AUTOMATION SYSTEM ACCESS CONTROL SYSTEM AND METHOD

• US 20140123276A1
• Filed: 10/31/2012
• Published: 05/01/2014
• Est. Priority Date: 10/31/2012
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Bush, Michael A., Brandt, Robert
• Granted Patent: US 8,949,970 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G05B 15/02 electric
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

An improved system and method for controlling access of components to industrial automation system resources by reference to the various operational states of the industrial automation system. A central access control system includes a processing circuitry, interface circuitry configured to receive information pertaining to the operational state of an automation system, memory circuitry, and a display and user interface. In operation, access to automation components are either allowed or denied based on the designation of an operational state of an automation system.

Claims

1. A method for controlling access to an industrial automation system, comprising:

determining an operational state of the industrial automation system from a plurality of operational states;

receiving a request to access the industrial automation system from an accessing component that can interact with the industrial automation system or an industrial automation component of the industrial automation system;

determining whether the accessing component is authorized to access the industrial automation system based upon the operational state; and

permitting or denying access to the industrial automation system based upon the authorization determination.

2. The method of claim 1, wherein permitting access to the industrial automation system comprises permitting access to a directory of industrial automation components.

3. The method of claim 1, wherein the operational states comprise a commissioning and/or maintenance state, and an operational state.

4. The method of claim 3, wherein the operational states are automatically set by the industrial automation system.

5. The method of claim 3, wherein criteria for allowing access in the commissioning and/or maintenance state are less restrictive than criteria for allowing access in the operational state.

6. The method of claim 5, wherein accessing components are logged during the commissioning and/or maintenance state and are thereafter permitted access to the industrial automation system during the operational state unless disallowed by an administrator.

7. The method of claim 5, wherein accessing components not logged during the commissioning and/or maintenance state are thereafter denied access to the industrial automation system during the operational state unless permitted by an administrator.

8. The method of claim 3, wherein accessing components logged during the operational state but denied access can be allowed access by a system administrator.

9. The method of claim 1, wherein the criteria for permitting or denying access comprise at least one of user identifying data, accessing component identifying data, application data, application version data and application publisher data.

10. The method of claim 9, wherein the criteria comprise a combination of user identifying data, accessing component identifying data, application data, application version data and application publisher data.

11. A method for controlling access to an industrial automation system, comprising:

permitting access to the industrial automation system based upon first criteria during a first operational state of the industrial automation system;

logging accessing components that access the industrial automation system during the first operational state;

changing the state of the industrial automation system to a second operational state; and

permitting access to the industrial automation system based upon second criteria during the second operational state, the second criteria being more restrictive than the first criteria.

12. The method of claim 11, wherein the first criteria comprise free access to the industrial automation system.

13. The method of claim 11, wherein permitting access to the industrial automation system comprises permitting access to a directory of industrial automation components.

14. A system for controlling access to an industrial automation system, comprising:

a state determination component that determines an operational state of the industrial automation system from a plurality of operating states;

a receiving component that receives a request to access the industrial automation system from an accessing component that can interact with the industrial automation system or an industrial automation component of the automation system;

an access control component that determines whether the accessing component is authorized to access the industrial automation system based upon the operational state and permits or denies access to the industrial automation system based upon the authorization determination.

15. The system of claim 14, wherein the industrial automation system comprises a directory of industrial automation components, and wherein the access control component permits or denies access to the directory.

16. The system of claim 14, wherein the operational states comprise a commissioning and/or maintenance state, and an operational state.

17. The system of claim 16, wherein the operational states are automatically set by the industrial automation system.

18. The system of claim 16, wherein criteria for allowing access in the commissioning and/or maintenance state are less restrictive than the one or more criteria for allowing access in the operational state.

19. The system of claim 18, wherein accessing components are logged during the commissioning and/or maintenance state and are thereafter permitted access to the industrial automation system during the operational state unless disallowed by an administrator.

20. The system of claim 18, wherein accessing components not logged during the commissioning and/or maintenance state are thereafter denied access to the industrial automation system during the operational state unless permitted by an administrator.

21. The system of claim 14, wherein criteria for permitting or denying access comprise at least one of user identifying data, accessing component identifying data, application data, application version data and application publisher data.