DE102011003325A1 - Network node for industrial automation network, has communication unit that forms tunnels of one virtual private sub-network with participants of sub-networks by using information relating to subscribers of virtual private network - Google Patents

Abstract

The network node (100) comprises a digital storage medium for storing information relating to subscribers of one virtual private network of the automation network (200). A communication unit transfers the data between the sub-networks (202). The communication unit forms the tunnels of one virtual private sub-network with the participants (204) of the sub-networks by using the stored information. The communication unit receives update data for updating the information, and forwards the updated data to other network nodes of automation network. Independent claims are included for the following: (1) automation network; and (2) method for updating information over virtual private network in automation network.

Description

The invention relates to an automation network, in particular an automation network with at least one virtual private subnetwork.

The establishment of Virtual Private Subnetworks (VPNs) within an automation network helps to structure the automation network and increase the security of the automation network.

In contrast, it is an object of the invention to provide an improved automation network, an improved network node for an automation network, an improved digital storage medium for a network node and an improved method for updating information about at least one virtual private subnet in the automation network.

The objects are achieved with the objects according to the independent claims. Embodiments of the invention are given in the dependent claims.

Embodiments of the invention relate to a network node for an automation network with communication means and a digital storage medium. The digital storage medium is designed to store information about subscribers of at least one virtual private subnetwork of the automation network. The communication means are designed for forwarding data from a first subnetwork to a second subnetwork and vice versa. In addition, the communication means for establishing tunnels of the at least one virtual private subnetwork with subscribers of the first and the second subnetwork are formed using the information. The communication means are further adapted to receive update data for updating the information and to forward the update data to other network nodes of the automation network.

The information about subscribers of the at least one virtual private subnetwork may include information about which virtual private subnetwork is connected to the network node or to another network node. In addition, the information may also include information about the subscribers of the at least one virtual private subnetwork.

The network node may, for example, be connected to the communication means to two further network nodes of the first subnetwork and to subscribers of the second subnetwork. In this case, for example, the first subnetwork could be a ring consisting of several network nodes, each network node being connected to two other network nodes. The second subnetwork consists of one or more subscribers connected to the network node. In such an automation network, for example, each network node can be connected to the first subnetwork and in each case to a second subnetwork. However, only one, two or a few network nodes can be connected to a second subnetwork.

The first subnetwork can also be formed linear. In this case, the network nodes are each connected to two other network nodes of the first subnetwork, with the exception of two network nodes that are only connected to another network node of the first subnetwork. Each network node can also be connected in this arrangement, each with a second subnetwork. However, only one, two or a few network nodes can be connected to a second subnetwork.

An automation network can, for. B. be designed as an industrial automation network. Such industrial automation networks can, for. B. for the control and / or regulation of industrial equipment (eg., Production equipment, conveyors, etc.), machines and / or equipment designed, equipped and / or provided. In particular, automation networks or industrial automation networks can use real-time communication protocols (eg Profinet, Profibus, Real-Time Ethernet) for communication at least between the components involved in the control and / or regulation tasks (eg between the control units and the to be controlled plants and / or machines). The secure transmission of data via storage media is also covered.

Furthermore, in addition to a real-time communication protocol, at least one further communication protocol (which, for example, does not need to be real-time capable) may also be provided in the automation network or industrial automation network, eg. B. for monitoring, setup, reprogramming or / or reparameterization of one or more control units in the automation network.

An automation network can, for. B. wired communication components and / or wireless communication components. In addition, an automation network may include at least one automation device.

An automation device can be, for example, a computer, PC and / or controller with control tasks or control capabilities. In particular, an automation device may be, for example, an industrial automation device, which, for. B. specially designed for the control and / or regulation of industrial equipment, set up and / or can be provided. In particular, such automation devices or industrial automation devices can be real-time capable, ie enable real-time control or regulation. For this purpose, the automation device or the industrial automation device z. B. include a real-time operating system and / or at least inter alia support a real-time communication protocol for communication (eg Profinet, Profibus, Real-Time Ethernet).

An automation network includes multiple sensors and actuators. The actuators and sensors are controlled by at least one control device. The actuators, the sensors and the at least one control device exchange data with each other. An automation protocol is used for data exchange. The at least one control device controls the actuators, the sensors and the data exchange in such a way that a mechanical manufacturing process takes place in which, for example, B. a product is produced.

