JP7589557B2 - Device, method and program - Google Patents

Description

The present invention relates to a device, a method and a program.

A variety of devices, such as programmable controllers, low-voltage inverters, and programmable displays, are known as industrial devices used in factories and plants. Manufacturers of these devices often set configuration information, such as device identification information and information regarding communication encryption, before shipping the devices to their destination. The task of setting such configuration information in devices is also known as kitting.

Since the setting information contains sensitive information such as device identification information and information related to communication encryption, kitting work is generally performed in a work environment that ensures security. Specifically, for example, in a dedicated work area where entry and exit are strictly controlled, a worker writes the setting information to each device one by one using a dedicated PC for kitting. This is because if the setting information or kitting program (kitting tool) is leaked, there is a risk that device spoofing may occur.

For this reason, kitting work requires a lot of manpower, which ultimately leads to higher product prices for devices. In response to this, there is technology that makes it possible to perform kitting work simultaneously for multiple information terminals (for example, Patent Document 1).

JP 2019-67245 A

However, even if the kitting process itself is made more efficient, a dedicated work space is still required. Furthermore, entry and exit to this work space must be strictly controlled, which incurs costs for the introduction and maintenance of an access control system.

One embodiment of the present invention has been made in consideration of the above points, and aims to reduce the costs required for kitting devices.

To achieve the above object, a device according to one embodiment has a generating unit that generates configuration information including security information when it receives initial information including at least the address of a first server managed by the device manufacturer, and a transmitting unit that transmits the initial information to other devices that have not yet generated the configuration information when the configuration information is generated.

This can reduce the cost of kitting devices.

FIG. 13 is a diagram for explaining an example of kitting according to the present embodiment. FIG. 2 is a diagram illustrating an example of a hardware configuration of a device according to the embodiment. FIG. 2 is a diagram illustrating an example of a functional configuration of a device according to the embodiment. FIG. 11 is a diagram for explaining an example of initial information. FIG. 4 is a diagram for explaining an example of setting information. 10 is a flowchart illustrating an example of a flow of a process executed by the device according to the embodiment. 13 is a flowchart showing an example of the flow of a set process. 13 is a flowchart showing an example of the flow of a server connection process.

One embodiment of the present invention will be described below. In this embodiment, a device 10 that can reduce the costs required for kitting (e.g., the personnel costs required for the operation of workers, the equipment costs required for the maintenance and management of a dedicated work area, etc.) will be described.

Here, kitting of the device 10 according to this embodiment refers to generating configuration information using initial information as input, and setting this configuration information in the device 10. The initial information is information required to connect to a device management server 20 managed by the manufacturer of the device 10, and includes, for example, the address of the device management server 20. The configuration information is information related to various settings of the device 10, and includes, for example, device identification information and information related to encryption of communications. The device management server 20 is realized by a cloud server or the like, and is connected to the device 10 via the Internet or the like.

The device 10 is shipped to a customer's factory, plant, etc., after the initial information is overwritten with destination information obtained from the device management server 20. The destination information is information that includes the address of the server to which the device 10 will connect during actual operation.

<Kitting Overview>
The kitting performed by the device 10 according to this embodiment will be described below. When the device 10 according to this embodiment completes the setting of its own setting information, it transmits initial information to the other devices 10. When the initial information is input, the other devices 10 generate setting information, set it for themselves, and then transmit the initial information to the other devices 10. By repeating this process, in this embodiment, if one device 10 is kitted, the remaining devices 10 are automatically kitted. This significantly reduces personnel costs, and also eliminates the need for a dedicated work area, thereby reducing equipment costs. In the following, when distinguishing between the multiple devices 10, they will be referred to as "device 10A,""device10B,""device10C,""device10D," and the like.

Specifically, for example, as shown in FIG. 1, initial information is sent from a worker's PC or the like to device 10A, and setting information is generated and set on this device 10A. Note that the setting information is generated by executing a specific program (e.g., a setting information generation program, etc.) in a secure execution environment. Also, the setting information is stored in a secure memory.

