Authentication server, authentication system, and authentication method

Abstract

To provide an authentication server for offering network authentication even to a device not having an authentication protocol.SOLUTION: An authentication server 40 capable of accessing data of a memory 21m in a PLC 21 detects input information for authentication, which is written in the memory 21m, so as to read it, and collates the input information for authentication with information on an account registered in a user DB 51 so as to generate an authentication result for the input information for authentication. The authentication result for the input information for authentication is written in the memory 21m in the PLC 21, so that the PLC 21 is notified of the approval or disapproval of control processing based on the authentication result.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an authentication server, an authentication system, and an authentication method. [Background technology]

[0002] In pharmaceutical manufacturing, GMP (Good Manufacturing Practice) standards and other regulations require the storage of manufacturing records. Records are increasingly being stored on paper, moving away from traditional methods and toward electronic data. Electronic data makes it easy to copy and tamper with, so it is necessary to store the original data and record information on operations and handling to guarantee the authenticity of the stored data.

[0003] Regarding the handling of electronic data for pharmaceutical manufacturing records, international guidelines such as "CFR21 PART11" by the U.S. Food and Drug Administration (FDA) and "Annex11" by PIC / S (Pharmaceutical Inspection Convention and Pharmaceutical Inspection Co-operation Scheme) have been established. Pharmaceutical manufacturers in each country are obligated to manage electronic data of pharmaceutical manufacturing records in a way that satisfies these requirements. These guidelines state that when handling electronic data of pharmaceutical manufacturing records, the information to be recorded must include "when," "who," "what," "how," and "the reason."

[0004] As described above, in order to record the identity of the user operating the device, a mechanism for authenticating a user who logs in to the device in advance is widely used. For example, Patent Document 1 describes a mechanism in which an authentication server that has received the ID and password input to an authentication switch queries an external directory server, which is an LDAP (Lightweight Directory Access Protocol) server, about the authentication result. In this way, by using network authentication, it becomes unnecessary to give the function of determining authentication to the device itself that logs in.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] The authentication switch of Patent Document 1 has a function of issuing an authentication request to an authentication server based on the ID and password input by the user. For a device such as this authentication switch that has the performance to the extent that it can perform authentication protocol processing by itself, network authentication is performed smoothly.

[0007] On the other hand, in a manufacturing site such as for pharmaceuticals, there are a PLC (Programmable Logic Controller), which is a control device operated by a user to control manufacturing equipment, and a terminal for inputting operation commands to the PLC. Each device in these manufacturing sites often has the unique specifications of the manufacturer that provides the PLC, and often does not implement a standard authentication protocol. Therefore, it is difficult to directly obtain data that requires authentication, such as who the person is who inputs an operation command to the terminal and whether the input operation command may be permitted.

[0008] Alternatively, consider implementing local authentication that has a function to determine the authentication success or failure of the input ID and password inside the PLC without performing network authentication. In this local authentication, although it is not necessary to implement an authentication protocol, in addition to the device cost of the PLC with enhanced functionality, it is necessary to prepare local authentication setting data individually for each PLC, resulting in increased management costs.

[0009] The present invention has been made in consideration of such circumstances, and the main problem is to provide network authentication for devices that do not implement an authentication protocol.

Means for Solving the Problems

[0010] To solve the above problems, the authentication server of the present invention has the following features. The present invention is an authentication server capable of accessing data in the memory within a control device, detects and reads the authentication input information written in the memory, generates an authentication result for the authentication input information by comparing the authentication input information with the account information registered in the user DB, and notifies the control device of the availability of control processing based on the authentication result by writing the authentication result for the authentication input information into the memory within the control device. Other features will be described later.

Effects of the Invention

[0011] According to the present invention, network authentication can be provided for devices that do not implement an authentication protocol.