An industrial automation device can, for. B. a programmable logic controller, a module or part of a programmable logic controller, a built-in computer or PC programmable logic controller and appropriate field devices, sensors and / or actuators, input and / or output devices or the like for connection to a programmable logic controller or such include.

As an automation protocol in the context of the present invention, any type of protocol is provided, which is provided for communication with automation devices according to the present description, suitable and / or set up. Such automation protocols may include, for example, the professional bus protocol (eg according to IEC 61158 / EN50170 ), a Profi-Bus-DP-protocol, a Profi-Bus-PA-protocol, a Profi-Net-protocol, a Profi-Net-IO-protocol, a protocol according to AS-Interface, a protocol according to IO-Link, a KNX protocol, a multipoint interface (MPI) protocol, a point-to-point (PtP) protocol, a protocol according to the specifications of the S7 communication (Which is provided and set up, for example, for the communication of programmable logic controllers from Siemens) or also an industrial Ethernet protocol or real-time Ethernt protocol or other specific protocols for communication with automation devices. As an automation protocol in the sense of the present description, any combination of the aforementioned protocols may be provided.

The virtual private subnetwork may include multiple participants in the automation network from different subnetworks. For example, the virtual private subnetwork may consist of three subscribers of the second subnetwork and two subscribers of another second subnetwork. Here, the second subnetwork is connected, for example, to the network node and the other second subnetwork to another network node. The two network nodes are part of the first subnetwork, which consists of several network nodes and is ring-shaped.

The data transmission within the virtual private subnetwork is encrypted via tunnel. In this case, a tunnel is set up by a subscriber of the virtual private subnetwork via at least one network node to another subscriber of the virtual private subnetwork. In order for the data within the virtual private subnetwork to be correctly forwarded by the network nodes, information must be stored in the network node. The information may be information about which subscriber belongs to which virtual private subnetwork. A subscriber may also belong to several virtual private subnetworks.

The network node, which is connected to the second subnetwork, stores information about the subscribers of the at least one second subnetwork, this information including clues as to which network devices of the second subnetwork are part of the virtual private subnetwork. This information is forwarded by the network node to the remaining network nodes of the first subnetwork using the communication means so that each network node of the first subnetwork stores information about the subscribers of the virtual private subnetwork.

It is particularly advantageous if the information about which the subscribers of the at least one second subnetwork are output exclusively to network nodes of the first subnetwork is particularly advantageous. As a result of the fact that the output of the information to subscribers of the at least one second subnetwork is omitted, superfluous data transmissions are avoided and the performance of the automation network is increased.

In addition, this protects the access to the at least one virtual private subnetwork.

In a particularly advantageous embodiment of the invention, the transmission of the information in the first subnetwork over blocked ports takes place. For example, blocked ports can exist in a redundancy manager.

If, for example, a subscriber of the second subnetwork is removed from the at least one virtual private subnetwork or added to the at least one virtual private subnetwork, information about it is sent to the network node manually or automatically. This can be done manually, for example, by a user using a subscriber of the second subnetwork to send information about adding or removing the subscriber to the network node. Automatically, the transmission of the information can be done by the added or removed subscriber transmitting this information to the network node. In the context of the invention, a subscriber can be in particular a computer, a laptop or an automation device of the automation network. A subscriber can also be referred to as a network device.

When the network node receives update data about the addition or removal of a subscriber from the at least one virtual private subnet, that information is stored as an update. The previously stored information is thus updated. The update data is also output from the network node to other network nodes of the automation network. Thus, the information about adding or removing a participant of the virtual private subnet is output to all network nodes of the automation network. A manual transmission of the information to each network node is therefore not necessary.

According to embodiments of the invention, the communication means of the network node are designed for data transmission via at least two redundant data transmission paths. The redundant transmission paths are preferably in the first subnetwork and serve for data transmission from the network node to further network nodes of the first subnetwork.