Then, device 10A transmits initial information to device 10B, which has no setting information. As a result, setting information is generated and set in device 10B, which has received the initial information. Device 10B then transmits the initial information to device 10C, which has no setting information. Then, setting information is generated and set in device 10C, which has received the initial information, in the same way, and the initial information is then transmitted to other devices 10, which have no setting information.

On the other hand, after sending the initial information to device 10B, if there is a device 10 for which configuration information has not been set, device 10A also sends the initial information to that device 10 (device 10D in the example shown in FIG. 1). As a result, configuration information is similarly generated and set in device 10D that received the initial information, and then the initial information is sent to other devices 10 for which configuration information has not been set.

In this way, when the device 10 according to this embodiment has setting information set for itself, it transmits initial information to other devices 10 for which setting information has not been set. Furthermore, when the device 10 according to this embodiment receives initial information from other devices 10, it uses this initial information to generate setting information and sets it for itself. This allows, for example, an operator to kit only the first device 10, and the remaining devices 10 are automatically kitted. Therefore, as described above, it is possible to reduce personnel costs and equipment costs.

<Hardware Configuration>
Next, a hardware configuration of the device 10 according to the present embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the hardware configuration of the device 10 according to the present embodiment.

As shown in FIG. 2, the device 10 according to this embodiment includes an input device 101, a display device 102, an external I/F 103, a communication I/F 104, a processor 105, and a memory device 106. Each of these pieces of hardware is connected to each other so as to be able to communicate with each other via a bus 107.

The input device 101 is, for example, a physical button or a touch panel. The display device 102 is, for example, a display panel. Note that the device 10 does not necessarily have to have at least one of the input device 101 and the display device 102.

The external I/F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a USB memory and an SD memory card.

The communication I/F 104 is an interface through which the device 10 communicates with other devices 10 and various other devices. The processor 105 is, for example, various types of arithmetic units such as a CPU (Central Processing Unit) and an MPU (Micro-processing Unit). The memory device 106 is various types of storage devices such as flash memory. In particular, the memory device 106 includes a secure storage device having tamper resistance, etc.

The device 10 according to this embodiment has the hardware configuration shown in FIG. 2 and is therefore capable of executing the process of achieving the kitting described above. Note that the hardware configuration shown in FIG. 2 is merely an example, and the device 10 may have other hardware configurations. For example, the device 10 may have multiple processors 105, or multiple memory devices 106.

<Functional configuration>
Next, the functional configuration of the device 10 according to the present embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the functional configuration of the device 10 according to the present embodiment.

As shown in FIG. 3, the device 10 according to this embodiment has a determination unit 201, a device communication unit 202, a verification unit 203, a generation unit 204, a storage unit 205, a flag setting unit 206, and a server communication unit 207. Each of these units is realized, for example, by a process executed by the processor 105 of one or more programs installed in the device 10.

As shown in FIG. 3, the device 10 according to this embodiment also has a storage unit 208. The storage unit 208 is realized, for example, by the memory device 106.

The determination unit 201 determines whether or not the setting information has been set. The device communication unit 202 receives initial information from other devices 10 and transmits initial information to other devices 10. The verification unit 203 verifies the address (the address of the device management server 20) included in the initial information. When the device communication unit 202 receives the initial information, the generation unit 204 generates the setting information. The storage unit 205 stores the setting information generated by the generation unit 204 and the initial information received by the device communication unit 202 in a secure storage area of the storage unit 208. As a result, the setting information is set in the device 10.

The flag setting unit 206 determines whether a flag indicating whether the device 10 is to be connected to the device management server 20 (hereinafter also referred to as the "server connection setting flag") is ON. The flag setting unit 206 also sets the server connection setting flag to ON in response to an operation by an operator or the like at the manufacturer. Here, the server connection setting flag is set to OFF immediately after the manufacture of the device 10, and is set to ON in response to an operation by an operator or the like at the manufacturer. When the server connection setting flag is set to ON, no initial information is sent to other devices 10, and a connection to the device management server 20 is initiated.

The server communication unit 207 connects to the device management server 20 and obtains the shipping destination information of the shipping destination corresponding to itself from the device management server 20. This shipping destination information is stored in a secure memory area of the memory unit 208 by the storage unit 205.

