditional" version.

[0120] Figure 15 UI screen 66, item 66C, handles user actions that are set as versions of objects with additional conditions. Items 66D to 66F handle user actions that set the specified conditions that the session start request should meet in order to accept the session start request.

[0121] More specifically, Items 66D and 66E handle operations for setting conditions for users and devices (supporting device 200), respectively. Item 66E handles operations for specifying authentication using a client certificate. Item 66G handles operations for setting the validity period of the conditions that can be used under Items 66D to 66E. Item 66D, for example, handles operations for setting accounts such as usernames. Additionally, Item 66E, for example, handles operations for specifying communication addresses such as the IP address or MAC address of supporting device 200. Furthermore, through the operations of Items 66D and 66E, conditions for determining whether to accept a session start request can be set, but conditions for determining whether to reject a session start request can also be set.

[0122] exist Figure 16In the UI screen 67, items 671 and 673 that receive user operations are included. In item 671, among the versions V1, V2 and V3 that the controller 100 can use, versions V2 and V3 are designated by user operation as "recommended versions" using a mark 672. When the support device 200 receives a user operation on item 673, negotiation described later is performed between the support device 200 and the controller 100.

[0123] In the present embodiment, the support device 200 transmits the information received via the user operation shown Figures 13-16 to the controller 100 in a manner set in the management table 185.

[0124] <E. Communication Frame>

[0125] Figure 17 is a diagram schematically illustrating a configuration example of the communication frame of the present embodiment. The controller 100 and the support device 200 use the communication frame to exchange commands, data and the like. Figure 17 shows an example of a communication frame having a command of a session start request 32. Referring to Figure 17 , the communication frame includes a header 40 for storing header information, and a main body 30 for storing a payload. The header 40 includes a destination 21c and a transmission source 21d. The main body 30 includes a secure communication version 31 representing the value of the application version 275 of the support device 200, the command of the session start request 32, and first identification information 33 and second identification information 34 for identifying the legitimacy of the user. The destination 21c includes a communication address such as the IP address of the controller 100. The transmission source 21d includes an identifier of the support device 200. The identifier includes, for example, the communication address of the support device 200. Such a communication address includes the IP address or MAC (Media Access Control address) of the support device 200. The first identification information 33 includes, for example, an account (user name, password) and the like. The second identification information 34 includes, for example, a connection ticket or a certificate and the like.

[0126] <F. Management Table>

[0127] Figures 18-22 is a diagram schematically illustrating the management table of the present embodiment. The management table 185 includes Figure 18 an account list 250, Figure 19 a version permission list 260, and condition tables 270, 270A and 270B representing predetermined conditions for judging the legitimacy of the session start request 32 Figure 20 , Figure 21 and Figure 22 .

[0128] Figure 18The account list 250 stores the account (username 25a, password 25b) and role 25c for one or more users respectively. Figure 19 The version license list 260 specifies at least one version that the controller 100 can utilize, and includes an identifier 26a representing the value of that version, a value 26b, a recommendation 26c representing the "recommended version" of the controller 100, and a note 26d. Value 26b is set to be based on... Figure 15 The value of the operation of button 661 in the UI screen 66. Figure 19 Recommendation 26c is set as: version V3, representing the highest security level, shown as the "recommended version" among the versions that the controller 100 can utilize. Furthermore, the "recommended version" shown in Recommendation 26c is not limited to one version and can include multiple versions. For example, it can also be based on... Figure 16 In the UI screen 67, the operation of item 671 is to set the recommendation 26c to indicate that version V2 and version V3 are the "recommended versions".

[0129] Figure 20 In condition table 270, controller 100 determines the data transmitted from support device 200 (e.g., in...) Figure 15 The data set in window 662 of the UI screen 66 is set in condition table 270. Condition table 270 represents the conditions used to determine whether controller 100 accepts session start request 32. More specifically, condition table 270 includes an identifier 27a representing the value of the version that controller 100 can utilize, and items for conditions attached to that version, for example, the category 27b of the condition and its value 27c, and the validity period 27d for utilizing the condition. Category 27b includes, for example, the user's identifier (e.g., username of an account), the identifier of the supporting device 200 (e.g., IP address, MAC address of a communication address), and so on. Figure 20 When controller 100 determines that the communication frame containing the first identification information 33 of session start request 32 satisfies the following conditions: username "Taro" or "Hanako", IP address of source 21d "xx.yy.zz.ww", and the time of receipt of session start request 32 (or the time of transmission of session start request 32) indicates an expiration date "DD", controller 100 accepts session start request 32. Furthermore, the types or number of items constituting the conditions to be attached to the version are not limited to... Figure 20 Project examples.

