Security method for engineering tools and industrial products, and security system

The invention includes a read-restriction setting step of setting read restriction on a program stored in hardware of an industrial product in response to a read restriction request, and a read requesting step of transmitting a read request for the program to the industrial product from an engineering tool that is a read request source. In the read-restriction setting step unique individual information retained in the hardware of the industrial product or unique individual information retained in hardware for executing an engineering tool that is a read-restriction request source is registered as registration individual information, and in the read requesting step, unique individual information retained in hardware for executing the engineering tool that is the read request source or unique individual information retained in the hardware of the industrial product is compared with the registration individual information.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a National Stage of International Application No. PCT/JP2010/056691 filed Apr. 14, 2010, the contents of all of which are incorporated herein by reference in their entirety.

FIELD

The present invention relates to a security method for engineering tools and industrial products, and a security system for applying the security method.

BACKGROUND

Conventionally, a method of using a password specified by a user as an authentication key is generally adopted to ensure security of a program stored in hardware of a factory automation (FA) product. The user having an access authority transmits the password together with a program read request to an FA device. In this case, any user not having the access authority can read the program if the user acquires the password by some means. This implies, for example, that a person with malicious intent may intercept the password and improperly execute reading of the program. Patent Literature 1 proposes a technique that enables to use a hardware key as an authentication key to enhance robustness of user authentication, for example.

CITATION LIST

Patent Literature

SUMMARY

Technical Problem

When a hardware key is used, a program read request is accepted only when authentication hardware is connected to hardware of an FA product. In this case, anyone on a network can read the program in a state where the authentication hardware device is connected to the FA product. For this reason, also when the authentication hardware device is used, a problem that it is difficult to ensure sufficient security occurs.

The present invention has been achieved in view of the above-mentioned circumstances and an object of the present invention is to provide a security method for engineering tools and industrial products and a security system, which can sufficiently ensure security.

Solution to Problem

In order to solve the above-mentioned problems and achieve the object, the present invention provides a security method for engineering tools and industrial products, the security method comprising: a read-restriction setting step of setting read restriction on a program stored in hardware of an industrial product in response to a read restriction request to the industrial product from an engineering tool that is a read-restriction request source; and a read requesting step of transmitting a read request for the program from an engineering tool that is a read request source to the industrial product, wherein in the read-restriction setting step, as registration individual information, unique individual information retained in the hardware of the industrial product is registered in hardware for executing the engineering tool that is a read-restriction request source, or unique individual information retained in hardware for executing the engineering tool that is the read-restriction request source is registered in the industrial product, and in the read requesting step, unique individual information retained in hardware for executing the engineering tool that is the read request source or unique individual information retained in the hardware of the industrial product is compared with the registration individual information.

Advantageous Effects of Invention

The security method for engineering tools and industrial products and the security system according to the present invention can ensure sufficient security.

DESCRIPTION OF EMBODIMENTS

Embodiments of a security method for engineering tools and industrial products and a security system according to the present invention will be described below in detail with reference to the drawings. The present invention is not limited to the embodiments.

First Embodiment

FIG. 1is a flowchart for explaining a procedure of setting read restriction on a program in a security method for engineering tools and industrial products according to a first embodiment of the present invention. The present embodiment is described by way of an example of a security system including personal computers (PCs) as hardware that executes engineering tools and a sequencer as hardware of an FA product (industrial product). The present embodiment is characterized in that media access control (MAC) addresses that are unique individual information pieces retained in the PCs are used for authentication to restrict reading of the program. In the present embodiment, the sequencer confirms authentication of the unique individual information.

From Step S11to Step S15that are read-restriction setting operations, read restriction on a program stored in the sequencer is set in response to a read restriction request to the FA product from an engineering tool that is a read-restriction request source. At Step S11, the engineering tool acquires a MAC address of a PC having the engineering tool installed therein.

