DIGITAL RIGHTS MANAGEMENT SYSTEM AND METHOD

• US 20100077217A1
• Filed: 12/02/2009
• Published: 03/25/2010
• Est. Priority Date: 03/31/2004
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Callaghan, David M.
• Granted Patent: US 9,135,430 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G05B 2219/24167 Encryption, password, user access privileges
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

The present invention concerns application of digital rights management to industrial automation devices including programmable logic controllers (PLCs), I/O devices, and communication adapters. Digital rights management involves a set of technologies for controlling and managing access to device objects and/or programs such as ladder logic programs. Access to automation device objects and/or programs can be managed by downloading rules of use that define user privileges with respect to automation devices and utilizing digital certificates, among other things, to verify the identity of a user desiring to interact with device programs, for example. Furthermore, the present invention provides for secure transmission of messages to and amongst automation devices utilizing public key cryptography associated with digital certificates.

Claims

1. An industrial automation device, comprising:

a processor configured to;

issue at least one digital certificate for a second industrial automation device that communicates with the industrial automation device over a local area network; and

define rights associated with the second industrial automation device based at least in part upon the at least one digital certificate.

2. The industrial automation device of claim 1, wherein the processor is further configured to issue at least a second digital certificate to one or more of a plurality of industrial automation devices that communicate with the industrial automation device over the local area network.

3. The industrial automation device of claim 1, wherein the at least one digital certificate comprises at least one digital signature and at least one public-private key pair.

4. The industrial automation device of claim 1, wherein the at least one digital certificate comprises at least one public key related to the second industrial automation device.

5. The industrial automation device of claim 1, wherein the at least one digital certificate comprises at least one entity identifier and at least one public key.

6. An industrial automation system, comprising:

a first industrial automation device, comprising;

a first processor configured to;

generate at least one digital certificate; and

define access rights to at least one program or at least one process based at least in part upon the at least one digital certificate; and

a second industrial automation device that communicates with the first industrial automation device over a local area network, wherein the second industrial automation device comprises;

a second processor configured to;

download the at least one digital certificate and the access rights; and

grant permission to the at least one program or the at least one process according to the access rights.

7. The industrial automation system of claim 6, wherein the at least one digital certificate comprises a public key.

8. The industrial automation system of claim 6, wherein the at least one digital certificate comprises at least one of:

an entity identifier, a validity period or a certification authority signature.

9. The industrial automation system of claim 6, wherein the at least one digital certificate comprises a digital signature.

10. The industrial automation system of claim 6, wherein the second industrial automation device comprises a private key.

11. The industrial automation system of claim 6, wherein the access rights are further based upon at least one of a user name, a role or an entity type.

12. The industrial automation system of claim 6, wherein the access rights allow a user to modify at least a portion of the at least one program or the at least one process.

13. The industrial automation system of claim 6, wherein the access rights comprise at least one of:

a right to view the at least one program or the at least one process,

a right to modify the at least one program or the at least one process,

a right to download the at least one program or the at least one process, or

a right to upload the at least one program or the at least one process.

14. The industrial automation system of claim 6, wherein the second industrial automation device is a programmable logic controller or an input/output device.

15. A method for employing digital rights management in an industrial automation environment, comprising:

receiving a request to access at least one program or at least one process from a requesting entity;

downloading a digital certificate corresponding to the requesting entity, wherein the digital certificate is generated by an industrial automation device accessible across a local area network;

matching the digital certificate to a list of access rights for the at least one program or the at least one process to determine a level of access to the at least one program or the at least one process; and

granting the level of access to the requesting entity.

16. The method of claim 15, further comprising requesting a plurality of digital certificates from the industrial automation device, wherein the plurality of digital certificates comprises the digital certificate corresponding to the requesting entity.

17. The method of claim 15, wherein the downloading the digital certificate includes downloading a public key.

18. The method of claim 15, wherein the downloading the digital certificate includes downloading at least one of an entity identifier, a validity period or a certification authority signature.

19. The method of claim 15, wherein the matching includes matching the digital certificate to a set of rights that restrict access to the at least one program or the at least one process according to at least one of a user name, an entity type or a role.

20. The method of claim 15, wherein the matching includes matching the digital certificate to a set of rights regulating at least one of:

viewing the at least one program or the at least one process,

modifying the at least one program or the at least one process,

downloading the at least one program or the at least one process, or

uploading the at least one program or the at least one process.