The storage unit 208 stores setting information, initial information (or shipping destination information), etc. Note that the storage unit 208 has a secure storage area realized by a secure storage device having tamper resistance, etc., and the setting information and initial information (or shipping destination information) are saved in this secure storage area.

<<Initial Information>>
An example of the initial information will now be described with reference to Fig. 4. Fig. 4 is a diagram for explaining an example of the initial information.

As shown in FIG. 4, the initial information includes a device management server address and a CA certificate. The device management server address is an address (e.g., an IP address or a domain name) for connecting to the device management server 20. The CA certificate is information used for authentication when the device 10 connects to the device management server 20.

In this way, the initial information includes the information necessary for the device 10 to communicate securely with the device management server 20.

<Settings information>
Next, an example of the setting information will be described with reference to Fig. 5. Fig. 5 is a diagram for explaining an example of the setting information.

As shown in FIG. 5, the setting information includes a device ID, a device function, a device certificate, a device private key, and a device public key. The device ID is identification information that identifies the device 10. The device function is information that indicates the function possessed by the device 10 (for example, the standard used for encrypting communications, the type of sensor possessed by the device 10 (specific examples include a temperature sensor, a pressure sensor, etc.)). The device certificate is a certificate of the device information. The device information includes the device ID and device function of the device 10, and is stored in the memory unit 208 when the device 10 is manufactured.

The device private key is a unique private key used to encrypt communications. The device public key is a public key that pairs with the device private key. The device public key is made public to the communication destination of the device 10 (e.g., the device management server 20, a server to which the device 10 connects during actual operation, etc.).

In this way, the configuration information includes the identification information and function information of the device 10, as well as the information necessary to communicate securely with the communication destination.

<Processing flow executed by each device 10>
Next, the flow of processing executed by the device 10 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a flowchart showing an example of the flow of processing executed by the device 10 according to this embodiment. Here, steps S101 to S106 in Fig. 6 are repeatedly executed at predetermined time intervals until the shipping destination information is set in the device 10 (i.e., until the shipping destination information is stored in the storage unit 208). Note that the predetermined time interval can be determined arbitrarily, and may be, for example, several seconds to several tens of seconds.

The determination unit 201 determines whether the setting information has been set (i.e., whether the setting information has been stored in the storage unit 208) (step S101).

If it is determined in step S101 above that the setting information has already been set (i.e., the setting information has not been set), the device communication unit 202 determines whether or not initial information has been received from another device 10 (or the worker's PC, etc.) (step S102).

If it is determined in step S102 above that the initial information has not been received, the device 10 returns to step S102. In this case, the device 10 waits for the initial information to be received, and repeatedly executes step S102 at predetermined time intervals until the initial information is received.

On the other hand, if it is determined in step S102 that the initial information has been received, the verification unit 203 verifies the device management server address included in the initial information with the CA certificate included in the initial information (step S103). That is, the verification unit 203 verifies the authenticity of the device management server address included in the initial information to determine whether it has been tampered with or the like.

Next, the verification unit 203 determines whether or not the verification in step S103 above was successful (step S104).

If it is determined in step S104 above that the verification was not successful, the device 10 returns to step S102 and waits to receive the initial information. This is because if the verification is not successful, there is a risk that the initial information may have been tampered with.

On the other hand, if it is determined in step S104 that the verification is successful, the generation unit 204 generates setting information (step S105). That is, the generation unit 204 generates setting information including, for example, a device ID, a device function, a device certificate, a device private key, and a device public key. Note that the device ID and the device function are acquired from the device information. In addition, the device certificate is generated by a known algorithm (for example, an algorithm based on a standard such as X.509), and the device private key and the device public key are also generated by a known algorithm (for example, an algorithm based on a standard such as RSA).

Then, the saving unit 205 stores the setting information generated by the generating unit 204 and the initial information received by the device communication unit 202 in a secure storage area of the storage unit 208 (step S106). As a result, the initial information and the setting information are saved in the secure storage area of the storage unit 208, and the setting information is set in the device 10. Note that the device public key and device certificate included in the setting information are passed to the device management server 20.

