# US 12,008,094 B2 · Control system and control method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,094 B2 - Document ID: US12008094B2 - Status: Granted - Kind: B2 - Application number: 17/438,464 - Filed: 2020-02-18 - Published: 2022-04-28 - Granted: 2024-06-11 - Earliest claimed: 2019-03-27 - Assignees: OMRON Corporation - Applicants: OMRON Corporation - Inventors: Yuta Nagata - Web page: https://patentgrep.com/patent/US12008094B2 ## CPC - G06F 21/33: using certificates - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 63/10: {for controlling access to devices or network resources} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique for managing, in a centralized manner, user accounts in a control system which includes two or more units is provided. A control system (2) is provided with first and second units (200, 300). The first unit (200), upon reception of an access request to the first unit (200) from an external device (500), requests the external device (500) to input a user account, and transmits the user account received from the external device (500) to the second unit (300). The second unit (300, U3) refers to registration information (330) defining account information of registered users, and, when the user account is determined to be registered, transmits to the first unit (200) a token indicating permission of access. The first unit (200) transmits the token received from the second unit (300) to the external device (500). ## Claims ### Claim 1 A control system which comprises a plurality of units, wherein the plurality of units includes a first unit, and a second unit which is able to communicate with the first unit, wherein the first unit requests an input of a user account to an external device constituted to be able to communicate with the first unit upon reception of a request for access to the first unit from the external device and transmits the user account directly to the second unit upon reception of the user account from the external device, wherein the second unit refers to registration information defining account information of registered users, determines whether or not the user account received by the second unit has been registered, and transmits a token indicating permission of access directly to the first unit when it is determined that the user account received by the second unit has been registered, and wherein the first unit transmits the token received from the second unit to the external device, wherein an access authority is associated with each user account defined in the account information, wherein the second unit refers to the account information upon reception of the user account from the external device, identifies the access authority associated with the user account, and further transmits the identified access authority to the first unit when the token is transmitted to the first unit, and wherein the first unit transmits information according to the access authority received from the second unit to the external device, wherein an operation mode of the control system includes a maintenance mode indicating that the control system is under maintenance, and wherein the first unit or the second unit rewrites the access authority of a kind set in advance as an access authority of another kind set in advance when the operation mode of the control system is the maintenance mode. ### Claim 2 (depends on 1) The control system according to claim 1, wherein the plurality of units further includes a third unit, and wherein the third unit permits access to the third unit when the token is received from the external device together with a request for access to the third unit. ### Claim 3 (depends on 2) The control system according to claim 2, wherein the third unit is constituted to be able to communicate with the first unit, and wherein the first unit relays communication between the second unit and the external device and relays communication between the third unit and the external device. ### Claim 4 (depends on 1) The control system according to claim 1, wherein the first unit or the second unit restores the access authority which has been rewritten as an access authority of another kind set in advance to the access authority before being rewritten when a condition which is set in advance and indicates that maintenance of the control system has ended is satisfied. ### Claim 5 A control method fora control system which comprises a plurality of units, wherein the plurality of units includes a first unit, and a second unit which is able to communicate with the first unit, and wherein the control method comprises: a step of the first unit requesting an input of a user account to an external device constituted to be able to communicate with the first unit upon reception of a request for access to the first unit from the external device and transmitting the user account directly to the second unit upon reception of the user account from the external device; a step of the second unit referring to registration information defining account information of registered users, determining whether or not the user account received by the second unit has been registered, and transmitting a token indicating permission of access directly to the first unit when it is determined that the user account received by the second unit has been registered; and a step of the first unit transmitting the token received from the second unit to the external device, wherein an access authority is associated with each user account defined in the account information, wherein the second unit refers to the account information upon reception of the user account from the external device, identifies the access authority associated with the user account, and further transmits the identified access authority to the first unit when the token is transmitted to the first unit, and wherein the first unit transmits information according to the access authority received from the second unit to the external device, wherein an operation mode of the control system includes a maintenance mode indicating that the control system is under maintenance, and wherein the first unit or the second unit rewrites the access authority of a kind set in advance as an access authority of another kind set in advance when the operation mode of the control system is the maintenance mode.