[0130] Figure 20 Condition table 270 can also be divided into Figure 21 The conditions regarding the account, Table 270A and Figure 22a condition table 270B regarding the IP address 27e. In addition, the condition tables 270, 270A, and 270B represent conditions for judging to accept the session start request 32, but may also be configured to represent conditions for judging not to accept the session start request 32.

[0131] <G. Flowchart>

[0132] Figures 23-27 is a processing flowchart of the controller of the present embodiment. Figure 23 in which the controller 100 judges whether a communication frame of the session start request 32 has been received from the support device 200 (step S100). When it is judged that the communication frame of the session start request 32 has not been received ("No" in step S100), the processing of step S100 is repeated.

[0133] When it is judged that the communication frame of the session start request 32 has been received ("Yes" in step S100), the controller 100 accepts the communication frame (step S101), performs an authentication process (step S102), and judges whether the authentication is successful (step S103). In the authentication process, the controller 100 judges whether the account (user name, password) indicated by the first identification information 33 of the communication frame of the session start request 32 matches the account stored in the account list 250, outputs an authentication success when they match, and outputs an authentication failure when they do not match.

[0134] If it is judged that the authentication has failed ("No" in step S103), the controller 100 transmits an error to the support device 200, and returns to step S100. If it is judged that the authentication is successful ("Yes" in step S103), a version judgment process is performed (step S104). In step S104, it is judged whether the session start request 32 is acceptable or unacceptable.

[0135] If it is judged to be unacceptable ("No" in step S105), the process proceeds to step S112, and if it is judged to be acceptable ("Yes" in step S105), the process PR of the level setting unit is performed. In the process PR, the setting unit of the controller 100 sets a security level for the session established based on the session start request 32 (steps S106, S107, S108). More specifically, the communication program corresponding to the communication protocol of the secure communication version 31 among the communication programs 181 to 183 is executed to establish the session.

[0136] The controller 100 determines whether the session establishment process was successful (step S109). If it is unsuccessful (no in step S109), the process proceeds to step S112. If it is successful (yes in step S109), the controller 100 sends a notification of successful session establishment to the support device 200 (step S110). The controller 100 then performs online processing on the established session (step S111).

[0137] Figure 24 This indicates version determination processing (step S104). Figure 24 In step S118, the level determination unit of controller 100 determines whether the security communication version 31 of session start request 32 represents the security level of the recommended version or a security level lower than the recommended version. More specifically, based on the value of security communication version 31, controller 100 retrieves the value 26b corresponding to the identifier 26a representing that value from the version license list 260. Controller 100 determines whether the retrieved value 26b represents "licensed," "conditionally licensed," or "not licensed."

[0138] If the retrieved value 26b is determined to represent "permission" ("permission" in step S120), meaning that the secure communication version 31 represents the recommended security level, then the controller 100 outputs an acceptable session start request 32 (step S121) and returns to step S104 (step S125). If the retrieved value 26b is determined to represent "conditional permission" ("conditional permission" in step S120), meaning that the secure communication version 31 represents a security level lower than the recommended security level, then the process proceeds to step S122.

[0139] If the retrieved value 26b is determined to mean "not permitted" (in step S120, it means "not permitted"), then the controller 100 outputs an unacceptable session start request 32 (step S124) and returns to step S104 (step S125).

[0140] In step S122, the condition determination unit of the controller 100 uses the condition table 270 to determine whether the session start request 32 meets the prescribed conditions for indicating the legitimacy of the request (step S122). If the conditions are met ("Yes" in step S123), the process proceeds to step S121; if the conditions are not met ("No" in step S123), the process proceeds to step S124. In step S122, the controller 100 compares the value 27c of the category 27b corresponding to the identifier 27a that matches the value of the secure communication version 31 with the value of the communication frame. If the comparison result indicates a match, the condition is determined to be met; otherwise, the condition is determined to be unmet. For example, if the secure communication version 31 indicates version V2, according to... Figure 20The condition table 270 determines that a condition is satisfied when the IP address of the transmission source 21d of a communication frame is "xx.yy.zz.ww", the user name of the first identification information 33 of the communication frame is "Hanako" or "Taro", and the reception time of the communication frame is before the expiration date "DD", and determines that the condition is not satisfied in other cases.

