Method for operating, monitoring and/or configuring an automation system of a technical plant

• US 9,088,429 B2
• Filed: 01/12/2011
• Issued: 07/21/2015
• Est. Priority Date: 01/13/2010
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Balint, Thomas, Bauer, Jrg, Kissling, Jan
• Primary Examiner(s): Bahta, Kidest
• Application Number:
  US13/522,131
• Publication Number:
  US 20120290105A1
• Time in Patent Office: 1,651 Days
• Field of Search: 700/1, 700/12, 700/28, 700/73, 709/288, 709/224, 709/217, 370/401
• US Class Current: 1/1
• CPC Class Codes: G05B 19/4185 characterised by the network communication
• CPC Class Codes: G05B 2219/31104 Remote configuration of parameters of controlled devices
• CPC Class Codes: G05B 2219/31186 TCP-IP internet protocol
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5038 for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: Y02P 90/80 Management or planning

Abstract

A method for operating, monitoring and/or configuring an automation system of a technical plant from a remote device may include a control software ensuring that the software processes of an operating and monitoring software and/or a configuration software relevant for a communication via a public network are terminated. After setting up a secure communication link from the device to the automation system via the public network, an endpoint of the communication link in the remote device is assigned a network address and the software processes of the operating and monitoring software and/or configuration software relevant for a communication via the public network are started. The data packets sent by the operating and monitoring software and/or configuration software for operating, monitoring and/or configuring the automation system are diverted to the network address by the control software.

Claims

1. A method for operating, monitoring and/or configuring an automation system of a technical plant by a facility remote from the technical plant by way of a secure communication link through a public network, wherein the remote facility comprises remote facility software for operating, monitoring and/or configuring the automation system and comprises a first network address for communication with the public network, and wherein the first network address can be addressed by the remote facility software in order to send data via the public network to the automation system, comprising:

a) executing, by at least one processor, control software of the remote facility to ensure that software processes of the remote facility software that are relevant to communication through the public network are terminated,

b) executing, by the at least one processor, the control software of the remote facility to establish a secure communication link from a first terminal point in the remote facility to a second terminal point in the automation system via the public network,

c) in the remote facility, assigning a second network address to the first terminal point, wherein the second network address is different than the first network address,

d) executing, by the at least one processor, the control software of the remote facility to start one or more software processes of the remote facility software that are relevant to communication through the public network,

e) executing, by the at least one processor, the one or more started software processes of the remote facility software sending data packets for operating, monitoring and/or configuring the automation system to the first network address, and

f) the control software routing the data packets sent to the first network address to the second network address,

wherein the control software and the one or more software processes are stored in non-transitory computer-readable media of the remote facility.

2. The method of claim 1, wherein the data packets sent by the remote facility software include the first network address, and wherein routing the data packets to the second network address in step f), the control software replaces the first network address in the data packets with the second network address.

3. The method of claim 1, wherein the public network is the Internet and the network addresses are IP addresses.

4. The method of claim 3, wherein the second network address is a Loopback IP address of the facility.

5. The method of claim 1, wherein the secure communication link runs over a secure communication platform that is connected to the public network.

6. The method of claim 5, wherein a data mirroring occurs on the secure communication platform.

7. The method of claim 1, wherein the secure communication link comprises a tunnel link.

8. Control software for facilitating operation, monitoring and/or configuring of an automation system of a technical plant by a facility remote from the technical plant by way of a secure communication link through a public network, the control software configured to interact with software of the remote facility, the control software stored in machine-readable, non-transitory media and when executed by a processor, operable to:

ensure that software processes of the remote facility software that are relevant to communication through the public network are terminated,

establish a secure communication link from a first terminal point in the remote facility to a second terminal point in the automation system via the public network,

start the software processes of the remote facility software that are relevant to communication through the public network, and for data packets sent by the remote facility to a first network address for operating, monitoring and/or configuring the automation system, redirect such data packets to a second network address assigned to the first terminal point, the second network address being different than the first network address.

9. The control software of claim 8, wherein the data packets sent by the remote facility software include the first network address, and wherein redirecting the data packets to the second network address comprises replacing the first network address in the data packets with the second network address.

10. The control software of claim 8, wherein the public network is the Internet and the network addresses are IP addresses.

11. The control software of claim 10, wherein the second network address is a Loopback IP address of the facility.

12. The control software of claim 8, wherein the secure communication link runs over a secure communication platform that is connected to the public network.

13. The control software of claim 12, wherein a data mirroring occurs on the secure communication platform.

14. The control software of claim 8, wherein the secure communication link comprises a tunnel link.