Controllers, methods, and programs

Abstract

One objective is to provide a communication environment that can guarantee communication security. [Solution] When a Factory Automation (FA) controller determines that a session start request sent from an information processing device indicates a security level lower than a predetermined security level, it determines whether the session start request satisfies predetermined conditions for demonstrating the legitimacy of the request. If it determines that the predetermined conditions are met, it sets a lower security level for the session established by the session start request. If it determines that the session start request indicates a predetermined security level, it sets a predetermined security level for the session.

Description

Technical Field

[0001] The present disclosure relates to a Factory Automation (FA) controller, a method, and a program.

Background Art

[0002] An FA controller installed at a production site communicates with an information processing apparatus that receives user instructions for operating the controller. For example, Japanese Unexamined Patent Application Publication No. 2003-241805 (Patent Document 1) or Japanese Unexamined Patent Application Publication No. 2005-38063 (Patent Document 2) discloses a development support apparatus that communicates with an FA controller.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 1

Summary of Invention

Problems to be Solved by the Invention

[0004] At production sites, it is desirable to apply a unified communication protocol between the FA controller and the information processing apparatus in order to ensure communication security. However, since users have different levels of proficiency in operations related to information processing apparatuses or communication, it has not been easy to meet such a demand.

[0005] Therefore, an object of the present disclosure is to provide a communication environment capable of ensuring communication security even under the aforementioned circumstances.

Means for Solving the Problems

[0006] The controller relating to this disclosure is a Factory Automation (FA) controller and comprises: a communication interface for connecting a network to which an information processing device belongs; a level determination unit that determines whether a session start request transmitted from the information processing device indicates a predetermined security level or a security level lower than the predetermined security level; a condition determination unit that determines whether the session start request satisfies predetermined conditions for demonstrating the legitimacy of the request when the level determination unit determines that the session start request indicates a lower security level; and a setting unit that sets a security level on the session established in response to the session start request. The setting unit sets a predetermined security level on the session when the level determination unit determines that the session start request indicates a predetermined security level, and sets a lower security level on the session when the level determination unit determines that the session start request indicates a lower security level and the condition determination unit determines that predetermined conditions are met.

[0007] According to the above disclosure, even if the security level that a user or information processing device intends to use for a session is lower than a predetermined security level, it is permitted to set a lower security level for a session in response to a session initiation request.

[0008] Furthermore, setting such a low security level is permitted only if the session initiation request meets predetermined conditions to demonstrate the legitimacy of the request; if these conditions are not met, the setting is not permitted. Therefore, even if a low security level is set for a session, it is possible to ensure the security of communications within that session.

[0009] In the disclosure described above, the specified conditions for demonstrating the legitimacy include conditions for demonstrating the legitimacy of the requester of the session initiation request.

[0010] According to the above disclosure, the conditions indicating the legitimacy of the requester can be applied to the predetermined conditions indicating the legitimacy of the session initiation request.

[0011] In the above disclosure, the controller exchanges communication frames with the information processing device, the communication frame of a session start request includes identification information that identifies the source of the communication frame, and the condition determination unit determines whether the identification information contained in the communication frame of the session start request satisfies the conditions that indicate its legitimacy.

[0012] According to the above disclosure, the controller can obtain identification information along with the session start request to determine the legitimacy of the request.

[0013] In the above disclosure, the specified conditions include the expiration date for which the specified conditions are available. According to the above disclosure, the controller does not determine whether to allow a lower security level setting for session initiation requests made after the expiration date included in the predetermined conditions, regardless of whether the legitimacy requirements are met. Therefore, it becomes possible to ensure communication security during the session.

[0014] In the above disclosure, the information processing device sends a negotiation request to the controller before a session start request, which has data indicating one or more security levels available to the session. The controller compares the one or more security levels indicated by the data in the negotiation request received from the information processing device with one or more security levels available to the session, and sends the comparison result to the information processing device.

[0015] According to the above disclosure, the controller may, before a session start request, compare one or more security levels available to the information processing device with one or more security levels available to the controller and transmit the result of the comparison to the information processing device.

[0016] In the above disclosure, the controller, prior to the session initiation request, responds to a negotiation request sent from the information processing device to inform the information processing device of one or more security levels available to the session.

[0017] According to the above disclosure, the controller may notify the information processing device of one or more security levels available to the session before a session start request.

[0018] The method relating to this disclosure is a method implemented by a Factory Automation (FA) controller, the controller having a communication interface for connecting to a network to which an information processing device belongs, and the method comprises: a level determination step of determining whether a session start request transmitted from the information processing device indicates a predetermined security level or a security level lower than the predetermined security level; a condition determination step of determining whether, if the level determination step determines that the session start request indicates a lower security level, the session start request satisfies predetermined conditions for demonstrating the legitimacy of the request; and a step of setting a security level on a session established in response to the session start request, wherein the setting step includes setting a predetermined security level on the session if the level determination step determines that the session start request indicates a predetermined security level, and setting a lower security level on the session if, if the level determination step determines that the session start request indicates a lower security level, the condition determination step determines that predetermined conditions are met.

[0019] The program relating to this disclosure is a program for causing the processor of a Factory Automation (FA) controller to execute a method, the controller having a communication interface for connecting to a network to which an information processing device belongs, and the method comprises: a level determination step of determining whether a session start request transmitted from the information processing device indicates a predetermined security level or a security level lower than said predetermined security level; a condition determination step of determining whether, if the session start request is determined in the level determination step to indicate a lower security level, the session start request satisfies predetermined conditions for indicating the legitimacy of said request; and a step of setting a security level on a session established in response to a session start request, wherein the setting step includes setting a predetermined security level on the session if the session start request is determined in the level determination step to indicate a predetermined security level, and setting a lower security level on the session if, if the session start request is determined in the level determination step to indicate a lower security level, the condition determination step determines that predetermined conditions are met.

[0020] When the above method is implemented or the program is executed, even if the security level that the user or information processing device intends to use for the session is lower than a predetermined security level, it is permitted to set a lower security level for the session in response to the session start request.

