System and methodology providing multi-tier-security for network data exchange with industrial control components

• US 7,536,548 B1
• Filed: 06/04/2002
• Issued: 05/19/2009
• Est. Priority Date: 06/04/2002
• Status: Expired due to Term

• Current Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Inventors: Baier, John Joseph, Batke, Brian Alan, Morse, Richard Alan, Callaghan, David Michael
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US10/162,320
• Time in Patent Office: 2,541 Days
• Field of Search: 726/11, 726/14, 726/15, 726/4, 726/5, 726/10, 713/152, 713/166
• US Class Current: 713/166
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

The present invention relates to a system and methodology facilitating network security and data access in an industrial control environment. An industrial control system is provided that includes an industrial controller to communicate with a network. At least one security layer can be configured in the industrial controller, wherein the security layer can be associated with one or more security components to control and/or restrict data access to the controller. An operating system manages the security layer in accordance with a processor to limit or mitigate communications from the network based upon the configured security layer or layers.

Claims

1. An industrial control system, comprising:

an industrial controller that communicates with a network;

at least one security layer configured in the industrial controller, the security layer associated with at least one security component further comprising at least one of a trust component to authenticate a trust relationship between a remote system and the industrial controller, an encryption component to provide data encryption, and a policy component to facilitate varying levels of data access to the industrial controller, and including user interface editing parameters;

1 to M mappings that relate a plurality of security layers configured in the industrial controller to at least one security component per layer, the security layers are associated with at least one of similar security components and dissimilar security components, M being an integer;

a security layer store to map security layers to security components;

an operating system to manage the at least one security layer, the at least one security component stored in accordance with the operating system and an associated memory subsystem; and

a processor to execute the operating system, the processor limits communications from the network based in part on the configured security layer.

2. The system of claim 1, the trust component includes at least one of Public Key Infrastructure (PKI) component and an Internet Key Exchange (IKE) component.

3. The system of claim 2, the trust component includes at least one of a certificate, a pre-shared key, and a Kerberos ticket.

4. The system of claim 1, the encryption component includes at least one of an Internet Protocol Security (IPSEC) component, a Kerberos component, a Secure Socket Layer (SSL), and a tunneling protocol.

5. The system of claim 4, the encryption protocol is employed to at least one of authenticate and authorize at least one of a user and a device.

6. The system of claim 5, further comprising at least one of an IPSEC driver and a TCP/IP driver to transport the encryption protocol.

7. The system of claim 5, further comprising at least one of a Main mode and a Quick mode negotiation to perform authentication and authorization.

8. The system of claim 1, the policy component including at least one of a security parameter, at least one rule, at least one filter, a filter list, an authentication method, a tunnel parameter, and a connection type.

9. The system of claim 1, the policy component includes at least one user-defined rule for at least one of permitting and denying access to the industrial controller.

10. The system of claim 9, the user-defined rule includes at least one of time-based, location-based, user-based, and process-based rule.

11. The system of claim 10, further comprising logical rules established for at least one of a selected policy and combinations of policies, the logical rules include at least one of AND, OR, NOT, BOOLEAN, and mathematical combinations.

12. The system of claim 1, the at least one security component including a Virtual Private Network (VPN) component to facilitate communications within a private network.

13. The system of claim 1, the at least one security component including a virus detection component that includes at least one of a commercially available detection program and a custom-coded detection program.

14. The system of claim 1, the mappings further comprise at least one of security configurations relating to an area and security configurations relating to a device associated with the industrial controller.

15. The system of claim 1, further comprising at least one of, a security components store to store security components, and a security mappings store to relate the security layers to at least one of an area within the industrial controller and a module associated with the industrial controller.

16. The system of claim 1, the at least one security component includes a locking component to at least one of grant and prevent access to the industrial controller.

17. The system of claim 16, the locking component includes a subnet list describing network addresses of devices.

18. The system of claim 1, the operating system comprising at least one of Windows, Windows NT, Linux, .NET, OS-9, UNIX, Windows CE, CE.NET, VxWorks and VRTX.

19. The system of claim 1, the encryption component is employed to at least one of encapsulate and encrypt a control protocol.

20. The system of claim 19, the control protocol includes at least one of a EtherNet/IP, DeviceNet, ControlNet, OPC DX, OPC DA, Data Highway, and Data Highway+ protocol.

21. A method to facilitate secure data exchange in an industrial controller network, comprising:

mapping at least one security component, based at least on encryption technology, that relates respective areas and/or modules associated with an industrial controller to at least one security layer in the industrial controller, the mapping is associated with at least one policy and/or rule that define when the mapping is active;

associating a plurality of security layers to at least one security component per layer through 1 to M mappings, the plurality of security layers are associated with at least one of similar security components or dissimilar security components, M is an integer;

storing a mapping as a configuration to define communications access to the industrial controller, including potential areas within the industrial controller and/or associated modules that interact with the industrial controller; and

communicating to the industrial controller in accordance with the stored mapping.

22. The method of claim 21, further comprising mapping a trust component, an encryption component and a policy component.

23. The method of claim 21, further comprising exchanging at least one of a certificate, a pre-shared key, and a ticket to facilitate a trust.

24. The method of claim 21, further comprising at least one of authenticating and authorizing an entity.

25. The method of claim 24, further comprising a negotiation to perform authentication and authorization.

26. The method of claim 21, further comprising defining rules that include at least one of time-based, location-based, user-based, process-based, and logical-based combination rules.

27. The method of claim 21, further comprising creating a private network across a public network to provide access to the industrial controller.

28. The method of claim 21, further comprising detecting viruses on the industrial controller.

29. The method of claim 21, further comprising segmenting at least one of an area and a device associated with the industrial controller in according to the mapping.

30. The method of claim 21, further comprising configuring a locking component to at least one of grant and prevent access to the industrial controller.

31. An industrial control system, comprising:

a plurality of remote devices communicating on a network;

an industrial controller that communicates with the remote devices;

a plurality of security layers stored in the industrial controller, the security layers associated with at least one security component further comprising at least one of a trust component to authenticate a trust relationship between a remote device and the industrial controller, an encryption component to provide data encryption, and a policy component to facilitate varying levels of data access to the industrial controller and including user interface editing parameters;

1 to M mappings that relate a plurality of security layers configured in the industrial controller to at least one security component per layer, the security layers are associated with at least one of similar security components and dissimilar security components, M being an integer;

a security layer store residing in the industrial controller to map security layers to security components;

an operating system to configure the security layers, the at least one security component stored in accordance with the operating system and an associated memory subsystem; and

a processor to execute the operating system, the processor limits communications from the remote devices based in part on the configured security layers.