At Step S12, the engineering tool transmits the MAC address acquired at Step S11to the sequencer together with a read restriction request. At Step S13, the sequencer determines whether or not an MAC address has been already registered therein. When no MAC address is registered in the sequencer (NO at Step S13), the sequencer writes therein the MAC address received from the engineering tool (Step S14). In this way, the MAC address retained in the PC that is intended to execute the engineering tool as the read-restriction request source is registered in the FA product as registration individual information.

Meanwhile, when a MAC address has been already registered in the sequencer (YES at Step S13), the sequencer rejects the read restriction request for the program from the engineering tool (Step S15). Accordingly, when read restriction has been already set, the read restriction is protected.

FIG. 2is a flowchart for explaining a procedure of executing reading of a program and rejecting a read request in response to the read request for the program. At Step S21, an engineering tool that is a read request source acquires a MAC address (retention individual information) of a PC having the engineering tool installed therein. At Step S22that is a read requesting operation, the engineering tool transmits the MAC address acquired at Step S21to a sequencer together with a read request. At Step S23, the sequencer determines whether or not a MAC address is already registered therein.

When no MAC address is registered in the sequencer (NO at Step S23), the sequencer executes reading of the program in response to the read request (Step S24). When no MAC address is registered, no read restriction is set and thus reading of the program is permitted in this case.

When a MAC address is registered in the sequencer (YES at Step S23), the sequencer compares the MAC address (registration individual information) registered therein with the MAC address (retention individual information) received from the engineering tool at Step S22to determine whether or not the both addresses match (Step S25). When the MAC address registered in the sequencer and the MAC address received by the sequencer match (YES at Step S25), the sequencer executes reading of the program (Step S24).

Meanwhile, when the MAC address registered in the sequencer and the MAC address received by the sequencer do not match (NO at Step S25), the sequencer rejects the read request for the program (Step S26). Furthermore, the sequencer outputs a warning of reading impossibility at Step S27. The warning is outputted as display of a message or a sound output, for example. The warning of reading impossibility may be both or one of the message display and the sound output, or intentionally, the warning does not need to be performed.

FIG. 3is an explanatory diagram of an example of executing reading of a program and rejecting a read request according to the procedure shown inFIG. 2. A sequencer1of an FA product is connected to PCs2and3through a network. It is assumed that a user sets read restriction on a program10stored in the sequencer1using the PC2in the read-restriction setting operation. An engineering tool20that is a read-restriction request source transmits a MAC address21of the PC2to the sequencer1together with a read restriction request. By the user setting the read restriction, the MAC address21of the PC2has been already registered in the sequencer1.

The user having an access authority requests reading of the program10using the PC2. The engineering tool20that is a read request source transmits the MAC address21of the PC2to the sequencer1together with a read request. Under the condition that the MAC address21already registered in the sequencer1and the MAC address21transmitted from the engineering tool20match, the sequencer1permits the read request from the user having the access authority.

On the other hand, it is assumed that a person with malicious intent having no access authority requests reading of the program10using the PC3. The sequencer1requests an engineering tool30that is a read request source in this case to transmit a MAC address31that is retention individual information. The engineering tool30that is the read request source transmits the MAC address31of the PC3to the sequencer1together with a read request. Under the condition that the MAC address21already registered in the sequencer1and the MAC address31transmitted from the engineering tool30do not match, the sequencer1rejects the read request from the person with malicious intent.

Input of a password is unnecessary for the read request from the user having the access authority. Therefore, even if there is an interception by a person with malicious intent, reading of the program10by the person with malicious intent can be prevented. In this way, as advantageous effects, sufficient security can be ensured by the security method for engineering tools and industrial products and the security system.

In the present embodiment, unique individual information to be used for authentication is not limited to the MAC address retained in a PC. The individual information may be any information as long as it is retained in hardware for executing an engineering tool and is unique to enable identification of hardware that is a read-restriction request source. In addition, when the hardware for executing an engineering tool can be identified by individual information held in the engineering tool, any unique individual information held in the engineering tool may be used for the authentication. As the individual information held in the engineering tool, an installation serial number of the engineering tool may be used, for example.

