SAFETY SYSTEM OF A DEVICE

Description

Technical field

[0001] The present invention relates to a security or securing system.

[0002] It falls within the field of automation applications, particularly for industrial automation, building automation or control and / or command systems for an energy distribution network. Prior art

[0003] It is known to use programmable logic controllers for the management of domestic or industrial processes, for example for the management of an electricity network.

[0004] In order to ensure the security of these processes against any risk of data theft or attempted malicious intrusion, the PLCs generally include one or more security systems to ensure the control and integrity of the stored data as well as the reliability of the PLC communications.

[0005] These security systems can, for example, take the form of software (anti-malware tool, firewall, vulnerability search, etc.) or physical access restrictions (keys, encrypted passwords, etc.).

[0006] For example, in order to control direct local access to certain PLC modules, these include a security system in the form of a human-machine interface, requiring an operator to enter a password on a keyboard if they wish to access the PLC.

[0007] However, such systems are not entirely satisfactory.

[0008] Indeed, it is necessary to provide a human-machine interface for each PLC module. In addition to the fact that a human-machine interface is expensive, takes a long time to implement on each module and is a high energy consumer, it can be vulnerable if the password has been disclosed or stolen.

[0009] Furthermore, although some operating situations require a high safety state of the PLCs, a lower safety state may also be sufficient in other operating situations, thus not requiring relatively complex safety systems.

[0010] Prior art document WO2018038536 discloses a method that includes granting a user who is using a terminal in lock mode and unlock mode a first and a second authority that allows the user to control the first and second sets of elements, respectively. The second set includes more elements than the first set. The first result is obtained by controlling the element of the first set in lock mode. The lock mode is switched to unlock mode while erasing a portion of the first results after obtaining the first result, preventing the first results from affecting the elements of the second set when the user is using the terminal in unlock mode. Summary

[0011] The invention improves the situation.

[0012] The invention aims more particularly to provide an effective security system for a device, such as an automaton, for particularly simple and flexible use, making it possible in particular to vary the security state in a simple and secure manner according to operating requirements.

[0013] A security system mounted on a device is proposed, the security system comprising a control element operable by at least one operator: in the first position, in which the device is configured to be in a high security state, and in the second position, in which the device is configured to be in a low security state.

[0014] Thanks to these provisions, the actuation of a control element at the device level makes it possible to determine the expected security state. This implements both physical access control means and particularly simple and effective software means to ensure the security of the device.

[0015] In particular, a remote connection to the device does not allow its security status to be modified, as direct access and activation of the security system is required.

[0016] According to another aspect, a device comprising such a security system is provided.

[0017] According to another aspect, there is provided a method of operating such a security system, comprising the following steps: if the control element is in the first position: check whether security has already been configured on the device, and if not, download device-specific configuration data and configure security on the device before use.

[0018] According to another aspect, there is provided a computer program comprising instructions for implementing all or part of a method as defined herein when this program is executed by a processor.

[0019] According to another aspect, there is provided a non-transitory, computer-readable recording medium on which such a program is recorded.

[0020] By "computer" we mean any programmable information processing medium, for example a processor included in a desktop computer, tablet, mobile phone or other.

[0021] The features set out in the following paragraphs may optionally be implemented. They may be implemented independently of each other or in combination with each other:

[0022] The high security state includes a configuration of software protection features.

[0023] The control element can be operated manually by an operator.

[0024] The control element includes a slot for pivoting a selector between at least the first position and the second position.

[0025] The control element is operable by an operator by means of wireless communication with the device carried out at short range.

[0026] The control element is also operable in a third position, in which the device is in a reset state.

[0027] The device is a programmable logic controller or a programmable logic controller module.

[0028] The device comprises a front face and a rear face, the securing system being mounted on the rear face, the rear face being configured to be arranged in contact with a support.

[0029] The process includes the following steps: if the control element is in the third position: operate the control element in the first or second position.

[0030] Actuation of the control element between the first position and the second position requires an intermediate passage into the third position. Brief description of the drawings

[0031] Other features, details and advantages will become apparent upon reading the detailed description below, and upon analyzing the attached drawings, in which: Fig. 1 [ Fig. 1] shows a perspective view of the rear face of a device comprising a security system according to one embodiment. Fig. 2 [ Fig. 2 ] shows a perspective view of the front face of the device of the [ Fig. 1 ] fixed on a support with other devices. Fig. 3 [ Fig. 3 ] shows a schematic view of the device of the [ Fig. 1 ]. Fig. 4 [ Fig. 4 ] shows a partial enlarged view of the rear face of the device of the [ Fig. 1 ]. Fig. 5 [ Fig. 5 ] shows a diagram illustrating the method of operation of the security system according to one embodiment. Description of the embodiments

[0032] The drawings and description below contain, for the most part, elements of a certain character. They may therefore not only serve to better understand this disclosure, but also contribute to its definition, if necessary.

[0033] Reference is made to the [ Fig. 1 ], which represents a device 1 comprising a security system according to the invention. The security system is more particularly a computer protection device, also called a cybersecurity system.

