Security model for industrial devices

• US 8,504,837 B2
• Filed: 10/15/2010
• Issued: 08/06/2013
• Est. Priority Date: 10/15/2010
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Jasper, Taryl J., Miller, Michael B., Brandt, Robert A.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): BROWN, ANTHONY D
• Application Number:
  US12/905,676
• Publication Number:
  US 20120096272A1
• Time in Patent Office: 1,026 Days
• Field of Search: 713/172, 713/159, 726/9, 726/20
• US Class Current: 713/172
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and/or methods are described relating to a security model that provides interoperability with foreign security domains while remaining scalable to small embedded devices. A security token service is provided, which is configured to issue, renew, and/or validate security tokens in response to a token request. A communication protocol, corresponding message structures, and the security tokens are defined in accordance with protocol buffer definitions.

Claims

1. An apparatus, comprising:

a processor;

a memory communicatively coupled to processor, the memory having stored therein computer-executable instructions, comprising;

a protocol buffer component configured to;

receive a first series of bytes representing a token request having credential information from a requestor;

de-serialize the first series of bytes into a token request protocol message object retaining the credential information, wherein the token request protocol message object is formatted according to a Protocol Buffer definition;

convert the token request protocol message object into a second token request protocol message object having an Extensible Markup Language representation in accordance with a WS-Trust specification; and

a security token service configured to;

send the second token request protocol message object to an external entity;

receive a first protocol buffer security token, having a Security Assertion Markup Language representation, from the external entity;

convert the first protocol buffer security token into a second protocol buffer security token structured in accordance with the the Protocol Buffer definition;

serialize the second protocol buffer security token into a second series of bytes; and

communicate the second series of bytes as a response to the token request.

2. The apparatus of claim 1, wherein the Protocol Buffer definition is programming language neutral, execution platform neutral, and extensible.

3. The apparatus of claim 1, further comprising a cryptography component configured to verify a digital signature attached to the token request.

4. The apparatus of claim 3, wherein the cryptography component is further configured to digitally sign the first protocol buffer security token.

5. The apparatus of claim 1, wherein the security token component further comprises an authentication component configured to validate the credential information with a data store that stores account information.

6. The apparatus of claim 1, further comprising a protocol buffer compiler configured to compile the Protocol Buffer definition into a serialization mechanism configured to serialize token request protocol message objects into series'"'"' of bytes.

7. The apparatus of claim 1, further comprising a protocol buffer compiler configured to compile the Protocol Buffer definition into a de-serialization mechanism configured to de-serialize series of bytes into token request protocol message objects.

8. The apparatus of claim 1, further comprising a protocol buffer compiler configured to compile the Protocol Buffer definition into a data access mechanism configured to access data in token request protocol message objects.

9. A method, comprising:

obtaining, by a device including a processor, a token request, as a series of bytes, that includes credential information to be authenticated;

de-serializing, by the device, the series of bytes to obtain the token request as an object structured in accordance with a Protocol Buffer definition;

converting, by the device, the token request, structured in accordance with the Protocol Buffer definition, into a second token request having an Extensible Markup Language representation in accordance with a WS-Trust specification;

sending, by the device, the second token request to an external entity;

receiving, by the device, a first security token, having a Security Assertion Markup Language representation, from the external entity;

converting, by the device, the first security token into a second security token structured in accordance with the Protocol Buffer definition;

serializing, by the device, the second security token into a byte stream; and

communicating, by the device, the byte stream as a response to the token request.

10. The method of claim 9, further comprising compiling, by the device, the Protocol Buffer definition into a serialization mechanism configured to serialize objects structured in accordance with the Protocol Buffer definition into series'"'"' of bytes.

11. The method of claim 9, further comprising compiling, by the device, the Protocol Buffer definition into a de-serialization mechanism configured to de-serialize byte streams into objects structured in accordance with the Protocol Buffer definition.

12. The method of claim 9 , further comprising compiling, by the device, the Protocol Buffer definition into a data access mechanism configured to access data in objects structured in accordance with the Protocol Buffer definition.

13. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution, cause at least one device including a processor to perform operations comprising:

receiving a token request, as first byte stream, that includes credential information to be authenticated;

de-serializing the first byte stream to obtain the credential information as a first object structured in accordance with a Protocol Buffer definition;

converting the first object into a second object, having an Extensible Markup Language representation, in accordance with a WS-Trust specification;

sending the second object to an external entity;

receiving a first security token, having a Security Assertion Markup Language representation, from the external entity;

converting the first security token into a second security token structured in accordance with the Protocol Buffer definition;

serializing the second security token into a second byte stream; and

sending the second byte stream as a response to the token request.