Patent Description:
In many production sites, machinery and equipment that have been and are currently used in the sites may be typically controlled by control systems including control devices, for example, programmable logic controllers (hereinafter, may be referred to as "PLC"). Conventionally, data stored in removable storage media are often used in such control systems for system recovery or update of programs and/or data.

For example, <CIT> (patent literature <NUM>) describes a backup and restoration system operable to backup or restore set values of target parameters in communication devices using a backup and restoration unit connected to the programmable logic controller (PLC). In this backup and restoration system, backup data stored in a removable storage medium, such as a memory card, is used to restore various pieces of data.

<CIT> discloses a semiconductor memory card comprising a control IC, a flash memory, and a ROM. The ROM holds information such as a medium ID unique to the semiconductor memory card. The flash memory includes an authentication memory and a non-authentication memory. The authentication memory can be accessed only by external devices which have been affirmatively authenticated. The non-authentication memory can be accessed by external devices whether the external devices have been affirmatively authenticated or not. The control IC includes control units, an authentication unit and the like. The control units control accesses to the authentication memory and the non-authentication memory, respectively. The authentication unit executes a mutual authentication with an external device.

<CIT> discloses a memory storing public and confidential information that is removably connected to a host device. General information on data stored in memory devices is accessible to the host device without authentication. Only a portion of confidential information stored in the memory device is accessible through the host device to an authenticated entity, where the entity has access rights to such portion. The entity is not able to access other portions of confidential information to which it has no rights. The public and confidential information is stored in a non-volatile storage medium, and a controller controls the supply of information.

<CIT> discloses an information access control method for limiting access to particular information of an information system side according to authentication of an external recording medium. The information access control method accesses the information data on the information system by using an external recording medium. The external recording medium contains system user information and the information system contains corresponding system user information. When the information system user information is sent to the information system as a request for connection to the external recording medium, the information system compares the system user information sent by the connection request and the system user information registered. If the comparison results in coincidence, the external recording medium is allowed to access the information data on the system within a range specified by the system user information.

In the known art, data may be often stored in removable storage media and accessed from devices including PLC whenever necessary, as in the backup and restoration system described in the patent literature <NUM>. Such removable storage media that users can easily carry with them are very user-friendly. On the other hand, such media that involve the risk of being stolen may raise certain concerns about security. An example of typical theft preventive measures may be access control through individual authentication using host devices authorized beforehand for the respective storage media. In the FA (factory automation)-related fields, however, the media, in practical use, may not always be inserted in the authorized host devices.

To address these issues of the known art, this disclosure is directed to providing a technology that can offer enhanced security without compromising user-friendliness in data accesses to removable storage media.

An aspect of this disclosure provides a control system as specified in claim <NUM>.

In the control system disclosed herein, when a storage medium is received by the first device, any members included in the members but the first device verify the relevant information, and it is not until results of the verification satisfy a predetermined condition that the data stored in the storage medium becomes accessible. This may offer an improved level of security while ensuring user-friendliness in accesses to the data stored in the removable storage medium.

In the control system disclosed herein, the first device includes a reader including a concealed logic for exclusive use, and the storage medium is configured to permit access from the reader alone.

In the control system thus characterized in that the storage medium can only be accessed from the reader of the first device including the concealed logic for exclusive use, a higher level of security may be ensured in data accesses to the removable storage medium.

The control system may be as specified in claim <NUM>.

In the control system thus characterized in that the data stored in the storage medium can only be accessed after a predetermined condition is satisfied by a result of the verification of the serial number used to identify each member. This may offer even a higher degree security in data accesses to the removable storage medium.

In the control system thus characterized in that the data stored in the storage medium can only be accessed after a predetermined condition is satisfied by a result of the verification of the model code of each member. Thus, accesses to the data stored in the storage medium may be enabled for the members of the same model code having different serial numbers. This may ensure a good balance between user-friendliness and better security in data accesses to the removable storage medium.

In the control system thus characterized in that a user is allowed to select, using the support device, which one of the following is desirably verified; serial numbers used to individually identify the members, and model codes of the members. Thus, the control system may be successfully built in a suitable manner for a level of security required of the system.

The control system disclosed herein further includes a support device configured to support the device group. The support device provides a user interface configured to set a number of any members included in the members but the first device to be verified.

In the control system thus characterized in that a user is allowed to set, using the support device, the number of members to be verified. Thus, the control system may be successfully built in a suitable manner for a level of security required of the system.

The control system disclosed herein further includes a support device configured to support the device group. The support device provides a user interface configured to set a range of applicable members among the members.

In the control system thus characterized in that a user is allowed to set, using the support device, a range of applicable members. Thus, the control system may be successfully built in a suitable manner for a level of security required of the system.

Another aspect of this disclosure provides a method as specified in claim <NUM>.

In the method disclosed herein, when a storage medium is received by the first device, any members included in the members but the first device verify the relevant information, and it is not until results of the verification satisfy a predetermined condition that the data stored in the storage medium becomes accessible. This may offer an improved level of security while ensuring user-friendliness in accesses to the data stored in the removable storage medium.

Yet another aspect of this disclosure provides a first device as specified in claim <NUM>.

In the first device disclosed herein, when a storage medium is received by the first device, any members included in the members but the first device verify the relevant information, and it is not until results of the verification satisfy a predetermined condition that the data stored in the storage medium becomes accessible. This may offer an improved level of security while ensuring user-friendliness in accesses to the data stored in the removable storage medium.

Embodiments of the technology disclosed herein are hereinafter described in detail referring to the accompanying drawings. Any identical, similar and corresponding components are simply marked with like reference signs. Such components, once they are described, will not be repetitively described.

Hereinafter is described an exemplified case to which the technology disclosed herein is applicable.

<FIG> is a diagram that schematically illustrates an exemplified case to which a control system <NUM> is applicable. As illustrated in <FIG>, control system <NUM> according to embodiments of this disclosure includes a device group including a plurality of devices that are allowed to communicate with one another.

In the specification of this disclosure, the "device" may refer a target element to be controlled that constitutes control system <NUM>, and programs, configuration settings and parameters required of computations for control may be generated and managed per each device. The "device" may typically encompass in its scope a programmable logic controller (PLC) which is a processing entity in charge of executing a control program (which may include sequence control and motion control), and peripheral devices connected to the PLC. The peripheral device may typically be a device that transmits and receives, to and from targets to be controlled, input and output data handled in the PLC. Specific examples of the peripheral device may include unit, slave device and coupler unit.

In the example illustrated in <FIG>, control system <NUM> includes the following devices; a programmable logic controller (PLC) <NUM>, and a plurality of units <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> and <NUM>-<NUM> (hereinafter, may be collectively referred to as "units <NUM>") connectable to the PLC <NUM> in a manner that these units are allowed to communicate with the PLC. PLC <NUM> is presented an example of the "first device", and units <NUM> are presented as an example of the "second device". The "first device" and the "second device" may be any one of such devices as PLC, unit, slave device, and coupler unit.

With PLC <NUM> being disposed in a slot <NUM> (Slot <NUM> in the drawing) as a key device, unit <NUM>-<NUM> is disposed in a slot <NUM> (Unit <NUM> in the drawing), unit <NUM>-<NUM> is disposed in a slot <NUM> (Unit <NUM> in the drawing), unit <NUM>-<NUM> is disposed in a slot <NUM> (Unit <NUM> in the drawing), and unit <NUM>-<NUM> is disposed in a slot <NUM> (Unit <NUM> in the drawing). These units <NUM>-<NUM> to <NUM>-<NUM> are connected to PLC <NUM> through a local bus <NUM> and are thereby allowed to communicate with PLC <NUM>.

