Flexible security control environment

• US 9,323,245 B2
• Filed: 11/02/2012
• Issued: 04/26/2016
• Est. Priority Date: 11/11/2011
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Bush, Michael A., Brandt, Robert A., Bliss, Ronald E., Miller, Michael B.
• Primary Examiner(s): Revak, Christopher
• Application Number:
  US13/667,914
• Publication Number:
  US 20130125233A1
• Time in Patent Office: 1,271 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G05B 19/042 using digital processors G05B19/05 takes precedence
• CPC Class Codes: G05B 2219/23121 Display graphics with corresponding text
• CPC Class Codes: G05B 2219/23171 Display dynamic change of process, animation
• CPC Class Codes: G05B 2219/23258 GUI graphical user interface, icon, function bloc editor, labview
• CPC Class Codes: G05B 2219/24093 Display, show place of error, fault
• CPC Class Codes: G05B 23/0216 Human interface functionality, e.g. monitoring system providing help to the user in the selection of tests or in its configuration
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G09G 2340/14 Solving problems related to the presentation of information to be displayed
• CPC Class Codes: G09G 5/00 Control arrangements or circuits for visual indicators common to cathode-ray tube indicators and other visual indicators image data processing or generation, in general G06T

Abstract

An automation control system is provided with an interface device configured to enable a user to monitor, control, or monitor and control processes of the automation control system. Upon power on or initialization of the interface device or when a previously logged in user is logged off, the interface device logs in a guest account associated with a user role having a defined set of access rights and provides access to monitor, control, or monitor and control the processes based upon the set of access rights.

Claims

1. An automation control system, comprising:

an interface device configured to enable a user to monitor, control, or monitor and control processes of the automation control system;

wherein, after initialization of the interface device, the interface device is configured to;

whenever an authentication input has not been received, login a guest account associated with a restricted user role having a defined set of access rights specific to users that have not provided an authentication input, wherein the defined set of access rights are selectively changeable via an account associated with administration of the defined set of access rights; and

whenever the authentication input has not been received, provide access to monitor, control, or monitor and control the processes based upon the set of access rights.

2. The automation control system of claim 1, wherein the interface device is configured to:

poll for an override key at each initialization of the interface device;

when the override key is detected, poll for and determine a validity of a provided authentication input;

when the provided authentication input is not valid, login the guest account; and

when the provided authentication input is detected and valid, login a user account associated with the provided authentication input.

3. The automation control system of claim 1, wherein the interface device is configured to login the guest account when an alternate account is logged out of the interface device.

4. The automation control system of claim 3, wherein the interface device comprises a human machine interface (HMI).

5. The automation control system of claim 1, wherein the access rights are specific to a particular component of the interface device, the interface device comprising a human machine interface (HMI), the particular component comprising:

an HMI project associated with the automation control system;

one or more objects of an HMI device screen;

the HMI device screen;

a first folder of the HMI containing interface device screens;

or a second folder of the HMI containing a first screen.

6. The automation control system of claim 1, wherein the access rights comprise inherit access rights for a particular component, wherein the inherit access rights are configured to inherit access rights for the particular component from a higher level component of the interface device.

7. The automation control system of claim 6, wherein the particular component comprises one or more objects of an interface device screen and the higher level component comprises the interface device screen.

8. The automation control system of claim 1, wherein the interface device is configured to log out the guest account when an alternate account is authenticated and logged into the interface device.

9. The automation control system of claim 1, wherein the interface device is configured to provide a toolbar configured to enable the user to login as an alternate account.

10. The automation control system of claim 9, wherein the toolbar, a user-defined log-out command, or a system-defined logout command, or any combination thereof is configured to enable the user to logout the alternate account, thus triggering login of the guest account.

11. The automation control system of claim 1, wherein choices for the access rights comprise:

full access, read only access, no access, and inherit access.

12. The automation control system of claim 1, wherein choices for the user role comprise:

an administrator role, an engineer role, a maintenance role, an operator role, a restricted role, a supervisor role, a none role, a user-defined role, or any combination thereof.

13. A method, comprising:

after initializing an interface device of an automation control system;

whenever an authentication input has not been received, logging in, via a processor of the interface device, a guest account associated with a restricted user role having a defined set of access rights specific to users that have not provided an authentication input, wherein the defined set of access rights are selectively changeable via an account associated with administration of the defined set of access rights, without requiring login information; and

whenever the authentication input has not been received, providing, via the processor of the interface device, access to monitor, control, or monitor and control the processes based upon the set of access rights.

14. The method of claim 13,

polling for an override key at each initialization of the interface device;

when the override key is detected, polling for and determining a validity of a provided authentication input;

when the provided authentication input is not valid, logging in the guest account; and

when the provided authentication input is detected and valid, logging in a user account associated with the authentication input.

15. The method of claim 13, comprising:

detecting an override trigger before logging in the guest account;

providing an alternate user login screen upon detecting the override trigger;

authenticating a request for login provided from the alternate user login screen;

logging in an alternate account if the request is authenticated; and

only logging in the guest account when the alternate account is not logged in.

16. The method of claim 13, comprising:

detecting a request to login an alternate account;

logging out the guest account and logging in the alternate account when the request is authenticated.

17. A non-transitory, computer-readable medium, comprising computer-readable instructions to:

whenever an authentication input has not been received, login a guest account of an interface device of an automation monitoring and control system, without requiring login information;

wherein the guest account is associated with a restricted user role having a defined set of access rights specific to users that have not provided an authentication input, wherein the defined set of access rights are selectively changeable via an account associated with administration of the defined set of access rights;

whenever the authentication input has not been received, provide access to monitor, control, or monitor and control the processes based upon the set of access rights.

18. The computer-readable medium of claim 17, comprising instructions to:

display a security programming screen comprising a security role input for the guest account, wherein the security programming screen is configured to associate a user role with the guest account.

19. The computer-readable medium of claim 18, wherein the security role input is configured to enable association of the guest account with an administrator role, an engineer role, a maintenance role, an operator role, a restricted role, a supervisor role, a none role, a user-configured role, or any combination thereof.

20. The computer-readable medium of claim 17, comprising computer-readable instructions to:

display a security properties screen associated with components of the interface device;

wherein the security properties screen comprises access rights fields for each role provided in the interface device and the access rights fields are configured to define access rights for each of the roles provided in the interface device.

21. The computer-readable medium of claim 17, wherein the access rights comprise:

full access, read only access, no access, and inherit access.