[0021] Furthermore, setting such a low security level is permitted only if the session initiation request meets predetermined conditions to demonstrate the legitimacy of the request; if these conditions are not met, the setting is not permitted. Therefore, even if a low security level is set for a session, it is possible to ensure the security of communications within that session. [Effects of the Invention]

[0022] According to the present disclosure, a communication environment capable of ensuring communication security can be provided. [Brief Description of the Drawings]

[0023] [Figure 1] It is a diagram for schematically explaining an application example of the present disclosure. [Figure 2] It is a schematic diagram showing the FA system according to the present embodiment. [Figure 3] It is a schematic diagram showing the hardware configuration of the support apparatus according to the present embodiment. [Figure 4] It is a schematic diagram showing the hardware configuration of the processing unit of the controller according to the present embodiment. [Figure 5] It is a schematic diagram showing an example of information stored in the nonvolatile memory of FIG. 4. [Figure 6] It is a diagram schematically showing the background of the present embodiment. [Figure 7] It is a diagram schematically showing the background of the present embodiment. [Figure 8] It is a diagram schematically showing the background of the present embodiment. [Figure 9] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 10] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 11] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 12] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 13] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 14] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 15] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 16] It is a diagram schematically showing the operation flow of the pre-registration processing according to the present embodiment. [Figure 17] This figure schematically shows an example of the configuration of a communication frame according to this embodiment. [Figure 18] This diagram schematically shows the management table according to this embodiment. [Figure 19] This diagram schematically shows the management table according to this embodiment. [Figure 20] This diagram schematically shows the management table according to this embodiment. [Figure 21] This diagram schematically shows the management table according to this embodiment. [Figure 22] This diagram schematically shows the management table according to this embodiment. [Figure 23] This is a processing flowchart of the controller according to this embodiment. [Figure 24] This is a processing flowchart of the controller according to this embodiment. [Figure 25] This is a processing flowchart of the controller according to this embodiment. [Figure 26] This is a processing flowchart of the controller according to this embodiment. [Figure 27] This is a processing flowchart of the controller according to this embodiment. [Figure 28] This diagram schematically shows the negotiation sequence according to this embodiment. [Modes for carrying out the invention]

[0024] Embodiments of this disclosure will be described in detail with reference to the drawings. Parts identical or corresponding to those shown in the drawings are denoted by the same reference numerals, and their descriptions will not be repeated.

[0025] <§. Examples of Application> First, an example of a scenario in which the present invention is applied will be described. Figure 1 is a diagram for schematically illustrating an example of application of this disclosure. In Figure 1, a communication sequence between a FA controller 100 and a support device 200, which is an example of an information processing device, is shown in relation to processing.

[0026] In this disclosure, when the controller 100 successfully authenticates the support device 200, a communication session is established between the controller 100 and the support device 200. Once a communication session is established, it may be maintained from the start to the end of communication. In this disclosure, a secure communication protocol is applied to each communication session established between the controller 100 and the support device 200 (hereinafter, a communication session is also simply referred to as a "session"). In this disclosure, the secure communication protocol is described as, for example, version V1, version V2 which has a higher security level than version V1, and version V3 which has a higher security level than version V2.

[0027] The security level of a communication protocol can be determined, for example, by the type, number, or combination of elements used for authentication of the destination. Such elements may include, for example, at least one of the following: attribute information indicating the destination's attributes, information indicating the destination's trustworthiness (e.g., digital certificates), encryption algorithms, encryption keys, and tamper detection algorithms. More specifically, security levels can be differentiated between communication protocols by varying at least one of the following: whether or not attribute information is used for destination authentication, whether or not information indicating the destination's trustworthiness is used for destination authentication, the type of attribute information used (e.g., passwords, biometric information), the type of encryption algorithm used, the type of encryption key used for the encryption algorithm, and the type of tamper detection algorithm used. Note that the elements used in the destination's authentication method are not limited to those described above.

[0028] In this disclosure, "setting a security level" means enabling communication on a session in accordance with one of the communication protocols of versions V1 to V3. Note that the security levels are not limited to versions V1, V2, and V3; there may be two versions, V1 and V2, or four or more versions capable of providing four or more security levels.

[0029] The controller 100 controls the object of FA (production equipment, etc.) by executing a control program. The controller 100 includes, for example, a PLC (Programmable Logic Controller) or an IPC (Industrial Personal Computer). The support device 200 provides a development environment for application programs, including the control program, and assists user operations, including the settings of the controller 100.

[0030] Figure 1 shows versions V1 and V2 as security levels. The controller 100 has security level 111 available for sessions showing versions V1 and V2, and the support device 200 has security level 211 available for sessions showing version V1.

[0031] In Figure 1, the controller 100 establishes a connection with the support device 200 and performs pre-registration processing over the connection (step R0). During the pre-registration processing, information to be stored (registered) in the management table 185, including the condition table 270 described later, is exchanged. Afterward, the connection is terminated (step R1). During the pre-registration process, the controller 100 is set to a security level recommended for use on the session (hereinafter also referred to as the "predetermined security level"). More specifically, the controller 100 is set to the highest of the two security levels, version V1 and V2, indicated by security level 111, as the predetermined security level (in the case of Figure 1, "V2"). Note that the predetermined security level is not limited to one, but may be two or more levels indicating a high level of security.

[0032] The support device 200 accepts user input to the support device 200 (step R2) and forwards a communication frame of the session start request 32 based on the user input to the controller 100. The communication frame includes the session start request 32, a secure communication version 31 indicating the security level that the support device 200 requests to be used for the session, and attribute information of the session start request 32. The secure communication version 31 is shown as "V1" in Figure 1, for example. The attribute information includes information indicating the legitimacy of the session start request 32. The legitimacy information includes, for example, identification information of the requesting user or support device 200. The identification information indicating the legitimacy of the requesting party is, for example, information for authenticating the requesting party, and includes, for example, the user account (username, etc.) of the user or support device 200 or the communication address of the support device 200. The information for identifying the legitimacy of the requesting party is not limited to these, and separately generated identification information may be used. For example, a user with administrator privileges may request the controller 100 to issue a connection ticket or certificate to identify them as a legitimate user. Subsequently, when the user operates the support device 200 to connect to the controller 100, they may request the start of a session using a set of identification information, such as the connection ticket or certificate, and identification information, such as the user account mentioned above.

[0033] The controller 100 determines whether the secure communication version 31 of the session start request 32 transferred from the support device 200 indicates a predetermined security level or a security level lower than that predetermined security level (step R3). If it is determined that the secure communication version 31 of the session start request 32 indicates the lower security level, the controller 100 determines whether the session start request 32 satisfies predetermined conditions in the condition table 270 for indicating the legitimacy of the request (step R4). In step R4, for example, it is determined whether the identification information (user account or communication address) included in the attribute information of the session start request 32 satisfies predetermined conditions.