[0034] According to one embodiment, the device 1 is implemented in a programmable logic controller (PLC). Such a controller is configured to control a domestic or industrial process, in particular by sequential processing of information. More particularly, the controller makes it possible to transmit a command to one or more other controllers or actuators from input data, such as sensor measurements, setpoints or others.

[0035] For example, the PLC allows the control of machines and sensors in a factory or building, or the piloting of an energy management system.

[0036] Advantageously, the device 1 according to the invention relates to a secure automaton.

[0037] According to one embodiment, the device 1 is a module, such as a communication module, of the PLC. More generally, the device 1 can be any module or industrial equipment allowing remote security configuration.

[0038] As illustrated in the [ Fig. 2 ], the device 1 can be configured to be mounted on a support, for example a rail 2. The support 2 generally comprises other devices 3, 4, 5 arranged in a modular manner relative to each other. The device 1 can thus be stored in an electrical cabinet (not shown).

[0039] Device 1 generally has a parallelepiped shape. However, other shapes are also possible.

[0040] The device 1 thus comprises a front face 1a, visible on the [ Fig. 2 ], accessible to an operator.

[0041] The device 1 also includes a rear face 1b, visible on the [ Fig. 1 ], likely to come into contact with, in particular in contact with, the support 2. Once the device 1 is fixed on the support 2, the rear face 1b is no longer directly accessible to the operator. It is necessary to remove the device 1 from the support 2 in order to be able to access the rear face 1b.

[0042] As illustrated in the [ Fig. 2 ] and the [ Fig. 3 ], the device 1 comprises input 10 / output 11 interfaces configured to receive and send information from / to the device 1 for process management.

[0043] The device 1 also comprises a processor 12 (in English “Central Processing Unit”, CPU) configured to process instructions which constitute the computer program for operating the device 1.

[0044] The device 1 also comprises a memory 13 configured to store the instructions constituting the operating computer program as well as various information.

[0045] The device 1 also comprises a communication interface 14, wired or wireless, in particular to a remote server configured to store the data of the device 1.

[0046] Finally, the device 1 may comprise a power source, such as a battery (not shown), or be connected directly to an electricity network.

[0047] According to the invention, the device 1 further comprises at least one security system. The security system comprises a control element 20 mounted on the device 1.

[0048] As illustrated in the [ Fig. 1 ], the control element 20 is advantageously mounted on the rear face 1b of the device 1.

[0049] The control element 20 can be operated by an operator.

[0050] According to one embodiment, the control element 20 can be manually actuated by the operator.

[0051] For this purpose, the control element 20 may comprise a slot allowing the use of a flat screwdriver type element to pivot a selector 21. However, other types of manual actuation are possible, by means of a key, a crank or any other tool known per se, specific or not. In addition, other types of control element 20 are possible, such as a pivoting button or others.

[0052] According to another embodiment, the control element 20 can be actuated without contact by the operator. The actuation is advantageously carried out at short range.

[0053] By "short range" is meant in particular actuation by wireless communication with the device 1 carried out for example at a distance of less than 1 meter, or even advantageously at a distance of less than 10 centimeters. Such short-range communication may for example use near field communication (NFC) technology.

[0054] Such short-range communication is advantageously secure in terms of authentication, integrity, and confidentiality of information.

[0055] Thus, the control element 20 is operable between at least a first position and a second position.

[0056] In the first position (illustrated by position A on the [ Fig. 4]), the device 1 is in a high security state. More particularly, the device 1 requires a prior security configuration in order to be used. Such a configuration makes it possible to implement protection functions, in particular software functions, known per se such as data encryption, a firewall, access control, protection diagnostics, updates, or others.

[0057] For example, Device 1 cannot establish communication until the security state configuration is completed. Once in the security state, communications are authenticated and secured.

[0058] In the second position (illustrated by position B on the [ Fig. 4 ]), Device 1 is in a low security state.

[0059] By "high / low security states" is meant that the security states are understood relatively to each other. Thus, the low security security state may correspond to a standard state, in which the device 1 does not require a security configuration, or includes relatively less important protection functions than those provided in the high security state.

[0060] According to one embodiment, the control element 20 can furthermore be actuated in one or more other positions corresponding to other safety states of the device 1, not described below.

[0061] According to the embodiment illustrated in the [ Fig. 4 ], the control element 20 can also be actuated in a third position.

[0062] In the third position (illustrated by position C on the [ Fig. 4]), the device 1 is in a reset state. More particularly, the device 1 is returned to its initial state, in particular to its factory state. The safety configuration as well as some or all of the protection functions possibly implemented by the device 1 are deleted, in particular erased from the memory 13 of the device 1.

[0063] The device 1 advantageously comprises a dedicated output allowing the operator to know the safety status of the device 1, for example via a signal tower or light column mounted on the electrical cabinet comprising the device 1 or via a software application intended for the operator.

[0064] The device 1 may also include an indicator allowing an operator to know in particular the security status of the device 1. The indicator is arranged on the front face 1a of the device 1 as illustrated in the [ Fig. 1 ].

