FLEXIBLE SECURITY CONTROL ENVIRONMENT

• US 20130125233A1
• Filed: 11/02/2012
• Published: 05/16/2013
• Est. Priority Date: 11/11/2011
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Bush, Michael A., Brandt, Robert A., Bliss, Ronald E., Miller, Michael B.
• Granted Patent: US 9,323,245 B2
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G05B 19/042 using digital processors G05B19/05 takes precedence
• CPC Class Codes: G05B 2219/23121 Display graphics with corresponding text
• CPC Class Codes: G05B 2219/23171 Display dynamic change of process, animation
• CPC Class Codes: G05B 2219/23258 GUI graphical user interface, icon, function bloc editor, labview
• CPC Class Codes: G05B 2219/24093 Display, show place of error, fault
• CPC Class Codes: G05B 23/0216 Human interface functionality, e.g. monitoring system providing help to the user in the selection of tests or in its configuration
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G09G 2340/14 Solving problems related to the presentation of information to be displayed
• CPC Class Codes: G09G 5/00 Control arrangements or circuits for visual indicators common to cathode-ray tube indicators and other visual indicators image data processing or generation, in general G06T

Abstract

An automation control system is provided with an interface device configured to enable a user to monitor, control, or monitor and control processes of the automation control system. Upon power on or initialization of the interface device or when a previously logged in user is logged off, the interface device logs in a guest account associated with a user role having a defined set of access rights and provides access to monitor, control, or monitor and control the processes based upon the set of access rights.

Claims

1. An automation control system, comprising:

an interface device configured to enable a user to monitor, control, or monitor and control processes of the automation control system;

wherein, upon power on or initialization of the interface device, the interface device is configured to;

login a guest account associated with a user role having a defined set of access rights; and

provide access to monitor, control, or monitor and control the processes based upon the set of access rights.

2. The automation control system of claim 1, wherein the guest account is associated with a restricted user role configured to define access rights specific to users that have not provided an authentication input.

3. The automation control system of claim 1, wherein the interface device is configured to login the guest account when an alternate account is logged out of the interface device.

4. The automation control system of claim 3, wherein the interface device comprises a human machine interface (HMI).

5. The automation control system of claim 1, wherein the access rights are specific to a particular component of the interface device, the particular component comprising:

an overall project associated with the automation control system;

one or more objects of an interface device screen;

the interface device screen;

a first folder containing interface device screens;

or a second folder containing the first screen.

6. The automation control system of claim 1, wherein the access rights comprise inherit access rights for a particular component, wherein the inherit access rights are configured to inherit access rights for the particular component from a higher level component of the interface device.

7. The automation control system of claim 6, wherein the particular component comprises one or more objects of an interface device screen and the higher level component comprises the interface device screen.

8. The automation control system of claim 1, wherein the interface device is configured to log out the guest account when an alternate account is authenticated and logged into the interface device.

9. The automation control system of claim 1, wherein the interface device comprises a toolbar configured to enable a user to login as an alternate account.

10. The automation control system of claim 1, wherein the toolbar, a user-defined log-out command, or a system-defined logout command, or any combination thereof is configured to enable a user to logout the alternate account, thus triggering login of the guest account.

11. The automation control system of claim 1, wherein choices for the access rights comprise:

full access, read only access, no access, and inherit access.

12. The automation control system of claim 1, wherein choices for the user role comprise:

an administrator role, an engineer role, a maintenance role, an operator role, a restricted role, a supervisor role, a none role, a user-defined role, or any combination thereof.

13. A method, comprising:

powering on or initializing an interface device of an automation control system;

logging in a guest account upon powering up or initializing the interface device, without requiring login information.

14. The method of claim 13, wherein the guest account is associated with a restricted user role configured to define access rights specific to users who do not provide an authentication input.

15. The method of claim 13, comprising:

detecting an override trigger before logging in the guest account;

providing an alternate user login screen upon detecting the override trigger;

authenticating a request for login provided from the alternate user login screen;

logging in an alternate account if the request is authenticated; and

only logging in the guest account when the alternate account is not logged in.

16. The method of claim 13, comprising:

detecting a request to login an alternate account;

logging out the guest account and logging in the alternate account when the request is authenticated.

17. A non-transitory, computer-readable medium, comprising computer-readable instructions to:

login a guest account upon powering up or initializing of an interface device of an automation monitoring and control system, without requiring an login information;

wherein the guest account is associated with a restricted user role defined by access rights specific to users who do not have to provide a password, a personal identification number (PIN), or a combination thereof.

18. The computer-readable medium of claim 17, comprising instructions to:

display a security programming screen comprising a security role input for the guest account, wherein the security programming screen is configured to associate a user role with the guest account.

19. The computer-readable medium of claim 18, wherein the security role input is configured to enable association of the guest account with an administrator role, an engineer role, a maintenance role, an operator role, a restricted role, a supervisor role, a none role, a user-configured role, or any combination thereof.

20. The computer-readable medium of claim 17, comprising computer-readable instructions to:

display a security properties screen associated with components of the interface device;

wherein the security properties screen comprises access rights fields for each role provided in the interface device and the access rights fields are configured to define access rights for each of the roles provided in the interface device.

21. The computer-readable medium of claim 17, wherein the access rights comprise:

full access, read only access, no access, and inherit access.