Control system <NUM> further includes a support device <NUM> configured to support the device group. Support device <NUM> is in charge of developing and managing control programs executed in the devices of control system <NUM> and parameters required of this system. PLC <NUM> is equipped with a USB (Universal Serial Bus) connector <NUM> connectable to and allowed to communicate with support device <NUM>. Any programs and parameters for settings developed by support device <NUM> are transferred (downloaded) through USB connector <NUM> into PLC <NUM> and units <NUM> by way of a network <NUM>.

Control system <NUM> thus configured is loaded with functions for system recovery and update of data and programs in which the data stored in removable storage media is used. For example, PLC <NUM> has a memory card interface <NUM> which receives memory card <NUM> in a removable manner. The data can be acquired by accessing memory card <NUM> mounted to memory card interface <NUM>. Memory card interface <NUM> is an example of the "receiving portion".

A specific use of this memory card interface may be backup and recovery of the system. For example, a user may store and save, in memory card <NUM>, pieces of data used in the devices through memory card interface <NUM>. The device, if it breaks down, may be replaced with a new device, and the data saved and stored in memory card <NUM> (hereinafter, may be referred to as "backup data") may be reloaded in the new device. This process may also be referred to as "restoration". The backup data may typically be used to fix any bugs and errors of control system <NUM>.

Memory card <NUM> described herein as an example of the "storage medium" may be selected from any removable memory cards such as SD (Secure Digital) cards. Other examples of the "storage medium" may include any removable storage media such as USB memory, compact flash (registered trademark) and memory stick.

The "data" stored in the storage medium may include the backup data described earlier, programs and parameters used in the devices, and log data and trace data obtained by the devices.

The backup data may be stored in removable memory card <NUM> to invite the devices, for example, PLC <NUM>, to access the stored data, whenever necessary. Such removable memory card <NUM> that users can easily carry with them is thus very user-friendly. On the other hand, such removable medium that involves the risk of being stolen may raise certain concerns about security. An example of typical theft preventive measures may be access control through individual authentication using a host device(s) authorized beforehand for memory card <NUM>. In the FA (factory automation)-related fields, however, memory card <NUM>, in practical use, may not always be inserted in such an authorized host device.

For example, a system with a higher level of security may certainly be feasible as a tighter access restriction is imposed on memory card <NUM>. This, however, may invite the risk of poor workability in practical use. To cope with such a trade-off problem, control system <NUM> according to the embodiments disclosed herein is provided with a technology that may ensure a higher level of security without compromising user-friendliness in data accesses to the data in removable memory card <NUM>.

Specifically, control system <NUM> is so configured that, in case memory card <NUM> inserted in a particular device of the device group fails to authenticate the device loaded with memory card <NUM>, this particular device is enabled to access the data in memory card <NUM>, insofar as consistency is determined among configurations of the other devices of the device group currently interconnected. This technical feature is hereinafter described in detail.

In this embodiment, memory card <NUM> and the devices including PLC <NUM> and units <NUM>-<NUM> to <NUM>-<NUM> may be each referred to as "member". The members each include a storage region in which a list containing pieces of relevant information associated with the members is retainable. The "relevant information" may be any information that can be used to identify each member. In this embodiment, the relevant information may include model codes (Model in the drawing) and serial numbers (Serial in the drawing).

The "model code" represents a model that allows each member to be distinguished from the other members based on differences in structure, facility and outer shape. The "serial number" represents a number that can be used to individually identify each member, an example of which may be a unique production number assigned to each product to be shipped out. The serial number is typically unique to each member, which may avoid the risk of different serial numbers being redundantly used among the members. On the other hand, the model codes are respectively assigned to specific models of products, which may possibly be shared among some of the members.

As for PLC <NUM> illustrated in the example of <FIG>, "A" as model code and "a" as serial number are assigned to this device. As for unit <NUM>-<NUM> illustrated in this drawing, "B" as model code and "b" as serial number are assigned to this device. As for unit <NUM>-<NUM> illustrated in this drawing, "B" as model code and "c" as serial number are assigned to this device. As for unit <NUM>-<NUM> illustrated in this drawing, "C" as model code and "d" as serial number are assigned to this device. As for unit <NUM>-<NUM> illustrated in this drawing, "C" as model code and "e" as serial number are assigned to this device. While the unique serial numbers are thus assigned to PLC <NUM> and units <NUM>-<NUM> to <NUM>-<NUM>, the same model code "B" is assigned to units <NUM>-<NUM> and <NUM>-<NUM> and the same model code "C" is assigned to units <NUM>-<NUM> and <NUM>-<NUM>.

As for memory card <NUM>, "X" as model code and "y" as serial number are assigned to this member.

Memory card <NUM> retains a list <NUM>, PLC <NUM> retains a list <NUM>, and units <NUM>-<NUM> to <NUM>-<NUM> respectively retain lists <NUM>-<NUM> to <NUM>-<NUM>. These lists are prepared by support device <NUM> and transferred into the devices. These lists are also retained in memory card <NUM> by way of support device <NUM> or PLC <NUM>.

In the example of <FIG> are illustrated contents of list <NUM> retained in memory card <NUM>. List <NUM> contains the model codes (Model) and the serial numbers (Serial) assigned to slots <NUM> to <NUM> and also contains the model code (Model) and the serial number (Serial) of memory card <NUM>. Thus, memory card <NUM> is allowed to grasp the members currently on the system by checking list <NUM>.

The contents of the lists retained by the members remain unchanged unless the members are changed or replaced. Specifically, list <NUM> illustrated in <FIG> have the same contents as those of list <NUM> retained by PLC <NUM> and of lists <NUM>-<NUM> to <NUM>-<NUM> retained by units <NUM>-<NUM> to <NUM>-<NUM>.

Further, the members are configured to verify pieces of relevant information associated with and obtained from the other members against pieces of relevant information associated with the other members and included in the lists retained by the other members.

Specifically, memory card <NUM> verifies the model codes and the serial numbers of and obtained from the other members (PLC <NUM>, units <NUM>) against the model codes and the serial numbers of the other members (PLC <NUM>, units <NUM>) included in the list currently retained by memory card <NUM> to determine consistency or inconsistency between these pieces of relevant information of the other members (PLC <NUM>, units <NUM>) obtained from the different sources.

Similarly, PLC <NUM> verifies the model codes and the serial numbers of and obtained from the other members (memory card <NUM>, unit <NUM>) against the model codes and the serial numbers of the other members (memory card <NUM>, unit <NUM>) included in the list currently retained by PLC <NUM> to determine consistency or inconsistency between these pieces of relevant information of the other members (memory card <NUM>, unit <NUM>) obtained from the different sources.

Similarly, units <NUM> verify the model codes and the serial numbers of and obtained from the other members (memory card <NUM>, PLC <NUM>, other units <NUM>) against the model codes and the serial numbers of the other members (memory card <NUM>, PLC <NUM>, other units <NUM>) included in the lists currently retained by units <NUM> to determine consistency or inconsistency between these pieces of relevant information of the other members (memory card <NUM>, PLC <NUM>, other units <NUM>) obtained from the different sources.

When memory card <NUM> is inserted in PLC <NUM>, accesses by PLC <NUM> to the data stored in memory card <NUM> are enabled, insofar as results of verification by the members satisfy a predetermined condition. The "predetermined condition" may be optionally selected from any conditions under which the data stored in memory card <NUM> is accessible in view of security.

When, for example, memory card <NUM> is inserted in PLC <NUM>, the members currently on the system are verified by any members included in the members but PLC <NUM> (memory card <NUM>, unit <NUM>) based on the lists retained by the members except PLC <NUM>. Then, accesses by PLC <NUM> to the data stored in memory card <NUM> are enabled, insofar as the degree of consistency between results of verification by the members is greater than a certain value.

In control system <NUM> according to the embodiments, when memory card <NUM> is received by PLC <NUM>, the data stored in memory card <NUM> only becomes accessible after a predetermined condition is satisfied by results of verification of the relevant information by any members included in the members but PLC <NUM> (memory card <NUM>, units <NUM>). This may ensure a higher level of security without compromising user-friendliness in accesses to the data stored in removable memory card <NUM>.