• – Media Redundancy Protocol (MRP);
• – Parallel Redundancy Protocol (PRP);
• – Cross-network Redundancy Protocol (CRP);
• – Beacon Redundancy Protocol (BRP);
• – High availability Seamless Ring (HSR); und
• – Highly Available Seamless Automation Ring (HASAR)

The redundant data transmission can take place, for example, according to one of the methods standardized in accordance with IEC 62439 ("Industrial communication networks: high availability automation networks"). This can be, for example, one of the following methods:

• - Media Redundancy Protocol (MRP);
• - Parallel Redundancy Protocol (PRP);
• - Cross-network Redundancy Protocol (CRP);
• Beacon Redundancy Protocol (BRP);
• - High availability Seamless Ring (HSR); and
• - Highly Available Seamless Automation Ring (HASAR)

According to embodiments of the invention, the communication means comprise network connections for the first and the second subnetwork and a processor. The digital storage medium includes first and second program instructions, and the processor is configured to execute the first and second program instructions. The network ports are configured to receive and send data over the first and second subnetworks.

The first program instructions, when executed, cause the processor to tunnel the at least one virtual private subnetwork between two subscribers of the virtual private subnetwork and the second program instructions cause the processor, when executed, to update the information when updating data is received over at least one of the network ports. The update data can in this case be received, for example, from another network node of the first subnetwork or from a subscriber of the second subnetwork.

In a further aspect, the invention relates to a digital storage medium for a network node in an automation network. The digital storage medium includes program instructions that, when executed, cause a network node to update information about at least one virtual private subnet of the automation network in the network node and to output update data to another network node of the automation network when update data has been received by the network node. The update data may have been received here, for example, by another network node or else by a subscriber who is directly connected to the network node.

In yet another aspect, the invention relates to an automation network having a plurality of network nodes. The network nodes are connected to each other annularly via a first subnetwork and each of the network nodes connects the first subnetwork to a respective second subnetwork. The second subnetworks are separated from each other. This means that no subscriber of a second subnetwork is also a subscriber of another second subnetwork at the same time. Each network node is designed for forwarding data from the first subnetwork into the respective one associated with the respective network node second sub-network and vice versa. Each of the network nodes is also designed for the production of tunnels of at least one virtual private subnetwork with subscribers of the first and each one connected to the respective network node second subnetwork. Each of the network nodes also includes a digital storage medium storing information about the at least one virtual private subnetwork. Each of the network nodes is configured to receive update data for updating the information from another network node and from a central network entity. Update data can also be received by a network node, for example by a subscriber of the respective second subnetwork. Each network node is configured to output the update data to at least one other network node.

In other words, update data received from a network node is forwarded to neighboring network nodes. Thus, the update data is distributed throughout the first subnetwork to all network nodes and a manual configuration of each network node is not necessary.

According to embodiments of the invention, each of the network nodes is designed for encrypted data transmission via the tunnels of the at least one virtual private subnetwork.

According to embodiments of the invention, each network node is configured to generate, after receiving the update data, further update data for updating another network node and to output it to the other network node.

In yet another aspect, the invention relates to a method for updating information about at least one virtual private subnetwork in an automation network according to embodiments of the invention.

In this case, a first signal for updating the information in a network node is initially received. The information in the first network node is then updated and a second signal is generated for updating the information in a second network node and output to the second network node. Then the information in the second network node is updated.

The information about the at least one virtual private subnetwork is thus automatically distributed to all network nodes of the automation network. This eliminates manual setup of all network nodes. The update data only has to be received by a network node of the automation network and then distributed to all network nodes throughout the network.

Embodiments of the invention will be explained in more detail below with reference to exemplary figures. Show it:

1 a block diagram of a network node for an automation network,

2 a schematic view of an automation network with multiple network nodes and multiple subnetworks, and

3 a flowchart of a method according to embodiments of the invention.

1 is a block diagram of a network node 100 with means of communication 102 and a digital storage medium 104 , The means of communication 102 For example, they may include a processor configured to execute program instructions stored in the digital storage medium 104 are stored. The digital storage medium 104 stores information about subscribers of at least one virtual private subnet of the automation network. The network node can communicate with these subscribers, for example via one of the network ports 106 be connected directly or via one of the network connections 108 be connected via at least one further network node of a first subnetwork of the automation network. The first subnetwork may, for example, be composed in a ring of several network nodes. The second subnetwork is over the ports 106 with the network node 100 connected. Each network node of the automation network is annularly connected to the other network nodes and also has connections 106 for connection to a second subnetwork of the automation network.

