Scalable and flexible information security for industrial automation

• US 8,132,225 B2
• Filed: 09/30/2004
• Issued: 03/06/2012
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Chand, Sujeet, Baier, John J., Kalan, Michael D., Marquardt, Randall A., Morse, Richard A., Briant, Stephen C., Farchmin, David W.
• Primary Examiner(s): PHAM, LUU T
• Application Number:
  US10/955,495
• Publication Number:
  US 20060074917A1
• Time in Patent Office: 2,714 Days
• Field of Search: 726/2, 707/10
• US Class Current: 726/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: Y02P 90/80 Management or planning

Abstract

A security system that relates to industrial automation security comprises a component that receives a request to modify security relating to a zone of a factory floor, the zone being less than an entirety of the factory floor. A zonal security component generates security procedures for the zone, the security procedures differ from security procedures implemented on the factory floor outside the zone.

Claims

1. A system for modifying security policy in a factory floor, the system comprising:

a processor;

a memory communicatively coupled to the processor, the memory having stored therein computer readable instructions that, when executed by the processor, cause the processor to perform;

associating a factory floor security policy with a plurality of devices on the factory floor, wherein the plurality of devices and the security policy are associated with a hierarchically structured data model of the factory floor;

receiving a request to disable an alarm of a first device located on a factory floor for at least one of testing, debugging and maintenance;

verifying the request to disable the alarm based on at least one of device location, time, date, and the security policy;

determining a security zone related to the request by querying the hierarchically structured data model, wherein the security zone includes a second device located on the factory floor interacting with the first at device during a manufacturing operation based on the hierarchically structured data model;

disabling the factory floor security policy to the security zone, including disabling the alarm of the first device and disabling a second alarm associated with the second device, while applying the factory floor security policy to other areas within the factory floor; and

reinstituting the factory floor security policy to the security zone upon completion the at least one of testing, debugging and maintenance.

2. The system of claim 1, wherein the request is sent in response to an alarm from the first device.

3. The system of claim 1, wherein the request is sent in response to a reaching a set time for the maintenance, test or debug of the first device.

4. A method for modifying security policy in a security zone of a factory floor, the method comprising:

employing a processor executing computer executable instructions stored on a computer readable storage medium to perform acts including;

associating a factory floor security policy with a plurality of devices on the factory floor, wherein the plurality of devices and the security policy are associated with a hierarchically structured data model of the factory floor

receiving a request to disable an alarm of a first device located on a factory floor for at least one of testing, debugging and maintenance;

verifying the request to disable the alarm based on at least one of device location, time, date, and the security policy;

determining a security zone related to the request by querying the hierarchically structured data model wherein the security zone includes a second device located on the factory floor interacting with the first at device during a manufacturing operation based on the hierarchically structured data model;

disabling the factory floor security policy to the security zone, including disabling the alarm of the first device and disabling a second alarm associated with the second device, while applying the security policy to other areas within the factory floor; and

reinstituting the factory floor security policy to the security zone upon completion the at least one of testing, debugging and maintenance.

5. The method of claim 4, further comprising receiving approval from an operator to disable the factory floor security policy in the security zone.

6. A non-transitory computer readable storage medium having stored thereon computer-executable instructions that, in response to execution, cause a computing system to perform operations, comprising:

associating a factory floor security policy with a plurality of devices on the factory floor, wherein the plurality of devices and the security policy are associated with a hierarchically structured data model of the factory floor

receiving a request to disable an alarm of a first device located on a factory floor for at least one of testing, debugging and maintenance;

verifying the request to disable the alarm based on at least one of device location, time, date, and the security policy;

determining a security zone related to the request by querying the hierarchically structured data model wherein the security zone includes a second device located on the factory floor interacting with the first at device during a manufacturing operation based on the hierarchically structured data model;

disabling the factory floor security policy to the security zone, including disabling the alarm of the first device and disabling a second alarm associated with the second device, while applying the security policy to other areas within the factory floor; and

reinstituting the factory floor security policy to the security zone upon completion the at least one of testing, debugging and maintenance.