Brief Description of the Drawings

[0012] [Figure 1] It is a configuration diagram of an authentication system according to this embodiment. [Figure 2] It is a hardware configuration diagram of each device of the authentication system according to this embodiment. [Figure 3] FIG. 2 is a sequence diagram showing the processing of the authentication system according to the present embodiment. [Figure 4] FIG. 10 is a diagram showing a login screen according to the present embodiment. [Figure 5] FIG. 2 is an explanatory diagram showing data contents of a memory according to the present embodiment. [Figure 6] FIG. 2 is an explanatory diagram showing details of each database used in the authentication system according to the present embodiment. [Figure 7] FIG. 2 is a diagram showing a control screen of a PLC according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0014] FIG. 1 is a diagram showing the configuration of an authentication system 100. The authentication system 100 is configured by connecting a PLC 21, a terminal 11, an authentication server 40, and a directory server 50 via a network. First, the device control function provided by the authentication system 100 will be described. The PLCs 21-23 are control devices that are connected to manufacturing equipment and issue control commands to the manufacturing equipment. The PLCs 21-23 may be devices that do not support authentication protocols such as LDAP, or may support authentication protocols. The terminals 11-13 are associated with the PLC 21 and are used to operate the PLC 21.

[0015] PLC 21 and terminal 11 are directly connected to each other, for example, by being placed on the same workbench 31. Similarly, PLC 22 and terminal 12 are placed on the same workbench 32, and PLC 23 and terminal 13 are placed on the same workbench 33. In other words, PLC 21 is the only PLC that terminal 11 can operate, and it cannot access the other PLCs 22 and 23. In this way, means for realizing a direct connection between PLC 21 and terminal 11 are as follows, for example. · The PLC 21 and the terminal 11 are configured as a single device housed in the same casing. In this case, for example, the function of the terminal 11 is realized as a touch panel attached to the PLC 21. · The PLC 21 and the terminal 11 are connected by a wired communication line such as a USB cable, and the PLC 21 is configured not to be connected to the other terminals 12 and 13 by a wired communication line (for example, having one USB port). · Data communication is enabled by connecting the PLC 21 and the terminal 11 with a wireless protocol of the PLC 21's own standard. Note that the wireless protocol of the PLC 21's own standard is not implemented in the terminals 12 and 13. · The workbenches 31 - 33 are physically separated from each other at an interval of 10 m, etc., and the PLCs 22 and 23 that are physically far from the terminal 11 are configured not to be operable.

[0016] Next, the authentication function provided by the authentication system 100 will be described. Here, "authentication" of the authentication function is a process of determining which user is to be granted the use permission of which PLCs 21 - 23. For example, a total of three authentications are required to perform the following three operations. · User U1 performs a first operation via the PLC 21. For this purpose, user U1 generates an authentication request by writing his / her own ID and PW to the memory 21m in the PLC 21 via the terminal 11. · User U1 performs a second operation via the PLC 22. For this purpose, user U1 generates an authentication request by writing his / her own ID and PW to the memory 21m in the PLC 22 via the terminal 12. · User U2 performs a third operation via the PLC 22. For this purpose, user U2 generates an authentication request by writing his / her own ID and PW to the memory 21m in the PLC 22 via the terminal 12.

[0017] The authentication server 40 monitors access to the memory 21m (details in FIG. 4) in the PLC 21. When it detects a combination of user ID and password (ID, PW) written to the memory 21m, it creates an authentication request based on that combination and sends the authentication request to the directory server 50. Note that the directory server 50 is configured as an external authentication authority for the authentication server 40 such as an LDAP server. Also, the functions of the authentication server 40 and the functions of the directory server 50 may be configured as a single device housed in the same enclosure. In that case, the authentication server 40 capable of accessing the data in the memory 21m in the PLC 21 has the following functions. · A function to detect and read the authentication input information written to the memory 21m by monitoring. · A function to generate an authentication result for the authentication input information by comparing the authentication input information with the account information registered in the user DB 51. · A function to notify the PLC 21 of the availability of control processing based on the authentication result by writing the authentication result for the authentication input information to the memory 21m in the PLC 21.