About the connections 106 and 108 Data can then be received, which is then transmitted by the means of communication 102 to get redirected. For example, data about one of the ports 106 be received by a network device of the second subnetwork and both ports 108 to network nodes of the first subnetwork be issued. In addition, secure tunnels can be used for encrypted data transmission. For example, these tunnels run from one subscriber of the second subnetwork over one of the ports 106 and at least one of the connections 108 or both connections 108 and at least one further network node to another subscriber of another second subnetwork connected to another network node.

In the automation network, at least one virtual private subnetwork can be set up. This virtual private subnetwork may include multiple subscribers of different second subnetworks. This means that information about the at least one virtual private subnetwork must be stored in the network node of the automation network so that the data can be forwarded correctly. The information includes, for example, a list of all subscribers of the virtual private subnetwork. The virtual private subnetwork is used to securely transfer data and to control that certain network devices are allowed to communicate only with certain other network devices and not with all network equipment in the automation network.

Now, if changes are made in the first virtual private subnet, such as adding or deleting a private virtual subnet user, that information must be updated. This is done by updating data from, for example, a subscriber of the second subnetwork via one of the ports 106 at the network node 100 be transmitted. The means of communication 102 receive the update data and update the information in the digital storage medium 104 , There will also be update information about the ports 108 to the neighboring network nodes in the first subnet, so that they also update their information about the at least one virtual private subnetwork.

2 is a schematic view of an automation network 200 with multiple network nodes 100 and several second subnetworks 202 , The network nodes 100 form an annular first subnetwork of the automation network 200 , The second subnetworks each comprise several subscribers 204 , The participants 204 can also be called network devices.

Data can be shared within the automation network by a subscriber 204 a second subnetwork 202 each at the respective network node 100 be transmitted. The respective network node 100 then either forwards this data to another participant 204 the same subnetwork 202 or to another network node 100 further. The network nodes 100 form an annular first subnetwork of the automation network 200 , Data transfers within the first annular subnetwork are preferably done redundantly in both ring directions. Moreover, within the automation network 200 set up a virtual private subnetwork. Virtual Private Subnet subscribers can be from any of the second subnetworks 202 come. Each of the network nodes has the data forwarded correctly 100 about information about the at least one virtual private subnetwork. The information preferably comprises a list of the participants of the virtual private subnetwork and the respective network nodes 100 with which the participants are directly connected. Now, if a change is made to the virtual private subnet, such as removing or adding a participant from or to the virtual private subnet, that information needs to be updated. For this purpose, update data from a participant 204 of the subnetwork 202 in which the change has taken place, at the respective network node 100 transfer. There, the update data is processed and the information about the virtual private subnet is updated. In addition, update data is sent to the two neighboring network nodes 100 which in turn update their information and the update data to the respective neighboring network nodes 100 output. Thus, update data is sent to each of the network nodes 100 automatically issued and manual reconfiguration of the information is eliminated.

3 FIG. 10 is a flowchart of a method for updating information about at least one virtual private subnetwork in an automation network. In a first step S1, update data, for example in the form of a first signal, for the information in a first network node of the automation network is received. The first signal is received by the network node whose information is to be updated. For example, the update is adding or removing a participant in the virtual private subnet that is also a participant of the second subnet that is directly connected to the first network node.

In a second step S2, the information in the first network node is updated, and in a third step S3, a second signal for updating the information in at least one second network node is generated. Preferably, this second signal is in one fourth step S4 output to the at least one second network node. In an annular structure of the first subnetwork, the second signal is preferably output to the second adjacent network node of the first network node. In step S5, the information in the second network node is then updated. If the second signal has been output to two network nodes in step S4, the information in the two network nodes is updated in step S5.