Next, hardware components and configurations of the devices included in control system <NUM> are hereinafter described.

<FIG> is a block diagram that schematically illustrates exemplified hardware components of PLC <NUM> and an exemplified configuration of memory card <NUM> according to the embodiments. As illustrated in <FIG>, PLC <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, a network controller <NUM> and a memory card interface <NUM>. These components are interconnected through a processor bus <NUM>.

Processor <NUM> is a computing unit configured to execute computations for control, and elements constituting this processor include a CPU (Central Processing Unit) and a GPU (Graphics Processing Unit). Specifically, processor <NUM> reads programs stored in storage <NUM> (for example, control program <NUM>, system program <NUM>, restoration program <NUM>) and then expands and runs the read programs on main memory <NUM>, so that predetermined processes for control are executed.

In <FIG> is presented an example in which functions required of PLC <NUM> are offered by prompting processor <NUM> to run predetermined programs. Instead, the functions thus offered may be implemented in part or in whole by using a dedicated hardware circuit (for example, ASIC or FPGA).

Main memory <NUM> may include a volatile storage device, for example, DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory). Storage <NUM> may include a non-volatile storage device(s), for example, HDD (Hard Disk Drive) and/or SSD (Flash Solid State Drive). In storage <NUM> are stored a system program <NUM> that enables basic functions, a control program <NUM> developed correspondingly to a target to be controlled, for example, facility or machinery, and a restoration program <NUM> used to restore PLC <NUM>.

Network controller <NUM> transmits and receives data to and from optional information processors including support device <NUM> through network <NUM>.

Memory card interface <NUM> is an interface for exclusive use with memory card <NUM> described herein as an example of removable recording media. Memory card interface <NUM> that received a predetermined access authentication is allowed to write data in memory card <NUM> and read various pieces of data (for example, backup data) from memory card <NUM>.

Memory card interface <NUM> is loaded with a security unit <NUM>. Security unit <NUM> is a security chip that permits or prohibits accesses made by processor <NUM> to memory card <NUM>. This security unit is an example of the "reader" including a concealed logic for exclusive use. Memory card <NUM> according to the embodiments is a memory card highly guarded against unauthorized data accesses. This memory card can only be accessed from security unit <NUM> alone. Thus, the level of security may be enhanced in regard to data accesses to memory card <NUM>.

Security unit <NUM> includes a processor <NUM>, a storage <NUM>, a memory <NUM>, an IO module <NUM>, an IO module <NUM>, and a memory card controller <NUM>.

Processor <NUM> is a computing device in charge of computations for control and may include, for example, MPU (Micro Processing Unit). Specifically, processor <NUM> reads programs stored in storage <NUM> (for example, read program <NUM>) and then expands and runs the read program on memory <NUM>, so that predetermined processes for control are executed.

In <FIG> is presented an example in which functions required of security unit <NUM> are offered by prompting processor <NUM> to run predetermined programs. Instead, the functions thus offered may be implemented in part or in whole by using a dedicated hardware circuit (for example, ASIC or FPGA).

Memory <NUM> may include a volatile storage device, for example, DRAM or SRAM. Storage <NUM> may include a non-volatile storage device, for example, flash memory. This storage is an example of the "storage region" in PLC <NUM>. In storage <NUM> are stored a read program <NUM>, a user data <NUM>, a certificate data <NUM>, an identification data <NUM>, and a list <NUM>.

Read program <NUM> includes a program which is run to execute an access authentication process. Specifically describing this process, when, for example, an access request is outputted from processor <NUM> for data <NUM> including the backup data stored in memory card <NUM>, this read program determines whether the requested access to data <NUM> in memory card <NUM> should be enabled. Then, the data is determined as accessible when a positive result is obtained but is determined as inaccessible when a negative result is obtained. User data <NUM> includes pieces of information used to identify users in control system <NUM> (for example, account names, passwords).

Certificate data <NUM> contains information used to prove that PLC <NUM> is an authorized member for control system <NUM>. For example, certificate data <NUM> contains information on certificates issued when the devices are authenticated by the original manufacturers as genuine products. Certificate data <NUM> may otherwise contain information on certificates issued when the devices are authenticated by users or third parties like outside organizations, instead of the original manufacturers.

Identification data <NUM> contains pieces of relevant information including the model code and the serial number of PLC <NUM>. As described earlier, list <NUM> contains pieces of relevant information associated with the members.

IO module <NUM> transmits and receives input and output data, through processor bus <NUM>, to and from processor <NUM> and processor <NUM>. IO module <NUM> transmits and receives input and output data, through memory card controller <NUM>, to and from processor <NUM> and memory card <NUM>.

Memory card controller <NUM> activates a communication path leading to memory card <NUM> when accesses made by processor <NUM> to memory card <NUM> are enabled based on the access authentication process.

As illustrated in <FIG>, memory card <NUM> includes a data area <NUM>, a secure area <NUM>, and a security controller <NUM>. Data area <NUM> is a storage region in which data <NUM> including the backup data is storable. Optionally, data <NUM> may be encrypted with a key, for example, with a public key and then stored in data area <NUM>.

Secure area <NUM> is a concealed storage region that requires any device trying to access this region to be authenticated beforehand. This secure area is an example of the "storage region" in memory card <NUM>. In secure area <NUM>, a user data <NUM>, a certificate data <NUM>, an identification data <NUM>, and a list <NUM> are stored.

User data <NUM> contains pieces of information used to identify users in control system <NUM> (for example, account names, passwords). Certificate data <NUM> contains information used to prove that memory card <NUM> is an authorized device for control system <NUM>. For example, certificate data <NUM> contains information on certificates issued when the devices are authenticated by the original manufacturers as genuine products. Certificate data <NUM> may otherwise contain information on certificates issued when the devices are authenticated by users or third parties like outside organizations, instead of the original manufactures.

Identification data <NUM> contains pieces of relevant information including the model code and the serial number of memory card <NUM>. As described earlier, list <NUM> contains pieces of relevant information associated with the members.

Security controller <NUM> activates a communication path between security unit <NUM> and area <NUM> when accesses made by processor <NUM> to data area <NUM> are enabled based on the access authentication process described earlier. Memory card <NUM> according to the embodiments can only be accessed from security unit <NUM> alone of PLC <NUM> including the concealed logic for exclusive use. Supposing there is another read-only device allowed to access memory card <NUM>, such a device is still not allowed to access data <NUM> stored in data area <NUM> of memory card <NUM> unless the device is authenticated beforehand based on the access authentication process.

<FIG> is a block diagram that schematically illustrates exemplified hardware components of units <NUM> according to the embodiments. As illustrated in <FIG>, units <NUM> each include a function module <NUM>, a local bus controller <NUM>, and a security unit <NUM>.

Function module <NUM> provides a function(s) suitable for a job(s) to be done by each unit <NUM>. In case units <NUM> are each a digital input unit, function module <NUM> has an input circuit and a detecting circuit for digital signals, for example, photocouplers. In case units <NUM> are each a servo driver, function module <NUM> has, for example, a track computing logic and a command generating logic.

Local bus controller <NUM> transmits and receives data, through local bus <NUM>, to and from PLC <NUM> or other units <NUM> which this bus controller is connected to.

Security unit <NUM> is a security chip used to execute the access authentication process and is allowed to intercommunicate with function module <NUM> and local bus controller <NUM>. Security unit <NUM> includes a processor <NUM>, a storage <NUM> and a memory <NUM>.

Processor <NUM> is a computing unit in charge of computations for control and may include, for example, MPU. Processor <NUM> reads programs stored in storage <NUM> (for example, restoration program <NUM>) and then expands and runs the read program on memory <NUM>, so that predetermined processes for control are executed.