[0034] The controller 100 sets a security level on the session established in response to the session start request 32 (step R5). More specifically, if the controller 100 determines that the secure communication version 31 has a security level lower than a predetermined security level, but the session start request 32 satisfies predetermined conditions, it sets a lower security level on the session established in response to the request. If the controller 100 determines that the security level of the secure communication version 31 is at a predetermined security level, it sets a predetermined security level on the session established in response to the request.

[0035] In Figure 1, the secure communication version 31 shows a level "V1" which is lower than the predetermined security level "V2". However, when it is determined that the predetermined conditions are met, the controller 100 sets the security level to "V1" for the session established in response to the session start request 32 (step R6). Online data processing is performed on the session, and then the session is terminated (step R7).

[0036] In Figure 1, even when the controller 100 determines that the secure communication version of the session start request 32 transferred from the support device 200 indicates a level lower than the predetermined security level recommended by the controller 100, the controller 100 sets a low security level for the session established in response to the session start request 32 on the condition that the session start request 32 satisfies a predetermined condition. Accordingly, for example, even when the security level available to the user or the support device 200 is lower than the security level recommended by the controller 100, setting a low security level for the session corresponding to the session start request 32 is permitted.

[0037] Further, such setting of a low security level is permitted on the condition that the session start request 32 satisfies a predetermined condition for demonstrating the validity of the request, and is not permitted when the predetermined condition is not satisfied. Accordingly, even if a low security level is set for the session, it is possible to ensure communication security on the session.

[0038] Hereinafter, as a more specific application example of the present invention, the more detailed configuration and processing of the system or apparatus according to the present embodiment will be described.

[0039] <A. System Configuration> First, the system 1000 according to the present embodiment will be described.

[0040] Figure 2 is a schematic diagram showing the factory automation system 1000 according to the present embodiment. The system 1000 includes a plurality of controllers 100-1, 100-2, and 100-3 connected via a network 50. The common configurations of the controllers 100-1, 100-2, and 100-3 will be collectively described as the controller 100. Note that the number of controllers 100 connected to the network 50 is not limited to a plurality, and may be one or more.

[0041] The controller 100 includes a processing unit 10 that is a main body for executing programs, a power supply unit 12 that supplies power to the processing unit 10 and the like, and an input / output unit 14 that exchanges signals between the controller 100 and a field. The input / output unit 14 is connected to the processing unit 10 via a system bus 11. Typically, the input / output unit 14 acquires an input signal from a detection sensor 6 which is a field device, and drives a relay 7 which is a field device in accordance with a program execution result in the processing unit 10.

[0042] The support device 200 communicates with the controller 100 via a network 13. The support device 200 has a module for supporting development of an application program executed by the controller 100, and a module for monitoring an operation state of the controller 100 connected via the network 13, values of various data, and the like.

[0043] <B. Hardware Configuration> (b1: Hardware Configuration of Support Device) FIG. 3 is a schematic diagram showing the hardware configuration of the support device 200 according to the present embodiment. With reference to FIG. 3, the support device 200 is typically configured by a general-purpose computer. Such a computer may include an HMI (Human Machine Interface) device, a smartphone carried by a user, a tablet device, and the like. The support device 200 is preferably a notebook personal computer excellent in portability from the viewpoint of maintainability.

[0044] Referring to Figure 3, the support device 200 includes a CPU (Central Processing Unit) 201 that executes various programs including an OS (Operating System), a ROM (Read Only Memory) 202 that stores a BIOS (Basic Input Output System) and various data, a RAM (Random Access Memory) 203 that provides a working area for storing data necessary for executing programs on the CPU 201, and a hard disk drive (HDD) 204 that non-volatilely stores programs executed on the CPU 201.

[0045] The support device 200 further includes a keyboard 205 and a mouse 206 for receiving user input to the support device 200, and a monitor 207 for displaying information to the user. The support device 200 also includes a communication interface (IF) 209 for communicating with the controller 100 (processing unit 10) and the like.

[0046] The various programs executed by the support device 200 are typically stored and distributed on a CD-ROM (Compact Disc Read Only Memory) 300. The programs stored on this CD-ROM 300 are read by a CD-ROM (Compact Disk-Read Only Memory) drive 208 and stored on a hard disk drive (HDD) 204 or the like. Alternatively, the support device 200 may be configured to receive programs from a higher-level host computer via a network.

[0047] Referring to Figure 3, the HDD 204 stores multiple programs or data, including a system program 269 containing the OS, communication programs 271, 272, and 273 for communicating with the controller 100 according to the respective communication protocols of versions V1 to V3, GUI data 274 for displaying a GUI (Graphical User Interface) screen, data indicating the applicable version 275 (described later), and a support program 276.

[0048] (b2: Controller hardware configuration) Figure 4 is a schematic diagram showing the hardware configuration of the processing unit 10 of the controller 100 according to this embodiment. Referring to Figure 4, the processing unit 10 includes a processor 101, a chipset 102, main memory 104, non-volatile memory 106, a system timer 108, a system bus controller 120, a network controller 140, and a USB (Universal Serial Bus) connector 110. The chipset 102 and the other components are connected via various buses.

[0049] The processor 101 and chipset 102 are typically configured according to a general-purpose computer architecture. That is, the processor 101 interprets and executes instruction codes supplied sequentially from the chipset 102 according to its internal clock. The chipset 102 exchanges internal data with various connected components and generates the instruction codes required by the processor 101. Furthermore, the chipset 102 has a module that caches data obtained as a result of the execution of arithmetic processing by the processor 101.

[0050] The processing unit 10 has main memory 104 and non-volatile memory 106 as memory.

[0051] Main memory 104 is a volatile memory area that stores various programs to be executed by the processor 101 after power is supplied to the processing unit 10. Main memory 104 is also used as working memory when the processor 101 executes various programs. Devices such as DRAM (Dynamic Random Access Memory) and SRAM (Static Random Access Memory) are used as such main memory 104.

[0052] The non-volatile memory 106 non-volatilely stores system programs including the real-time OS, various application programs (modules) such as executable programs, and data such as system setting parameters. These programs and data are copied to the main memory 104 as needed so that the processor 101 can access them.

[0053] The processing unit 10 has a system bus controller 120 and a network controller 140 as communication interfaces. These communication interfaces transmit output data and receive input data.

[0054] The system bus controller 120 controls the exchange of data via the system bus 11. More specifically, the system bus controller 120 includes a DMA (Dynamic Memory Access) control circuit 122, a system bus control circuit 124, and a buffer memory 126. The system bus controller 120 is internally connected to the system bus 11 via a system bus connector 130 which includes a communication circuit. The processing unit 10 exchanges control commands calculated by the execution of the control program and the status values ​​of the controlled object with the controlled object (a field device, such as a detection sensor 6 or relay 7) via the system bus connector 130.

