ROUTER WITH LOGIN FUNCTIONALITY AND SUITABLE ACCESS CONTROL METHOD

Description

[0001] The present invention relates to a router that is connected between at least two communication, plant, and / or computer networks and is equipped and configured with a login function for logging in a user in order to grant the user access to predetermined network areas and / or network devices connected to them after the entry of login data recognized as valid. The invention further relates to an access control method, particularly suitable for such a router.

[0002] As is well known, communication, plant, and / or computer networks, also generally referred to as networks within the scope of this invention, can in and of themselves represent private or public networks and, depending on the definition, can form, for example, so-called LANs (Local Area Networks) or WANs (Wide Area Networks), and can be structured in fundamentally different ways. Networks can therefore cover an entire automation system, production plant, or office environment, or parts thereof, down to individual network cells. Other examples include data centers or a public telephone network. Within a network, network devices can communicate with each other via a common medium and protocol and / or exchange data, and generally also share a number of resources.In the case of, for example, automation or production plants, the network participants connected within a network communicate with each other via a common Ethernet network.

[0003] To enable communication and / or data exchange across network boundaries, and / or to connect a network to the internet or another network, routers are commonly used at the outer boundaries of a network. These routers allow multiple networks, even those using different protocols or media, to be interconnected. Within the scope of this invention, the term "network" or "network" therefore also refers to sub-areas of such a network, down to individual network cells, each of which has a router at its outer boundary. An example of such a router is described in document US2016 / 087942, published on March 24, 2016, by Yaguchi Takamasa.

[0004] Access from outside such a communication, plant, and / or computer network to this network, or to at least predetermined network segments and / or connected network devices, is therefore usually via a router and is generally only permitted to appropriately authorized users. Such users can be people, but also network devices from other networks. Such external access is often necessary, for example, for remote maintenance and / or security applications, for which a specific user must access at least predetermined network segments or connected network devices from outside the network. To prevent unauthorized users from accessing such segments or connected network devices from outside the network, it is therefore usually necessary to first enter the appropriate login credentials into the router.to pass this information to the user, in order to then grant them access to the network behind the router, or to the network areas and devices connected to it and consequently protected by the router, based on the access authorization stored with the login data. For granted access, the router can then, for example, initiate the establishment of a corresponding VPN tunnel to a specific network area and / or network device.

[0005] German patent DE 10 2006 057 400 B4 discloses an access control system for access code-protected, administrator-managed data sources with a remote access method protected by a known access code. The access control system includes a means to temporarily block remote access using a known valid access code. This is achieved by changing the access code known to a user, which the access control system also recognizes as valid, into a substitute code that is to be used instead but is unknown to the user whose access is to be blocked. Since the substitute code replaces the valid access code of even an authorized user at the data source to be blocked, even a user who is generally authorized would have to enter the unknown substitute code instead of their valid access code to gain access if their valid access code is temporarily blocked.

[0006] One disadvantage here is that the access control system must still actively check the access code entered by a user, even when the access code is temporarily blocked, i.e., compare the entered access code with the substitute code used for temporary blocking.

[0007] One object of the invention is therefore to provide a high level of security against unwanted external access to a network, even for authorized users, and in particular to prevent any potentially possible external access at least temporarily, in a simpler and especially capacity-saving manner, particularly with regard to the components and resources responsible for checking and / or releasing a requested access.

[0008] The solution to the invention is already provided by a router with the features according to claim 1 and an access control method with the features according to claim 9.

[0009] The present invention thus proposes a router in which a registration functionality for registering a user is provided in such a way as to grant the user access to predetermined network areas and / or network devices connected to them after input of registration data recognized as valid, such that an activation / deactivation device cooperating with the registration functionality is provided on the router for temporarily activating and / or deactivating a registration data input device required for the input of registration data by the user.

[0010] The invention further proposes an access control method, particularly for such a router, in which the entry of login data can be temporarily enabled and / or disabled by means of an activation / deactivation device to control access. In contrast to the prior art cited above, in particular DE 10 2006 057 400 B4, the solution according to the invention thus eliminates the need to check an entered code or login data when access to the network is to be temporarily blocked, since in this case the entry of login data is already prevented. The temporary blocking of network access is therefore achieved in a significantly more resource-efficient manner, as no active check for the validity of entered login data is required.