In <FIG> is presented an example in which functions required of units <NUM> are offered by prompting processor <NUM> to run predetermined programs. Instead, the functions thus offered may be implemented in part or in whole by using a dedicated hardware circuit (for example, ASIC or FPGA).

Memory <NUM> may include a volatile storage device, for example, DRAM or SRAM. Storage <NUM> may include a non-volatile storage device, for example, flash memory. This storage is an example of the "storage region" in unit <NUM>. In storage <NUM> are stored a restoration program <NUM>, a user data <NUM>, a certificate data <NUM>, an identification data <NUM>, and a list <NUM>.

Restoration program <NUM> contains programs run to restore unit <NUM>. User data <NUM> contains pieces of information used to identify users in control system <NUM> (for example, account names, passwords). Certificate data <NUM> contains information used to prove that units <NUM> are authorized devices for control system <NUM>. For example, certificate data <NUM> contains information on certificates issued when the devices are authenticated by the original manufacturers as genuine products. Certificate data <NUM> may otherwise contain information on certificates issued when the devices are authenticated by users or third parties like outside organizations, instead of the original manufactures.

<FIG> is a block diagram that schematically illustrates exemplified hardware components of support device <NUM> according to the embodiments. Support device <NUM> is implemented by, for example, prompting a computer that complies with general-purpose architectures to execute a program.

As illustrated in <FIG>, support device <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, an input unit <NUM>, a display unit <NUM>, an optical drive <NUM> and a network controller <NUM>. These components are interconnected through a processor bus <NUM>.

Processor <NUM> may include, for example, CPU and GPU. This processor reads programs stored in storage <NUM>(for example, OS <NUM> and support program <NUM>) and then expands and runs the read program on main memory <NUM>, so that predetermined processes for control are executed.

In <FIG> is presented an example in which functions required of support device <NUM> are offered by prompting processor <NUM> to run predetermined programs. Instead, the functions thus offered may be implemented in part or in whole by using a dedicated hardware circuit (for example, ASIC or FPGA).

Main memory <NUM> may include a volatile storage device, for example, DRAM or SRAM. Storage <NUM> may include a volatile storage device, for example, HDD or SSD.

In addition to OS <NUM> that enables basic functions, support program <NUM> is stored in storage <NUM>. This support program provides functions required of support device <NUM>. Support program <NUM> prompts a computer to operate as support device <NUM>.

Input unit <NUM> may include a keyboard and a mouse to receive inputs from a user. Display unit <NUM> includes a display, indicators and a printer, so that processing results of processor <NUM>, for example, are outputted.

Network controller <NUM> transmits and receives data, through network <NUM>, to and from optional external devices, for example, PLC <NUM>.

Support device <NUM> is equipped with optical drive <NUM>. Programs that are non-transitorily stored in a computer-readable recording medium <NUM> (for example, optical recording medium such as DVD (Digital Versatile Disc)) are read from this recording medium and installed into, for example, storage <NUM>.

Support program <NUM> run by support device <NUM>, for example, may be installed through computer-readable recording medium <NUM> or may be downloaded from, for example, a network server and then installed. The functions provided by support device <NUM> according to the embodiments may be feasible by leveraging some of the modules provided by OS.

Referring to <FIG>, an exemplified verification is hereinafter described, in which serial numbers are used for verification in the access authentication process (hereinafter, may be referred to as "serial verification").

<FIG> is a diagram that schematically illustrates an exemplified serial verification when data is duly accessed in control system <NUM> according to the embodiments. <FIG> is a diagram that schematically illustrates an example of serial verification assessment in control system <NUM> according to the embodiments.

As for PLC <NUM> in slot <NUM> illustrated in the example of <FIG>, "A" as model code and "a" as serial number are assigned to this device in control system <NUM>. As for unit <NUM>-<NUM> in slot <NUM> illustrated in this drawing, "B" as model code and "b" as serial number are assigned to this device. As for unit <NUM>-<NUM> in slot <NUM> illustrated in this drawing, "B" as model code and "c" as serial number are assigned to this device. As for unit <NUM>-<NUM> in slot <NUM> illustrated in this drawing, "C" as model code and "d" as serial number are assigned to this device. As for unit <NUM>-<NUM> in slot <NUM> illustrated in this drawing, "C" as model code and "e" as serial number are assigned to this device. In control system <NUM> thus configured, the backup data of PLC <NUM> is stored in memory card <NUM>.

It is assumed that, under such circumstances, PLC <NUM> in slot <NUM> breaks down, and a control system 1a should desirably be newly built by replacing failed PLC <NUM> with a PLC 100a. As for PLC 100a, "A" as model code and "f" as serial number are assigned to this device. Thus, PLC 100a newly introduced to replace PLC <NUM> has the same model code as that of PLC <NUM> and a serial number that differs from that of PLC <NUM>.

When memory card <NUM> is inserted in PLC 100a to restore the backup data of PLC <NUM>, the access authentication process (serial authentication) is carried out by memory card <NUM>, PLC 100a and units <NUM>-<NUM> to <NUM>-<NUM>.

It is assumed that the same contents are stored in the lists of the different members; list <NUM> of memory card <NUM>, list <NUM>-<NUM> of unit <NUM>-<NUM>, list <NUM>-<NUM> of unit <NUM>-<NUM>, list <NUM>-<NUM> of unit <NUM>-<NUM>, and list <NUM>-<NUM> of unit <NUM>-<NUM>. PLC 100a is a newly introduced device, list 100aL of which is thus containing no information (blank).

Memory card <NUM> obtains the serial number "f" as identification data from PLC 100a in slot <NUM> and verifies the obtained serial number against the serial number "a" for slot <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the serial numbers are inconsistent. Memory card <NUM> obtains the serial numbers "b", "c", "d" and "e" as identification data from units <NUM> of slots <NUM> to <NUM> and verifies the obtained serial numbers against the serial numbers "b", "c", "d" and "e" for slots <NUM> to <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the serial numbers obtained from the different sources are consistent. As a result of the verification by memory card <NUM>, the serial numbers for slot <NUM> alone are determined as inconsistent.

On the condition that, for example, memory card <NUM> sets the bit "<NUM>" in its own table when the verification result indicates consistency and sets the bit "<NUM>" when the verification result indicates inconsistency, as illustrated in <FIG>, the bit "<NUM>" is set for slot <NUM> alone and the bit "<NUM>" is set for the other members based on the verification result.

PLC 100a obtains the serial number "y" as identification data from memory card <NUM> and verifies the obtained serial number against the serial number for this memory card stored in its own list 100aL. Since list 100aL is containing no information (blank), PLC 100a determines that the serial numbers are inconsistent. PLC 100a obtains the serial numbers "b", "c", "d" and "e" as identification data from units <NUM> of slots <NUM> to <NUM> and verifies the obtained serial numbers against the serial numbers for slots <NUM> to <NUM> stored in its own list 100aL. Because of list 100aL containing no information (blank), PLC 100a determines that the serial numbers are inconsistent. As a result of the verification by PLC 100a, the serial numbers for memory card <NUM> and slots <NUM> to <NUM> are determined as inconsistent.

On the condition that, for example, PLC 100a in slot <NUM> sets the bit "<NUM>" in its own table when the verification result indicates consistency and sets the bit "<NUM>" when the verification result indicates inconsistency, as illustrated in <FIG>, the bit "<NUM>" is set for slots <NUM> to <NUM> and memory card <NUM> based on the verification result.