LIST OF REFERENCE NUMBERS

100

Network nodes

102

means of communication

104

digital storage medium

106

connections

108

connections

200

Automation network

202

second subnetwork

204

Attendees

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• IEC 61158 [0015]
• EN50170 [0015]

Claims (14)

Network node ( 100 ) for an automation network ( 200 ) with: - means of communication ( 102 ); and - a digital storage medium ( 104 ); wherein the digital storage medium is configured to store information about subscribers of at least one virtual private subnetwork of the automation network; wherein the communication means for forwarding data from a first subnetwork into a second subnetwork ( 202 ) and vice versa are formed; wherein the communication means for establishing tunnels of the at least one virtual private subnetwork with subscribers ( 100 ; 204 ) of the first and / or the second subnetwork are formed using the information about the at least one virtual private subnetwork; wherein the communication means are adapted to receive update data for updating the information; and wherein the communication means are adapted to forward the update data to further network nodes of the automation network. A network node according to claim 1, wherein the encrypted data transmission communication means are formed via the tunnels of the virtual private subnetwork. Network node according to one of the preceding claims, wherein the communication means are designed for data transmission via at least two redundant data transmission paths, in particular in the first subnetwork. Network node according to claim 3, wherein at least one of the following protocols is provided for data transmission, in particular in the first subnetwork: - Media Redundancy Protocol (MRP); - Parallel Redundancy Protocol (PRP); - Cross-network Redundancy Protocol (CRP); Beacon Redundancy Protocol (BRP); - High availability Seamless Ring (HSR); and - Highly Available Seamless Automation Ring (HASAR). Network node according to one of the preceding claims, wherein the communication means network connections ( 106 ; 108 ) for the first and second subnetworks and a processor, the digital storage medium comprising first and second program instructions, wherein the processor is adapted to execute the first and second program instructions, the network terminals for receiving and transmitting data via the programmer the first program instructions, when executed, cause the processor to establish the tunnel of the at least one virtual private subnetwork, the second program instructions, when executed, for causing the information to be updated if the update data is received via at least one of the Network connections are received. Digital storage medium ( 104 ) for a network node ( 100 ) in an automation network ( 200 ), wherein the digital storage medium comprises program instructions, the program instructions causing a network node to execute when updating information about at least one virtual private subnetwork of the automation network in the network node, and for issuing update data to another network node of the automation network, if update data received by the network node. The digital storage medium of claim 6, wherein the network node of any one of claims 1-5 is formed and the automation network of any of claims 8-11. Automation network ( 200 ) with several network nodes ( 100 ), wherein the network nodes are connected to one another in a ring-shaped or linear manner via a first subnetwork, wherein each of the network nodes has the first subnetwork, each with a second subnetwork (FIG. 202 Each of the network nodes for forwarding data from the first subnetwork is formed in the respectively connected second subnetwork and vice versa, wherein each of the network nodes for the production of tunnels at least one virtual private subnetwork with participants of the first and / or each a second Subnetwork is formed, each of the network nodes a digital storage medium ( 104 ) on which information about the at least one virtual private subnetwork is stored, wherein each of the network nodes is configured to receive update data for updating the information about the at least one virtual private subnetwork from another network node and / or central network unit, and wherein each of the network nodes is adapted to update the update data to at least one other network node issue. Automation network according to claim 8, wherein each of the network nodes for encrypted data transmission via the tunnels of the at least one virtual private subnetwork is formed. Automation network according to one of claims 8 or 9, wherein each of the network nodes is adapted, after receiving the update data, to generate further update data for updating another network node and to output it to the other network node. Automation network according to one of claims 8-10, wherein at least one of the following protocols is provided for data transmission, in particular in the first subnetwork: - Media Redundancy Protocol (MRP); - Parallel Redundancy Protocol (PRP); - Cross-network Redundancy Protocol (CRP); Beacon Redundancy Protocol (BRP); - High availability Seamless Ring (HSR); and - Highly Available Seamless Automation Ring (HASAR). Automation network according to one of claims 8-11, wherein the network nodes are designed according to one of claims 1-5 and the storage medium according to claim 6 or 7 is formed. A method of updating information about at least one virtual private subnetwork in an automation network according to any of claims 8-11, the method comprising the steps of: - Receiving (S1) a first signal for updating the information about the at least one virtual private subnetwork in a first network node; Updating (S2) the information in the first network node; - generating (S3) a second signal for updating the information in a second network node; Output (S4) of the second signal to the second network node; - updating (S5) the information in the second network node. The method of claim 13, wherein the network nodes of any one of claims 1-5 are formed and the storage medium is formed according to claim 6 or 7.

Images