AUTHENTICATION FOR LICENSING IN AN EMBEDDED SYSTEM

• US 20080082449A1
• Filed: 01/26/2007
• Published: 04/03/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Perrotto, Nicholas L., Wilkinson, John C., Kalan, Michael D., Jasper, Taryl J., Schulz, Glenn B., Visoky, Jack M., Meeker, James A., Tambascio, Kevin M.
• Granted Patent: US 8,015,409 B2
• Time in Patent Office: Days
• US Class Current: 705/59
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

An industrial automation system is provided. This includes at least one license component that is granted by a third party to permit access to a portion of an industrial control component. At least one protocol component that is based in part on a private key exchange facilitates authentication and access to the portion of the industrial control component.

Claims

1. An industrial automation system, comprising:

at least one license component that is granted by a license generating component (LGC) to permit access to a portion of an industrial control component; and

at least one protocol component that is based in part on an asymmetric key exchange to facilitate authentication and access to the portion of the industrial control component.

2. The system of claim 1, the asymmetric key exchange is associated with a private key component.

3. The system of claim 1, the asymmetric key exchange is associated with a public key component.

4. The system of claim 1, the license component is a digital certificate.

5. The system of claim 4, the digital certificate includes at least one of a header section, a license section, or an attributes section.

6. The system of claim 4, the digital certificate includes a public key component or a digital signature component.

7. The system of claim 4, the digital certificate includes a certificate length, a certificate type, or a certificate version component.

8. The system of claim 4, the digital certificate includes a license count, a license list, a license key, or a license instance.

9. The system of claim 4, the digital certificate includes an attribute type, and attribute length, or an attribute data component.

10. The system of claim 1, further comprising a state machine to process message exchanges between at least two authenticating components.

11. The system of claim 10, the state machine includes at least three states having an initial state, a challenge-submit state, a wait for session-submit state, or a session state.

12. The system of claim 1, the protocol component further comprising a sequential number generator or a random number generator.

13. The system of claim 12, the protocol component further comprising a nonce generator to facilitate authentication.

14. The system of claim 1, the protocol component further comprising a SHA-1 component, a concatenation component, or a random number generator.

15. The system of claim 1, the protocol component further comprising an asymmetric encryption or decryption algorithm.

16. The system of claim 1, the protocol component further comprising a challenge component, a certificate component, or a response component.

17. A computer readable medium having a data structure stored thereon to facilitate licensing in an industrial automation environment, comprising:

a first data field to specify a certificate from a client, the certificate issued as a license from a third party;

a second data field to specify a response to the client; and

a third data field that establishes a session based in part on the certificate and the response.

18. The computer readable medium of claim 17, further comprising a device challenge field for one way authentication.

19. The computer readable medium of claim 17, further comprising a challenge-submit field.

20. The computer readable medium of claim 17, further comprising a challenge response field.

21. The computer readable medium of claim 17, further comprising a session submit field for two way authentication.

22. The computer readable medium of claim 17, further comprising a session response field.

23. A licensing method for industrial control components, comprising:

obtaining a certificate from at least one third party component;

sending the certificate to at least one other device; and

employing a private key and the certificate to determine if a license grant is established.

24. The method of claim 23, further comprising sending a client certificate to the device.

25. The method of claim 23, further comprising sending a challenge to a client in response to receiving a certificate.

26. The method of claim 25, further comprising sending a response to the challenge.

27. The method of claim 26, further comprising establishing a session between at least two devices.

28. The method of claim 23, further comprising employing a public key to validate a signature associated with the digital certificates.

29. The method of claim 28, further comprising generating an error message if the signature is determined invalid.

30. The method of claim 29, further comprising exchanging a nonce after at least one validation procedure.

31. A licensing system for an industrial control environment, comprising:

means for obtaining a license from at least one third party;

means for communicating certificates across an industrial control network after receiving the license; and

means for negotiating a trusted session based on the certificates and the license.