Secure remote maintenance devices and method for remote maintenance of industrial equipment

GENERAL TECHNICAL FIELD AND STATE OF THE ART

The invention relates to the remote maintenance of industrial equipment, in particular those involved in the manufacture of aeronautical systems such as turbomachines.

In industry, and in particular in the aeronautics industry, the industrial equipment involved is increasingly sophisticated and often requires maintenance operations which must be carried out most of the time by qualified personnel authorized to work on this equipment.

In order to manage the maintenance of this equipment, it is connected to a network, which is connected to a remote maintenance server to which a worker can connect as soon as an authorized person authorizes him access.

However, the authorized person and the qualified worker are not always present on the industrial site, so that outside of their hours of presence on the industrial site, the opening of communication and therefore the remote troubleshooting of equipment is impossible.

One solution to allow access at any time and remotely is to permanently connect the equipment to a network accessible remotely.

However, such a solution is not satisfactory for security issues with regard to accessibility to the network.

PRESENTATION OF THE INVENTION

The invention overcomes the aforementioned drawbacks.

To this end, the invention relates, according to a first aspect, to a box for managing access to an industrial network, to which industrial equipment is connected, the management box comprising: an access path to a data network of Internet type, said access path to the data network comprising a cut-off unit, a control path of the access path to the data network, said control path comprising a controller configured to control the cut-off unit in such a way to allow communication between the industrial network and the data network.

The invention, according to the first aspect, is advantageously completed by the following characteristics, taken alone or in any of their technically possible combination:

the piloting channel comprises a first communication interface configured to put the box in communication with a mobile network of the GSM type;

the cut-off unit comprises a cut-off relay which can be activated by means of a control signal from the controller;

the first communication interface is a GSM communication interface, the control signal being a function of a received SMS;

the controller is configured to authenticate a user, the controller being configured to drive the breaking unit in order to establish communication between the industrial network and the data network as soon as the user is authenticated.

The invention relates, according to a second aspect, to a remote maintenance server configured to be connected on the one hand to an industrial network to which a set of industrial equipment is connected and on the other hand to a box according to the invention, the server. comprising a control server configured to communicate with the box, said server further comprising a firewall configured to manage access to the industrial network from said box.

The invention, according to the second aspect, is advantageously completed by the characteristic according to which the firewall is configured to isolate industrial equipment from other equipment of the network so as to allow access to the isolated equipment only without being able to access the others. .

The invention relates, according to a third aspect, to a method for the remote maintenance of a set of industrial equipment connected together to an industrial network, the industrial network being linked to a box for managing access to an industrial network according to the invention. first aspect of the invention, the management box being linked to a data network and a mobile network, the method comprising the following steps, an anomaly having been detected on a unit of the set called unit of interest: reception on the control channel of the box of a request, for the purpose of establishing a remote maintenance communication between the industrial network and the data network, authentication of the request, and if the request is authenticated,establishment of remote maintenance communication between the industrial network and the data network.

The invention, according to the third aspect, is advantageously supplemented by the following characteristics, taken alone or in any of their technically possible combination:

the mobile network is a GSM network, the request consisting of an SMS preferably comprising a confidential code allowing authentication of said request;

the box being connected to a remote maintenance server, method in which the establishment of the remote maintenance communication comprises a step consisting in isolating the equipment of interest from other equipment of the industrial network so that only the equipment of interest is connected to the industrial network;

the method comprises a step of connecting, via the management box, a terminal of a participant to the industrial network so that the latter can access the equipment of interest via the data network in order to perform maintenance operations on said equipment of interest; and once the maintenance operations are completed; the method comprises a step of disconnection via the management box, from the operator's terminal to the industrial network, the industrial network no longer being accessible via the Internet network;

the step of connecting the intervening party's terminal comprises authenticating said intervening party in order to verify that he is authorized to connect to the industrial network;

the method comprises a step of restoring the industrial network so that all the industrial equipment is accessible via the industrial network but inaccessible from the Internet network. The advantages of the invention are numerous;

The invention allows a person authorized to pilot the remote maintenance solution to set up secure remote maintenance connections so that a maintenance operator who is therefore authorized can connect and perform maintenance or repair of industrial equipment at anytime and from anywhere in the world.