[0011] Further training stipulates that the router, as part of its login functionality, will have a login menu accessible via a desktop or browser as a login data input device.

[0012] In a particularly preferred embodiment, the invention further provides that the activation / deactivation device for temporarily deactivating the application data input device merely prevents a visual display of the application menu.

[0013] Accordingly, a particularly preferred access control method is characterized by the fact that the entry of the login data takes place via a login menu accessible via a desktop or a browser and is blocked by preventing a visual display of this login menu.

[0014] However, in supplementary or alternative training, it is also appropriate to provide for the registration functionality to be set up for the automated entry of registration data and / or for reading the registration data using scanning or sensor devices when the registration data input device is temporarily activated.

[0015] In a further supplementary or alternative embodiment, it is provided that the activation / deactivation device has a switch, in particular a switch designed as hardware or as software.

[0016] In appropriate further development, such a switch can be designed, for example, as a key switch or as an HMI (Human Machine Interface) button.

[0017] According to a further supplementary or alternative training, it is also planned to set up the activation / deactivation device in conjunction with the registration functionality to activate and deactivate the registration data input device independently of any activated or deactivated communication connection.

[0018] Further advantages and features of the invention will become apparent from the following description of some preferred embodiments with reference to the accompanying drawings, which show: Fig. 1, in a highly schematic representation, shows a partial view of a router with a first embodiment of an activation / deactivation device according to the invention; Fig. 2, in a highly schematic representation, shows a partial view of a router with a second embodiment of an activation / deactivation device according to the invention; Fig. 3, in a highly schematic representation, shows a partial view of a router with a third embodiment of an activation / deactivation device according to the invention; Fig. 4, in a highly schematic representation, shows a partial view of a router with a fourth embodiment of an activation / deactivation device according to the invention; and Fig. 5, in a highly simplified representation, shows a preferred embodiment of an access control method according to the invention.

[0019] The following description of preferred embodiments of the invention assumes a router that is connected between at least two communication, plant, and / or computer networks and is equipped and configured with a login function for logging in a user. This allows the user, after entering login data recognized as valid, to access predetermined network areas and / or network devices connected to them. After access to predetermined network areas and / or network devices connected to them has been granted, the user is then typically routed through a user firewall based on an individual set of rules.

[0020] For example, let's assume that the previously necessary access to the login area, particularly the login functionality, or the login input device required for users to enter login credentials, of such a router is possible 24 hours a day, seven days a week. Both service staff and administrators can therefore, in principle, log in at any time with valid credentials, especially their usernames and individual passwords, to access the network behind the router from outside the network. This means, in particular, accessing the second network from one network via the router located at the outer boundary of a second network. Such a router can also separate individual network segments from one another, down to the smallest network cells.

[0021] However, this can pose an unnecessary risk, for example, during the operation of a plant. Consequently, it may be desirable that, for example, in the case of an operational plant or a specific machine within it, external access to the relevant network—that is, the network pertaining specifically to the plant or the specific machine—should not be possible.

[0022] Consequently, there are situations where external access to a network should not be possible, even if a potential user is appropriately qualified and / or is the only authorized user and knows the appropriate login data, such as password and username.

[0023] Fig. 5For such constellations, a preferred embodiment of an access control method according to the invention is outlined in a highly simplified representation. For example, according to the left-hand illustration, the following must be considered: Fig. 5 For access to predefined network areas and / or network devices connected to them, protected by login credentials, login credentials must first be entered and recognized as valid. These credentials are entered as shown on the left. Fig. 5 For example, a login menu accessible via a desktop or browser (10), where, in the example shown, a username and password must be entered into a corresponding input field and then the button labeled "Login" must be pressed, after which a check for valid login data is initiated for access control purposes. In a scenario like the one shown on the left... Fig. 5Once the activated state is visible, the login data can be entered, and consequently, the entry of login data is enabled.

[0024] With the correct representation of the Fig. 5 In contrast, a deactivated state is outlined. In such a state, no login credentials can be entered, and consequently, entering login credentials is blocked. For example, if the login credentials are disabled according to... Fig. 5 If a login menu 10 is provided that can be accessed via a desktop or browser, blocking can preferably be done simply by preventing a visual display of the login menu 10, as shown in the right-hand illustration of the Fig. 5 sketched.