On the other hand, if it is determined in step S101 above that the setting information has already been set, the device 10 executes the setting process (step S107).

<<Flow of configured processes>>
Next, the flow of the setting process in step S107 in Fig. 6 will be described with reference to Fig. 7. Fig. 7 is a flow chart showing an example of the flow of the setting process.

The flag setting unit 206 determines whether the server connection setting flag is ON (step S201). As described above, the server connection setting flag is set to ON in response to an operation by an operator of the manufacturer. For example, when kitting of each device 10 is completed, the operator of the manufacturer may perform an operation to set the server connection setting flag of each device 10 to ON.

The operation for turning the server connection setting flag ON may be performed using a software switch displayed on the display panel, or may be performed using a physical switch such as a DIP switch. Also, although it may be possible to turn the server connection setting flag back to OFF after it has been turned ON once, it is preferable that it cannot be turned back to OFF.

If it is determined in step S201 above that the server connection setting flag is OFF, the device communication unit 202 requests a connection to other devices 10 for which setting information has not been set (step S202). Here, the device communication unit 202 may, for example, search for other devices 10 present in the vicinity and then request a connection from other devices 10 that are waiting to receive initial information. Note that the device communication unit 202 may request a connection from other devices 10 using any communication standard, and for example, a connection may be made using short-range wireless communication such as Bluetooth (registered trademark). However, the device communication unit 202 may also connect using wired communication, and in this case, a connection may be made using, for example, a local LAN (Local Area Network) or serial communication.

Next, the device communication unit 202 determines whether or not a connection has been established to another device 10 for which configuration information has not been set (step S203).

If it is determined in step S203 above that the device 10 is unable to connect to another device 10 for which the setting information has not been set, the device 10 returns to step S202. In this case, the device 10 searches again for other devices 10 for which the setting information has not been set, and then requests a connection to the other devices 10 that are waiting to receive the initial information.

On the other hand, if it is determined in step S203 that a connection has been established to another device 10 for which no configuration information has been set, the device communication unit 202 transmits the initial information stored in the storage unit 208 to the other device 10 (step S204). As a result, the other device 10 executes the processes from step S103 in FIG. 6 onward.

If it is determined in step S201 above that the server connection setting flag is ON, the device 10 executes the server connection process (step S205).

<Server connection process flow>
Next, the flow of the server connection process in step S205 in Fig. 7 will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the flow of the server connection process.

The server communication unit 207 requests a connection to the device management server 20 (step S301). Here, the server communication unit 207 requests a connection to the device management server 20 using the device management server address included in the initial information stored in the storage unit 208. When a connection is established between the device 10 and the device management server 20, a Transport Layer Security (TLS) session is established between the device 10 and the device management server 20. When this session is established, the server communication unit 207 authenticates the device management server 20 using the CA certificate included in the initial information. Furthermore, if this authentication is successful, a session key is shared between the device 10 and the device management server 20, and the public key and private key of the device management server 20 and the device public key and device private key of the device 10 are used to generate this session key.

The server communication unit 207 determines whether or not a connection to the device management server 20 has been established (step S302).

If it is determined in step S302 above that a connection to the device management server 20 cannot be established, the device 10 returns to step S301. In this case, for example, after waiting for a predetermined time, the device 10 executes step S302 above again.

On the other hand, if it is determined in step S302 that a connection to the device management server 20 has been established, the server communication unit 207 transmits the device information stored in the storage unit 208 to the device management server 20 (step S303). The device management server 20 manages shipping destination information for each device 10, and upon receiving device information, replies with the shipping destination information corresponding to the device information. When the device management server 20 receives device information from a device 10, it verifies the authenticity of the device information using a device certificate, and replies with the shipping destination information if the verification is successful.

Next, the server communication unit 207 judges whether or not the shipping destination information has been received from the device management server 20 (step S304). When the server communication unit 207 receives the shipping destination information from the device management server 20, it verifies the authenticity of the shipping destination information using the CA certificate of the device management server 20, and performs the judgment of this step only if the verification is successful. If the verification fails, the above step S302 is executed again.