The unit integrated into a system allowing remote maintenance to be carried out can be controlled remotely via a mobile network, in particular a cellular network (GSM network) while having high security.

For maintenance, it is therefore possible to set up a secure remote maintenance connection to allow additional support by an operator located outside the industrial site at any time.

In particular, the box allows the opening of an electronic circuit allowing the connection between the remote maintenance server and a data network. The opening can be done locally or via a mobile network, this then allows the maintenance operator to access industrial equipment in a secure manner.

PRESENTATION OF FIGURES

Other characteristics, aims and advantages of the invention will emerge from the following description, which is purely illustrative and non-limiting, and which should be read with reference to the appended drawings in which:

FIG. 1 represents a remote maintenance environment in accordance with the invention;

FIG. 2 illustrates the steps of a remote maintenance method according to the invention.

In all of the figures, similar elements bear identical references.

DETAILED DESCRIPTION OF THE INVENTION

In relation to FIG. 1, industrial equipment U1, U2, U3 are connected to an industrial network 10. Such an industrial network 10 is well known to those skilled in the art and will not be described in more detail here.

A remote maintenance server 20 is connected to the industrial network 10. Such a server 20 makes it possible to control the security of remote maintenance communications relating to industrial equipment of the industrial network 10. In particular, the remote maintenance server 20 makes it possible to manage access to the industrial network and therefore access to industrial equipment connected to it. It is through this remote maintenance server 20 that the maintenance operations as such are carried out.

The server 20 comprises a control server 21 configured to communicate with the box 30, and also comprises a firewall 22 making it possible to filter the connections according to the intervention to be carried out on industrial equipment. Thanks to the firewall 22, the remote maintenance server 20 makes it possible to isolate industrial equipment from other equipment in the network so that a user terminal can access the isolated equipment only without being able to access the others.

In addition, a box 30 for managing access to the industrial network is connected to the remote maintenance server 20.

This box 30 makes it possible to manage the access of a worker for the remote maintenance of the industrial network 10 via the remote maintenance server 20 via a communication terminal 50 ′.

In particular, as will be described later, the box 30 allows the opening and closing of a remote maintenance communication in order to be able to remotely troubleshoot an industrial equipment of the industrial network 10 via a data network 40. , Internet type.

It is, advantageously, via a mobile network 70, of the GSM type, that an authorized person, via his terminal 50, can initiate a remote maintenance communication for an authorized maintenance worker or for him- same.

In this way, an authorized maintenance operator or the authorized person can connect to the industrial network 10 via the data network 40, via a terminal 50, 50 ', in order to troubleshoot one of the equipment U 1 , U2, U3 industrial network 10.

In the example of FIG. 1, a terminal 50 is considered for the authorized person and another terminal 50 ′ for the maintenance operator so that these are two different people but the invention also applies. in the event that the authorized person opens the remote maintenance communication for himself.

As will be understood, the box allows two distinct connections: a connection to a data network 40 and another connection to a mobile network 70.

In addition, a terminal 50, 50 ′ is for example an intelligent telephone (in English, “smartphone”), a tablet or even a laptop computer. However, it will be understood that for the establishment of the remote maintenance communication via the mobile network 70, the terminal is able to connect to such a network. Like the terminal for performing remote maintenance via the data network 40, the terminal is able to connect to such a data network.

Still in relation to FIG. 1, the management box 30 comprises a channel 30a for accessing an Internet-type data network and a channel 30b for controlling said channel 30a for accessing the data network.

Advantageously, the control channel 30b comprises a first communication interface 32 making it possible to access a wireless network 70 of the GSM type.

