Automated deployment of computer-specific software updates

• US 9,003,387 B2
• Filed: 09/16/2010
• Issued: 04/07/2015
• Est. Priority Date: 09/25/2009
• Status: Active Grant

• Current Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Original Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Inventors: Van Camp, Kim O., Wiggins, Bob, Syed, Naqi
• Primary Examiner(s): Zhen, Li B
• Assistant Examiner(s): CHEN, SEN THONG
• Application Number:
  US12/883,664
• Publication Number:
  US 20110078675A1
• Time in Patent Office: 1,664 Days
• Field of Search: 717/170
• US Class Current: 717/170
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

A software update system automatically deploys software updates, approved by a provider of a process control system, to computer hosts that execute the process control system. The software update system includes a client application that generates a request for software updates applicable to the computer hosts and initiates automatic deployment of the software update to the host, and a server application that provides software update data to the client application in response to the request.

Claims

1. A software update system for use in a computer network to automatically deploy software updates, wherein the computer network includes a host that executes an operating system and process control software, and a process control layer in which the host operates and a secure layer that separates the process control layer from an external network, wherein the process control software controls operation of a process plant having one or more controllers, field devices and user interfaces that perform steps to perform physical control of the process plant;

the automated software update system comprising;

a first client application, stored as a first set of instructions on a non-transitory computer-readable medium, to receive a set of software objects associated with the operating system from a first server communicatively coupled to the process plant for updating the operating system in the computer network, wherein the first server communicatively coupled to the process plant is operated by a provider of the operating system;

a second client application, stored as a second set of instructions on a non-transitory computer-readable medium, to receive metadata related to the software objects from a second server communicatively coupled to the process plant, wherein the second server communicatively coupled to the process plant is operated by a provider of the process control software;

wherein

the metadata specifies which of the set of software objects have been approved by the provider of the process control software for use with the process control software and the operating system being executed on the host;

wherein the second client application is further adapted to specify which of the software objects are to be deployed to the host that executes the operating system and process control software; and

wherein

the second client application includes;

a front-end module to be run in the secure layer and receive the metadata from the second server communicatively coupled to the process plant via the external network; and

a back-end module to be run in the process control layer and receive the metadata from the front-end module.

2. The software update system of claim 1, further comprising:

a deployment application, stored as a third set of instructions on a non-transitory computer-readable medium, to automatically install one or several software updates on the host;

wherein

the second client application is adapted to transmit a message to the deployment application to initiate deployment of the specified software objects.

3. The software update system of claim 1, wherein the second client application is further adapted to receive:

a software object associated with the process control software; and

metadata related to the software object associated the process control software.

4. The software update system of claim 3, wherein the second client application includes a format conversion module to apply a wrapper to the software object associated with the process control software to generate a wrapped software object, so that the wrapped software object and the software objects associated with the operating system are compatible with a common deployment application.

5. A software update system for automatically delivering software updates to a computer host that executes an operating system and process control software and wherein the computer host operates in a process control layer of an operator network, and wherein the operator network further includes a secure layer disposed between the process control layer and an external network to prevent direct access from the external network to the process control network, wherein the process control software controls an operation of a process plant having one or more controllers, field devices and user interfaces that perform steps to perform physical control of the process plant;

the software update system comprising;

a client application stored as a first set of instructions on a non-transitory computer-readable medium, communicatively coupled to the process plant, to generate a request for one or more software updates applicable to the computer host, receive software update data including metadata related to a software update, and to initiate automatic deployment of the software update to the host that executes an operating system and process control software to control the operation of the process plant using the software update data including metadata; and

a server application stored as a second set of instructions on a non-transitory computer-readable medium, communicatively coupled to the process plant, to provide the software update data including metadata to the client application in response to receiving the request, wherein

the metadata specifies that the software update has been approved by a provider of the process control software for use with the process control software and the operating system on the computer host,

wherein the client application includes;

a front-end module installed in the secure layer to receive the software update and software update data including metadata from the server application; and

a back-end module installed in the process control layer to retrieve the software update and software update data including metadata from the front-end module and initiate deployment of the software update within the process control network.

6. The software update system of claim 5, wherein the software update includes at least one of:

a software object associated with at least one of the process control software, an operating system used being used by the computer host, or an antivirus software being run in a computer network including the computer host; and

metadata related to the at least one software object.

7. The software update system of claim 6, wherein the metadata specifies at least one of file size, update behavior, installation instructions, and target computer identity.

8. The software update system of claim 5, wherein the software update is for updating the process control software.

9. The software update system of claim 5, wherein the software update is for updating the operating system.

10. The software update system of claim 5, wherein the front-end module includes:

a message generator to generate a query to request a list of approved software updates; and

an update list processor to receive a list of one or more approved software updates, and to compare the list with data stored in a repository disposed in the secure layer;

wherein

the message generator further generates the request for the one or more software updates if the one or more approved software updates are not available in the repository.

11. The software update system of claim 5, wherein the front-end module includes a scheduler to generate a periodic event in response to which the front-end module generates the request for the one or more software updates.

12. The software update system of claim 5, wherein the software update includes a software object associated with the process control software;

and wherein the back-end module includes;

a format conversion module to apply a wrapper to the software object to generate a wrapped software object, wherein the wrapped software object is compatible with an commercial off-the-shelf (COTS) deployment application.