[0018] The directory server 50 collates the received authentication request with the user DB 51 (details in FIG. 5) where combinations of user ID and password (ID, PW) etc. are managed, permits the authentication request including the combination (ID, PW) registered in the user DB 51, and rejects the authentication request not including the combination (ID, PW). The directory server 50 responds to the authentication server 40 to write out information indicating the authentication result (authentication permission or authentication rejection) (hereinafter referred to as "Result") to the memory 21m in the PLC 21 that is the source of the authentication request. Thereby, the PLC 21 can determine whether to accept or reject the control commands issued from the terminal 11 in the future by referring to the Result in its own memory 21m.

[0019] FIG. 2 is a hardware configuration diagram of each device (terminal 11, PLC 21, authentication server 40, directory server 50) of the authentication system 100. Each device of the authentication system 100 is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 executes a program (also called an application or an app for short) loaded into the RAM 902 to improve and control each processing unit. This program can be distributed via a communication line or recorded on a recording medium 917 such as a CD-ROM and distributed.

[0020] FIG. 3 is a sequence diagram showing the processing of the authentication system 100. As shown in FIG. In step S11, the terminal 11 receives input of a combination of a user ID and a password (ID, PW) from the user as authentication input information. Note that instead of using (ID, PW) as authentication input information, any personal identification information may be used, such as biometric authentication input information such as a fingerprint or tag information read from an employee ID card carried by the user.

[0021] FIG. 4 is a diagram showing the login screen of S11. On the login screen 210 displayed on the terminal 11 , the user inputs his / her own user ID in the ID field 211 , inputs his / her own password in the PW field 212 , and then presses the OK button 213 .

[0022] Returning to FIG. 3, in S12, the terminal 11 transmits the authentication input information (ID, PW) input in S11 to the PLC 21. In step S13, the PLC 21 stores the (ID, PW) transmitted in step S12 in its own memory 21m.

[0023] FIG. 5 is an explanatory diagram showing the data contents of the memory 21m. The memory area 101 within the memory 21m stores the (ID, PW) saved in S13 and the authentication result (Result) for the user who input the (ID, PW). Note that the terminal 11 and the authentication server 40 preset the storage information regarding which address in which memory area 101 within the memory 21m each item (ID, PW, Result) is to be stored. Thereby, the terminal 11 and the authentication server 40 may directly specify an address in the memory area 101 within the memory 21m to read and write each item (ID, PW, Result) (using means at the RAW level). And the authentication server 40 accesses the data within the memory 21m via an inter - connectable international standard protocol such as a PLC manufacturer - specific protocol or OPC (OLE for Process Control).

[0024] The memory area 101 stores the content saved at the time of S13. At this time, the (ID, PW) input in S11 is recorded, but Result is blank, indicating that authentication is in progress. The memory area 102 is the first example of the saved content at the time of S24 described later, and Result indicating that the input (ID, PW) has been authenticated is added. The memory area 103 is the second example of the saved content at the time of S24 described later, and Result indicating that the input (ID, PW) has been rejected for authentication is added.

[0025] Regarding the information written to the memory areas 101 - 103 within the memory 21m, an encryption method that has been shared in advance between the PLC21 and the authentication server 40 may be used. · The PLC21 writes encrypted information regarding the information to be written to the memory 21m. · The authentication server 40 decrypts the information read from the memory 21m. Thereby, direct data attacks (such as illegal data writing and peeping) into the memory 21m by a third party can be prevented.

[0026] Returning to FIG. 3, in S14, the authentication server 40 directly monitors the memory 21m of the PLC 21 for access, and when a new (ID, PW) is written, it reads the (ID, PW). In S15, the authentication server 40 generates an authentication request including the read (ID, PW) and transmits the authentication request to the directory server 50. The authentication request may include the ID of the PLC 21 (PLC-ID). In S21, the directory server 50 performs authentication processing for the authentication request of S15. That is, the directory server 50 collates each account registered in the user DB 51 with the authentication request received in S14, and thereby permits authentication requests including accounts registered in the user DB 51 and rejects authentication requests for unregistered accounts.

