Internet friendly proxy server extending legacy software connectivity

• US 8,281,385 B2
• Filed: 09/29/2005
• Issued: 10/02/2012
• Est. Priority Date: 09/29/2005
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Callagahan, David M.
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US11/238,877
• Publication Number:
  US 20070074280A1
• Time in Patent Office: 2,560 Days
• Field of Search: None
• US Class Current: 726/15
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

An industrial automation proxy server comprises an interface that receives data related to legacy software, where the data is associated with a legacy protocol. Additionally, the industrial automation proxy server includes a protocol transformation component that converts the data associated with the legacy protocol to a disparate protocol. Furthermore, the industrial automation proxy server can include a routing component that redirects the data to a remote device over an internet connection.

Claims

1. A system, comprising:

an industrial controller configured to generate control data to facilitate control of industrial automation equipment, comprising;

an interface component configured to receive the control data wherein the control data is is associated with a legacy encapsulating protocol for data communication on a local network, the control data is employed by the industrial controller to control a first industrial automation equipment located on the local network and the legacy encapsulating protocol is employed to communicate the control data to the first industrial automation equipment on the local network; and

a protocol transformation component configured to replace the encapsulating legacy protocol with a disparate encapsulating protocol required for data communication over a remote network to facilitate control, by the industrial controller, of a second industrial automation equipment located on the remote network with the control data utilized to control the first industrial automation equipment.

2. The system of claim 1, wherein the industrial controller is one of a programmable logic controller, a numeric controller, or a robotic controller.

3. The system of claim 1, wherein the interface component is further configured to transmit the control data with the disparate protocol to the remote device located on the remote network via a local area network.

4. The system of claim 1, wherein the interface component is further configured to intercept an output associated with the legacy software.

5. The system of claim 1, wherein the legacy protocol is incompatible with transmission over an internet connection.

6. The system of claim 1, wherein the legacy protocol is incompatible with tunneling through a firewall.

7. The system of claim 1, wherein the legacy protocol is Common Industrial Protocol.

8. The system of claim 1, wherein the disparate protocol is compatible with at least one of transmission over an internet connection and tunneling through a firewall.

9. The system of claim 1, wherein the disparate protocol is at least one of a Transmission Control Protocol/Internet Protocol, a User Datagram Protocol, a HyperText Transfer Protocol, a HyperText Transfer Protocol Secure, an Internet Protocol, an Elliptic Curve Cryptography protocol, a Rivest, Shamir and Adleman encryption protocol, an Advanced Encryption Standard protocol, a Simple Object Access Protocol, or a web services protocol.

10. The system of claim 1, wherein the industrial controller further comprises a routing component configured to redirect the control data to the second industrial automation equipment over an internet connection.

11. The system of claim 10, wherein the routing component is further configured to redirect the control data, which was originally directed to a non-routable port employed by the legacy software for communication on the local network, to a disparate port that supports web based communications over the remote network.

12. The system of claim 10, wherein the routing component is further configured to redirect the control data, which was originally direct to a non-routed private address employed by the legacy software for communication on the local network, to a remote IP address associated with the second industrial automation equipment.

13. The system of claim 12, wherein the routing component is further configured to utilize a lookup table to identify the remote IP address based on the non-routed private address.

14. The system of claim 10, wherein the routing component is further configured to utilize a one to one relationship between the industrial controller employing the legacy software and an internet protocol address associated with the second industrial automation equipment.

15. The system of claim 1, wherein the industrial controller further comprises an encryption component configured to encrypt the control data for transmission with the legacy protocol or the disparate protocol.

16. The system of claim 15, wherein the encryption component is further configured to utilize at least one of private key encryption, public key encryption, symmetric key encryption, an Elliptic Curve Cryptography protocol, a Data Encryption Standard protocol, Secure Hash Algorithm-1, a Rivest, Shamir and Adleman encryption protocol, or an Advanced Encryption Standard protocol.

17. The system of claim 1, wherein the industrial controller further comprises a security component configured to administer security to prevent unauthorized access of the control data.

18. The system of claim 1, wherein the industrial controller further comprises a filtering component configured to selectively filter the control data based at least in part upon at least one of user identity, user location, or remote device location.