Second Embodiment

FIG. 4is a flowchart for explaining a procedure of setting read restriction on a program in a security method for engineering tools and industrial products according to a second embodiment of the present invention. The present embodiment is characterized in that a serial number that is unique individual information retained in a sequencer is used for the authentication to restrict reading of a program. In the present embodiment, the sequencer carries out authentication check of the unique individual information. Explanations of the second embodiment overlapped with the first embodiment will be omitted as appropriate.

From Step S31to Step S36that are read-restriction setting operations, read restriction on a program stored in the sequencer is set in response to a read restriction request to an FA product from an engineering tool that is a read-restriction request source. At Step S31, the engineering tool transmits a read restriction request to the sequencer. At Step S32, the sequencer determines whether or not read restriction has been already set therein.

When the read restriction has been already set in the sequencer (YES at Step S32), the sequencer rejects the read restriction request for the program from the engineering tool (Step S36). In this way, when read restriction has been already set, the read restriction is protected.

Meanwhile, when no read restriction is set in the sequencer (NO at Step S32), the sequencer transmits its own serial number to the engineering tool (Step S33). At Step S34, the sequencer writes therein information indicating that the read restriction has been already set. The order of processes of Steps S33and S34is voluntary and these processes can be performed at the same time.

The engineering tool writes the received serial number in a recording area of a PC having the engineering tool installed therein (Step S35). This causes the serial number retained in the sequencer to be registered in the PC as registration individual information. The order of processes of Step S34and S35is voluntary and these processes can be performed at the same time.

FIG. 5is a flowchart for explaining a procedure of executing reading of a program and rejecting a read request in response to the read request for the program. At Step S41, an engineering tool acquires data registered in a PC as a serial number (registration individual information). At Step S42that is a read requesting operation, the engineering tool transmits the data acquired at Step S41to the sequencer together with a read request.

At Step S43, the sequencer determines whether or not read restriction has been already set therein. Whether or not the read restriction has been already set is determined based on presence or absence of the information written at Step S34. When no read restriction is set in the sequencer (NO at Step S43), the sequencer executes reading of the program in response to the read request (Step S44). When no read restriction is set therein, reading of the program is permitted. Also when no valid data as a serial number are transmitted at Step S42because no registration individual information is registered in the PC, wherein no read restriction is set in the sequencer, the sequencer permits reading of the program.

When read restriction is set in the sequencer (YES at Step S43), the sequencer compares data received as the serial number (registration individual information) from the engineering tool at Step S42with a serial number (retention individual information) retained in the sequencer to determine whether or not the data and the serial number match (Step S45). When the data received by the sequencer and the serial number retained in the sequencer match (YES at Step S45), the sequencer executes reading of the program in response to the read request (Step S44).

Meanwhile, when the data received by the sequencer and the serial number retained in the sequencer do not match (NO at Step S45), the sequencer rejects the read request for the program (Step S46). Furthermore, the sequencer outputs a warning of reading impossibility at Step S47. The warning is outputted as display of a message or a sound output, for example. The warning of reading impossibility can be both or one of the message display and the sound output, or intentionally, the warning does not need to be performed. Also when no valid data as the serial number is transmitted at Step S42because no registration individual information is registered in the PC, wherein read restriction is set in the sequencer, the sequencer rejects reading of the program.

FIG. 6is an explanatory diagram of an example of executing reading of a program and rejecting a read request according to the procedure shown inFIG. 5. The sequencer1of an FA product is connected to the PCs2and3through a network. It is assumed that a user sets read restriction on the program10stored in the sequencer1using the PC2in a read-restriction setting operation. When the read restriction is set by the user, a serial number11of the sequencer1is registered in the PC2that executes the engineering tool20that is a read-restriction request source.