13. The software update system of claim 5, wherein the back-end module is adapted to retrieve the software update from the front-end module without the front-end module receiving a manual approval from a human operator.

14. The software update system of claim 5, wherein the computer host operates in a process control layer of an operator network, wherein the client application runs in the operator network, and wherein the server application runs in a network operated by a provider of the process control software;

wherein the server application includes;

a control system interface to receive the request from the operator, wherein the request includes operator authentication data;

a user authenticator to authenticate the operator based on the operator authentication data; and

a control system identifier to determine a version of the process control software installed in the process control layer of the operator network.

15. A method in a computer system for automatically deploying software updates to a network operated by a customer and having a process control layer in which at least one host implements process control software, wherein process control software is implemented by at least one host to operate a process plant having one or more controllers, field devices and user interfaces that perform steps to perform physical control of the process plant, and wherein the network operated by the customer further includes a secure layer disposed between the process control layer and an external network to prevent direct access from the external network to the process control network;

the method comprising;

receiving a query from the customer, wherein the query is a first electronic message transmitted to the computer system via a communication link coupled to the process plant;

executing a database query to identify one or more software updates applicable to the process control layer in response to receiving the query, wherein each of the one or more software updates has been approved for use with the process control system and an operating system being used in the process control layer;

generating software update data including metadata corresponding to the one or more software updates, wherein the software update is stored on a computer-readable medium and the metadata specifies that the one or more software updates has been approved by a provider of the process control software for use with the process control software and the operating system on the computer host; and

transmitting, in a second electronic message, the software update data including metadata to a front-end module of the host run in the secure layer, wherein the host implements process control software to operate a process plant in the network operated by the customer; and

retrieving the second electronic message via a back-end module of the host run in the process control layer.

16. The method of claim 15, wherein generating software update data includes at least one of:

providing software objects associated with the process control system and metadata related to the software objects associated with the process control system;

providing metadata related to software objects associated with the operating system; and

providing metadata related to software objects associated with an anti-virus software being used in the network operated by the customer.

17. The method of claim 15, further comprising authenticating the client using login and password data included in the query.

18. The method of claim 15, further comprising, prior to generating software update data and transmitting the software update data to the host:

transmitting a list of available updates to the host in a third electronic message; and

receiving a fourth electronic message that indicates which of the available updates specified in the list of available updates are to be transmitted in the second electronic message.

19. A software update method for deploying software updates to a host that operates in a client computer network and executes process control software wherein the host operates in a process control layer of an operator network, wherein the operator network further includes a secure layer disposed between the process control layer and an external network to prevent direct access from the external network to the process control network, and wherein the process control software execute controls for operating a process plant having one or more controllers, field devices and user interfaces that perform steps to perform physical control of the process plant;

the method comprising;

generating a query from the client computer network to request information related to software updates approved for use with the process control system and an operating system currently being used by the host;

transmitting the query from the client computer network to a provider of the process control system as a first electronic message;

receiving at a front-end module run in the secure layer of the client computer network, a response to the query as a second electronic message, and retrieving the response via a back-end module run in the process control layer, wherein the response includes software update data including metadata indicating which of a set of available updates has been approved by the provider of the process control system for use with the process control software and the operating system being executed on the host; and

initiating automatic deployment of the software update to the host that operates in a computer network and executes process control software for operating a process plant based on the software update data including metadata.

20. The method of claim 19, wherein generating the query includes generating the query in response to a timer expiration event.

21. The method of claim 19, wherein initiating automatic deployment includes:

applying a wrapper to a software object included in the software update to generate a wrapped software object if the software update is associated with the process control software; and

transmitting the wrapped software object to an off-the-shelf (COTS) deployment application if the software update is associated with the process control software.

22. The method of claim 19, further comprising transmitting a command to a client update application if the software update data includes metadata related to a software object associated with the operating system, wherein the client update application is responsible for providing software updates associated with the operating system, and wherein the command specifies one or several software updates associated with the operating system.

23. A software application stored as a set of instructions on a non-transitory computer-readable medium for use in a client computer network in which a host executes an operating system and process control software;

wherein the process control software executes instructions to operate a process plant having one or more controllers, field devices and user interfaces that perform steps to perform physical control of the process plant and wherein the computer host operates in a process control layer of an operator network, and wherein the operator network further includes a secure layer disposed between the process control layer and an external network to prevent direct access from the external network to the process control network;

the software application comprising;

a message generator to generate a query requesting software update data including metadata, wherein the software update data including metadata specifies which of the set of software updates have been approved by a provider of the process control software for use with the process control software and the operating system being executed on the host;

a first interface to transmit the query from the client computer network to the provider of the process control software;

an update list processor, installed as part of a front-end module in the secure layer, to receive one or more available software updates and to receive the software update data including metadata at the client computer network indicating which of the set of available updates has been approved for deployment to a computer executing the operating system and the process control software by the provider of the process control software; and

a second interface, installed as part of a back-end module in the process control layer, to initiate deployment of the one or more software updates, retrieved from the update list processor, to the one or more hosts that execute an operating system and process control software to operate a process plant based on the software update data including metadata;

wherein

each of the one or more software updates is associated with at least one of the process control software and the operating system.