[0055] The network controller 140 controls the exchange of data between itself and other controllers 100 via the network 50 through the communication connector 150. That is, the network controller 140 controls the transmission of output data and the reception of input data according to the network standard used. For example, the system 1000 employs Ethernet®, TCP / IP (Transmission Control Protocol / Internet Protocol), UDP / IP (User Datagram Protocol / Internet Protocol), or Common Industrial Protocol (CIP) for communication on the network 50. The communication standards applicable to the network 50 are not limited to these.

[0056] The network controller 140 includes a network control circuit 144, a DMA control circuit 142, and a buffer memory 146 for exchanging data with other controllers 100 connected to the network 50.

[0057] The USB connector 110 is a communication interface for connecting the network 13 to which the support device 200 belongs to the processing unit 10. Typically, executable programs or data transferred from the support device 200 to the processor 101 of the processing unit 10 are received by the controller 100 via the USB connector 110.

[0058] Figure 5 is a schematic diagram showing an example of information stored in the non-volatile memory 106 of Figure 4. Referring to Figure 5, the non-volatile memory 106 of the controller 100 includes a system program including the OS, a user-defined application 170, a communication program 184, and a management table 185 referenced for session communication.

[0059] The user-defined application 170 includes a setting program 171 for setting a security level for a session, a level determination program 172 for determining the security level indicated by a session start request, a condition determination program 173 for determining whether the session start request satisfies certain conditions, and a control program 174. When executed, the setting program 171, the level determination program 172, and the condition determination program 173 constitute the setting unit, the level determination unit, and the condition determination unit modules, respectively. The communication program 184 includes communication programs 181 to 183 for each of the communication protocols of versions V1 to V3, for communicating according to the respective protocol.

[0060] <C.セッション> In this disclosure, "recommended version" refers to a version with a predetermined security level that is recommended for use in session communication between the controller 100 and the support device 200. More specifically, the "recommended version" is set in the controller 100 during the pre-registration process described above. The "recommended version" can be set to one version with the highest security level among multiple versions available to the controller 100 for the session, or two or more versions with higher security levels. Furthermore, the applicable version 275 refers to one version used for the session from among one or more versions available to the support device 200 or the user for the session.

[0061] (c1. Background explanation of the embodiment) Figures 6 to 8 schematically illustrate the background of this embodiment. Figure 6 shows, for example, the connection when the support device 200 first connects to the controller 100 when the controller 100 is installed at the production site. For the sake of simplicity, the initial value of the "recommended version" that is pre-registered in the controller 100 at the time of shipment is set to, for example, V1. Figure 6 shows the controller 100 with the "recommended version" set to the initial value V1, and support devices 200A and 200B as support devices 200, with the "applicable version" set to V1. Note that the initial value of the "recommended version" that is pre-registered in the controller 100 is not limited to V1.

[0062] The UI screen of the monitor 207 of support device 200A includes item 21 for setting the user (administrator) account (username, password) on the controller 100. The UI screen of the monitor 207 of support device 200B includes item 21 as described above, as well as button 24. Button 24 is operated by the user of support device 200B to set the support device 200 to "Applied Version" as V2 for subsequent sessions.

[0063] In Figure 6, the "applicable version" of support devices 200A and 200B matches the "recommended version" of controller 100, which is "V1," so support devices 200A and 200B can exchange information with controller 100. When controller 100 communicates with support device 200A, it registers the user of support device 200A as an administrator (step S1), and support device 200A sets the recommended version for subsequent sessions in controller 100 to version V1 or V2 (step S2), and then terminates the connection.

[0064] When the controller 100 communicates with the support device 200B, based on the user operation received by the support device 200B, the controller 100 sets the recommended version for subsequent sessions to version V2 and disables version V1 (step S4), and then terminates the connection.

[0065] Figures 7 and 8 show the scene where the support devices 200A and 200B reconnect to the controller 100 after the communication in Figure 6 is completed. Between the end of the connection in Figure 6 and the reconnection, the recommended version of the controller 100 may be changed (set) by, for example, the administrator. Figure 7 shows the controller 100 with the "recommended version" set to V2 and version V1 disabled, while Figure 8 shows the controller 100 with the "recommended version" set to V2 and version V1 set to conditional.

[0066] Figure 7 shows support device 200A with "Applicable Version" V1 and support device 200B with "Applicable Version" V2. The UI screen of monitor 207 includes an item 21A for accepting user account input and a button 21B that is operated to instruct a session start request. Support devices 200A and 200B include the user account and secure communication version 31 data in the session start request communication frame. More specifically, secure communication version 31 indicates "V1" or "V2", which is the "Applicable Version" of support devices 200A and 200B.

[0067] The controller 100 compares the secure communication version 31 of the session start request forwarded from the support devices 200A and 200B with the controller 100's recommended version "V2" and determines if they match. The controller 100 determines that the secure communication version 31 of the session start request from support device 200A does not match and, according to the determination result, does not establish a session (step S6). The controller 100 determines that the secure communication version 31 of the session start request from support device 200B matches and, according to the determination result, establishes a session (step S7).

[0068] In the case of Figure 7, the support device 200A whose "applicable version" does not match the "recommended version" cannot establish a session with the controller 100. In contrast, Figure 8 illustrates a case where a session can be established with the controller 100 even for the support device 200A whose "applicable version" does not match the "recommended version". More specifically, in Figure 8, the "recommended version" is set to V2 in the controller 100, and version V1 is set as conditional. In Figure 8, the controller 100 determines that the secure communication version 31 in the session start request from the support device 200A does not match the "recommended version". In this case, when the controller 100 determines that the condition associated with version V1 for the session start request is satisfied, it establishes the session (step S9). For the session start request from the support device 200B, the controller 100 determines that the secure communication version 31 matches the "recommended version", and thus establishes the session (step S10).

[0069] As shown in Figure 8, even when the controller 100 determines that the secure communication version 31 indicated by the session start request has a security level lower than the security level of the recommended version, the controller 100 can establish the session when the session start request satisfies the condition. In the following, an operation flow including the operation of setting the condition in the controller 100 is described.

[0070] <D. Specific Flow> Figures 9 to 16 are diagrams schematically illustrating the operation flow of the pre-registration processing according to the present embodiment. This operation flow is illustrated using transitions of UI screens displayed on the monitor 207 of the support device 200.