Units <NUM>-<NUM> to <NUM>-<NUM> each obtains the serial number "y" as identification data from memory card <NUM> and verify the obtained serial number against the serial number "y" stored in their own lists <NUM>-<NUM> to <NUM>-<NUM>. Then, units <NUM>-<NUM> to <NUM>-<NUM> determine that the serial numbers are consistent. Units <NUM>-<NUM> to <NUM>-<NUM> obtain the serial number "f" as identification data from PLC 100a and verify the obtained serial number against the serial number "a" for slot <NUM> stored in their own lists <NUM>-<NUM> to <NUM>-<NUM>. Then, units <NUM>-<NUM> to <NUM>-<NUM> determine that the serial numbers are inconsistent. Units <NUM> each obtain the serial numbers as identification data from the other units <NUM> and verify the obtained serial numbers against the serial numbers for the other units <NUM> stored in their own lists. Then, units <NUM> determine that the serial numbers are consistent. As a result of the verification by units <NUM>-<NUM> to <NUM>-<NUM>, the serial numbers for slot <NUM> alone are determined as inconsistent.

On the condition that, for example, units <NUM> of slots <NUM> to <NUM> set the bit "<NUM>" in their own tables when the verification result indicates consistency and set the bit "<NUM>" when the verification result indicates inconsistency, as illustrated in <FIG>, the bit "<NUM>" is set for slot <NUM> alone and the bit "<NUM>" is set for the other members based on the verification result.

After the serial numbers in regard to all of the members are thus verified, the serial numbers in slot <NUM> in regard to memory card <NUM> and units <NUM> alone are determined as inconsistent. As a result, PLC 100a of slot <NUM> is determined by many of the members as being newly introduced, which can be rephrased that none of the other members has been replaced or changed. The serial number-based verification result thus indicates a high degree of consistency. Based on the rule of majority vote, therefore, memory card <NUM> enables PLC 100a to access and restore the backup data.

The verification results obtained by the members are transmitted to the other members, so that the table illustrated in <FIG> can be shared among all of the members. One of the members (for example, member that first acquired the verification results of the members) determines whether the verification results satisfy a predetermined condition. Specifically, the bits set by the members are added as illustrated in <FIG>, a result of which is then divided by the number of members to calculate an average value (%). Based on the calculated average values of the members, it is determined whether any device with an average value greater than <NUM>% is among the members. In the illustrated example, the average value exceeds <NUM>% in slot <NUM> alone.

In case three or more members have average values greater than <NUM>%, i.e., three or more members are determined as being replaced or changed by the members having average values of <NUM>% or more, the verification result is determined as indicating a low degree of consistency, disallowing data accesses. In case less than three members have average values greater than <NUM>%, i.e., less than three members are determined as being replaced or changed by the members having average values of <NUM>% or more, the verification result is determined as being acceptable.

Insofar as the verification result is thus found acceptable, memory card <NUM> enables PLC 100a to access the backup data.

<FIG> is a diagram that schematically illustrates an exemplified serial verification when data is unduly accessed in control system <NUM> according to the embodiments.

It is assumed that, under such circumstances, data is restored in a control system 1x including an unauthorized line built after memory card <NUM> is stolen. For example, PLC 100x of slot <NUM> and units 200x-<NUM> to 200x-<NUM> of slots <NUM> to <NUM> are interconnected through a local bus 4x in a manner that these devices are allowed to communicate with one another.

As for unit PLC 100x in slot <NUM>, "A" as model code and "o" as serial number are assigned to this device. As for unit 200x-<NUM> in slot <NUM>, "B" as model code and "p" as serial number are assigned to this device. As for unit 200x-<NUM> in slot <NUM>, "B" as model code and "q" as serial number are assigned to this device. As for unit 200x-<NUM> in slot <NUM>, "C" as model code and "r" as serial number are assigned to this device. As for unit 200x-<NUM> in slot <NUM>, "C" as model code and "s" as serial number are assigned to this device.

When memory card <NUM> is inserted in PLC 100x to unduly restore the backup data of PLC <NUM>, the data in memory card <NUM> is not accessible by PLC 100x without the access authentication process unless a program required to run this process has been pre-installed in this device. This may prevent the risk of data leakage.

Supposing that the respective members are loaded with such an access authentication program, memory card <NUM>, PLC 100x and units 200x-<NUM> to 200x-<NUM> carry out the access authentication process (serial authentication).

Memory card <NUM> obtains the serial number "o" as identification data from PLC 100x in slot <NUM> and verifies the obtained serial number against the serial number "a" for slot <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the serial numbers are inconsistent. Memory card <NUM> obtains the serial numbers "p", "q", "r" and "s" as identification data from units 200x of slots <NUM> to <NUM> and verifies the obtained serial numbers against the serial numbers "b", "c", "d" and "e" for slots <NUM> to <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the serial numbers obtained are inconsistent. As a result of the verification by memory card <NUM>, the serial numbers are determined as inconsistent for all of the slots <NUM> to <NUM>.

In the serial verification employed in this embodiment, the serial numbers of and obtained from the members are verified against the serial numbers of the members stored in list <NUM> of memory card <NUM>, and the degree of consistency is determined as low when the number of members with their serial numbers being determined as consistent does not exceed a certain number (for example, three). In the example illustrated in <FIG>, the serial number-based verification result thus indicates a low degree of consistency, therefore, memory card <NUM> does not enable PLC 100x to access or restore the backup data.

Referring to <FIG>, an exemplified verification is hereinafter described, in which model codes are used for verification in the access authentication process (hereinafter, may be referred to as "model verification").

<FIG> is a diagram that schematically illustrates an exemplified model verification when data is duly accessed in control system <NUM> according to the embodiments. <FIG> is a diagram that schematically illustrates an example of model verification assessment in control system <NUM> according to the embodiments.

It is assumed, under such circumstances, to newly build a control system 1b by duplicating a line configured similarly to that of control system <NUM>. For example, PLC 100b of slot <NUM> and units 200b-<NUM> to 200b-<NUM> of slots <NUM> to <NUM> are interconnected through a local bus 4b in a manner that these devices are allowed to communicate with one another.

As for unit PLC 100b in slot <NUM>, "A" as model code and "g" as serial number are assigned to this device. As for unit 200b-<NUM> in slot <NUM>, "B" as model code and "h" as serial number are assigned to this device. As for unit 200b-<NUM> in slot <NUM>, "B" as model code and "i" as serial number are assigned to this device. As for unit 200b-<NUM> in slot <NUM>, "C" as model code and "j" as serial number are assigned to this device. As for unit 200b-<NUM> in slot <NUM>, "C" as model code and "k" as serial number are assigned to this device.

When memory card <NUM> is inserted in PLC 100b to restore the backup data of PLC <NUM>, the access authentication process (model authentication) is carried out by memory card <NUM>, PLC 100b and units 200b-<NUM> to 200b-<NUM>.

It is assumed that the same contents are stored in the lists of the different members; list <NUM> of memory card <NUM>, list 200b-<NUM> of unit 200b-<NUM>, list 200b-<NUM> of unit 200b-<NUM>, list 200b-<NUM> of unit 200b-<NUM>, and list 200b-<NUM> of unit 200b-<NUM>.

Memory card <NUM> obtains the model code "A" as identification data from PLC 100b in slot <NUM> and verifies the obtained model code against the model code "A" for slot <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the model codes obtained from the different sources are consistent. Memory card <NUM> obtains the model codes "B", "B", "C" and "C" as identification data from units <NUM> of slots <NUM> to <NUM> and verifies the obtained model codes against the model codes "B", "B", "C" and "C" for slots <NUM> to <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the model codes obtained from the different sources are consistent. Based on the verification result obtained by memory card <NUM>, the model codes are determined as consistent for all of the slots <NUM> to <NUM>.

On the condition that, for example, memory card <NUM> sets the bit "<NUM>" in its own table when the verification result indicates consistency and sets the bit "<NUM>" when the verification result indicates inconsistency, as illustrated in <FIG>, the bit "<NUM>" is set for slots <NUM> to <NUM> based on the verification result.