The user having an access authority requests reading of the program10using the PC2. The engineering tool20that is a read request source transmits the serial number11registered in the PC2to the sequencer1together with a read request. Under the condition that the serial number11received by the sequencer1and the serial number11retained in the sequencer1match, the sequencer1permits the read request from the user having the access authority.

On the other hand, it is assumed that a person with malicious intent having no access authority requests reading of the program10using the PC3. The sequencer1requests transmission of the serial number11that is registration individual information to the engineering tool30that is a read request source in this case. Because no valid data are transmitted from the engineering tool30as the read request source as the serial number11, the sequencer1rejects the read request. In this way, the sequencer1rejects the read request from the person with malicious intent.

Input of a password is unnecessary for a read request from the user having the access authority. Therefore, even if there is an interception by a person with malicious intent, reading of the program10by the person with malicious intent can be prevented. Also in the present embodiment, sufficient security can be ensured as in the first embodiment.

Unique individual information to be used for authentication in the present embodiment is not limited to the serial number retained in the sequencer. The individual information may be any information as long as it is retained in hardware of the industrial product and is unique to enable identification of the hardware of the industrial product.

Third Embodiment

FIG. 7is a flowchart for explaining a procedure of setting read restriction on a program in a security method for engineering tools and industrial products according to a third embodiment of the present invention. The present embodiment is characterized in that reading of a program is restricted using the MAC address of a PC and the serial number of the sequencer for authentication. In the present embodiment, the sequencer carries out authentication check of unique individual information. Explanations of the third embodiment overlapped with the first and second embodiments will be omitted as appropriate.

From Step S51to Step S57that are read-restriction setting operations, read restriction on a program stored in a sequencer is set in response to a read restriction request to an FA product from an engineering tool that is a read-restriction request source. At Step S51, the engineering tool acquires the MAC address of a PC having the engineering tool installed therein.

At Step S52, the engineering tool transmits the MAC address acquired at Step S51to the sequencer together with the read restriction request. At Step S53, the sequencer determines whether or not a MAC address has been already registered therein. When a MAC address has been already registered in the sequencer (YES at Step S53), the sequencer rejects the read restriction request for the program from the engineering tool (Step S57). In this way, when read restriction has been already set, the read restriction is protected.

Meanwhile, when no MAC address is registered in the sequencer (NO at Step S53), the sequencer writes therein the MAC address received from the engineering tool (Step S54). This causes the MAC address retained in the PC that executes the engineering tool that is the read-restriction request source, to be registered in the FA product as first registration individual information.

The sequencer then transmits its own serial number to the engineering tool (Step S55). The engineering tool writes the received serial number in a recording area of the PC having the engineering tool installed therein (Step S56). This causes the serial number retained in the sequencer to be registered as second registration individual information in the PC that executes the engineering tool that is the read-restriction request source.

FIG. 8is a flowchart for explaining a procedure of executing reading of a program and rejecting a read request, in response to the read request for the program. At Step S61, an engineering tool that is a read request source acquires a MAC address (first retention individual information) of a PC having the engineering tool installed therein. At Step S62, the engineering tool acquires data registered as a serial number (second registration individual information) in the PC. At Step S63that is a read requesting operation, the engineering tool transmits the MAC address acquired at Step S61and the data acquired at Step S62to the sequencer together with a read request.

At Step S64, the sequencer determines whether or not a MAC address has been already registered therein. When no MAC address is registered in the sequencer (NO at Step S64), the sequencer executes reading of the program in response to the read request (Step S65). When no MAC address is registered therein, no read restriction is set and thus the sequencer permits reading of the program in this case.

When a MAC address is registered in the sequencer (YES at Step S64), the sequencer compares the MAC address (first registration individual information) registered therein with the MAC address (first retention individual information) received from the engineering tool at Step S63to determine whether or not these MAC addresses match at Step S66. At Step S66, the sequencer also compares the data received as the serial number (second registration individual information) from the engineering tool at Step S63with a serial number (second retention individual information) retained therein to determine whether or not the data and the serial number match.