[0027] In S22, the directory server 50 returns to the authentication server 40 a response message in which the authentication result (Result) of S21 is associated with the (ID, PW) of the authentication request. If the authentication server 40 and the directory server 50 are in the same housing, the authentication server 40 generates an authentication result (Result) indicating authentication permission in the process of S22 if the ID of the PLC 21 that detected the authentication input information is registered in the user DB 51 in addition to the authentication input information. Therefore, the account information registered in the user DB 51 is registered in association with the ID of the PLC 21 in addition to the authentication input information. This makes it possible to support one user being granted different privileges for each of multiple PLCs (equipment).

[0028] FIG. 6 is an explanatory diagram showing details of each database used in the authentication system 100. The authentication server 40 manages the current authentication status in the authentication status DB 41. The authentication status DB 41 stores authentication request information (ID, PW, PLC-ID), the current authentication status, and result information (operation authority, display name) in association with each other. The current authentication status indicates either "Authentication in progress" before the result is issued, which is written at S15, or "Authentication permitted" or "Authentication rejected," which indicates the issued result of authentication success or failure, which is written at S22. The operation authority indicates the range of authority of the PLC 21 permitted when authentication is permitted, as the job title (administrator or general) of "operation authority" in the authority table 21T. The authority table 21T associates each function in the PLC with the operation authority that permits that function. The display name is the display name that is displayed on the screen when an authenticated and permitted user operates the terminal 11. Although only the current authentication status is recorded in the authentication status DB 41 in this way, the authentication server 40 may also store the history of past authentication status DB 41 in chronological order. This is useful for tracing the cause of a problem, such as who was using which PLC and when.

[0029] Furthermore, the authentication server 40 may monitor the time that has elapsed during authentication (the time that has elapsed from S13 to S24), and if the elapsed time exceeds a predetermined time, may notify the terminal 11 of a timeout and a failure of the authentication process (not a rejection of the authentication). In other words, if the authentication server 40 does not receive a response to the authentication request that it sent to the directory server 50 within a predetermined time, it writes an authentication result indicating a failure of the authentication process into the memory 21m. Possible causes of this timeout include a device malfunction in the authentication server 40, a device malfunction in the directory server 50, or a network malfunction between the authentication server 40 and the directory server 50. When the authentication process of the network authentication fails, the terminal 11 may execute login and grant operation authority by local authentication via an emergency manager account prepared within the PLC 21. Local authentication is authentication that is completed within the PLC 21 without going through the authentication server 40 or the directory server 50.

[0030] In the user DB 51, as account information, information for collation with authentication requests (ID, PW, PLC-ID) and information to be included in the Result when the collation is successful (operation authority, display name) are prepared by an administrator or the like. By including the PLC-ID in the user DB 51, even for the same user U1, for the PLC 21 handling the favorite manufacturing equipment (for example, "culturing equipment", "purifying equipment", "reaction tank", etc. used in the pharmaceutical process), the administrator's operation authority is given, but for the PLC 22 handling logistics equipment outside the specialty, general operation authority is given, etc., and operation authorities according to an individual's specialty field can be individually assigned. Note that for each facility controlled via the PLCs 21 - 23, changing its set value has a great impact on the manufacturing quality. Therefore, by performing authority management in the user DB 51 so that operations having an impact on quality are permitted only to highly specialized users as operation authorities, both the management of manufacturing quality and the account management of users can be collectively performed in the user DB 51.

[0031] On the other hand, the following items may be omitted from the user DB 51. · By omitting the display name, the display name will not be displayed on the screen of the terminal 11, but it has no impact on the authentication process. · By omitting the operation authority, the unit permitted in authentication is replaced from "a certain function within the PLC 21" to "all functions within the PLC 21". · By omitting the PLC-ID, the unit permitted in authentication is replaced from "the specific PLC 21 that requested authentication among the PLCs 21 - 23" to "any PLC that requested authentication among the PLCs 21 - 23".

