Access protection accessory for an automation network

• US 9,344,296 B2
• Filed: 04/05/2012
• Issued: 05/17/2016
• Est. Priority Date: 04/08/2011
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Gerlach, Hendrik, Schmid, Wolfgang
• Primary Examiner(s): Traore, Fatoumata
• Assistant Examiner(s): LE, KHOI V
• Application Number:
  US13/440,766
• Publication Number:
  US 20120260305A1
• Time in Patent Office: 1,503 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/40006 Architecture of a communication node current supply arrangements H04L12/10; intermediate storage or scheduling H04L49/90
• CPC Class Codes: H04L 2012/4026 Bus for use in automation systems
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

An automation network connected to an automation installation configured to perform an automation process executable in at least two states, where the access protection accessory comprises network ports, a digital storage medium configured to store at least first and second rules, and a processor configured to read the at least first and second rules, process the rules and receive and forward data via the network ports, and receive at least one signal comprising advice of a change in the state of the automation process. The first rules, in a first state of the automation process, define which received data are forwarded and which received data are not forwarded, and following reception of the at least one signal the second rules define which received data are forwarded and which received data are not forwarded.

Claims

1. An access protection accessory for an automation network which is connected to an automation installation configured to perform an automation process executable in at least two states, the access protection accessory comprising:

a digital storage medium configured to store at least first rules and second rules;

a combinational logic module configured to perform scaling operations or linearization operations in which at least one measurement parameter is compared with at least one associated threshold value, and a state change is detected when the at least one measurement parameter is above or below the at least one associated threshold value;

network ports; and

a processor configured to read the at least first and second rules, process the at least first rules and second rules and receive and forward data from the access protection accessory through the network ports;

wherein the first rules, in a first state of the automation process, define which received data are forwarded from the access protection accessory and which received data are not forwarded from the access protection accessory;

wherein the processor is further configured to receive at least one signal at the combinational logic module indicating a change in a state of the automation process and detect the change in the state of the automation process by evaluating the signal; and

wherein, following reception of the at least one signal, the second rules define which received data are forwarded from the access protection accessory and which received data are not forwarded from the access protection accessory.

2. The access protection accessory as claimed in claim 1, wherein the processor is configured to receive the at least one signal through at least one network port of the network ports.

3. The access protection accessory as claimed in claim 1, wherein the access protection accessory comprises a separate port for receiving the at least one signal, and wherein the at least one signal comprises the at least one measurement parameter from the automation process, the at least one measurement parameter being measured by a sensor in the automation installation.

4. The access protection accessory as claimed in claim 1, wherein the processor is further configured to receive a plurality of signals, wherein the at least one signal comprises a plurality of measurement parameters, and wherein the processor is further configured to detect the change in the state of the automation process by applying computational operations to the plurality of measurement parameters.

5. The access protection accessory as claimed in claim 1, wherein the at least first rules and second rules define access rights based on a transmitter and a receiver of the data.

6. The access protection accessory as claimed in claim 1, wherein the first rules are combined in at least one first rule group and the second rules are combined in at least one second rule group.

7. The access protection accessory as claimed in claim 1, wherein the first state of the automation process is an operating state and the second state is an emergency state;

and wherein the second rules allow access to all network accessories in the automation network from an emergency inspection network accessory.

8. The access protection accessory as claimed in claim 1, wherein the first state of the automation process is an operating state and the second state is an emergency state, and wherein the second rules allow access to all network accessories in the automation network from any network accessory in the automation network.

9. An automation system comprising:

at least one automation installation configured to perform an automation process;

at least one automation network connected to the automation installation via an access protection accessory comprising a digital storage medium configured to store at least first rules and second rules, network ports, a combinational logic module configured to perform scaling operations or linearization operations in which at least one measurement parameter is compared with at least one associated threshold values, and a state change is detected when the at least one measurement parameter is above or below the at least one associated threshold value, and a processor arranged in the access protection accessory and configured to read the at least first rules and second rules, process the rules and receive and forward data from the access protection accessory through the network ports;

wherein the first rules, in a first state of the automation process, define which received data are forwarded from the access protection accessory and which received data are not forwarded from the access protection accessory;

wherein the processor arranged in the access protection accessory is further configured to receive, through one network port of the network ports from the automation installation, at the combinational logic module at least one signal indicating a change in a state of the automation process and detect the change in a state of the automation process by evaluating the signal; and

wherein, following reception of the at least one signal, the second rules define which received data are forwarded from the access protection accessory and which received data are not forwarded from the access protection accessory.

10. A method for operating an access protection accessory in an automation network connected to an automation installation configured to perform an automation process, the method comprising:

performing the automation process in a first state;

reading, first rules from a storage medium arranged in the access protection accessory by a processor arranged in the access protection accessory;

forwarding data from the access protection accessory by applying the first rules, the first rules defining which data are forwarded from the access protection accessory and which data are not forwarded from the access protection accessory;

receiving at least one signal at a combinational logic module arranged in the access protection accessory, said combinational logic module performing scaling operations or linearization operations in which at least one measurement parameter is compared with at least one associated threshold value, and a state change is detected when the at least one measurement parameter is above or below the at least one associated threshold value, and said at least one signal indicating a change in a state of the automation process;

detecting the change in state by evaluating the signal by the processor arranged in the access protection accessory;

reading second rules from the storage medium arranged in the access protection accessory; and

forwarding the data from the access protection accessory, after detecting the change in state, by applying the second rules, the second rules defining which received data are forwarded from the access protection accessory and which received data are not forwarded from the access protection accessory.

11. The method as claimed in claim 10, wherein the at least one signal comprises the at least one measurement parameter from the automation process, the at least one measurement parameter being measured by a sensor in the automation installation.

12. The method as claimed in claim 10, wherein the at least one first rules and second rules define access rights based on a transmitter and a receiver of the data.

13. The method as claimed in claim 11, wherein the at least one first and second rules define access rights based on a transmitter and a receiver of the data.

14. The method as claimed in claim 10, wherein the first rules are combined in at least one first rule group and the second rules are combined in at least one second rule group.

15. A non-transitory digital storage medium for an access protection accessory in an automation network connected to an automation installation configured to perform an automation process, the digital storage medium comprising program instructions which, upon execution by a processor arranged in the access protection accessory, prompt the access protection accessory to:

perform the automation process in a first state and read first rules using the processor arranged in the access protection accessory;

forward data from the access protection accessory by applying the first rules, the first rules defining which data are forwarded from the access protection accessory and which data are not forwarded from the access protection accessory;

receive at least one signal at a combinational logic module arranged in the access protection accessory, said combinational logic module performing scaling operations or linearization operations in which at least one measurement parameter is compared with at least one associated threshold value, and a state change is detected when the at least one measurement parameter is above or below the at least one threshold values value, and said at least one signal indicating a change in the state of the automation process;

read second rules from the database; and

forward the data from the access protection accessory by applying the second rules after the at least one signal is received, the second rules defining which received data are forwarded from the access protection accessory and which received data are not forwarded from the access protection accessory.