REMOVABLE SECURITY MODULES AND RELATED METHODS

• US 20100185857A1
• Filed: 01/21/2009
• Published: 07/22/2010
• Est. Priority Date: 01/21/2009
• Status: Active Grant

• Current Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Original Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Inventors: Law, Gary Keith, Sherriff, Godfrey R., Neitzel, Lee Allen
• Granted Patent: US 8,977,851 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/25107 Pluggable card, magnetic or smart with configuration data, staying in device
• CPC Class Codes: G05B 2219/25326 Module with low maintenance connected to removable module with high maintenance
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

Example removable security modules for use with process control devices and related methods are disclosed. An example removable security module includes a body configured to be removably coupled to the process control device and a memory disposed in the body with a shared secret stored in the memory. The example removable security module also includes a processing unit disposed in the body, coupled to the memory and configured to read information from the process control device, compare the information to the shared secret and authenticate the process control device based on the comparison.

Claims

1. A removable security module for use with a process control device, comprising:

a body configured to be removably coupled to the process control device;

a memory disposed in the body and a shared secret stored in the memory; and

a processing unit disposed in the body, coupled to the memory and configured to;

read information from the process control device;

compare the information to the shared secret; and

authenticate the process control device based on the comparison.

2. The removable security module of claim 1, wherein the processing unit is further configured to prevent commissioning of the process control device if the process control device is not authenticated based on the comparison.

3. The removable security module of claim 1, wherein the memory includes encryption information stored thereon, and wherein the processing unit is configured to use the encryption information to secure communications associated with the process control device.

4. The removable security module of claim 3, wherein the encryption information comprises an encryption key.

5. The removable security module of claim 1, wherein the memory has stored thereon commissioning information associated with the process control device.

6. The removable security module of claim 5, wherein the commissioning information comprises configuration information.

7. The removable security module of claim 6, wherein the configuration information comprises at least one of a device identifier or a control parameter.

8. The removable security module of claim 1, further comprising a display to present authorization information received from the process control device.

9. The removable security device of claim 8, further comprising an input device to receive a user input in response to the presentation of at least some of the authorization information via the display.

10. The removable security device of claim 8, wherein the authorization information is a secret stored in the process control device.

11. The removable security module of claim 1, wherein the security module further includes a communications unit to provide substantially all communication software and electronics for the process control device.

12. A plurality of removable security modules for use with a process control device, wherein each of the modules comprises:

a body configured to be removably coupled to the process control device;

a memory disposed in the body and a shared secret stored in the memory; and

a processing unit disposed in the body, coupled to the memory and configured to;

read information from the process control device;

compare the information to the shared secret; and

authenticate the process control device based on the comparison.

13. The plurality of removable security modules of claim 12, wherein each of the modules enables a different type of function or level of functionality to be provided by the process control device.

14. The plurality of removable security modules of claim 12, wherein at least one of the modules provides upgraded functionality relative to another one of the modules.

15. The plurality of removable security modules of claim 12, wherein a first module of the plurality of modules is effective as a replacement of a second module of the plurality of modules.

16. The plurality of removable security modules of claim 15, wherein the process control device remains in service when the first module replaces the second module.

17. The plurality of removable security modules of claim 12, wherein a module of the plurality of modules is couplable to a second control device.

18. The plurality of removable security modules of claim 17, wherein the second control device does not have to be commissioned to operate after being coupled to the module.

19. A method of securing a process control device with a removable security module, the method comprising:

reading information in the process control device via the security module;

comparing the information to a shared secret stored in a memory of the security module; and

authenticating the process control device based on the comparison via the security module.

20. The method of claim 19, further comprising preventing commissioning of the process control device if the process control device is not authenticated based on the comparison.

21. The method of claim 19, further comprising using encryption information stored in the memory to secure communications associated with the process control device.

22. The method of claim 21, wherein the encryption information comprises an encryption key.

23. The method of claim 19, further comprising storing commissioning information in the memory in response to the process control device being authenticated.

24. The method of claim 23, wherein the commissioning information comprises configuration information.

25. The method of claim 24, wherein the configuration information comprises at least one of a device identifier or a control parameter.

26. A method of securing a process control device, the method comprising:

receiving a request or command at the process control device, wherein the request or command is associated with a first person;

obtaining a secret in response to the receipt of the request or command;

providing the secret to a second person;

sending the secret to the process control device via the second person;

authorizing the request or command for the process control device in response to the process control device receiving the secret.

27. The method of claim 26, wherein providing the secret to a second person occurs via a removable security module.

28. The method of claim 27, wherein obtaining the secret comprises the removable security module providing the secret.

29. The method of claim 26, wherein providing the secret to the second person comprises displaying the secret to the second person via a display.

30. The method of claim 26, wherein sending the secret to the process control device via the second person comprises:

sending the secret received from the second person to a source of the request or command; and

returning the secret to the process control device via the source of the request or command.

31. The method of claim 30, further comprising receiving the secret from the second person at an input device of a removable security module before sending the secret to the source of the request or command.

32. The method of claim 26, wherein the secret is provided via a pattern of lights.

34. A distributed process control system as defined in claim 31 further comprising means for two-person authorization of one or more applications.

33. A distributed process control system comprising:

one or more process control devices;

means for reading information from at least one of process control devices;

means for comparing the information to a shared secret;

means for authenticating at least one of the process control devices based on the comparison; and

means for authorizing one or more applications for use with at least one of the process control devices.