[0032] Returning to FIG. 3, as S23, the authentication server 40 notifies the PLC 21 to write the authentication result (Result) received in S22 corresponding to the authentication request (ID, PW) to the memory 21m in the PLC 21 that is the source of the authentication request. That is, when the authentication server 40 writes the authentication result to the memory 21m in the PLC 21, it also writes information indicating the operation authority together, thereby notifying the PLC 21 whether control processing can be performed within the scope of the operation authority based on the authentication result. Therefore, the account information registered in the user DB 51 is registered in association with the information indicating the operation authority among the functions provided by the PLC 21 in addition to the authentication input information.

[0033] As S24, the PLC 21 stores the authentication result (Result) of S23 in the memory 21m, such as in the memory area 102 of FIG. 5 (when the authentication is permitted "OK", the operation authority and the display name are also written out), or in the memory area 103 (when the authentication is rejected "NG"). As S25, the terminal 11 reads the authentication result (Result) for the login information (ID, PW) transmitted in S12 from the memory 21m in the PLC 21.

[0034] As S31, the terminal 11 displays the control screen of the PLC reflecting the authentication result (Result) of S25 and accepts the input of a control command from the user. If Result is an authentication rejection, a login failure screen is displayed and the system returns to the login screen for another user. When Result is an authentication permission, as S32, the PLC 21 executes the control command by transmitting the control command from the user received from the terminal 11 in S31 to equipment (not shown). Alternatively, instead of the terminal 11 reading the authentication result (Result) of S25, the PLC 21 may read it. In this case, as S32, the PLC 21 collates the control command from the user received from the terminal 11 with the authentication result (Result) of S25 and executes only the control commands within the scope of the "operation authority" in the authority table 21T.

[0035] Furthermore, the terminal 11 may also set a time limit (such as 15 minutes) for the operation reception time of S31, and if there is no operation within the time limit, delete the authentication result (Result) saved in S24 and execute forced logout. That is, after the authentication server 40 writes the authentication result into the memory 21m in the PLC 21, when it receives a notification from the PLC 21 indicating that it has been forced into a logged-out state because no operation input to the PLC 21 has been performed for a predetermined time, the authentication server 40 deletes the authentication result from the memory 21m in the PLC 21. Thereby, after the user U1 successfully authenticates the PLC 21, the operation of the PLC 21 by the user U2 who aims to take advantage of the absence of the user U1 can be appropriately prohibited.

[0036] Figure 7 is a control screen diagram of the PLC. The control screen 220 is a control screen for administrators with the operation authority, and the display name = UserLV2 is displayed. As in the operation authority for administrators in the authority table 21T of FIG. 6, each operation button is enabled so that all operation buttons (sensor value acquisition, belt conveyor control, robot arm control, tank temperature change) provided by the PLC 21 can be input. The control screen 230 is a control screen for general users with the operation authority, and the display name = UserLV1 is displayed. Since some operation buttons (robot arm control, tank temperature change) provided by the PLC 21 do not have the operation authority as in the operation authority for administrators in the authority table 21T, each operation button is disabled.

[0037] The authentication system 100 of the present embodiment described above includes the PLC 21, the authentication server 40, and the directory server 50, and has the following features. · The PLC 21 writes the input authentication input information into its own memory 21m. · The authentication server 40 detects and reads the authentication input information written in the memory 21m, and transmits an authentication request including the authentication input information to the directory server 50. · The directory server 50 generates an authentication result for the authentication input information by comparing the authentication input information included in the authentication request with the account information registered in the user DB 51, and returns it to the authentication server 40. · The authentication server 40 writes the authentication result for the authentication input information to the memory 21m. · The PLC 21 determines whether control processing based on the authentication result read from the memory 21m is possible.