19. A system that enables legacy software to connect to remote devices in an industrial automation environment, comprising:

an industrial automation device configured to control industrial automation equipment, comprising;

an interface component configured to utilize legacy software that provides data with a legacy encapsulating protocol, wherein the legacy encapsulating protocol facilitates communication on a local network connection and the industrial automation device controls, with the data, a first industrial automation equipment communicatively coupled on the local network connection; and

a proxy server configured to intercept the data and replace the legacy encapsulating protocol with a disparate encapsulating protocol that complies with communication protocol required for communication over an internet connection facilitating control of a remotely located second industrial automation equipment with the data utilized to control the first industrial automation equipment.

20. The system of claim 19, wherein the proxy server is a software layer.

21. The system of claim 19, wherein the proxy server is a network based application configured to execute on a network infrastructure component.

22. The system of claim 19, wherein the second industrial automation equipment is configured to connect directly to the internet connection and further configured to perform actions in accordance with instructions comprising the data with the disparate encapsulating protocol.

23. The system of claim 22, wherein the second industrial automation equipment is configured to facilitate at least one of decrypting an encryption layer around the data and utilizing the data in the disparate protocol.

24. The system of claim 19, wherein the second industrial automation equipment is located behind a firewall.

25. A method for utilizing a legacy application with devices located locally and remotely in an industrial automation environment, comprising:

generating, at an industrial controller, control data comprising instructions to control industrial automation equipment, wherein the control data being generated with an original encapsulating protocol associated with a legacy application, the legacy application facilitating control, with the control data, of first industrial automation equipment located on a local network and the original encapsulating protocol facilitates transmission of the control data on the local network, the original encapsulating protocol does not support connectivity via internet communications;

replacing, at the industrial controller, the original encapsulating protocol with a disparate encapsulating protocol that supports connectivity via internet communications to a second industrial automation equipment device, wherein the second industrial automation equipment is remotely located and is to be controlled by the legacy application control data; and

transmitting, by the industrial controller, the control data, with the disparate encapsulating protocol, to the second industrial automation equipment facilitating control, with the instructions comprising the control data, of the second industrial automation equipment by the legacy application.

26. The method of claim 25, further comprising:

determining whether the legacy application is directing the control data to a non-routable port employed for communicating on the local network; and

routing the control data to a disparate port for connectivity of the internet communications in response to the legacy application directing the control data to the non-routable port.

27. The method of claim 25, further comprising:

determining whether the legacy application is directing the control data to a non-routed private internet protocol (IP) address employed by the legacy application for communicating on the local network; and

routing the control data to a remote IP address associated with the second industrial automation equipment in response to the legacy application directing the data to the non-routed private IP address.

28. The method of claim 25, further comprising:

receiving the control data at the second industrial automation equipment; and

unsecuring the control data at the second industrial automation equipment.

29. The method of claim 28, wherein unsecuring the control data includes at least one of decrypting the control data received at the second industrial automation equipment or removing the control data from an encapsulation.

30. The method of claim 25, wherein replacing the original encapsulating protocol with the disparate encapsulating protocol includes replacing with at least one of a Transmission Control Protocol/Internet Protocol, a User Datagram Protocol, a HyperText Transfer Protocol, a HyperText Transfer Protocol Secure, an Internet Protocol, an Elliptic Curve Cryptography, a Rivest, Shamir and Adleman encryption protocol, an Advanced Encryption Standard protocol, a Simple Object Access Protocol, or a web services protocol.

31. The method of claim 25, wherein the original protocol is Common Industrial Protocol.

32. The method of claim 25, further comprising configuring a system for proxy behavior including logging into the system and providing information via a secure mechanism.

33. The method of claim 25, further comprising configuring the second industrial automation equipment by including configuration information with a payload of the control data, wherein the configuration information indicating how the second industrial automation equipment is to communicate with the industrial controller.

34. A proxy server in an industrial automation environment, comprising:

an industrial controller comprising the proxy server wherein the industrial controller is configured to generate control data to facilitate control of industrial automation equipment, the industrial controller further comprising;

a processor;

a computer-readable non-transitory storage medium operationally coupled to the processor and storing computer executable instructions, the computer executable instructions, in response to execution by the processor, implement operations, comprising;

receiving control data generated by the industrial controller and formatted according to a legacy encapsulating protocol facilitating data communications on a local network, wherein the legacy encapsulating protocol facilitating communicating with a first industrial automation device located on the local network and controlling the first industrial automation device with the control data encapsulated with the legacy encapsulating protocol; and

replacing the legacy encapsulating protocol with a disparate encapsulating protocol being required for communication of the control data over a remote network facilitating communication between the industrial controller and a second industrial automation device located on the remote network facilitating control of the second industrial automation device with the control data utilized to control the first industrial automation device.