[0141] In steps S106 to S108, respectively, Figures 25-27 the illustrated session establishment processing is executed. In step S106, the communication program 181 is executed to perform the session establishment processing according to version V1, in step S107, the communication program 182 is executed to perform the session establishment processing according to version V2, and in step S108, the communication program 183 is executed to perform the session establishment processing according to version V3. Figure 25 The vulnerability in session establishment of version V1 Figure 26 can be eliminated in the session establishment of version V2 with a higher security level, and in Figure 27 the session establishment of version V3, a higher security level than that of Figure 26 the session establishment of version V2 can be ensured.

[0142] Figures 23-27 The illustrated flowchart can be implemented by the processor 101 of the controller 100 executing the setting program 171, the level determination program 172, the condition determination program 173, and the communication program 184.

[0143] <H. Negotiation>

[0144] Figure 28 is a diagram schematically showing the sequence of negotiation according to the present embodiment. In the present embodiment, it may be configured that after the above-described pre-registration processing is performed, the controller 100 performs Figure 28 the illustrated negotiation between the controller 100 and the support device 200. After executing this negotiation, Figure 23 the illustrated session establishment processing is executed.

[0145] In Figure 28 the illustrated processing, the support device 200 transmits a negotiation request 91 to the controller 100. The negotiation request 91 includes data D1 representing one or more versions that the support device 200 can use. The controller 100 receives the negotiation request 91 (step S20), and compares the one or more versions represented by the data D1 with the one or more versions permitted to be used in the version permission list 260 (step S21). Based on the comparison result, the controller 100 determines whether the version permitted by the controller 100 corresponds to the usable version of the support device 200, and transmits a response 92 including data D2 representing the determination result to the support device 200 (step S22).

[0146] Based on the above comparison, when the controller 100 determines that one or more versions permitted in the version permission list 260 match one or more versions available to the support device 200, the data D2 indicates the matching versions. The support device 200 determines the version with the highest security level among the one or more versions indicated by the data D2 received from the controller 100, and sets the determined version as the application version 275 to be used in subsequent sessions. When the controller 100 determines based on the above comparison that the one or more versions permitted by the controller 100 do not match the one or more versions available to the support device 200, the controller 100 transmits data D2 indicating the mismatch to the support device 200.

[0147] According to Figure 19 in the version permission list 260, versions V2 and V3 are permitted in the controller 100. Therefore, for example, when the data D1 indicates versions V1, V2 and V3, the data D2 indicates versions V2 and V3, and when the data D1 indicates only version V1, the data D2 indicates a mismatch or an error.

[0148] In addition, Figure 28 herein, the controller 100 transmits the data D2 indicating the matching versions based on the above determination result to the support device 200, but the present invention is not limited to this. For example, the controller 100 may also transmit data D2 indicating mismatched versions to the support device 200 based on the above determination result. Further, the data D2 may indicate both matching versions and mismatched versions.

[0149] (h1. Another example of negotiation)

[0150] The controller 100 may instead of Figure 19 the above configuration, be configured to notify the support device 200 of one or more permitted versions indicated in the version permission list 260 in response to a negotiation request transmitted from the support device 200. At this time, the support device 200 determines a version that is available to the support device 200 and has the highest security level from among the one or more versions indicated by the notification from the controller 100, and sets the determined version as the application version 275.

[0151] <I. Program>

[0152] The program executed in the controller 100 is non-temporarily stored in the HDD 106. The program is transmitted from the support device 200 or via the network 50 and stored in the HDD 106. Alternatively, the program is stored in a not-illustrated storage medium, such as a CD-ROM, and distributed. The program stored in the CD-ROM is read from the CD-ROM and stored in the HDD 106.

[0153] The modules provided by the controller 100 illustrate a structural example in which the required modules are provided by the CPU 101 executing a program, but a part or all of these provided modules may also be implemented using a dedicated hardware circuit (for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), etc.). In this case, the controller 100 may also use virtualization technology to execute a plurality of OSs with different purposes in parallel, and execute required applications on each OS.

[0154] <J. Appendix>

[0155] The present embodiment described above includes the following technical concepts.

[0156] [Structure 1]

[0157] A controller (100) for FA, i.e. factory automation, comprising: a communication interface (110) for connecting to a network (13) to which an information processing device (200) belongs; a level determination unit (172) that determines which one of a prescribed security level and a security level lower than the prescribed security level is indicated by a session start request (32) transmitted from the information processing device; a condition determination unit (173) that, when the level determination unit determines that the session start request indicates the lower security level, determines whether the session start request satisfies prescribed conditions (270, 270A, 270B) for indicating the validity of the request; and a setting unit (171) that sets a security level for a session established based on the session start request, the setting unit sets the prescribed security level for the session when the level determination unit determines that the session start request indicates the prescribed security level, the setting unit sets the lower security level for the session when the level determination unit determines that the session start request indicates the lower security level and the condition determination unit determines that the prescribed conditions are satisfied.

