Unique identification of entities of an industrial control system

• US 8,327,130 B2
• Filed: 09/25/2007
• Issued: 12/04/2012
• Est. Priority Date: 09/25/2007
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Rockwell Automation, Inc.)
• Inventors: Wilkinson, John C. Jr., Hall, Kenwood Henry, Jasper, Taryl Jon, Kalan, Michael Dean
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US11/861,082
• Publication Number:
  US 20090083843A1
• Time in Patent Office: 1,897 Days
• Field of Search: 726/9, 726/4, 726/27, 713/172, 713/186, 713/155, 713/156, 713/168
• US Class Current: 713/155
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Systems and methods are provided for issuing unique identification credentials to a plurality of devices, and their constituent components, in an industrial control system. Identification credentials are granted by an identification authority and conveyed to each of the credentialed devices and/or component through an identity token. The identification credentials include (1) a unique device identifier, (2) an identification authority component identifier, and (3) an indication of the location of the identification authority component. To secure the issued credentials, such credentials are encrypted and the identification token can be embedded with biometrics features. Identification credentials provide for the following prominent features: (i) Secure access to a device form a client and (ii) determination a topology of a set of credentialed devices in an industrial control system. The topology is network agnostic and facilitates organizational modeling of processes in the industrial control system.

Claims

1. A method of installing an industrial automation device in an industrial automation network, comprising:

communicating industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

issuing an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify an identification authority component that issues the industrial automation device identification credential; and

establishing communication with the industrial automation device across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component in response to authenticating the industrial automation device identification credential.

2. The method of claim 1, wherein the communicating industrial automation device information includes storing the industrial automation device information in an access control list associated with an identification authority component.

3. The method of claim 1, wherein the communicating industrial automation device information includes communicating industrial automation device information across the industrial automation network in response to a periodic broadcast message from an identification authority component.

4. The method of claim 1, further including storing the industrial automation device identification credentials in an identity token component adapted to reside in the industrial automation device.

5. The method of claim 1, wherein the communicating with the industrial automation device includes obtaining the industrial automation device identification credential from the industrial automation device, and receiving the operational credentials from an identification authority component based on the industrial automation device identification credentials obtained from the industrial automation device.

6. The method of claim 1, wherein the functionality of the industrial automation device further includes a reporting capability of the industrial automation device.

7. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution, cause at least one device to perform operations comprising:

communicating industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

issuing an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify an identification authority component that issues the industrial automation device identification credential; and

establishing communication with the industrial automation device across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component in response to authenticating the industrial automation device identification credential.

8. The non-transitory computer-readable medium of claim 7, further including storing the industrial automation device identification credentials in an identity token component adapted to reside in the industrial automation device.

9. The non-transitory computer-readable medium of claim 7, wherein the communicating with the industrial automation device includes obtaining the industrial automation device identification credential from the industrial automation device, and receiving the operational credentials from an identification authority component based on the industrial automation device identification credentials obtained from the industrial automation device.

10. The non-transitory computer-readable medium of claim 7, wherein the functionality of the industrial automation device further includes a reporting capability of the industrial automation device.

11. A system for installing an industrial automation device in an industrial automation network, comprising:

an identification authority component configured to;

receive industrial automation device information across an industrial automation network, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

issue an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify the identification authority component;

authenticate communication between a component and the industrial automation device across the industrial automation network based on the industrial automation device identification credential; and

transmit operational credentials to the industrial automation device.

12. The system of claim 11, wherein the functionality of the industrial automation device further includes a reporting capability of the industrial automation device.

13. A system for installing an industrial automation device in an industrial automation network, comprising:

means for communicating industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

means for issuing an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify an identification authority component that issues the industrial automation device identification credential; and

means for establishing communication with the industrial automation device across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component in response to authenticating the industrial automation device identification credential.

14. A system for installing an industrial automation device in an industrial automation network, comprising:

the industrial automation device configured to;

transmit industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

receive from the identification authority component an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify the identification authority component; and

establish communication with a component across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component based on the industrial automation device identification credential.