[0065] According to one embodiment, the indicator comprises one or more indicator lights 15 making it possible to display the security, diagnostic and / or operating status of the device 1. The display of the indicator light(s) 15 can in particular be compared by the operator with the position of the security system in order to ensure the integrity of the device 1.

[0066] A method of operation, and more particularly of installation, of the security system of the device 1 is described below, in connection with the [ Fig. 5 ].

[0067] Initially, the control element 20 is in one of the first, second or third positions A, B, C, respectively corresponding to the device 1 in the high security state, the low security state or the reset state.

[0068] If the control element 20 is initially in the first position, one step of the method consists of checking whether a security has already been configured on the device 1.

[0069] If the configuration has already been completed, device 1 can be used.

[0070] In the case of security not yet configured on the device 1, the method comprises one or more additional configuration steps. During these configuration steps, CS_conf security data can be downloaded by the device 1, in particular by means of the communication interface 14. The download is done for example via Ethernet or USB communication from a specific configuration application stored in a remote server or in an internal web server.

[0071] Alternatively, the security data CS_conf may already be stored in the memory 13 of the device 1.

[0072] The security is configured by means of a computer program advantageously already present in the device 1. Once the configuration has been carried out, the security is implemented and the device 1 can be used.

[0073] If the control element 20 is initially in the second position, the device 1 can be used without requiring any particular security configuration of the device 1.

[0074] If the control element 20 is initially in the third position, the control element 20 must be actuated to one of the other positions before any use so that the device 1 is in the high or low safety state. The method steps described above can then be implemented subsequently.

[0075] When in use, the device 1 is fixed to the support 2. The rear face 1b of the device 1 is then no longer directly accessible to the operator.

[0076] Furthermore, the actuation of the control element 20 is advantageously deactivated when the device 1 is used, in particular connected to the power source.

[0077] This prevents the control element 20 from being easily actuated to change the safety state of the device 1 after it has been switched on.

[0078] Thus, if one wishes to move from the high security state to the low security state, or vice versa, it is necessary to first disconnect the device 1 from the power source and / or to separate the device 1 from the support 2 so that the rear face 1b of the device 1 is accessible again.

[0079] In the event of unauthorized actuation of the control element 20, the safety system may include an alarm (not shown), for example visual or audible, making it possible to warn the operator.

[0080] According to one embodiment, to move from a high security state to a low security state, or vice versa, it is first necessary to actuate the control element 20 in the third position.

[0081] Thus, the security configuration is necessarily deleted before Device 1 can transition to the other security state. This ensures that no information about Device 1's configuration can be retained in the weak security state, which is potentially more vulnerable to cyberattacks.

[0082] Obviously, the invention is not limited to the embodiments described above and provided solely by way of example. It encompasses various modifications, alternative forms and other variants that may be envisaged by those skilled in the art within the framework of the present invention and in particular all combinations of the different operating modes described above, which may be taken separately or in association.

Claims

1. Security system fitted in a device (1) forming part of a programmable logic controller and comprising a front face (1a) and a back face (1b), the security system being fitted in the back face (1b), the back face (1b) being configured to be placed in contact with a holder (2) when the device is being used, the security system comprising a command element (20) that is actuatable by an operator at least: - to a first position, in which the device (1) is configured to be in a high-security state, and - to a second position, in which the device (1) is configured to be in a low-security state, wherein the back face (1b) of the device (1) is not directly accessible to the operator when the back face (1b) is in contact with the holder (2).

2. Security system according to Claim 1, wherein the high-security state comprises a configuration of software protection functions of the device (1).

3. Security system according to Claim 1 or 2, wherein the command element (20) is actuatable by an operator manually.

4. Security system according to Claim 3, wherein the command element (20) comprises a slot allowing a selector (21) to be pivoted between at least the first position and the second position.

5. Security system according to Claim 1 or 2, wherein the command element (20) is actuatable by an operator by means of a short-range wireless communication with the device (1).

6. Security system according to any one of the preceding claims, wherein the command element (20) is also actuatable to a third position, in which the device (1) is in a reset state.

7. Device (1) comprising the security system according to any one of the preceding claims.

8. Method for operating the security system according to any one of Claims 1 to 6, comprising the following steps: - if the command element (20) is in the first position: - verifying whether the security of the device (1) has already been configured, and - if not, downloading configuration data specific to the device (1) and configuring the high-security state of the device (1) before use thereof.

9. Method according to Claim 8 for operating the security system according to Claim 6, comprising the following steps: - if the command element (20) is in the third position: - actuating the command element (20) to the first position or the second position.

10. Method according to Claim 9, wherein the actuation of the command element (20) between the first position and the second position requires intermediate passage to the third position.

11. Computer program containing instructions for implementing the method according to one of Claims 8 to 10 when this program is executed by a computer.

12. Computer-readable non-volatile storage medium on which is stored a program for implementing the method according to one of Claims 8 to 10 when this program is executed by a computer.