[0158] [Structure 2]

[0159] In the controller according to Structure 1, the prescribed conditions for indicating the validity include a condition indicating the validity of the request source of the session start request.

[0160] [Structure 3]

[0161] In the controller described in structure 1 or 2, The controller exchanges communication frames with the information processing device. The communication frame that requests the start of the session contains identification information (21d, 33, 34) that identifies the source of the communication frame. The condition determination unit determines whether the identification information contained in the communication frame of the session start request satisfies the conditions representing the legitimacy.

[0162] [Structure 4]

[0163] In the controller described in any of structures 1 to 3, the specified conditions include a validity period (27 days) during which the specified conditions can be utilized.

[0164] [Structure 5]

[0165] In any of the controllers described in structures 1 to 4, Before the session start request, the information processing device sends a negotiation request (91) to the controller, the negotiation request (91) having data (D1) indicating that the information processing device is capable of using more than one security level for the session. The controller compares one or more security levels represented by the data in the negotiation request received from the information processing device with one or more security levels that the controller can use for the session, and sends the comparison result (D2) to the information processing device.

[0166] [Structure 6]

[0167] In any of the controllers described in structures 1 to 5, In response to a negotiation request sent from the information processing device prior to the session initiation request, the controller notifies the information processing device of one or more security levels that the controller can be used for the session.

[0168] [Structure 7]

[0169] A method implemented by a controller (100) for factory automation (FA), the controller having a communication interface (110) for connecting to a network (13) to which an information processing device (200) belongs, the method comprising: The step of determining the security level is to determine whether the session start request (32) sent from the information processing device represents a specified security level or a security level lower than the specified security level; In the conditional judgment step, if the level judgment step determines that the session start request indicates the low security level, it then determines whether the session start request meets the prescribed conditions (270, 270A, 270B) for indicating the legitimacy of the request; and The step of setting a security level on a session established based on the session start request. The steps for making the above settings include: In the step of determining the security level, if it is determined that the session start request indicates the specified security level, the specified security level is set for the session; and If, in the step of determining the level, it is determined that the session start request indicates the low security level, and in the step of determining the condition, it is determined that the specified condition is met, the low security level is set for the session.

[0170] [Structure 8]

[0171] A program (171, 172, 173) for causing the processor (101, 102) of a controller (100) for factory automation (FA) to execute a method, the controller having a communication interface (110) for connecting to a network (13) to which an information processing device (200) belongs, the method comprising: The step of class determination is to determine whether the session start request (32) transmitted from the information processing device represents a specified security level or a security level lower than the specified security level; In the conditional judgment step, if the level judgment step determines that the session start request indicates the low security level, it then determines whether the session start request meets the prescribed conditions (270, 270A, 270B) for indicating the legitimacy of the request; and The step of setting a security level on a session established based on the session start request. The steps for making the above settings include: In the step of determining the security level, if it is determined that the session start request indicates the specified security level, the specified security level is set for the session; and If, in the step of determining the level, it is determined that the session start request indicates the low security level, and in the step of determining the condition, it is determined that the specified condition is met, the low security level is set for the session.

[0172] Embodiments of the invention have been described, but should be considered illustrative rather than limiting in all respects. The scope of the invention is set forth in the claims and is intended to include all modifications within the meaning and scope equivalent to the claims.

Claims

1. A controller, which is a FA (factory automation) controller, wherein, The controller has: A communication interface, used to connect to the network to which the information processing device belongs; The security level determination unit determines whether the session start request sent from the information processing device indicates a specified security level or a security level lower than the specified security level. The condition determination unit determines whether the session start request meets the prescribed conditions for representing the legitimacy of the request if the level determination unit determines that the session start request represents the low security level. as well as The settings unit sets a security level for the session established based on the session start request. When the level determination unit determines that the session has initiated a request indicating the specified security level, the setting unit sets the specified security level for the session. When the level determination unit determines that the session start request indicates a low security level, and the condition determination unit determines that the specified conditions are met, the setting unit sets the session to the low security level.

2. The controller according to claim 1, wherein, The prescribed conditions used to indicate the legitimacy include conditions indicating the legitimacy of the request source that initiated the session.

3. The controller according to claim 1 or 2, wherein, The controller exchanges communication frames with the information processing device. The communication frame that initiates the session includes identification information that identifies the source of the communication frame. The condition determination unit determines whether the identification information contained in the communication frame of the session start request satisfies the conditions representing the legitimacy.