When the MAC address already registered in the sequencer and the MAC address received by the sequencer match and the data received as the serial number by the sequencer and the serial number retained in the sequencer match (YES at Step S66), the sequencer executes reading of the program in response to the read request (Step S65).

On the other hand, in at least one of the case where the MAC address registered in the sequencer and the MAC address received by the sequencer do not match and the case where the data received by the sequencer and the serial number retained in the sequencer do not match (NO at Step S66), the sequencer rejects the read request for the program (Step S67). Furthermore, the sequencer outputs a warning of reading impossibility at Step S68. The warning is outputted as display of a message or a sound output, for example. The warning of reading impossibility may be both or one of the message display and the sound output, or intentionally, the warning does not need to be performed.

FIG. 9is an explanatory diagram of an example of executing reading of a program and rejecting a read request according to the procedure shown inFIG. 8. The sequencer1of an FA product is connected to the PCs2and3through a network. It is assumed that a user sets read restriction on the program10stored in the sequencer1using the PC2in the read-restriction setting operation.

The engineering tool20that is a read-restriction request source transmits the MAC address21of the PC2to the sequencer1together with read restriction request. Because the user has set the read restriction, the MAC address21of the PC2has been registered in the sequencer1. Furthermore, a serial number11of the sequencer1has been already registered in the PC2for executing the engineering tool20that is the read-restriction request source by virtue of the user's setting of the read restriction.

The user having an access authority requests reading of the program10using the PC2. The engineering tool20that is a read request source transmits the MAC address21of the PC2and the serial number11registered in the PC2to the sequencer1together with a read request. Under the condition that the MAC address21registered in the sequencer1and the MAC address21transmitted from the engineering tool20match and the serial number11received by the sequencer1and the serial number11retained in the sequencer1match, the sequencer1permits the read request from the user having the access authority.

On the other hand, it is assumed that a person with malicious intent having no access authority requests reading of the program10using the PC3. The sequencer1requests the engineering tool30that is the read request source in this case to transmit the MAC address31that is the first retention individual information and the serial number11that is the second registration individual information. The engineering tool30as the read request source transmits the MAC address31of the PC3to the sequencer1together with a read request.

Because the MAC address21registered in the sequencer1and the MAC address31transmitted from the engineering tool30do not match and no valid data are transmitted as the serial number11from the engineering tool30, the sequencer1rejects the read request. In this way, the sequencer1rejects a read request from a person with malicious intent.

In the present embodiment, double authentication using the MAC address of a PC and the serial number of the sequencer is adopted, thereby making it possible to ensure higher security. Also in the present embodiment, unique individual information to be used for the authentication is not limited to the MAC address retained in a PC and the serial number retained in the sequencer, and may be any information.

Fourth Embodiment

FIG. 10is a flowchart for explaining a procedure of setting read restriction on a program in a security method for engineering tools and industrial products according to a fourth embodiment of the present invention. In the present embodiment, unique individual information retained in each PC, e.g., the MAC address is used for authentication to restrict reading of a program. In the present embodiment, a PC that is hardware for executing an engineering tool carries out authentication check of the unique individual information.

In a read-restriction setting operation (from Step S71to Step S77), read restriction on a program stored in a sequencer is set in response to a read restriction request to an FA product from an engineering tool that is a read-restriction request source. The engineering tool acquires a MAC address of a PC having the engineering tool installed therein (Step S71).

The engineering tool transmits to the sequencer an acquisition request for acquiring the MAC address of the PC from the sequencer (Step S72). The sequencer transmits information retained therein to the engineering tool in response to the acquisition request (Step S73).

