Aggregating audit information with field conditions

• US 7,715,930 B2
• Filed: 09/27/2006
• Issued: 05/11/2010
• Est. Priority Date: 09/27/2006
• Status: Expired due to Fees

• Current Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Inventors: Grewal, Ardaman Singh, Bush, Michael A.
• Primary Examiner(s): Jarrett; Ryan A
• Application Number:
  US11/535,563
• Publication Number:
  US 20080126377A1
• Time in Patent Office: 1,322 Days
• Field of Search: 702/183, 702/185, 702/187, 700/26, 700/79
• US Class Current: 700/26
• CPC Class Codes: G05B 2219/31356 Automatic fault detection and isolation
• CPC Class Codes: G05B 2219/32196 Store audit, history of inspection, control and workpiece data into database
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

The subject invention relates to a system and/or method that facilitates assessing unexpected field conditions based upon the verification of an audit log. A sensing component can monitor field conditions with respect to an industrial environment. An analysis component can analyze the field conditions and determine that an unexpected event has occurred and retrieve audit logs from a data repository to determine cause of the unexpected event.

Claims

1. An asset management system stored on a storage medium, comprising:

a sensing component that monitors field conditions with respect to an industrial environment;

an analysis component that analyzes the field conditions and determines that an unexpected event has occurred and retrieves audit logs that include changes associated with the industrial environment from a data repository and determines a cause of the unexpected event and whether the unexpected event is related to an authorized change or a rogue attack; and

a security component that identifies a user and the user'"'"'s rights, and determines authorization to verify or edit at least one of an asset, the audit log, the industrial environment, or a portion of the industrial environment.

2. The system of claim 1, the data repository retains at least one of a hierarchical representation of assets within the industrial environment or the audit log.

3. The system of claim 2, the asset is hierarchically represented based at least in part upon a physical location of the asset within the industrial environment.

4. The system of claim 2, the hierarchical representation of assets is based at least in part upon an industry standard which can be at least one of ISA S95 or ISA S88.

5. The system of claim 2, the hierarchical representation of assets is based at least in part upon a proprietary hierarchy that is provided by an enterprise.

6. The system of claim 2, the asset is at least one of a physical device, a controller application, software, or a firmware.

7. The system of claim 6, the physical device is at least one of a programmable logic controller, a pump, a press, a valve, a drain, a heater, a cooler, a switch, a sensor, or a conveyor.

8. The system of claim 1, the audit log tracks at least one of a change, an edit, a manipulation, and an update related to at least one of a process, an asset, a device, a controller, software, firmware, or a control application within the industrial environment.

9. The system of claim 8, the audit log tracks data that is authenticated by a security measure.

10. The system of claim 9, the security measure is at least one of a username, a password, an administrator, a biometric data, a fingerprint, or a designated Internet Protocol (IP) address.

11. The system of claim 1, further comprising a detection component that ascertains at least one of when an asset has been edited, when an asset has been manipulated, when an asset has been updated, or when an asset has been changed.

12. The system of claim 11, the asset includes sufficient intelligence to initiate a message to the detection component, wherein such message can include at least one of a type of the asset, a type of edit to the asset, a type of change to the asset, an identity of the asset, or a location upon a network of the asset.

13. The system of claim 11, the asset utilizes an identification data to detect and maintain alterations of an asset within the industrial environment.

14. The system of claim 11, further comprising an updating component that updates at least one of the following:

1) the hierarchical representation of assets within the data repository based upon an alteration determined by the detection component;

or

     2) the audit log based upon an alteration determined by the detection component.

15. The system of claim 1, further comprising an edit to a control application is recorded by the audit log to evaluate the field condition within the industrial environment monitored by the sensing component, wherein the analysis component provides a reason for the particular field condition.

16. The system of claim 1, the analysis component determines whether at least one of a rogue attack or a rogue editor is present within the industrial environment by evaluating at least the audit log.

17. The system of claim 1, further comprising an alert component that can provide an alert for at least one of the following:

a detected rogue attack;

a detected rogue editor;

an edit related to the system;

a change related to an asset;

an update related to a hierarchical representation of assets;

an unexpected field condition;

an irregular field condition;

a valid audit log;

or an expected field condition.

18. The system of claim 17, the alert is at least an audio alert, a visual alert, a manipulation to a process, a text, a digital signal, a communication to a user, or a communication to an entity.

19. The system of claim 1, further comprising a log component to track a result associated with at least one of the sensing component or the analysis component.

20. The system of claim 19, the log component tracks at least one of the following:

the field condition;

an evaluation of the audit log;

the audit log;

an edit to an asset;

a change to an asset;

a manipulation to an asset;

or an update to a hierarchical representation of assets.

21. The system of claim 1, further comprising an intelligence component that aids at least the sensing component or the analysis component by inferring states of at least the asset management system, the industrial environment, and a user.

22. A method for assessing unexpected events based upon audit logs, comprising:

a processor-implemented act of executing computer executable instructions stored on a computer readable storage medium to implement the following;

monitoring field conditions with respect to an industrial environment;

analyzing the field conditions and determines that an unexpected event has occurred;

retrieving audit logs that include changes associated with the industrial environment from a data repository;

determining a cause of the unexpected event and whether the unexpected event is related to an authorized change or a rogue attack; and

identifying a user and the user'"'"'s rights, and determining authorization to verify or edit at least one of an asset, the audit log, the industrial environment, or a portion of the industrial environment.

23. The method of claim 22, the data repository retains at least one of a hierarchical representation of assets within the industrial environment and the audit log.

24. The method of claim 23, the asset is hierarchically represented based at least in part upon a physical location of the asset within the industrial environment.

25. The method of claim 23, the hierarchical representation of assets is based at least in part upon an industry standard which can be at least one of ISA S95 and ISA S88.

26. The method of claim 22, the audit log tracks at least one of a change, an edit, a manipulation, and an update related to at least one of a process, an asset, a device, a controller, software, firmware, and a control application within the industrial environment.

27. The method of claim 22, the audit log tracks data that is authenticated by a security measure.

28. The method of claim 22, further comprising detecting at least one of when an asset has been edited, when an asset has been manipulated, when an asset has been updated, or when an asset has been changed.

29. The method of claim 28, further comprising updating at least one of the following:

1) the hierarchical representation of assets within the data repository based upon an alteration determined by the detection component;

or

     2) the audit log based upon an alteration determined by the detection component.

30. The method of claim 22, determining whether at least one of a rogue attack or a rogue editor is present within the industrial environment by evaluating at least the audit log.

31. A computer-implemented system stored on a storage medium that facilitates assessing unexpected field conditions based upon the verification of an audit log, comprising:

means for monitoring field conditions with respect to an industrial environment;

means for analyzing the field conditions and determining that an unexpected event has occurred and retrieves audit logs that include changes associated with the industrial environment from a data repository and determining a cause of the unexpected event and whether the unexpected event is related to an authorized change or a rogue attack; and

means for identifying a user and the user'"'"'s rights, and determines authorization to verify or edit at least one of an asset, the audit log, the industrial environment, or a portion of the industrial environment.