PLC 100b obtains the model code "X" as identification data from memory card <NUM> and verifies the obtained model code against the model code "X" for this memory card stored in its own list 100bL. Then, PLC 100b determines that the model codes obtained from the different sources are consistent. PLC 100b obtains the model codes "B", "B", "C" and "C" as identification data from units 200b of slots <NUM> to <NUM> and verifies the obtained model codes against the model codes "B", "B", "C" and "C" for slots <NUM> to <NUM> stored in its own list 100bL. Then, PLC 100b determines that the model codes obtained from the different sources are consistent. Based on the verification result obtained by PLC 100b, the model codes are determined as consistent for all of the slots <NUM> to <NUM>.

On the condition that, for example, PLC 100b in slot <NUM> sets the bit "<NUM>" in its own table when the verification result indicates consistency and sets the bit "<NUM>" when the verification result indicates inconsistency, as illustrated in <FIG>, the bit "<NUM>" is set for slots <NUM> to <NUM> and memory card <NUM> based on the verification result.

Units 200b-<NUM> to 200b-<NUM> each obtains the model code "X" as identification data from memory card <NUM> and verifies the obtained model code against the model code "X" for this memory card stored in a respective one of their own lists 200b-<NUM> to 200b-<NUM>. Then, units 200b-<NUM> to 200b-<NUM> determine that the model codes obtained from the different sources are consistent. Units 200b-<NUM> to 200b-<NUM> each obtains the model code "A" as identification data from PLC 100b and verifies the obtained model code against the model code "A" for slot <NUM> stored in a respective one of their own lists 200b-<NUM> to 200b-<NUM>. Then, units 200b-<NUM> to 200b-<NUM> determine that the model codes obtained from the different sources are consistent. Units 200b each obtains the model codes as identification data from the other units 200b and verifies the obtained model codes against the model codes for the other units 200b stored in their own lists. Then, units 200b determine that the model codes are consistent. Based on the verification result obtained by units 200b-<NUM> to 200b-<NUM>, the model codes are determined as consistent for all of the slots <NUM> to <NUM>.

On the condition that, for example, units 200b in slots <NUM> to <NUM> each sets the bit "<NUM>" in its own table when the verification result indicates consistency and sets the bit "<NUM>" when the verification result indicates inconsistency, as illustrated in <FIG>, the bit "<NUM>" is set for the respective members based on the verification result.

After the model codes in regard to all of the members are thus verified, the model codes for all of memory card <NUM> and slots <NUM> to <NUM> are determined as consistent. As a result, it is determined by many of the members that the members including PLC 100b in slot <NUM> are mostly not replaced or changed. The model code-based verification result thus indicates a high degree of consistency. Based on the rule of majority vote, therefore, memory card <NUM> enables PLC 100b to access and restore the backup data.

The verification results obtained by the members are transmitted to the other members, so that the table illustrated in <FIG> can be shared among all of the members. One of the members (for example, member that first acquired the verification results of the members) determines whether the verification results satisfy a predetermined condition. Specifically, the bits set by the members are added as illustrated in <FIG>, a result of which is then divided by the number of members to calculate an average value (%). Based on the calculated average values of the members, it is determined whether any device with an average value greater than <NUM>% is among the members. In the illustrated example, none of the members has an average value greater than <NUM>%.

In the example illustrated in <FIG> in which the model codes are duplicated from the same line, the serial numbers of the units and PLC are changed. Supposing that the serial verification illustrated in <FIG> and <FIG> is employed in the example of <FIG>, it is determined by many of the members that the members including the PLC in slot <NUM> are mostly replaced or changed. Memory card <NUM>, therefore, does not enable accesses by the PLC to the backup data.

In the verification using the model codes instead of the serial numbers unique to the devices, accesses to the backup data stored in memory card <NUM> are enabled in regard to the members of the same model code having different serial numbers, as illustrated in the example of <FIG> and <FIG>. This may ensure a good balance between user-friendliness and better security in data accesses to memory card <NUM>.

<FIG> is a diagram that schematically illustrates an exemplified model verification when data is unduly accessed in control system <NUM> according to the embodiments.

It is assumed that, under such circumstances, data is restored in a control system 1y including an unauthorized line built after memory card <NUM> is stolen. For example, PLC 100y of slot <NUM>, units 200y-<NUM> to 200y-<NUM> of slots <NUM> to <NUM> are interconnected through a local bus 4y in a manner that these devices are allowed to communicate with one another.

As for unit PLC 100y in slot <NUM>, "D" as model code and "k" as serial number are assigned to this device. As for unit 200y-<NUM> in slot <NUM> illustrated in this drawing, "E" as model code and "I" as serial number are assigned to this device. As for unit 200y-<NUM> in slot <NUM> illustrated in this drawing, "E" as model code and "m" as serial number are assigned to this device. As for unit 200y-<NUM> in slot <NUM> illustrated in this drawing, "F" as model code and "n" as serial number are assigned to this device. Slot <NUM> is empty with no unit.

When memory card <NUM> is inserted in PLC 100y to unduly restore the backup data of PLC <NUM>, the data in memory card <NUM> is not accessible by PLC 100y without the access authentication process unless a program required to run this process has been pre-installed in this device. This may prevent the risk of data leakage.

Supposing that the respective members are loaded with the program installed to run the access authentication process, memory card <NUM>, PLC 100y and units 200y-<NUM> to 200y-<NUM> carry out the access authentication process (model authentication).

Memory card <NUM> obtains the model code "D" as identification data from PLC 100y in slot <NUM> and verifies the obtained model code against the model code "A" for slot <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the model codes are inconsistent. Memory card <NUM> obtains the model codes "E", "E" and "F" as identification data from units 200y of slots <NUM> to <NUM> and verifies the obtained model codes against the model codes "B", "B" and "C" for slots <NUM> to <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the model codes are inconsistent. The identification data is not obtainable from slot <NUM> or verifiable against the model code "C" for slot <NUM> stored in its own list <NUM>. Then, memory card <NUM> determines that the lack of consistency. Based on the verification result obtained by memory card <NUM>, the model codes are determined as inconsistent for all of the slots <NUM> to <NUM>.

In the model verification employed in this embodiment, the model codes of and obtained from the members are verified against the model codes of the members stored in list <NUM> of memory card <NUM>, and the degree of consistency is determined as low when the number of members with their model codes being determined as consistent does not exceed a certain number (for example, three). In the example illustrated in <FIG>, the model code-based verification result thus indicates a low degree of consistency, therefore, memory card <NUM> does not enable PLC 100y to access or restore the backup data.

<FIG> is a diagram that schematically illustrates an exemplified setting screen of support device <NUM> according to the embodiments. As illustrated in <FIG>, support device <NUM> provides a user interface that allows users to input various settings for the access authentication process.

Specifically, support device <NUM> has a screen <NUM> which includes the following fields; user information <NUM> in which user information is settable, user authentication method <NUM> in which a user authentication method is settable, password <NUM> in which a password is settable, a verification method <NUM> in which a verification method is settable, security level <NUM> in which a level of security is settable, and applicable range <NUM> in which a range of applicable devices is settable.

A user inputs an account name of his/her own choice in the field of user information <NUM> and is thus able to set the account name as his/her user information. The user can select and set a user authentication method of his/her own choice in the field of user authentication method <NUM>. In the embodiments disclosed herein, face authentication or biometric authentication (for example, fingerprint authentication), though not illustrated in the drawings, may be selected instead of the password authentication. The user who selected the password authentication can input a password his/her own choice in the field of password <NUM>.

The user can select and set a verification method of his/her own choice in the field of verification method <NUM>. In the embodiments disclosed herein, the user is given a choice between the serial verification and the model verification. Thus, support device <NUM> according to the embodiments disclosed herein provides a user interface that allows users to select either one of the serial verification and the model verification.

Then, the user is allowed to select, using support device <NUM>, which one of the following is desirably verified; serial numbers used to individually identify the members, and model codes of the members. Thus, the control system may be successfully built in a suitable manner for a level of security required of the system.