4. The controller according to claim 1 or 2, wherein, The specified conditions include the period during which the specified conditions can be utilized.

5. The controller according to claim 1 or 2, wherein, Before the session initiation request, the information processing device sends a negotiation request to the controller, the negotiation request containing data indicating that the information processing device is capable of using more than one security level for the session. The controller compares one or more security levels represented by the data in the negotiation request received from the information processing device with one or more security levels that the controller can use for the session, and sends the comparison results to the information processing device.

6. The controller according to claim 1 or 2, wherein, In response to a negotiation request sent from the information processing device prior to the session initiation request, the controller notifies the information processing device of one or more security levels that the controller can be used for the session.

7. A method implemented by a FA (factory automation) controller, wherein, The controller has a communication interface for connecting to the network to which the information processing device belongs. The method has the following characteristics: The step of determining the security level involves determining whether the session start request sent from the information processing device indicates a specified security level or a security level lower than the specified security level. In the condition judgment step, if the session start request indicates a low security level in the level judgment step, it is determined whether the session start request meets the prescribed conditions for indicating the legitimacy of the request. as well as The step of setting a security level on a session established based on the session start request. The steps for making the above settings include: In the step of determining the security level, if it is determined that the session start request indicates the specified security level, the specified security level is set for the session. as well as If, in the step of determining the level, it is determined that the session start request indicates the low security level, and in the step of determining the condition, it is determined that the specified condition is met, the low security level is set for the session.

8. The method according to claim 7, wherein, The prescribed conditions used to indicate the legitimacy include conditions indicating the legitimacy of the request source that initiated the session.

9. The method according to claim 7 or 8, wherein, The controller exchanges communication frames with the information processing device. The communication frame that initiates the session includes identification information that identifies the source of the communication frame. The condition determination step includes the following steps: determining whether the identification information contained in the communication frame of the session start request satisfies the conditions representing the legitimacy.

10. The method according to claim 7 or 8, wherein, The specified conditions include the period during which the specified conditions can be utilized.

11. The method according to claim 7 or 8, wherein, Before the session initiation request, the information processing device sends a negotiation request to the controller, the negotiation request containing data indicating more than one security level that can be used for the session. The method further comprises the following steps: comparing one or more security levels represented by the data in the negotiation request sent from the information processing device with one or more security levels that the controller can utilize for the session, and sending the comparison result to the information processing device.

12. The method according to claim 7 or 8, wherein, The method further comprises the following steps: in response to a negotiation request sent from the information processing device prior to the session start request, notifying the information processing device of one or more security levels that the controller can utilize for the session.

13. A storage medium storing a program for executing a method by a processor of a controller for factory automation (FA), wherein, The controller has a communication interface for connecting to the network to which the information processing device belongs. The method has the following characteristics: The step of determining the security level involves determining whether the session start request sent from the information processing device indicates a specified security level or a security level lower than the specified security level. In the condition judgment step, if the session start request indicates a low security level in the level judgment step, it is determined whether the session start request meets the prescribed conditions for indicating the legitimacy of the request. as well as The step of setting a security level on a session established based on the session start request. The steps for making the above settings include: In the step of determining the security level, if it is determined that the session start request indicates the specified security level, the specified security level is set for the session. as well as If, in the step of determining the level, it is determined that the session start request indicates the low security level, and in the step of determining the condition, it is determined that the specified condition is met, the low security level is set for the session.

14. The storage medium according to claim 13, wherein, The prescribed conditions used to indicate the legitimacy include conditions indicating the legitimacy of the request source that initiated the session.

15. The storage medium according to claim 13 or 14, wherein, The controller exchanges communication frames with the information processing device. The communication frame that initiates the session includes identification information that identifies the source of the communication frame. The condition determination step includes the following steps: determining whether the identification information contained in the communication frame of the session start request satisfies the conditions representing the legitimacy.

16. The storage medium according to claim 13 or 14, wherein, The specified conditions include the period during which the specified conditions can be utilized.

17. The storage medium according to claim 13 or 14, wherein, Before the session initiation request, the information processing device sends a negotiation request to the controller, the negotiation request containing data indicating more than one security level that can be used for the session. The method further comprises the following steps: comparing one or more security levels represented by the data in the negotiation request sent from the information processing device with one or more security levels that the controller can utilize for the session, and sending the comparison result to the information processing device.

18. The storage medium according to claim 13 or 14, wherein, The method further comprises the following steps: in response to a negotiation request sent from the information processing device prior to the session start request, notifying the information processing device of one or more security levels that the controller can utilize for the session.

Images