[0038] According to this authentication system 100, the following effects can be obtained. · By having the authentication server 40 request external authentication to the user DB 51 of the directory server 50 on behalf of the PLC 21, the integrated management of users can be extended to the PLCs 21-23 that do not have an authentication protocol function such as LDAP. · Since it is not necessary to have local authentication inside the PLC 21, account management can be centralized in one place in the directory server 50. Therefore, even if the number of PLCs 21-23 increases, the maintenance man-hours for account management can be reduced. · Since it is not necessary to have an authentication protocol function inside the PLC 21, the network authentication function can be added to the authentication system 100 while still using the existing old-fashioned PLCs 21-23 as they are.

[0039] Furthermore, the present invention is not limited to the above-described embodiments, and it goes without saying that various other application examples and modification examples can be adopted without departing from the gist of the present invention described in the claims. For example, the above-described embodiments have described the configuration of the authentication system 100 in detail and specifically for easy understanding of the present invention, and are not necessarily limited to those having all the configured components described. Also, it is possible to replace a part of the configuration of one embodiment with the configured components of another embodiment. Also, it is possible to add the configured components of another embodiment to the configuration of one embodiment. Also, it is possible to add, replace, or delete other configured components for a part of the configuration of each embodiment.

[0040] Furthermore, the above-described configurations, functions, processing units, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. As the hardware, a broad processor device such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit) may be used. Furthermore, each component of the authentication system 100 according to the above-described embodiment may be implemented in any hardware as long as the respective hardware can transmit and receive information to and from each other via a network. Furthermore, the processing executed by a certain processing unit may be realized by a single piece of hardware, or may be realized by distributed processing using multiple pieces of hardware. [Explanation of symbols]

[0041] 11 Terminals 21 PLC (controller) 21m memory 31 Workbench 40 Authentication Server 41 Authentication Status DB 50 Directory Servers 51 User DB 100 Authentication System

Claims

1. An authentication server capable of accessing data in a memory within a control device, detecting and reading authentication input information written in the memory, generating an authentication result for the authentication input information by collating the authentication input information with account information registered in a user DB, and notifying the control device of the availability of control processing based on the authentication result by writing the authentication result for the authentication input information into the memory within the control device. Authentication server.

2. The account information registered in the user DB is registered in association with the ID of the control device in addition to the authentication input information, and the authentication server generates the authentication result indicating authentication permission when the ID of the control device that detected the authentication input information is registered in the user DB in addition to the authentication input information. The authentication server according to claim 1.

3. The account information registered in the user DB is registered in association with information indicating an operation authority among the functions provided by the control device in addition to the authentication input information, and when writing the authentication result into the memory within the control device, the authentication server also writes information indicating an operation authority, thereby notifying the control device of the availability of control processing within the scope of the operation authority based on the authentication result. The authentication server according to claim 1.

4. After writing the authentication result into the memory within the control device, the authentication server receives a notification from the control device indicating that the authentication server has been forced into a logged-out state because no operation input has been made to the control device for a predetermined time, and deletes the authentication result from the memory within the control device. The authentication server according to claim 1.

5. An authentication system having a control device, an authentication server, and a directory server, wherein the control device writes the input authentication input information into its own memory, and the authentication server detects and reads the authentication input information written in the memory, and transmits an authentication request including the authentication input information to the directory server. The directory server generates an authentication result for the authentication input information by collating the authentication input information included in the authentication request with the account information registered in the user DB, and returns the result to the authentication server. The authentication server writes the authentication result for the authentication input information to the memory. The control device is characterized by determining whether control processing based on the authentication result read from the memory is possible. Authentication system.

6. The authentication server is characterized by writing, to the memory, an authentication result indicating authentication processing failure when a reply to the authentication request transmitted to the directory server is not made within a predetermined time. The authentication system according to claim 5.

7. The control device writes encrypted information for the information to be written to the memory. The authentication server decrypts the information read from the memory. The authentication system according to claim 5.

8. An authentication server capable of accessing data in a memory within a control device detects and reads the authentication input information written to the memory, generates an authentication result for the authentication input information by collating the authentication input information with the account information registered in the user DB, and notifies the control device of whether control processing based on the authentication result is possible by writing the authentication result for the authentication input information to the memory within the control device. Authentication method.

Images