Instead of requesting the user to select one of two options; the model verification and the serial verification, support device <NUM> may offer the user such an option that both of the model and serial verifications are available. In this instance, control system <NUM> according to the embodiments disclosed herein may determine whether the devices are enabled to access the data in memory card <NUM> using both of the model verification and the serial verification.

In the field of security level <NUM>, the user can set a level of security required of control system <NUM>. Specifically, the user can set the number of devices, among all of the devices, subject to the serial verification or the model verification in the access authentication process. While all of the device should desirably be verified in view of security, the devices to be verified may be decreased in order to shorten processing time or lessen the workload of complex processes. In the embodiments disclosed herein, the number of devices to be verified may desirably be a total number of devices from which "<NUM>" has been subtracted. Thus, support device <NUM> according to the embodiments disclosed herein provides a user interface that allows users to set the number of devices to be verified.

Then, the user is allowed to select and set, using support device <NUM>, how many devices are desirably verified. Thus, the control system may be successfully built in a suitable manner for a level of security required of the system.

The user can set, in the field of applicable range <NUM>, a range of applicable members subject to the serial verification and/or the model verification in the access authentication process. In the embodiments disclosed herein, the user may select, as a range of applicable devices, PLC <NUM> and the devices connected to PLC <NUM> through the local bus <NUM>, or may further select, in addition to these devices, tools like network <NUM> and support device <NUM>. Thus, support device <NUM> according to the embodiments disclosed herein provides a user interface that allows users to set the range of applicable devices.

Then, the user is allowed to set, using support device <NUM>, the range of applicable devices. Thus, the control system may be successfully built in a suitable manner for a level of security required of the system.

An example of the access authentication process executed in control system <NUM> according to the embodiments disclosed herein is hereinafter described referring to <FIG> and <FIG>.

<FIG> is a sequence diagram that illustrates an exemplified access authentication process using the serial verification executed in control system <NUM> according to the embodiments disclosed herein. In <FIG> is illustrated the access authentication process (serial verification) in the example of <FIG> and <FIG>. Specifically, this drawing illustrates the data restoration after PLC <NUM> with the serial number of "a" is replaced with PLC 100a with the serial number of "f' in slot <NUM>.

Though not illustrated in the drawing, when memory card <NUM> is inserted in PLC 100a of slot <NUM> and a predetermined switch is turned on, the user is requested to input his/her user data on the screen of support device <NUM>. When a user inputs, as user data, his/her user information (for example, account name) and password, support device <NUM> transmits the user data to PLC 100a of slot <NUM>, memory card <NUM> and units <NUM> of slots <NUM> to <NUM>, as illustrated in <FIG> (steps <NUM>), <NUM>), <NUM>)).

PLC 100a of slot <NUM> verifies user data <NUM> retained by itself against the user data obtained from support device <NUM>. When these two pieces of user data obtained from the different sources are consistent with each other, PLC 100a transmits certificate data <NUM> retained by itself to units <NUM> of slots <NUM> to <NUM> (step <NUM>)). PLC 100a of slot <NUM> does not transmit certificate data <NUM> unless the user data is authenticated.

When units <NUM> of slots <NUM> to <NUM> determine that PLC 100a is a genuine product supplied by the original manufacturer based on certificate data <NUM>, these units <NUM> transmit, to PLC 100a, authentication data indicating that PLC 100a has been authenticated (step <NUM>)). Units <NUM> of slots <NUM> to <NUM> do not transmit the authentication data to PLC 100a unless PLC 100a is determined as being a genuine product supplied by the original manufacturer.

Units <NUM> of slots <NUM> to <NUM> verify user data <NUM> retained by themselves against the user data obtained from support device <NUM>. When these two pieces of user data obtained from the different sources are consistent with each other, units <NUM> transmit certificate data <NUM> retained by themselves to PLC 100a of slot <NUM> (step <NUM>)). Units <NUM> of slots <NUM> to <NUM> do not transmit certificate data <NUM> unless the user data is authenticated.

Memory card <NUM> verifies user data <NUM> retained by itself against the user data obtained from support device <NUM>. When these two pieces of user data obtained from the different sources are consistent with each other, memory card <NUM> transmits certificate data <NUM> retained by itself to PLC 100a of slot <NUM> (step <NUM>)). Memory card <NUM> does not transmit certificate data <NUM> unless the user data is authenticated.

When PLC 100a of slot <NUM> determines that units <NUM> of slots <NUM> to <NUM> are genuine products supplied by the original manufacturers based on certificate data <NUM>, PLC 100a transmits, to units <NUM>, authentication data indicating that units <NUM> have been authenticated (step <NUM>)). PLC 100a of slot <NUM> does not transmit the authentication data unless units <NUM> of slots <NUM> to <NUM> are determined as being genuine products supplied by the original manufacturers.

When PLC 100a of slot <NUM> determines that memory card <NUM> is a genuine product supplied by the original manufacturer based on certificate data <NUM>, PLC 100a transmits, to memory card <NUM>, authentication data indicating that memory card <NUM> has been authenticated (step <NUM>)). PLC 100a of slot <NUM> does not transmit the authentication data unless memory card <NUM> is determined as being a genuine product supplied by the original manufacturer.

When the processes in steps <NUM>) to <NUM>) are all completed, PLC 100a in slot <NUM> has been authenticated by units <NUM> in slots <NUM> to <NUM>, units <NUM> in slots <NUM> to <NUM> have been authenticated by PLC 100a in slot <NUM>, and memory card <NUM> has been authenticated by PLC 100a in slot <NUM>.

For the serial verification, PLC 100a in slot <NUM> thereafter transmits identification data <NUM> (serial number "f") retained by itself to units <NUM> in slots <NUM> to <NUM> (step <NUM>)). For the serial verification, PLC 100a in slot <NUM> thereafter transmits identification data <NUM> (serial number "f") retained by itself to memory card <NUM> (step <NUM>)).

For the serial verification, units <NUM> in slots <NUM> to <NUM> thereafter transmit identification data <NUM> (serial numbers "b", "c", "d" and "e") retained by themselves to memory card <NUM> (step <NUM>)). For the serial verification, memory card <NUM> thereafter transmits identification data <NUM> (serial number "y") retained by itself to units <NUM> in slots <NUM> to <NUM> (step <NUM>)). For the serial verification, units <NUM> in slots <NUM> to <NUM> thereafter transmit identification data <NUM> retained by themselves to the other units <NUM> (step <NUM>)).

As a result of the processes in steps <NUM>) to <NUM>), memory card <NUM>, PLC 100a in slot <NUM> and units <NUM> in slots <NUM> to <NUM> obtain the pieces of identification data of the members (serial numbers).

Then, memory card <NUM>, PLC 100a in slot <NUM> and units <NUM> in slots <NUM> to <NUM> verify the obtained identification data (serial numbers) of the members against the serial numbers of the members stored in the lists retained by themselves (step <NUM>)).

As described referring to the examples of <FIG> and <FIG>, when the degree of consistency in the serial number-based verification result is determined as high by one of the members (for example, member that first acquired the verification results of the members), memory card <NUM> enables PLC 100a to access the backup data and transmits the backup data to PLC 100a in slot <NUM> (step <NUM>)).

Then, the members update their own lists based on the pieces of identification data (serial numbers) obtained from the other members (step <NUM>)). The lists retained by the members are thus updated into the latest data.

After that, PLC 100a of slot <NUM> restores the data based on the backup data obtained from memory card <NUM> (step <NUM>)).

In the example illustrated in <FIG>, the backup data is transmitted from memory card <NUM> to PLC 100a of slot <NUM> when the degree of consistency in the model verification result is determined as high. Instead, the backup data may be transmitted from memory card <NUM> to PLC 100a of slot <NUM> after PLC 100a, memory card <NUM> and units <NUM> are mutually authenticated. In this instance, PLC 100a of slot <NUM> may be prohibited from restoring the data unless the degree of consistency in the model verification result is determined as high.