The data network access path 30a comprises a second communication interface 34 making it possible to access a data network 40 of the Internet type.

Thus, as will be understood, the management box 30 is preferably both connected to a wire mobile network 70 (for example of the GSM type) and to a data network 40 of the Internet type.

By connected to the mobile network 70 and to the data network 40, it is specified that it is meant that it is possible to establish a communication between the management box 30 and one or the other of the data network 40 or of the 70 mobile network.

The box 30 has two distinct functions.

The first functionality is that of controlling via the control channel 30b the opening or closing of the remote maintenance communication between the industrial network 10 and the data network 40. The opening or closing of the remote maintenance communication as such is carried out via the channel 30a for accessing the data network 40.

The second functionality is to secure access to the industrial network. As such, the path 30a for accessing the data network 40 comprises a cut-off unit 33 configured to physically isolate the industrial network 10 from the data network 40 so that no communication can be established from the data network 40. . To control the cut-off unit 33, the control channel 30b comprises a controller 31 configured to control the cut-off unit 33 so as to allow access to the industrial network 10 from the data network 40 and thus to establish a communication. remote maintenance.

In a complementary manner, the firewall 22 of the remote maintenance server 20 also has the functionality of communicating with the controller 31 of the disconnection box 30 in order to authorize or not the opening of the remote maintenance communication.

In order to manage the opening or closing of the remote maintenance communication, the controller 31 is linked with the remote maintenance server 20 and with the first communication interface 32.

The links between the first communication interface 32 and the controller

31 on the one hand and between the controller 31 and the remote maintenance server 20 are known connections of the RS232 type.

The opening and closing of the remote maintenance communication are managed by the control channel 30b. In particular, a request for the purpose of establishing the remote maintenance communication originating from the mobile network 70 must be authenticated. This request comes from an authorized person.

Such authentication is implemented by the controller 31 which processes information received from the first communication interface 32 and transmits it to a server 21 for controlling the remote maintenance server 20.

The control server 21 comprises a memory (not shown) in which a list of authorized participants is stored. The controller 31 is therefore configured to carry out a comparison between the data of the piloting service 21 and data relating to the identity of the person who sent the request for establishing the remote maintenance communication.

The first communication interface 32 is a GSM communication interface comprising a SIM card in order to be able to connect the management box 30 to a mobile network of a GSM operator. In this case, the authorized person can send his request for the purpose of opening the remote maintenance communication by sending an SMS.

Advantageously, the transmitted SMS responds to a very specific syntax making it possible to identify the authorized person and also includes the piloting command which will be transmitted by the controller 31 to the piloting service 21.

In addition, for obvious security reasons, the SMS includes a confidential code typically made up of 8 digits which allows the authorized person to be authenticated.

Also, the SMS is advantageously composed of three fields:

a first field consisting of the confidential code

a second field consisting of a command to open or close the remote maintenance communication

a third field formed by the control command of a particular industrial equipment item.

The piloting command is a command for a particular industrial equipment U 1, U2, U3 to allow its maintenance via remote maintenance communication. In other words, it is a command applied to an item of equipment with the aim of allowing its remote maintenance.

The controller 31 is therefore configured to process the received request (the SMS), in order to compare the identity that it contains with the list of authorized persons stored in the memory of the control server 21 (in the case of the SMS, the verification identity will be implemented thanks to the telephone number from which the SMS originated and thanks to the confidential code contained in the SMS).

Once the comparison has been validated, the controller 31 generates a control signal which makes it possible to control the cut-off unit 33 so that the latter puts the industrial network 10 in communication with the data network 40 via the second interface 34 Communication.