[0071] (d1. Operation Flow of Pre-registration Processing) In the operation flow d1, based on user operations on the support device 200, administrator information is registered in the controller 100 and a recommended version is set. Other information is pre-registered through the operation flow d2, which will be described later. This other information includes information about roles other than the administrator in the controller 100, or information about other versions that the controller 100 can use but are different from the recommended version.

[0072] Figures 9 to 12 show the operation flow for transferring the project file in the pre-registration process of Figure 1. In Figure 9, the support device 200 generates a project file based on user operations received on the UI screen while offline and not communicating with the controller 100 (step S30). When the support device 200 receives an online operation from the user (step S31), it switches the screen of the monitor 207 to the UI screen for the initial online process. The project file includes, for example, a user-defined application 170 including the controller 100's control program 174 or configuration data. The project file is then transferred to the controller 100 in the subsequent online state.

[0073] The support device 200 is operated by a user with administrator privileges. More specifically, when the support device 200 receives a user operation on item 521 of the UI screen (step S32), it switches the screen of the monitor 207 to the UI screen shown in Figure 10. In Figure 10, when the support device 200 first receives a user operation and a transfer instruction on the UI screen (step S33), it switches to a UI screen that displays a message recommending version V2 as the secure communication version. When the user operates button 24 followed by an "OK" operation (step S34), V2 is set as the applicable version 275, and a session is established with the controller 100 (step S35).

[0074] When a session is established, and the support device 200 receives a user operation for item 561 on the UI screen in Figure 11, it transfers the project file to the controller 100 (step S38). The controller 100 stores the project file transferred from the support device 200 in the non-volatile memory 106 (step S38a). Subsequently, when the support device 200 receives a user operation for item 581 on the UI screen in Figure 12, the support device 200 switches the operating mode of the controller 100 to the execution mode for running the program (step S39a).

[0075] During the pre-registration process, the support device 200 transfers the information received from the user to the controller 100 according to the operation flow shown in Figures 13 to 16. The controller 100 stores the information received from the support device 200 in the management table 185.

[0076] Figure 13 shows the administrator's operation flow for setting up a user account or role on the controller 100. The support device 200, which has an applied version 275 of V2, is online and, upon receiving a user operation on item 601 of the UI screen, forwards the account setting request to the controller 100 (step S42). In response to the request, the controller 100 forwards the account list 250 to the support device 200. The support device 200 displays information based on the account list 250 forwarded from the controller 100 on the UI screen 61.

[0077] On UI screen 61, the username 611 and role 612 are displayed for each of the multiple users of controller 100, along with buttons 61a to 61c. Buttons 61a or 61b are operated to add or delete an account, button 61c is operated to change the password, and button 61d is operated to change the role 612. The role indicates the scope of operation privileges of controller 100. Administrators have the maximum scope. Administrators are permitted to operate buttons 61a to 61d, while users with roles other than administrator are permitted to operate only button 61c. When the support device 200 receives a user operation via button 61a, it switches from UI screen 61 to UI screen 62. On UI screen 62, based on the user operation received by the support device 200, the account and role (administrator) are added (registered) to the account list 250 of controller 100.

[0078] Figures 14 to 16 show the administrator's operation flow for registering the recommended version to the controller 100. When the support device 200, which indicates that the applicable version 275 is V2, is online and receives a user operation for item 602 on the UI screen in Figure 14, it displays, for example, the UI screen 64 in Figure 14, the UI screen 66 in Figure 15, or the UI screen 67 in Figure 16.

[0079] The UI screen 64 in Figure 14 accepts user input to set the recommended version of the controller 100. The user can set only one of versions V1 or V2 as the "recommended version" by operating button 641, or they can set both versions V1 and V2, which are checked 642a, as the "recommended version" by operating button 642. The operation to set the "recommended version" is not limited to the operation in Figure 14, but may also be the operation in Figure 15, for example.

[0080] In the UI screen 66 of Figure 15, a button 661 is shown that accepts user operations to set the version of the controller 100. Button 661 includes an identifier 66a and a specification 66b for each of the versions V1, V2, and V3 available for the session. The values ​​that can be set for the specification 66b of each version include "Not Allowed" which indicates that the use of that version is not permitted, "Conditional" which indicates that the use of that version is permitted if certain conditions are met, and "Allowed" which indicates that the use of that version is permitted without any conditions. The window 662 of the UI screen 66 includes objects of items 66C to 66G that are configured to accept condition setting operations.

[0081] By setting the specified 66b on the UI screen 66 to "Allowed" through user operation, the controller 100 can register the version indicated by the identifier 66a corresponding to the specified 66b as the "Recommended Version".

[0082] (d2. Other operation flows for pre-registration processing) The user can register each version of the UI screen 66 other than the recommended version as an "unauthorized" or "conditional" version in the controller 100 by setting a value in the designated 66b corresponding to the identifier 66a of that version through user operation.

[0083] Item 66C of UI screen 66 in Figure 15 accepts user operations to set the version to be subject to the condition. Items 66D to 66F accept user operations to set predetermined conditions that the session start request must satisfy in order to accept the session start request.

[0084] More specifically, item 66D and item 66E each receive an operation for setting conditions of a user and a device (support device 200). Item 66E receives an operation for designating to perform authentication using a client certificate. Item 66G receives an operation for setting an expiration date during which the conditions of items 66D to 66E are available. Item 66D receives an operation for setting an account such as a user name. Furthermore, item 66E receives an operation for designating a communication address such as an IP address or a MAC address of the support device 200. Note that although the conditions for determining to accept a session start request are set by the operations on item 66D and item 66E, conditions for determining not to accept a session start request may be set instead.

[0085] The UI screen 67 in FIG. 16 includes item 671 and item 673 that receive user operations. In item 671, a mark 672 indicates that versions V2 and V3 among versions V1, V2, and V3 available for the controller 100 have been designated as "recommended versions" by a user operation. When the support device 200 receives a user operation on item 673, the support device 200 executes negotiation, which will be described later, between the support device 200 and the controller 100.

[0086] In the present embodiment, the support device 200 transfers the information received by the user operations shown in FIGS. 13 to 16 to the controller 100 so as to be set in the management table 185.