If it is determined in step S304 above that the shipping destination information has not been received, the device 10 returns to step S303. In this case, for example, after waiting for a predetermined time, the device 10 executes step S303 above again.

On the other hand, if it is determined in step S304 above that the shipping destination information has been received, the saving unit 205 overwrites the shipping destination information received by the server communication unit 207 onto the initial information stored in the memory unit 208 (step S305). As a result, the shipping destination information is saved in a secure memory area of the memory unit 208, and the shipping destination information is set in the device 10. As a result, the address of a server to be connected to at the shipping destination factory, plant, etc. is set in the device 10, and the device 10 becomes ready for shipment. Note that while the initial information is overwritten with the shipping destination information, this is just one example, and for example, the initial information may be left as it is.

<Summary>
As described above, when the device 10 according to the present embodiment has setting information set therein, it transmits initial information to other devices 10 for which setting information has not been set. Then, when the other devices 10 for which setting information has not been set receive the initial information, they generate and set setting information. As a result, for example, if an operator kits only the first device 10, the remaining devices 10 are automatically kitted, which can reduce personnel costs and equipment costs. In addition, each device 10 is automatically kitted, and the more devices 10 that have been kitted, the more devices 10 can be automatically kitted, which makes it possible to dramatically scale up the kitting work.

The present invention is not limited to the specifically disclosed embodiments above, and various modifications, variations, and combinations with known technologies are possible without departing from the scope of the claims.

10 Device 20 Device management server 101 Input device 102 Display device 103 External I/F
103a Recording medium 104 Communication I/F
105 Processor 106 Memory device 107 Bus 201 Determination unit 202 Device communication unit 203 Verification unit 204 Generation unit 205 Storage unit 206 Flag setting unit 207 Server communication unit 208 Storage unit

Claims (7)

a generating unit that generates setting information including security information when receiving initial information including at least an address of a first server managed by a device manufacturer;
a flag setting unit that sets a flag indicating whether or not the initial information is to be transmitted to other devices that have not yet generated the setting information;
a transmission unit that transmits the initial information to the other device when the flag is a value representing that the initial information is to be transmitted ;
an acquisition unit that, when the flag is a value indicating that the initial information is not to be transmitted, performs encrypted communication with the first server using the security information and the address of the first server to acquire shipping destination information including at least an address of a second server to be connected to after the device is shipped;
A device having The setting information includes identification information of the device,
The acquisition unit is
The device of claim 1 , further comprising: a device operable to obtain shipping information corresponding to an identification information of the device from the first server. The device according to claim 1 , further comprising a receiving unit that waits for reception of the initial information if the setting information has not yet been generated by the generating unit. The generation unit is
The device according to claim 1 , further comprising : a device operable to store the generated configuration information in a secure storage area. The transmission unit is
A device as described in any one of claims 1 to 4 , which searches for other devices that have not yet generated the setting information from among other devices present around the device, and transmits the initial information to the other devices found. a generation step of generating setting information including security information when initial information including at least an address of a first server managed by a device manufacturer is received;
a flag setting step of setting a flag indicating whether or not the initial information is to be transmitted to other devices that have not yet generated the setting information;
a transmission step of transmitting the initial information to the other device when the flag is a value representing that the initial information is to be transmitted ;
an acquisition step of performing encrypted communication with the first server using the security information and the address of the first server when the flag is a value indicating that the initial information is not to be transmitted, and acquiring shipping destination information including at least the address of a second server to be connected to after the device is shipped;
How a computer executes. a generation step of generating setting information including security information when initial information including at least an address of a first server managed by a device manufacturer is received;
a flag setting step of setting a flag indicating whether or not the initial information is to be transmitted to other devices that have not yet generated the setting information;
a transmission step of transmitting the initial information to the other device when the flag is a value representing that the initial information is to be transmitted ;
an acquisition step of performing encrypted communication with the first server using the security information and the address of the first server when the flag is a value indicating that the initial information is not to be transmitted, and acquiring shipping destination information including at least the address of a second server to be connected to after the device is shipped;
A program that causes a computer to execute the following.

Images