Scalable and flexible information security for industrial automation

• US 20060074917A1
• Filed: 09/30/2004
• Published: 04/06/2006
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Inventors: Kalan, Michael D., Baier, John J., Chand, Sujeet, Morse, Richard A., Briant, Stephen C., Marquardt, Randall A., Farchmin, David W.
• Granted Patent: US 8,132,225 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: Y02P 90/80 Management or planning

Abstract

A security system that relates to industrial automation security comprises a component that receives a request to modify security relating to a zone of a factory floor, the zone being less than an entirety of the factory floor. A zonal security component generates security procedures for the zone, the security procedures differ from security procedures implemented on the factory floor outside the zone.

Claims

1. A security system relating to industrial automation security, comprising:

a component that receives a request to modify security relating to a zone of a factory floor, the zone being less than an entirety of the factory floor; and

a zonal security component that generates security procedures particular to the zone.

2. The security system of claim 1, an industrial controller receives the security procedures.

3. The security system of claim 1, the generated security procedures structured according to a structured data model.

4. The security system of claim 1, the generated security procedures structured according to one or more of an SP95 standard and a S88 standard.

5. The security system of claim 1, the zonal security component is aware of pre-existing security procedures relating to the zone.

6. The security system of claim 5, the generated security procedures are based at least in part upon the pre-existing security procedures.

7. The security system of claim 1, the zonal security component is aware of devices existent within the zone.

8. The security system of claim 7, the generated security procedures are based at least in part upon the awareness of the zonal security component with respect to the devices.

9. The security system of claim 1, the zone comprises a proxy server that facilitates implementation of the generated security procedures with respect to devices that do not directly support implementation of security procedures.

10. The security system of claim 9, the proxy server aggregates security administration for the devices that do not directly support implementation of the generated security procedures.

11. The security system of claim 9, the devices are low-level factory floor devices.

12. The security system of claim 1, the security procedures comprise variable levels of device authentication.

13. The security system of claim 12, the variable levels of device authentication comprise one or more of digital signatures and certificates.

14. The security system of claim 12, the variable levels of device authentication associated with selectable complexity of device authentication.

15. The security system of claim 1, the security procedures based upon contextual information relating to a user.

16. The security system of claim 15, the contextual information comprises at least one of the user'"'"'s identity, the user'"'"'s location, the user'"'"'s role, time of day, and user'"'"'s action(s).

17. The security system of claim 1, the security procedures based at least in part upon biometric attributes of a user.

22. A centralized security system comprising the zonal security system of claim 1.

23. The system of claim 22, further comprising:

one or more distributed security models, the centralized security system and the one or more distributed security model(s) described by a data model; and

a component that facilitates automatic integration of the distributed security model(s) with the centralized security system upon receipt of a request for such integration, the integration based at least in part upon policies defined within the data model.

18. A zonal security system for an industrial environment, comprising:

a representation of a factory floor, the representation comprises a plurality of zones; and

a zonal security component that generates security procedures specific to one or more of the zones, the one or more of the zones selected via the representation.

19. The system of claim 18, the representation is structured hierarchically.

20. The system of claim 19, the hierarchical structure is based at least in part upon an SP95 standard.

21. The system of claim 18, the representation based at least in part upon an S88 standard.

24. A zonal security component, comprising:

a component that receives a request for security modification relating to one or more of a device and an operation resident upon a factory floor;

a dynamic zone generator that analyzes the request and dynamically determines a zone relating to the request; and

a zonal security component that generates security procedures for the factory floor relating to the dynamically determined zone.

25. The system of claim 24, the request is initiated by an alarm on the factory floor.

26. A method for generating security procedures for a portion of a factory floor, comprising:

receiving a request for a security modification relating to a factory floor;

determining a zone of the factory floor based at least in part upon the request; and

generating security procedures for the zone based at least in part upon the request.

27. The method of claim 26, relaying the security procedures to an industrial controller.

28. The method of claim 26, further comprising authenticating an operator that initiates the request.

29. The method of claim 26, the zone determined based upon an operator selection of a defined zone.

30. The method of claim 26, further comprising:

associating devices on the factory floor with a proxy server; and

implementing the generated security procedures with respect to the devices via the proxy server.

31. The method of claim 26, further comprising approving the request prior to generating the security procedures.

32. A zonal security system, comprising:

means for receiving a request to modify security with respect to a portion of a factory floor;

means for determining a zone that comprises the portion of the factory floor based upon the request; and

means for generating security procedures for one or more of a device and a operation within the zone.