The engineering tool then compares the MAC address acquired from the PC with the information received from the sequencer to determine whether or not the MAC address of the PC has been already registered in the sequencer (Step S74). For example, when no MAC address is registered in the sequencer, a specific initial value is stored in an area for retaining the MAC address of a PC so that a registration state can be determined by only referring to the information stored in the area.

When a MAC address of a PC is registered in the sequencer (YES at Step S74), the engineering tool rejects the read restriction request for the program (Step S77).

On the other hand, when no MAC address is registered in the sequencer (NO at Step S74), the engineering tool transmits a read restriction request to the sequencer with the MAC address of the PC having the engineering tool installed therein (Step S75). The sequencer registers therein the MAC address received from the engineering tool (Step S76). In this way, the MAC address retained in the PC that executes the engineering tool that is the read-restriction request source is registered in the FA product as registration individual information.

FIG. 11is a flowchart for explaining a procedure of executing reading of a program and rejecting the reading, in response to a read request for the program. An engineering tool that is a read request source acquires a MAC address (retention individual information) of a PC having the engineering tool installed therein (Step S81). The engineering tool transmits to a sequencer an acquisition request for acquiring a MAC address of a PC from the sequencer (Step S82). The sequencer transmits information retained therein to the engineering tool in response to the acquisition request (Step S83).

The engineering tool then compares the MAC address acquired from the PC with the information received from the sequencer to determine whether or not a MAC address of a PC has been already registered in the sequencer (Step S84). When no MAC address has been registered in the sequencer (NO at Step S84), the engineering tool transmits a read request for the program to the sequencer (Step S85). The sequencer executes reading of the program in response to the read request (Step S86).

When a MAC address is registered in the sequencer (YES at Step S84), the engineering tool compares the MAC address (retention individual information) acquired from the PC with the MAC address (registration individual information) received from the sequencer in response to the acquisition request (Step S87). When the MAC address acquired from the PC and the MAC address received from the sequencer match (YES at Step S87), the engineering tool transmits a read request for the program to the sequencer (Step S85). The sequencer executes reading of the program in response to the read request (Step S86).

On the other hand, when the MAC address acquired from the PC and the MAC address received from the sequencer do not match (NO at Step S87), the engineering tool rejects reading of the program (Step S88). Furthermore, the engineering tool outputs a warning of reading impossibility (Step S89). The warning is outputted as display of a message or a sound output, for example. The warning of reading impossibility may be both or one of the message display and the sound output, or intentionally, the warning does not need to be performed.

Also in the present embodiment, sufficient security can be ensured. In the present embodiment, unique individual information to be used for the authentication is not limited to the MAC address retained in the PC. The individual information may be any information as long as it is retained in hardware for executing an engineering tool and is unique to enable identification of hardware that is a read-restriction request source.

When hardware for executing an engineering tool can be identified by individual information held in the engineering tool, unique individual information held in the engineering tool may be used for the authentication. As the individual information held in the engineering tool, an installation serial number of the engineering tool may be used, for example.

Fifth Embodiment

FIG. 12is a flowchart for explaining a procedure of setting read restriction on a program in a security method for engineering tools and industrial products according to a fifth embodiment of the present invention. The present embodiment restricts reading of the program using unique individual information retained in a sequencer, for example, a serial number for authentication. In the present embodiment, a PC that is hardware that executes an engineering tool carries out authentication check of unique individual information.

In read-restriction setting operations (from Step S91to Step S98), read restriction on a program stored in a sequencer is set in response to a read restriction request to an FA product from an engineering tool that is a read-restriction request source. The engineering tool transmits to the sequencer an acquisition request for acquiring set state information of read restriction (Step S91). The sequencer transmits the set state information of read restriction to the engineering tool in response to the acquisition request (Step S92). The set state information of read restriction is information indicating whether or not read restriction on a program has been set in the sequencer.