[0087] <E. Communication Frame> FIG. 17 is a diagram schematically showing a configuration example of a communication frame according to the present embodiment. The controller 100 and the support device 200 exchange commands, data, and the like using communication frames. FIG. 17 shows an example of a communication frame including a command of a session start request 32. With reference to FIG. 17, the communication frame includes a header 40 for storing header information, and a body 30 for storing a payload. The header 40 includes a destination 21c and a source 21d. The body 30 includes a secure communication version 31 indicating the value of the applied version 275 of the support device 200, a command of a session start request 32, and first identification information 33 and second identification information 34 for identifying the validity of a user. The destination 21c includes a communication address such as the IP address of the controller 100. The source 21d includes an identifier of the support device 200. This identifier includes, for example, the communication address of the support device 200. Such a communication address includes the IP address or MAC (Media Access Control address) of the support device 200. The first identification information 33 includes, for example, an account (user name, password) and the like. The second identification information 34 includes, for example, a connection ticket or a certificate and the like.

[0088] <F. Management Table> FIG. 18 to FIG. 22 are diagrams schematically showing management tables according to the present embodiment. The management table 185 includes the account list 250 in FIG. 18, the version permission list 260 in FIG. 19, and the condition tables 270, 270A, and 270B in FIG. 20, FIG. 21, and FIG. 22 that indicate predetermined conditions for determining the validity of the session start request 32.

[0089] The account list 250 in Figure 18 stores the account (username 25a, password 25b) and role 25c for each of one or more users. The version permission list 260 in Figure 19 includes, for each of the at least one versions available to the controller 100, an identifier 26a indicating the value of that version, a value 26b, a recommendation 26c indicating the "recommended version" of the controller 100, and a note 26d. The value 26b is set based on the operation of button 661 on the UI screen 66 in Figure 15. The recommendation 26c in Figure 19 is set to indicate version V3, which has the highest security level among the versions available to the controller 100, as the "recommended version". Note that the "recommended version" indicated by recommendation 26c is not limited to one version but may be multiple versions. For example, based on the operation of item 671 on the UI screen 67 in Figure 16, recommendation 26c may be set to indicate versions V2 and V3 as the "recommended versions".

[0090] The condition table 270 in Figure 20 is used by the controller 100 to set data in the condition table 270 based on data transferred from the support device 200 (for example, data set in window 662 of the UI screen 66 in Figure 15). The condition table 270 indicates the conditions for the controller 100 to determine whether to accept the session start request 32. More specifically, the condition table 270 includes, for each of the at least one available versions of the controller 100, an identifier 27a indicating the value of that version, and a condition item attached to that version. The condition item includes, for example, the type of condition 27b and its value 27c, and the expiration date 27d for which the condition is available. The type 27b includes, for example, a user identifier (e.g., the username of the account) and an identifier of the support device 200 (e.g., the IP address of the communication address, MAC address, etc.). According to Figure 20, the controller 100 accepts the session start request 32 when it determines that the conditions are met, such that the username in the first identification information 33 of the communication frame of the session start request 32 is "Taro" or "Hanako", the IP address of the source 21d is "xx.yy.zz.ww", and the time the session start request 32 was received (or forwarded) is before the expiration date "DD". Note that the types or number of items that constitute the conditions to be attached to the version are not limited to the example items in Figure 20.

[0091] The condition table 270 in Figure 20 may be divided into a condition table 270A for the account in Figure 21 and a condition table 270B for the IP address 27e in Figure 22. Note that while condition tables 270, 270A, and 270B show conditions for deciding whether to accept the session start request 32, they may also be configured to show conditions for deciding whether to reject it.

[0092] <G.フローチャート> Figures 23 to 27 show the processing flowchart of the controller according to this embodiment. In Figure 23, the controller 100 determines whether to receive a communication frame for a session start request 32 from the support device 200 (step S100). If it is determined that the controller will not receive a communication frame for a session start request 32 (NO in step S100), the processing in step S100 is repeated.

[0093] When it is determined that the communication frame for the session start request 32 has been received (YES in step S100), the controller 100 accepts the communication frame (step S101), performs authentication processing (step S102), and determines whether authentication was successful or not (step S103). In the authentication processing, the controller 100 determines whether the account (username, password) indicated by the first identification information 33 of the communication frame for the session start request 32 matches an account stored in the account list 250. If they match, it outputs authentication success; otherwise, it outputs authentication failure.

[0094] If authentication is determined to have failed (NO in step S103), the controller 100 forwards the error to the support device 200 and returns to step S100. If authentication is determined to have succeeded (YES in step S103), the version determination process (step S104) is performed. In step S104, it is determined whether the session start request 32 is acceptable or not.

[0095] If acceptance is deemed unacceptable (NO in step S105), the process proceeds to step S112. However, if acceptance is deemed acceptable (YES in step S105), the processing PR of the level setting unit is executed. In processing PR, the setting unit of the controller 100 sets the security level for the session established in response to the session start request 32 (steps S106, S107, S108). More specifically, the communication program corresponding to the communication protocol of secure communication version 31 among the communication programs 181 to 183 is executed to establish the session.

[0096] The controller 100 determines whether the session establishment process will succeed or fail (step S109). If it fails (NO in step S109), the process proceeds to step S112. If it succeeds (YES in step S109), the controller 100 forwards a notification of successful session establishment to the support device 200 (step S110). The controller 100 then performs online processing on the established session (step S111).

[0097] Figure 24 shows the version determination process (step S104). In Figure 24, the level determination unit of the controller 100 determines whether the secure communication version 31 of the session start request 32 indicates the security level of the recommended version or a security level lower than the security level of the recommended version (step S118). More specifically, based on the value of the secure communication version 31, the controller 100 searches the version permission list 260 for a value 26b corresponding to the identifier 26a that indicates that value. The controller 100 determines whether the retrieved value 26b indicates "permitted", "conditionally permitted", or "not permitted".

[0098] If the retrieved value 26b is determined to indicate "permission" ("permission" in step S120), that is, if the secure communication version 31 is determined to indicate the security level of the recommended version, the controller 100 outputs acceptance of the session start request 32 (step S121) and returns to step S104 (step S125). If the retrieved value 26b is determined to indicate "conditional permission" ("conditional permission" in step S120), that is, if the secure communication version 31 is determined to indicate a security level lower than the security level of the recommended version, the process proceeds to step S122.

[0099] If the retrieved value 26b is determined to be "unauthorized" ("unauthorized" in step S120), the controller 100 outputs that the session start request 32 cannot be accepted (step S124) and returns to step S104 (step S125).

