IMAGE CAPTURE DEVICES FOR A SECURE INDUSTRIAL CONTROL SYSTEM

• US 20170147807A1
• Filed: 12/16/2016
• Published: 05/25/2017
• Est. Priority Date: 12/30/2011
• Status: Active Grant

• Current Assignee: Bedrock Automation Platforms, Inc. (Analog Devices, Inc.)
• Original Assignee: Bedrock Automation Platforms, Inc. (Analog Devices, Inc.)
• Inventors: Rooyakkers, Albert
• Granted Patent: US 11,144,630 B2
• Time in Patent Office: Days
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 2219/2651 Camera, photo
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04N 7/183 for receiving images from a single remote source

Abstract

An image capture device for a secure industrial control system is disclosed. In an embodiment, the image capture device includes: an image sensor; a signal processor coupled to the image sensor; and a controller for managing the signal processor and transmitting data associated with processed image signals to at least one of an input/output module or a communications/control module via a communications interface that couples the controller to the at least one of the input/output module or the communications/control module, wherein the controller is configured to establish an encrypted tunnel between the controller and the at least one of the input/output module or the communications/control module based upon at least one respective security credential of the image capture device and at least one respective security credential of the at least one of the input/output module or the communications/control module.

Claims

1. An image capture device for a secure industrial control system, comprising:

an image sensor;

a signal processor coupled to the image sensor; and

a controller for managing the signal processor and transmitting data associated with processed image signals to at least one of an input/output module or a communications/control module via a communications interface that couples the controller to the at least one of the input/output module or the communications/control module, wherein the controller is configured to establish an encrypted tunnel between the controller and the at least one of the input/output module or the communications/control module based upon at least one respective security credential of the image capture device and at least one respective security credential of the at least one of the input/output module or the communications/control module.

2. The image capture device of claim 1, wherein the controller is further configured to perform an authentication sequence with the at least one of the input/output module or the communications/control module utilizing the at least one respective security credential of the image capture device and the at least one respective security credential of the at least one of the input/output module or the communications/control module.

3. The image capture device of claim 1, wherein the at least one respective security credential of the image capture device comprises a unique security credential provisioned for the image capture device at a respective point of manufacture from a key management entity.

4. The image capture device of claim 3, wherein the at least one respective security credential is at least one of modifiable, revocable, or authenticatable by the key management entity at a site different from the respective point of manufacture.

5. The image capture device of claim 3, wherein the at least one respective security credential is at least one of modifiable, revocable, or authenticatable by the at least one of the input/output module or the communications/control module.

6. The image capture device of claim 1, wherein the communications interface is configured to connect the controller, via the at least one of the input/output module or the communications/control module, to a communications backplane including a serial communications interface and a parallel communications interface.

7. The image capture device of claim 6, wherein the communications interface comprises a Power Over Ethernet (POE) port for receiving power supplied by the at least one of the input/output module or the communications/control module.

8. The image capture device of claim 1, wherein the one or more processed image signals include spectral data detected by the image sensor.

9. The image capture device of claim 8, wherein the controller is configured to transmit the spectral data for monitoring one or more industrial control system environmental conditions including an environmental presence of one or more of:

fire, dust, smoke, micro-particles, heat, moisture, elevated pressure, gas, or radiation.

10. A secure industrial control system, comprising:

a communications/control module;

an input/output module;

a communications backplane that physically and communicatively couples the communications/control module to the input/output module; and

an image capture device including;

an image sensor;

a signal processor coupled to the image sensor; and

a controller for managing the signal processor and transmitting data associated with processed image signals to at least one of the input/output module or the communications/control module via a communications interface that couples the controller to the at least one of the input/output module or the communications/control module, wherein the controller is configured to establish an encrypted tunnel between the controller and the at least one of the input/output module or the communications/control module based upon at least one respective security credential of the image capture device and at least one respective security credential of the at least one of the input/output module or the communications/control module.

11. The secure industrial control system of claim 10, wherein the controller is further configured to perform an authentication sequence with the at least one of the input/output module or the communications/control module utilizing the at least one respective security credential of the image capture device and the at least one respective security credential of the at least one of the input/output module or the communications/control module.

12. The secure industrial control system of claim 10, wherein the at least one respective security credential of the image capture device comprises a unique security credential provisioned for the image capture device at a respective point of manufacture from a key management entity.

13. The secure industrial control system of claim 12, wherein the at least one respective security credential of the image capture device is at least one of modifiable, revocable, or authenticatable by the key management entity at a site different from the respective point of manufacture.

14. The secure industrial control system of claim 12, wherein the at least one respective security credential of the image capture device is at least one of modifiable, revocable, or authenticatable by the at least one of the input/output module or the communications/control module.

15. The secure industrial control system of claim 10, wherein the communications interface is configured to connect the controller, via the at least one of the input/output module or the communications/control module, to the communications backplane, wherein the communications backplane includes a serial communications interface and a parallel communications interface.

16. The secure industrial control system of claim 15, wherein the communications interface comprises a Power Over Ethernet (POE) port for receiving power supplied by the at least one of the input/output module or the communications/control module.

17. The secure industrial control system of claim 10, wherein the one or more processed image signals include spectral data detected by the image sensor.

18. The secure industrial control system of claim 17, wherein the controller is configured to transmit the spectral data for monitoring one or more industrial control system environmental conditions including an environmental presence of one or more of:

fire, dust, smoke, micro-particles, heat, moisture, elevated pressure, gas, or radiation.

19. The secure industrial control system of claim 10, wherein at least one of the communications/control module or the input/output module is configured to pre-process or post-process image signals received from the image capture device before transmitting the image signals to another industrial element of the secure industrial control system or a network connected device.

20. A secure industrial control system, comprising:

a communications/control module;

an input/output module;

a communications backplane that physically and communicatively couples the communications/control module to the input/output module, the communications backplane including a serial communications interface for connecting the input/output module to the communications/control module and a parallel communications interface configured for separately connecting the input/output module to the communications/control module; and

an image capture device including;

an image sensor;

a signal processor coupled to the image sensor; and

a controller for managing the signal processor and transmitting data associated with processed image signals to at least one of the input/output module or the communications/control module via a communications interface that couples the controller to the at least one of the input/output module or the communications/control module.