When memory card <NUM> is received by PLC 100a, accesses to the backup data stored in memory card <NUM> are enabled only when the degree of consistency is determined as high among the members in the serial number verification results obtained by any members but PLC 100a. This may ensure a higher level of security without compromising user-friendliness in accesses to the data stored in removable memory card <NUM>.

In addition to the risk of being stolen, memory card <NUM> may possibly be accidentally inserted in any system differently configured. In such an event, the data in memory card <NUM> becomes inaccessible from any device unless such accesses are authorized as a result of the access authentication process (serial verification) described earlier. This may prevent undue data accesses even if memory card <NUM> is inserted in wrong systems.

<FIG> is a sequence diagram that illustrates an exemplified access authentication process using the model verification executed in control system <NUM> according to the embodiments. In <FIG> is illustrated the access authentication process (model verification) in the example of <FIG> and <FIG>. This drawing illustrates an example of restoration after a line configured similarly to that of control system <NUM> is duplicated.

Though not illustrated in the drawing, when memory card <NUM> is inserted in PLC 100b of slot <NUM> and a predetermined switch is turned on, the user is requested to input his/her user data on the screen of support device <NUM>. When a user inputs, as user data, his/her user information (for example, account name) and password, support device <NUM> transmits the user data to memory card <NUM>, as illustrated in <FIG> (step (<NUM>)).

Memory card <NUM> verifies user data <NUM> retained by itself against the user data obtained from support device <NUM>. When these two pieces of user data obtained from the different sources are consistent with each other, memory card <NUM> transmits certificate data <NUM> retained by itself to PLC 100b of slot <NUM> (step <NUM>)). Memory card <NUM> does not transmit certificate data <NUM> unless the user data is authenticated.

When PLC 100b of slot <NUM> determines that memory card <NUM> is a genuine product supplied by the original manufacturer based on certificate data <NUM>, PLC 100b transmits, to memory card <NUM>, authentication data indicating that memory card <NUM> has been authenticated (step <NUM>)). PLC <NUM> of slot <NUM> does not transmit the authentication data unless memory card <NUM> is determined as being a genuine product supplied by the original manufacturer.

PLC 100b of slot <NUM> verifies user data <NUM> retained by itself against the user data obtained from support device <NUM>. When these two pieces of user data obtained from the different sources are consistent with each other, PLC 100b transmits certificate data <NUM> retained by itself to memory card <NUM> of slot <NUM> (step <NUM>)). PLC 100b of slot <NUM> does not transmit certificate data <NUM> unless the user data is authenticated.

When memory card <NUM> determines that PLC 100b of slot <NUM> is a genuine product supplied by the original manufacturer based on certificate data <NUM>, memory card <NUM> transmits, to PLC 100b, authentication data indicating that PLC 100b has been authenticated (step <NUM>)). Memory card <NUM> does not transmit the authentication data unless PLC 100b of slot <NUM> is determined as being a genuine product supplied by the original manufacturer.

When the processes in steps <NUM>) to <NUM>) are all completed, memory card <NUM> has been authenticated by PLC 100b in slot <NUM>, and PLC 100b in slot <NUM> has been authenticated by memory card <NUM>.

For the model verification, PLC 100b in slot <NUM> thereafter transmits identification data <NUM> (model code "A") retained by itself to units 200b in slots <NUM> to <NUM> (step <NUM>)). For the model verification, PLC 100b in slot <NUM> thereafter transmits identification data <NUM> (model code "A") retained by itself to memory card <NUM> (step <NUM>)).

For the model verification, units 200b in slots <NUM> to <NUM> thereafter transmit identification data <NUM> (model codes "B", "B", "C" and "C") retained by themselves to memory card <NUM> (step <NUM>)). For the model verification, memory card <NUM> thereafter transmits identification data <NUM> (model code "X") retained by itself to units 200b in slots <NUM> to <NUM> (step <NUM>)). For the model verification, units 200b in slots <NUM> to <NUM> thereafter transmit identification data <NUM> retained by themselves to the other units 200b (step <NUM>)).

As a result of the processes in steps <NUM>) to <NUM>), memory card <NUM>, PLC 100b in slot <NUM> and units 200b in slots <NUM> to <NUM> obtain the pieces of identification data of the members (model codes).

After that, memory card <NUM>, PLC 100b in slot <NUM> and units 200b in slots <NUM> to <NUM> verify the pieces of identification data (model codes) obtained from the members against the model codes of the members stored in the lists retained by themselves (step <NUM>)).

As described referring to the examples of <FIG> and <FIG>, when the degree of consistency in the model code-based verification result is determined as high by one of the members (for example, member that first acquired the verification results of the members), memory card <NUM> enables PLC 100b to access the backup data and transmits the backup data to PLC 100b in slot <NUM> (step <NUM>)).

After that, PLC 100b of slot <NUM> restores the data based on the backup data obtained from memory card <NUM> (step <NUM>)).

In the example illustrated in <FIG>, the backup data is transmitted from memory card <NUM> to PLC 100b of slot <NUM> when the degree of consistency in the model verification result is determined as high. Instead, the backup data may be transmitted from memory card <NUM> to PLC 100b of slot <NUM> after PLC 100b and memory card <NUM> are mutually authenticated. In this instance, PLC 100b of slot <NUM> may be prohibited from restoring the data unless the degree of consistency in the model verification result is determined as high.

When memory card <NUM> is received by PLC 100b, accesses to the backup data stored in memory card <NUM> are enabled only when the degree of consistency is determined as high among the members in the model code verification results obtained by any members but PLC 100b. This may ensure a higher level of security without compromising user-friendliness in accesses to the data stored in removable memory card <NUM>.

Further advantageously, accesses to the backup data stored in memory card <NUM> are enabled in regard to the members of the same model code having different serial numbers. This may ensure a good balance between user-friendliness and better security in data accesses to removable storage media.

In addition to the risk of being stolen, memory card <NUM> may possibly be accidentally inserted in any system differently configured. In such an event, the data in memory card <NUM> becomes inaccessible from any device unless such accesses are authorized as a result of the access authentication process (model verification) described earlier. This may prevent undue data accesses even if memory card <NUM> is inserted in wrong systems.

In control system <NUM> according to the embodiments disclosed herein, when memory card <NUM> is received by PLC <NUM>, it is not until results of the relevant information verified by units <NUM> other than PLC <NUM> satisfy a predetermined condition that the data stored in memory card <NUM> becomes accessible. This may ensure a higher level of security without compromising user-friendliness in accesses to the data stored in removable memory card <NUM>.

The embodiments disclosed herein are given by way of example in all aspects and should not be construed as limiting the scope of this disclosure. The scope of this disclosure is solely defined by the appended claims and is intended to cover the claims, equivalents, and all of possible modifications made without departing the scope of this disclosure.

Claim 1:
A control system (<NUM>) configured to control access to data in a device group, the device group comprising a plurality of devices (<NUM>, <NUM>-<NUM> to <NUM>-<NUM>), the plurality of devices being configured to communicate with one another, the control system comprising:
a first device (<NUM>) included in the plurality of devices and configured to receive, in a removable manner, a storage medium (<NUM>) in which data is storable; and
one or a plurality of second devices included in the plurality of devices, wherein
each of members of the plurality of devices (<NUM>-<NUM> to <NUM>-<NUM>) and the storage medium is configured to:
comprise a storage region (<NUM>, <NUM>, <NUM>) configured to retain a list (<NUM>, <NUM>, <NUM>-<NUM> to <NUM>-<NUM>) including relevant information for identification of each of the members; and
verify consistency or inconsistency between the relevant information of each of other members included in the list retained in the storage region and the relevant information of each of the other members obtained from each of the other members when the storage medium is inserted in the first device, and
the first device is configured to access the data stored in the storage medium when a result of verification, based on said verifying consistency or inconsistency, obtained by each of the other members but the first device satisfies a predetermined condition.