[0100] In step S122, the condition determination unit of the controller 100 uses the condition table 270 to determine whether the session start request 32 satisfies predetermined conditions for demonstrating the legitimacy of the request (step S122). If the conditions are met, the process proceeds to step S121; otherwise, it proceeds to step S124. In step S122, the controller 100 compares the value 27c of type 27b corresponding to the identifier 27a that matches the value of secure communication version 31 with the value of the communication frame. If the comparison results show a match, the controller determines that the conditions are met; otherwise, the controller determines that the conditions are not met. For example, if secure communication version 31 indicates version V2, according to the condition table 270 in Figure 20, the conditions are deemed to be met if the IP address of the source 21d of the communication frame is "xx.yy.zz.ww", the username in the first identification information 33 of the communication frame is "Hanako" or "Taro", and the reception time of the communication frame is before the expiration date "DD". In all other cases, the conditions are deemed not to be met.

[0101] In steps S106 to S108, the session establishment processes shown in Figures 25 to 27 are performed, respectively. In step S106, the communication program 181 is executed to perform the session establishment process according to version V1; in step S107, the communication program 182 is executed to perform the session establishment process according to version V2; and in step S108, the communication program 183 is executed to perform the session establishment process according to version V3. The vulnerability in the session establishment of version V1 in Figure 25 can be resolved in the session establishment of version V2 in Figure 26, which has a higher security level, and the session establishment of version V3 in Figure 27 guarantees a higher security level than the session establishment of version V2 in Figure 26.

[0102] The flowcharts in Figures 23 to 27 can be realized by the processor 101 of the controller 100 executing a setting program 171, a level determination program 172, a condition determination program 173, and a communication program 184.

[0103] <H.ネゴシエーション> Figure 28 is a schematic diagram showing the negotiation sequence according to this embodiment. In this embodiment, after the pre-registration process described above is performed, the controller 100 may be configured to perform the negotiation shown in Figure 28 between the controller 100 and the support device 200. After this negotiation is performed, the session establishment process shown in Figure 23 is performed.

[0104] In Figure 28, the support device 200 forwards a negotiation request 91 to the controller 100. The negotiation request 91 includes data D1 indicating one or more versions available to the support device 200. The controller 100 receives the negotiation request 91 (step S20) and compares the one or more versions indicated by data D1 with one or more versions permitted in the version permission list 260 (step S21). Based on the comparison result, the controller 100 determines whether the version permitted by the controller 100 corresponds to an available version of the support device 200, and forwards a response 92 including data D2 indicating the determination result to the support device 200 (step S22).

[0105] Based on the above comparison, if the controller 100 determines that one or more versions permitted in the version permission list 260 match one or more available versions of the support device 200, data D2 indicates the matching version. The support device 200 determines the version with the highest security level among the one or more versions indicated by data D2 received from the controller 100, and sets the determined version as the applicable version 275 to be used for subsequent sessions. Based on the above comparison, if the controller 100 determines that one or more versions permitted by the controller 100 do not match one or more available versions of the support device 200, it forwards data D2 indicating the mismatch to the support device 200.

[0106] According to the version permission list 260 in Figure 19, controller 100 is permitted to allow versions V2 and V3. Therefore, for example, if data D1 indicates versions V1, V2, and V3, data D2 will indicate versions V2 and V3. Conversely, if data D1 indicates only version V1, data D2 will indicate a mismatch or error.

[0107] In Figure 28, the controller 100 transfers data D2, which indicates the matching version based on the above determination result, to the support device 200, but this is not limited to that. For example, the controller 100 may transfer data D2, which indicates the non-matching version based on the above determination result, to the support device 200. Also, data D2 may indicate both the matching version and the non-matching version.

[0108] (h1. Other examples of negotiation) Instead of the configuration in FIG. 19, the controller 100 may be configured to notify the support device 200 of one or more permitted versions indicated by the version permission list 260 in response to the negotiation request transferred from the support device 200. In this case, the support device 200 determines a version that is available to the support device 200 and has the highest security level from the one or more versions indicated by the notification from the controller 100, and sets the determined version as the applied version 275.

[0109] <I. Program> The program executed in the controller 100 is non-temporarily stored in the HDD 106. The program is transferred from the support device 200 or via the network 50 and stored in the HDD 106. Alternatively, the program is stored in a non-illustrated recording medium, for example, a CD-ROM, and distributed. The program stored in this CD-ROM is read from the CD-ROM and stored in the HDD 106.

[0110] Although the modules provided by the controller 100 illustrate a configuration example in which necessary modules are provided by the CPU 101 executing a program, part or all of these provided modules may be implemented using a dedicated hardware circuit (for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), etc.). In this case, the controller 100 may use virtualization technology to cause a plurality of OSs with different uses to execute in parallel, and cause necessary applications to execute on each OS.

[0111] <J. Supplementary Notes> The present embodiment as described above includes the following technical ideas. [Configuration 1] A FA (Factory Automation) controller (100), comprising: A communication interface (110) for connecting the network (13) to which the information processing device (200) belongs, The session start request (32) transmitted from the information processing device is determined by a level determination unit (172) that determines whether it indicates a predetermined security level or a security level lower than the predetermined security level, If the level determination unit determines that the session start request indicates the low security level, the condition determination unit (173) determines whether the session start request satisfies predetermined conditions (270, 270A, 270B) for demonstrating the legitimacy of the request, The system includes a setting unit (171) that sets a security level on the session established in response to the session start request, The aforementioned setting unit is, When the level determination unit determines that the session start request indicates the predetermined security level, the predetermined security level is set for the session. A controller that, if the level determination unit determines that the session start request indicates the low security level, and if the condition determination unit determines that the predetermined condition is met, sets the low security level for the session. [Configuration 2] The controller according to Configuration 1, wherein the predetermined conditions for demonstrating the legitimacy include conditions for demonstrating the legitimacy of the requester of the session start request. [Configuration 3] The controller exchanges communication frames with the information processing device. The communication frame of the session start request includes identification information (21d, 33, 34) that identifies the source of the communication frame. The aforementioned condition determination unit, A controller according to configuration 1 or 2, which determines whether the identification information contained in the communication frame of the session start request satisfies the conditions indicating legitimacy. [Structure 4] The controller according to any of configurations 1 to 3, wherein the predetermined conditions include the condition of the expiration date (27d) during which the predetermined conditions can be used. [Composition 5] Prior to the session start request, the information processing device sends a negotiation request (91) to the controller, which has data (D1) indicating one or more security levels available to the session. A controller according to any one of configurations 1 to 4, wherein the controller compares one or more security levels indicated by the data in the negotiation request received from the information processing device with one or more security levels available to the session, and transmits the comparison result (D2) to the information processing device. [Composition 6] The aforementioned controller, A controller according to any one of configurations 1 to 5, which, in response to a negotiation request sent from the information processing device prior to the session start request, notifies the information processing device of one or more security levels available for the session. [Composition 7] A method implemented by a Factory Automation (FA) controller (100), The controller has a communication interface (110) for connecting to the network (13) to which the information processing device (200) belongs, and the method is The session start request (32) transmitted from the information processing device includes a level determination step of determining whether it indicates a predetermined security level or a security level lower than the predetermined security level, If, in the level determination step, it is determined that the session start request indicates the low security level, then a condition determination step is made to determine whether the session start request satisfies predetermined conditions (270, 270A, 270B) for demonstrating the legitimacy of the request. The process includes the step of setting a security level on a session established in response to the session start request, The aforementioned setting step is, If, in the level determination step, it is determined that the session start request indicates the predetermined security level, the predetermined security level is set for the session. A method comprising setting the low security level to the session if, in the level determination step, it is determined that the session start request indicates the low security level, and if, in the condition determination step, it is determined that the predetermined condition is met. [Structure 8] Programs (171, 172, 173) that cause the processors (101, 102) of the FA (Factory Automation) controller (100) to execute a method, The controller has a communication interface (110) for connecting to the network (13) to which the information processing device (200) belongs, and the method is The session start request (32) transferred from the information processing device includes a level determination step of determining whether it indicates a predetermined security level or a security level lower than the predetermined security level, If, in the level determination step, it is determined that the session start request indicates the low security level, then a condition determination step is made to determine whether the session start request satisfies predetermined conditions (270, 270A, 270B) for demonstrating the legitimacy of the request. The process includes the step of setting a security level on a session established in response to the session start request, The aforementioned setting step is, If, in the level determination step, it is determined that the session start request indicates the predetermined security level, the predetermined security level is set for the session. A program that, in the level determination step, determines that the session start request indicates the low security level, and in the condition determination step, determines that the predetermined condition is met, sets the low security level for the session.