Advantageously, the cut-off unit 33 comprises an electronic relay allowing physical cut-off between two communication ports of the RJ45 type, one of which is connected to the remote maintenance server 20 by means of a security gateway 22 and the other to the Internet data network 40 Thus, by virtue of a control signal from the controller 31 adapted to the relay, the connection or disconnection of the two communication ports is controlled. As the relays are controlled by a 12VDC signal, the command (5VDC) from the controller is adapted via an electronic voltage amplifier.

Alternatively, the cut-off unit 33 can be controlled locally in order to allow the opening or closing of the circuit without going through the SMS mode. In this case, the authentication is done locally and not remotely directly by sending a request to the controller 31 via the control service 21 of the server.

Maintenance is described in relation with FIG. 2 of a remote maintenance method implemented in the environment of FIG. 1 described above.

In a preliminary step (step EO), an anomaly on industrial equipment of the industrial network 10 is detected and communicated to the maintenance department of the industrial site.

If the maintenance department is in the interest of a remote maintenance communication to have additional remote support, it opens or asks an authorized person to proceed with the establishment of a secure remote maintenance communication in order to make the equipment of the industrial network for which an anomaly is detected remotely accessible.

The industrial equipment for which an anomaly is detected is, in what follows, called “equipment of interest”.

The management box 30 is in communication with the mobile network 70 and is waiting for the reception of a request for the purpose of establishing a remote maintenance communication between the industrial network 10 and the data network 40. The request can be constituted by the SMS described above from the authorized person.

At this stage, the management box 30 is only accessible via the mobile network 70 or locally if the request is local.

A request for the purpose of establishing a remote maintenance communication between the industrial network 10 and the data network 40 is received (step E1) by the control channel 30b. The request includes in particular the identity of the person authorized to request the establishment of the remote maintenance communication. The identity consists of the telephone number from which the SMS constituting the request originated.

This request is then authenticated (step E2). More precisely, the authentication consists in the controller 31 of the box 30 comparing the identity of the authorized person with a list of people stored in the control server 21 of the remote maintenance server 20. In the case of sending the SMS at this stage, the system also checks the confidential code contained in the SMS.

Once this request has been authenticated, the remote maintenance communication is established (step E3).

As such, the box 30 via the controller 31 controls (step 32) the disconnection unit 33 to put the industrial network 10 in communication with the data network 40 via said disconnection unit 33.

Advantageously, the industrial network 10 is in communication with the data network 40 via the second communication interface 34.

In a complementary manner, the establishment of the remote maintenance communication comprises prior to the control of the switching unit a step (step 31) consisting in isolating the industrial equipment on which an intervention is required on the industrial network 10 from the other equipment. industrial. In other words, only the industrial equipment of interest is accessible on the industrial network.

Once the remote maintenance communication has been established, a maintenance operator can connect (step E4) to the industrial network 10 via the data network 40 via his terminal (smartphone, tablet, computer, etc.).

To allow the connection of the maintenance operator, the authorized person who requested the opening of the remote maintenance communication transmits to the maintenance operator a connection link of the “URL” type then identification information. Thanks to this link, the maintenance operator has access to an interface making it possible to ensure the maintenance of industrial equipment.

The connection of the maintenance operator is made via an Internet type connection on the remote maintenance server 20 and includes authentication. This authentication consists in verifying that the participant who connects to the server is indeed the one expected and then authorized to cross the firewall 22 located on the remote maintenance server 20. A secure connection is then established.

Once this secure connection has been established, the management box 30 makes it possible to put the industrial network 10 and the intervenor's terminal in communication so that the latter can access the equipment of interest. This communication enables the intervening party's terminal to access the equipment of interest via the network 40 in order to perform maintenance operations. During this step, the management box has “physically” connected the industrial network 10 to the Internet network 40.

Then, the worker performs (step E5) one or more maintenance operation (s) on the industrial equipment of interest.

When the maintenance operation (s) are carried out, the worker disconnects (step E6) from the industrial network. This step E6 is initiated by the worker via his terminal.