The engineering tool determines whether or not read restriction has been already set in the sequencer based on the set state information of read restriction received from the sequencer (Step S93). When read restriction has been already set in the sequencer (YES at Step S93), the engineering tool rejects the read restriction request for the program (Step S98).

On the other hand, when no read restriction is set in the sequencer (NO at Step S93), the engineering tool transmits to the sequencer an acquisition request for acquiring a serial number of the sequencer (Step S94). The sequencer transmits the serial number retained therein to the engineering tool in response to the acquisition request (Step S95).

The sequencer registers therein information about the fact that read restriction has been already registered, as set state information of read restriction to be retained therein (Step S96). The order of processes of Steps S95and S96is voluntary and these processes may be performed at the same time. The engineering tool stores the serial number received from the sequencer in the PC (Step S97). In this way, the serial number retained in the sequencer is registered as registration individual information in the PC. The order of processes of Steps S96and S97is voluntary and these processes may be performed at the same time.

FIG. 13is a flowchart for explaining a procedure of executing reading of a program and rejecting the reading in response to a read request for the program. An engineering tool transmits to a sequencer an acquisition request for acquiring set state information of read restriction (Step S101). The sequencer transmits the set state information of read restriction to the engineering tool in response to the acquisition request (Step S102).

The engineering tool determines whether or not read restriction has been already set in the sequencer based on the set state information of read restriction received from the sequencer (Step S103). When no read restriction has been set in the sequencer (NO at Step S103), the engineering tool transmits a read request for the program to the sequencer (Step S104). The sequencer executes reading of the program in response to the read request (Step S105).

When read restriction has been set in the sequencer (YES at Step S103), the engineering tool transmits to the sequencer an acquisition request for acquiring a serial number of the sequencer (Step S106). The sequencer transmits the serial number retained therein to the engineering tool in response to the acquisition request (Step S107).

The engineering tool then compares a serial number (registration individual information) registered in the PC with the serial number (retention individual information) received from the sequencer in response to the acquisition request (Step S108). When the serial number registered in the PC and the serial number received from the sequencer match (YES at Step S108), the engineering tool transmits a read request for the program to the sequencer (Step S104). The sequencer executes reading of the program in response to the read request (Step S105).

On the other hand, when the serial number registered in the PC and the serial number received from the sequencer do not match (NO at Step S108), the engineering tool rejects reading of the program (Step S109). Furthermore, the engineering tool outputs a warning of reading impossibility (Step S110). The warning is outputted as display of a message or a sound output, for example. The warning of reading impossibility may be both or one of the message display and the sound output, or intentionally, the warning does not need to be performed.

Also in the present embodiment, sufficient security can be ensured. Unique individual information to be used for the authentication in the present embodiment is not limited to the serial number retained in the sequencer. The individual information may be any information as long as it is retained in hardware of an industrial product and is unique to enable identification of the hardware of the industrial product.

Sixth Embodiment

FIG. 14is a flowchart for explaining a procedure of setting read restriction on a program in a security method for engineering tools and industrial products according to a sixth embodiment of the present invention. The present embodiment restricts reading of the program using a MAC address of a PC and a serial number of a sequencer for authentication. In the present embodiment, a PC that is hardware that executes an engineering tool carries out authentication check of unique individual information.

In read-restriction setting operations (from Step S111to Step S119), read restriction on a program stored in a sequencer is set in response to a read restriction request to an FA product from an engineering tool that is a read-restriction request source. The engineering tool acquires a MAC address of a PC having the engineering tool installed therein (Step S111).

The engineering tool transmits to a sequencer an acquisition request for acquiring a MAC address of a PC from the sequencer (Step S112). The sequencer transmits information retained therein to the engineering tool in response to the acquisition request (Step S113).

The engineering tool then compares the MAC address acquired from the PC with the information received from the sequencer to determine whether or not a MAC address of a PC has been already registered in the sequencer (Step S114). When a MAC address of a PC has been registered in the sequencer (YES at Step S114), the engineering tool rejects a read restriction request for the program (Step S119).