[0112] The embodiments disclosed herein should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims rather than by the foregoing description, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Explanation of symbols]

[0113] 6 Detection sensor, 7 Relay, 10 Processing unit, 11 System bus, 12 Power supply unit, 13 Network, 14 Input / Output unit, 21c Destination, 21d Source, 25a, 611 Username, 25b Password, 25c, 612 Role, 26a, 27a, 66a Identifier, 26c Recommendation, 27d Expiration date, 30 Main unit, 31 Secure communication version, 32 Session start request, 33 First identification information, 34 Second identification information, 40 Header, 92 Response, 100 Controller, 101 Processor, 104 Main memory, 106 Non-volatile memory, 110 USB connector, 111, 211 Security level, 120 System bus controller, 170 User-defined application, 171 Configuration program, 172 Level determination program, 173 Condition determination program, 174 Control programs, 181, 182, 183, 184, 271, 272, 273; Communication programs, 185; Management tables, 200, 200A, 200B; Support devices, 207; Monitors, 250; Account lists, 260; Version permission lists, 270, 270A, 270B; Condition tables, 275; Applicable versions, 276; Support programs, 1000; System, D1, D2 data, V1, V2, V3 versions.

Claims

1. It is a Factory Automation (FA) controller, A communication interface for connecting the network to which the information processing device belongs, A level determination unit determines whether the session start request transmitted from the information processing device indicates a predetermined security level or a security level lower than the predetermined security level. If the level determination unit determines that the session start request indicates the low security level, a condition determination unit determines whether the session start request satisfies predetermined conditions for demonstrating the legitimacy of the request. The system includes a setting unit that sets a security level on the session established in response to the session start request, The aforementioned setting unit is, When the level determination unit determines that the session start request indicates the predetermined security level, the predetermined security level is set for the session. A controller that, if the level determination unit determines that the session start request indicates the low security level, and if the condition determination unit determines that the predetermined condition is met, sets the low security level for the session.

2. The controller according to claim 1, wherein the predetermined conditions for demonstrating legitimacy include conditions for demonstrating legitimacy of the requester of the session start request.

3. The controller exchanges communication frames with the information processing device. The communication frame of the session start request includes identification information that identifies the source of the communication frame. The aforementioned condition determination unit, The controller according to claim 1 or 2, which determines whether the identification information contained in the communication frame of the session start request satisfies the conditions indicating legitimacy.

4. The controller according to claim 1 or 2, wherein the predetermined conditions include conditions for the expiration date during which the predetermined conditions can be used.

5. Prior to the session start request, the information processing device sends a negotiation request to the controller, which contains data indicating one or more security levels available to the session. The aforementioned controller, The controller according to claim 1 or 2, wherein the controller compares one or more security levels indicated by the data in the negotiation request received from the information processing device with one or more security levels available to the session, and transmits the comparison result to the information processing device.

6. The controller according to claim 1 or 2, wherein the controller, in response to a negotiation request sent from the information processing device prior to the session start request, notifies the information processing device of one or more security levels available to the session.

7. A method implemented by a Factory Automation (FA) controller, The controller has a communication interface for connecting the network to which the information processing device belongs, and the method is The session start request transmitted from the information processing device includes a level determination step of determining whether it indicates a predetermined security level or a security level lower than the predetermined security level, If, in the level determination step, it is determined that the session start request indicates the low security level, then a condition determination step is made to determine whether the session start request satisfies predetermined conditions for demonstrating the legitimacy of the request. The process includes the step of setting a security level on a session established in response to the session start request, The aforementioned setting step is, If, in the level determination step, it is determined that the session start request indicates the predetermined security level, the predetermined security level is set for the session. A method comprising setting the low security level to the session if, in the level determination step, it is determined that the session start request indicates the low security level, and if, in the condition determination step, it is determined that the predetermined condition is met.

8. A program that causes the processor of a Factory Automation (FA) controller to execute a method, The controller has a communication interface for connecting the network to which the information processing device belongs, and the method is The session start request transmitted from the information processing device includes a level determination step of determining whether it indicates a predetermined security level or a security level lower than the predetermined security level, If, in the level determination step, it is determined that the session start request indicates the low security level, then a condition determination step is made to determine whether the session start request satisfies predetermined conditions for demonstrating the legitimacy of the request. The process includes the step of setting a security level on a session established in response to the session start request, The aforementioned setting step is, If, in the level determination step, it is determined that the session start request indicates the predetermined security level, the predetermined security level is set for the session. A program that, in the level determination step, determines that the session start request indicates the low security level, and in the condition determination step, determines that the predetermined condition is met, sets the low security level for the session.

Images