The remote maintenance server 20 then controls the controller 31 of the management box (step E7) so that it controls the cut-off unit 33 in order to isolate again the industrial network 10 from the data network.

As the industrial network 10 is no longer accessible, the latter is repaired (step E8): all the industrial equipment is then connected to the industrial network.

The last step (step E9) is implemented by the remote maintenance server 20, and consists in tracing the actions performed by the maintenance operator on the equipment of interest.

Preferably, the control service 21 records the actions carried out on the industrial network 10, for example in the form of video in order to guarantee the integrity of the production data.

CLAIMS

1. Box (30) for managing access to an industrial network (10), to which industrial equipment (U 1, U2, U3) are connected, the box (30) for management comprising:

- a channel (30a) for accessing an Internet-type data network, said channel (30a) for accessing the data network comprising a cut-off unit (33),

- a channel (30b) for controlling the channel (30a) for accessing the data network, said channel (30a) for piloting comprising a controller (31) configured to control the cut-off unit (33) so as to allow communication between the industrial network and the data network, the cut-off unit comprising a cut-off relay which can be activated by means of a control signal from the controller (31).

2. Box according to claim 1, in which the control channel (30b) comprises a first communication interface (32) configured to put the box in communication with a mobile network of GSM type.

3. Box according to claim 2, wherein the first communication interface (32) is a GSM communication interface, the control signal being a function of a received SMS.

4. Housing according to one of the preceding claims, wherein the controller (31) is configured to authenticate a user, the controller (31) being configured to drive the unit (33) of cut in order to establish a communication between the industrial network (10) and the data network as soon as the user is authenticated.

5. Remote maintenance server (20) configured to be connected on the one hand to an industrial network (10) to which a set of industrial equipment is connected and on the other hand to a box (30) according to one of the preceding claims. , the server (20) comprising a control server (21) configured to communicate with the box (30), said server (20) further comprising a firewall (22) configured to manage access to the network (10) industrial from said housing (30).

6. Remote maintenance server according to claim 5, wherein the firewall (22) is configured to isolate industrial equipment from other network equipment so as to allow access to the isolated equipment only without being able to access the others.

7. A method of remote maintenance of a set of industrial equipment connected together to an industrial network (10), the industrial network (10) being linked to a box (30) for managing access to an industrial network according to l 'one of claims 1 to 4, the management box being linked to a data network (40) and a mobile network (70), the method comprising the following steps, an anomaly having been detected on a unit of the set known as unit of interest:

- reception (E1) on the channel (30b) for controlling the box of a request, for the purpose of establishing a remote maintenance communication between the industrial network (10) and the data network (40),

- authentication (E2) of the request, and if the request is authenticated

- establishment (E3) of the remote maintenance communication between the industrial network and the data network.

8. Method according to the preceding claim, in which the mobile network is a GSM network, the request consisting of an SMS preferably comprising a confidential code allowing authentication of said request.

9. Method according to one of claims 7 to 8, the box (30) being connected to a remote maintenance server (20), the method in which the establishment (E3) of the remote maintenance communication comprises a step of isolating the equipment of interest from other equipment of the industrial network (10) so that only the equipment of interest is connected to the industrial network (10).

10. Method according to one of claims 7 to 9, comprising a connection step (E4), via the management box (30), of a terminal of a participant to the industrial network (10) so that the latter can access the equipment of interest via the data network (40) in order to perform (E5) maintenance operations on said equipment of interest; and once the maintenance operations are completed; the method comprises a step of

disconnection (E6) via the management box, from the operator's terminal to the industrial network, the industrial network no longer being accessible via the Internet network (40).

1 1. The method of claim 10, wherein the step of connecting the speaker terminal comprises an authentication of said speaker to verify that he is authorized to connect to the network (10) industrial.

12. Method according to one of claims 7 to 11, comprising a step (E8) of repairing the industrial network (10) so that all the industrial equipment is accessible via the industrial network (10) but inaccessible from the network. internet (40).