METHOD AND SYSTEM FOR CONNECTING A CONTROLLER FOR A MACHINE TO A HIGHER-LEVEL IT SYSTEM

• US 20140090017A1
• Filed: 09/26/2013
• Published: 03/27/2014
• Est. Priority Date: 09/27/2012
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Birzer, Johannes, Ordenewitz, Rainer
• Granted Patent: US 9,787,682 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

In a method for securely connecting a controller for a machine or plant to a higher-level IT system, an integration layer is provided between the controller and the IT system, a controller image of the controller is generated in the integration layer, and the controller image is accessed from the IT system. The IT system thus always accesses the controller image rather than directly the controller. This prevents malware from gaining access to the controller e.g. via a network.

Claims

1. A method for connecting at least one controller for a machine or plant to a higher-level IT system, comprising:

providing an integration layer between the at least one controller and the IT system,

generating a controller image of the controller in the integration layer, and

accessing the controller image from the IT system.

2. The method of claim 1, wherein the integration layer is provided on at least one of a standard hardware and software platform.

3. The method of claim 1, wherein the controller image is accessed via a Controller Data Access (CDA) interface.

4. The method of claim 1, wherein the integration layer comprises a configuration file defining characteristics of the controller image.

5. The method of claim 4, wherein the configuration file is accessed via a Controller Data Configuration (CDC) interface.

6. The method of claim 1, further comprising automatically generating, with the controller, controller-relevant data for creating the controller image, and transmitting the controller-relevant data or data derived from the controller-relevant data to the integration layer.

7. The method of claim 6, further comprising, prior to transmitting the controller-relevant data or the data derived from the controller-relevant data to the integration layer, filtering the controller-relevant data or transforming the controller-relevant data into a generic data model.

8. The method of claim 7, further comprising back-transforming the controller-relevant data transmitted to the integration layer into a proprietary data model prior to forwarding the controller-relevant data to the integration layer.

9. The method of claim 1, wherein the controller is configured so as to be invisible in a computer network.

10. A system for connecting a controller for a machine or plant to a higher-level IT system, comprising at least:

a controller,

a higher-level IT system, and

an integration layer connected between the controller and the IT system, wherein the integration layer comprises a controller image of the controller and wherein the higher-level IT system and the integration layer are configured for allowing the higher-level IT system access to the controller image.

11. The system of claim 10, wherein the integration layer is provided on at least one of a standard hardware and software platform.

12. The system of claim 10, further comprising a Controller Data Access (CDA) interface for accessing the controller image.

13. The system of claim 10, wherein the integration layer comprises a configuration file defining characteristics of the controller image.

14. The system of claim 13, further comprising a Controller Data Configuration (CDC) interface for accessing the configuration file.

15. The system of claim 10, wherein the controller comprises a memory for accumulating controller-relevant data (DA).

16. The system of claim 10, wherein the controller comprises a filtering and transformation unit for filtering the controller-relevant data collected by the controller or transforming the controller-relevant data into a generic data model.

17. The system of claim 16, wherein the integration layer comprises a transformation unit which back-transforms the data stored in form of a generic data model into data stored in form of a controller-specific data model.

18. The system of claim 10, wherein the controller is configured so as to be invisible in a computer network.