On the other hand, when no MAC address is registered in the sequencer (NO at Step S114), the engineering tool transmits a read restriction request to the sequencer with the MAC address of the PC having the engineering tool installed therein (Step S115). The sequencer registers therein the MAC address received from the engineering tool (Step S116). In this way, the MAC address retained in the PC for executing the engineering tool that is the read-restriction request source is registered in the FA product as first registration individual information.

The sequencer transmits a serial number retained therein to the engineering tool (Step S117). The engineering tool stores the serial number received from the sequencer in the PC (Step S118). In this way, the serial number retained in the sequencer is registered as second registration individual information in the PC for executing the engineering tool that is the read-restriction request source.

FIG. 15is a flowchart for explaining a procedure of executing reading of a program and rejecting the reading in response to a read request for the program. An engineering tool acquires a MAC address of a PC having the engineering tool installed therein (Step S121). The engineering tool transmits to a sequencer an acquisition request for acquiring a MAC address of a PC from the sequencer (Step S122). The sequencer transmits information retained therein to the engineering tool in response to the acquisition request (Step S123).

The engineering tool then compares the MAC address acquired from the PC with the information received from the sequencer to determine whether or not a MAC address of a PC has been already registered in the sequencer (Step S124). When no MAC address has been registered in the sequencer (NO at Step S124), the engineering tool transmits a read request for the program to the sequencer (Step S125). The sequencer performs reading of the program in response to the read request (Step S126).

When a MAC address has been registered in the sequencer (YES at Step S124), the engineering tool compares the MAC address (first retention individual information) acquired from the PC with the MAC address (first registration individual information) received from the sequencer in response to the acquisition request (Step S127).

When the MAC address acquired from the PC and the MAC address received from the sequencer match (YES at Step S127), the engineering tool acquires a serial number registered in the PC (Step S128). The engineering tool also transmits to the sequencer an acquisition request for acquiring a serial number of the sequencer (Step S129).

The engineering tool then compares the serial number (second registration individual information) registered in the PC with the serial number (second retention individual information) received from the sequencer in response to the acquisition request (Step S130). When the serial number registered in the PC and the serial number received from the sequencer match (YES at Step S130), the engineering tool transmits a read request for the program to the sequencer (Step S125). The sequencer executes reading of the program in response to the read request (Step S126).

When the MAC address acquired from the PC and the MAC address received from the sequencer do not match (NO at Step S127) or when the serial number registered in the PC and the serial number received from the sequencer do not match (NO at Step S130), the engineering tool rejects reading of the program (Step S131). Furthermore, the engineering tool outputs a warning of reading impossibility (Step S132). The warning is outputted as display of a message or a sound output, for example. The warning of reading impossibility may be both or one of the message display and the sound output, or intentionally, the warning does not need to be performed.

In the present invention, double authentication using the MAC address of the PC and the serial number of the sequencer is adopted thereby making it possible to ensure higher security. Also in the present embodiment, unique individual information to be used for the authentication is not limited to the MAC address retained in the PC and the serial number retained in the sequencer and may be any information.

If read restriction on a program is set between hardware of an FA product and hardware that executes an engineering tool, when identification information for identifying the hardware of the FA product and determination information transmitted or received by the engineering tool to identify the hardware of the FA product has a functional relation (a relation that enables to uniquely determine one when the other is determined), the following may be adopted. The hardware that executes the engineering tool retains one of the identification information and the determination information as well as set state information of read restriction, so that read restriction can be executed without accessing the hardware of the FA product. In this way, the number of communications to be performed between the hardware of the FA product and the hardware that executes the engineering tool can be reduced.

INDUSTRIAL APPLICABILITY

As described above, the security method for engineering tools and industrial products and the security system according to the present invention are useful for ensuring security of a program stored in hardware of an FA product.

REFERENCE SIGNS LIST