Programmable Controller Data-Level Access Control for Secure Writes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for programmable controllers in factory automation cannot set access authorities for each data referred to in a program, leading to inadequate security and access management.
Innovation Solution
A control system that includes a control unit, storage unit, and input unit to manage access authorities for each data, determining user access rights based on predefined rules and storing access history, allowing for secure access control and data protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access control is implemented at the user level only, then user management is simplified, but data-level security is insufficient
Solution Approach 1:
The access control system is segmented into two levels: user-level access control (managing which users can access the system) and data-level access control (managing which specific data variables each user can access). This segmentation allows simplified user management while simultaneously providing fine-grained data security through per-variable access authority settings.
Solution Approach 2:
The patent implements local quality by assigning different access authorities to different data variables based on their security requirements. Each variable can have its own access control settings, allowing critical data to have restricted access while non-critical data remains accessible. This enables tailored security policies for different data locations without complicating overall user management.
2Reliability
If access authority is set for each data variable, then data security is enhanced, but system complexity increases
Solution Approach 1:
The system performs preliminary action by automatically generating access authority settings during program compilation or loading. The PLC controller analyzes the program structure and pre-configures access authorities for each variable before runtime, eliminating the need for manual per-variable configuration and reducing system complexity despite fine-grained security control.
Solution Approach 2:
The access control system provides self-service by automatically managing data-level access authorities based on program analysis. The PLC controller itself performs the configuration of access rights without requiring external intervention or complex manual setup, thereby enhancing data security while keeping the system relatively simple to operate.
3Adaptability or versatility
If manual configuration of access rights is used, then flexibility is high, but time consumption increases
Solution Approach 1:
The system performs preliminary analysis of the program structure during compilation or loading phases, automatically identifying all data variables and their security requirements. This preliminary action enables the automatic generation of access authority configurations, maintaining flexibility in adapting to different programs while dramatically reducing the time required compared to manual configuration.
Solution Approach 2:
The system uses feedback from program analysis to automatically configure access rights. By analyzing the program structure and data flow, the system receives feedback about which variables need protection and configures appropriate access authorities automatically, combining the flexibility of adaptive configuration with the efficiency of automated processing.
Data Source
AI summary
An access authority is set for each data referred to by a program. A control system includes a control unit that controls a control target, a storage unit that stores a program executed by the control unit and each access authority for each of data referred to by the program, and an input unit that receives an access request for any one of the data. Each access authority includes information about an operation that can be executed by a user having each authority. The control unit refers to each access authority based on acquisition of the access request for any one of the data from the input unit, and determines whether the user who transmits the access request has the access authority for the data for which the access is requested based on each access authority.