Systems and/or methods for managing critical digital assets in power generating plants

• US 9,614,872 B2
• Filed: 01/10/2012
• Issued: 04/04/2017
• Est. Priority Date: 01/10/2011
• Status: Expired due to Fees

• Current Assignee: Sheffield Scientific
• Original Assignee: Sheffield Scientific
• Inventors: Carter, Kevin C.
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US13/979,093
• Publication Number:
  US 20140304772A1
• Time in Patent Office: 1,911 Days
• Field of Search: 726 3
• CPC Class Codes: F01K 13/02 Controlling, e.g. stopping or starting
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: Y02E 30/00 Energy generation of nuclear origin
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

Systems and methods are disclosed that implement a coordinated cyber security program for a power generation plant to establish and/or maintain cyber security controls for the power generation plant through a comprehensive life cycle approach.

Claims

1. An information server for managing cyber security information for power generation facilities, comprising:

a processor;

a master cyber security repository configured to store security control information for digital assets associated with a plurality of power generation facilities;

a network interface configured to communicate with one or more participant servers operated on behalf of the power generation facilities over a data communication network wherein the participant servers manage the security control information for the digital assets; and

a memory comprising a repository manager module configured to manage the security control information in the master cyber security repository;

wherein the repository manager module is configured to receive security information for a first digital asset from a first one of the participant servers associated with a first one of the plurality of power generation facilities, to determine if a record for the first digital asset exists in the master cyber security repository, and, in response to determining that a record exists for the first digital asset, to update the record of the first digital asset with the security information; and

wherein the information server is configured to transmit the updated record of the first digital asset to a second one of the participant servers associated with a second one of the plurality of power generation facilities for use in connection with a second digital asset;

wherein the first participant server and the second participant server are operated by independent power generation entities; and

wherein the repository manager module is configured, in response to determining that the record exists for the first digital asset, to determine if the record of the first digital asset needs to be updated before updating the record of the first digital asset with the security information.

2. The information server of claim 1, wherein the digital asset comprises an equipment used in digital computer and/or communications systems and/or networks in a power generation facility.

3. The information server of claim 2, wherein the digital asset performs a safety-related or important-to safety function, a security function, or an emergency preparedness function, or the asset supports systems and equipment which, if compromised, would adversely impact the safety, security, or emergency preparedness functions.

4. An information server for managing cyber security information for power generation facilities, comprising:

a processor;

a master cyber security repository configured to store security control information for digital assets associated with a plurality of power generation facilities;

a network interface configured to communicate with one or more participant servers operated on behalf of the power generation facilities over a data communication network wherein the participant servers manage the security control information for the digital assets; and

a memory comprising a repository manager module configured to manage the security control information in the master cyber security repository;

wherein the repository manager module is configured to receive security information for a first digital asset from a first one of the participant servers associated with a first one of the plurality of power generation facilities, to determine if a record for the first digital asset exists in the master cyber security repository, and, in response to determining that a record exists for the first digital asset, to update the record of the first digital asset with the security information; and

wherein the information server is configured to transmit the updated record of the first digital asset to a second one of the participant servers associated with a second one of the plurality of power generation facilities for use in connection with a second digital asset;

wherein the first participant server and the second participant server are operated by independent power generation entities; and

wherein the repository manager module is configured, in response to determining that the record does not exist for the first digital asset, to create a new record for the first digital asset and to update the new record with the security information.

5. A participant server for managing digital assets in a power generation facility, comprising:

a processor;

a local cyber security repository configured to store security control information for digital assets used within the power generation facility;

a network interface configured to communicate with a remote cyber security information server over a data communication network; and

a memory comprising a cyber security reporting module configured to conform security information in the local cyber security repository with security control information in a master cyber security repository operated by the remote cyber security information server;

wherein the cyber security reporting module is configured to transmit security information for one or more digital assets used within the power generation facility to the remote cyber security information server; and

wherein the local cyber security repository is configured to receive updated security control information for the one or more digital assets from the remote cyber security information server and to update security information in the local cyber security repository with the updated security control information received from the remote cyber security information server;

wherein the participant server further comprises a life cycle compliance module that is configured to integrate security information for digital assets used within the power generation facility contained in the local cyber security repository with an internal process relating to the digital assets.

6. The participant server of claim 5, wherein the life cycle compliance module that is configured to integrate security information for digital assets used within the power generation facility contained in the local cyber security repository with an engineering change process for updating the digital assets.

7. The participant server of claim 5, wherein the life cycle compliance module is configured to interface with an enterprise asset management system operated by the power generation facility.

8. A method of managing cyber security information for power generation facilities, comprising:

storing security control information for digital assets associated with a plurality of power generation facilities at an information server comprising a processor;

receiving, at the information server, security information for a first digital asset from a first remote participant server associated with a first one of the plurality of power generation facilities;

determining, at the information server, if a record for the first digital asset exists in a master cyber security repository;

in response to determining that a record exists for the first digital asset, updating, at the information server, the record of the first digital asset with the security information; and

transmitting the updated record of the first digital asset from the information server to a second remote participant server associated with a second one of the plurality of power generation facilities for use in connection with a second digital asset managed by the second remote participant server;

wherein the first participant server and the second participant server are operated by independent power generation entities;

wherein the method further comprises, in response to determining that the record exists for the first digital asset, determining if the record of the first digital asset needs to be updated before updating the record of the first digital asset with the security information.

9. The method of claim 8, wherein the digital asset comprises an equipment used in digital computer and/or communications systems and/or networks in a power generation facility.

10. The method of claim 8, wherein the digital asset performs a safety-related or important-to safety function, a security function, or an emergency preparedness function, or the asset supports systems and equipment which, if compromised, would adversely impact the safety, security, or emergency preparedness functions.

11. The method of claim 8, farther comprising, in response to determining that the record exists for the first digital asset, determining if the record of the first digital asset needs to be updated before updating the record of the first digital asset with the security information.

12. The method of claim 8, further comprising, in response to determining that the record does not exist for the first digital asset, creating a new record for the first digital asset and updating the new record with the security information.