[0025] Enabling and / or disabling the input or the input option for login credentials is conveniently accomplished via an activation / deactivation device, as explained in more detail below. This allows for temporary selection, meaning that, depending on requirements, the input of login credentials can be temporarily enabled and / or temporarily disabled, particularly by simply switching between the two states, as indicated by the double arrow marked with reference numeral 15. Control over access to predetermined network areas and / or network devices connected to them is thus ensured at all times.

[0026] The Figures 1 and 2 Figure 20a shows, in a highly schematic representation, partial views of routers with a respective preferred embodiment, particularly one implemented in hardware, of an activation / deactivation device according to the invention. Sketched on each router are 20a ( Fig. 1 ) and 20b ( Fig. 2) existing connection blocks 21 and 23. Connection blocks 21 and 23 each comprise a number, in particular a plurality, of input connections, and usually also a number, in particular a plurality, of output connections. Such input and output connections generally provide digital signal connections and are known to those skilled in the art. The router 20a or 20b is each connected between two networks, as in the Figs. 1 and 2 The double arrows labeled N1 and N2 indicate this. For example, router 20a or 20b separates a specific network cell N1 from another network area N2. Network cell N1 could, for example, correspond to a specific production cell within a plant network, at whose outer boundary router 20a or 20b is located to control access from outside network cell N1, specifically from network or network area N2.

[0027] The first, in Fig. 1The outlined embodiments provide for an activation / deactivation device according to the invention, which interacts with the registration functionality, on the router such that two predetermined terminals must be connected to each other and directly electrically by means of a contact bridge 22 in order to activate a registration data input device required for the input of registration data by the user, but which is not shown in the figure for the sake of clarity.

[0028] As from the previous description of the Fig. 5As can be seen, such a login data entry device can, for example, take the form of a login menu set up by the router as part of its login functionality, accessible via a desktop or browser. If the contact bridge is removed, and thus there is no direct electrical connection between the two predetermined terminals, the login data entry device is deactivated. Consequently, the login data entry device can be switched from an activated state to a deactivated state and vice versa at any time as needed.

[0029] The second, in Fig. 2 The outlined embodiments differ from the embodiment shown. Fig. 1A hardware solution is presented in which a switch or button 24 is provided on the router, by means of which the login data input device, which interacts with the login functionality but is not shown in the figure for the sake of clarity, can be temporarily activated and / or deactivated. The switch or button 24 can preferably be designed as a key switch, i.e., as an electrical switch that is combined with a lock for security reasons, so that the switching operation can only be carried out by authorized persons using the appropriate key. The switch or button 24 can, for example, connect a predetermined terminal, in particular with a digital input, to the necessary voltage potential, e.g., 24V, for entering the login data. To block the possibility of entering login data, i.e., if external access to the network delimited by the router is prevented, e.g.,If it is not possible or permitted to connect from network N2 to network N1, the connection to the necessary voltage potential can be temporarily interrupted by means of the switch or button 24.

[0030] If, for example, a service employee wants to access network N1 from network N2, e.g., the network of a production cell, to reconfigure a PLC (Programmable Logic Controller), they must first know the necessary login credentials, such as their username and a corresponding password, to pass through router 20a or 20b, which is located between networks N1 and N2 and is specifically designed to protect N2. Router 20a or 20b is therefore preferably a so-called security router with a user firewall. With the router according to the invention, security can be increased to the point that login and the associated authentication of an authorized user is only possible if the activation / deactivation device provided on the router is also activated, i.e., if a predetermined digital input on the router is set accordingly.via a local key switch. If the activation / deactivation device is in a deactivated state, logging into the router is not possible. For example, the activation / deactivation device may be configured to prevent the visual display of a login menu as described above. Furthermore, it may be specifically designed that an employee on-site must first activate the activation / deactivation device, i.e., turn the key switch to the activating position, thus enabling the entry of login data. The service technician must therefore first consult with the employee on-site and obtain this "mechanical authorization."

[0031] This offers the particular advantage that an external user can only act in consultation with the operator of the network to which the external user wishes to access (four-eyes principle). The network operator thus retains control over their network, which is protected from the outside by the router according to the invention.

[0032] In a variation of the embodiments according to Figs. 1 and 2 In further preferred embodiments within the scope of the invention, the activation / deactivation device can also be fully or partially designed in software, e.g. as a software-based HMI button or have one.

[0033] At the in Fig. 3In the outlined embodiments, for example, a further advantageous modification provides that an activation / deactivation device of the router 20c provided within the scope of the invention comprises a control component 25a connected to it, in particular via a network connection of the network N1, as well as a software switch, so that the software switch can be triggered by means of the connected control component via a control signal according to a desired activated or deactivated state, i.e. to enable or disable the possibility of entering login data.

[0034] Alternatively, for example, according to a method similar to that used in... Fig. 4The outlined embodiments may also include a control component 25b connected to predetermined ports of a router 20d via separate or individual signal lines 26, in particular to temporarily activate and / or deactivate the login data input device required for the user to enter login data by means of appropriate control signals.

[0035] It should be noted that the application data input device used in the invention is not limited to devices that allow manual entry of application data. Alternatively, devices that enable automatic or automated entry of application data and / or where the input of application data can be detected by appropriate sensors, such as fingerprint sensors, can also be used as application data input devices in the invention.

[0036] Furthermore, regardless of the specific design of the activation / deactivation device and / or the login functionality, the activation / deactivation device, in conjunction with the login functionality, is expediently configured in such a way that the activation and deactivation of the login data input device is possible independently of any activated or deactivated communication connection, such as a VPN connection.

[0037] Taking into account the above description, the solution according to the invention can therefore be used in particular also in applications where a VPN tunnel is not used, e.g. in communication from a production network area to a single production cell, and / or in applications where a VPN tunnel to a specific network or network area must be permanently established, but access through the VPN tunnel should only take place in consultation with the operator of this specific network or network area.

Claims

1. Router (20a, 20b, 20c, 20d) which is connected between at least two communication, system and / or computer networks (N1. N2) and is equipped with login functionality and configured for logging in a user in order to grant the user access to predetermined network zones and / or network devices connected thereto after inputting login data recognized as permissible, characterised in that an activation / deactivation device interacting with the login functionality is provided on the router for temporarily activating and / or deactivating a login data input device required for inputting login data by the user.

2. Router (20a, 20b, 20c, 20d) according to claim 1, further characterised in that a login menu (10) which can be called up via a desktop or browser is configured as a login data input device as part of the login functionality.

3. Router (20a, 20b, 20c, 20d) according to claim 2, further characterised in that the activation / deactivation device is designed to prevent a visual display of the login menu (10) for temporary deactivation.

4. Router (20a, 20b, 20c, 20d) according to one of the preceding claims, further characterised in that the login functionality is configured for automated input of the login data and / or for reading in the login data using scanning or sensor devices when the login data input device is temporarily activated.

5. Router (20a, 20b, 20c, 20d) according to one of the preceding claims, further characterised in that the activation / deactivation device is implemented in hardware and / or software.

6. Router (20a, 20b, 20c, 20d) according to claim 4, further characterised in that the activation / deactivation device has a key switch (24) or an HMI button.

7. Router (20a. 20b, 20c. 20d) according to one of claims 1 to 6, further characterised in that the activation / deactivation device is configured to temporarily interrupt a voltage potential necessary for inputting the login data.

8. Router (20a, 20b, 20c, 20d) according to any one of claims 1 to 7, further characterised in that the activation / deactivation device is configured in cooperation with the login functionality to effect activation and also deactivation of the login data input device, independently of any activated or deactivated communication connection, such as VPN connection.

9. Access control method, in particular for a router (20a, 20b, 20c, 20d) according to one of the preceding claims, for an access functionality protected by login data to predetermined network zones and / or network devices connected thereto, wherein login data must be inputted and recognised as permissible login data in order to use the access possibility, characterised in that, in order to control the access, the input of login data can be temporarily enabled and / or blocked by means of an activation / deactivation device (15).

10. Access control method according to claim 9, further characterised in that the login data is inputted via a login menu (10) which can be called up via a desktop or browser and is blocked by suppressing a visual display of the login menu (10).

11. Access control method according to claim 9 or 10, further characterised in that the access functionality is configured to support an automated login procedure for inputting login data for granting access to predetermined network zones and / or network devices connected thereto and / or to support the reading in of login data using scanning or sensor devices.