System for performing remote services for a technical installation

• US 9,940,116 B2
• Filed: 01/10/2011
• Issued: 04/10/2018
• Est. Priority Date: 01/12/2010
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Balint, Thomas, Bauer, Jrg, Kissling, Jan
• Primary Examiner(s): AQUINO, WYNUEL S
• Application Number:
  US13/521,987
• Publication Number:
  US 20130139147A1
• Time in Patent Office: 2,647 Days
• Field of Search: None
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: Y04S 40/18 Network protocols supporting networked applications, e.g. including control of end-device applications over a network

Abstract

A system is provided for performing remote services for a technical installation comprising a first remote service system having a first tunnel connection for transmitting data between a first device at a distance from the installation and a first device internal to the installation, and a second remote service system having a second tunnel connection for transmitting data between a second device at a distance from the installation and a second device internal to the installation, wherein the second tunnel connection runs through the first tunnel connection. Performing a plurality of remote services in an installation can thereby be enabled at a high level of IT security and a high level of operational reliability of the installation, wherein the administrative effort on the part of the installation operator call be kept small.

Claims

1. A system for performing remote services for a technical installation comprising one or more installation components, each comprising a device or service of the installation, the system comprising:

a first remote services system comprising;

a first device remote from the installation for performing a first remote service,

a first device within the installation, and

a first virtual tunnel connection for transmission of data between the first device remote from the installation and the first device within the installation, the first virtual tunnel connection beginning at a first remote endpoint in the first remote services system and terminating at a first installation endpoint within the installation, and

a second remote services system comprising;

a second device remote from the installation for performing a second remote service,

a second device within the installation, and

a second virtual tunnel connection for transmission of data between the second device remote from the installation and the second device within the installation, the second virtual tunnel connection beginning at a second remote endpoint in the second remote services system and terminating at a second installation endpoint within the installation, wherein the second remote endpoint is separate from the first remote endpoint and the second installation endpoint is separate from the first installation endpoint,

wherein the first and second virtual tunnel connections share a common physical connection via a secure communication platform connected between the first remote services system and the second remote services system, the secure communication platform being linked to the Internet,

wherein the secure communication platform is programmed to;

receive a communication from one of a particular installation component or the first remote services system, the communication including first data intended for the other one of the particular installation component or the first remote services system,

store the first data in a data server of the secure communication platform,

establish an authenticated connection with the other one of the particular installation component or the first remote services system, and

only after establishing the authenticated connection, transmitting the stored first data to the other one of the particular installation component or the first remote services system via the first virtual tunnel connection, and performing a function at the particular installation component or at the first remote services based on the first data,

wherein the first virtual tunnel connection uses a first data encryption technology for communications between the first device remote from the installation and the first device within the installation, and the second virtual tunnel connection uses a second data encryption technology different from the first data encryption technology for communications between the second device remote from the installation and the second device within the installation, such that communications between the first device remote from the installation and the first device within the installation are encrypted differently than communications between the second device remote from the installation and the second device within the installation, and

wherein the second virtual tunnel connection runs through the first virtual tunnel connection.

2. The system of claim 1, wherein the secure communication platform is located in a demilitarized zone.

3. The system of claim 1, wherein the first remote services system and the second remote services system are linked to a common authentication entity.

4. The system of claim 1, further comprising a router and a controller, each within the installation, wherein the router is the first installation endpoint and the controller is the installation second endpoint.

5. The system of claim 1, wherein the first remote endpoint corresponds with the first device, and the second remote endpoint corresponds with the second device.

6. A system for performing remote services for a technical installation comprising one or more installation components, each comprising a device or service of the installation, the system comprising:

a first virtual tunnel connection for transmitting data between (a) a first device remote from the installation for performing a first remote service and (b) a first device within the installation, the first virtual tunnel connection beginning at a first remote endpoint in the first remote services system and terminating at a first installation endpoint within the installation, and

a second virtual tunnel connection for transmitting data between (a) a second device remote from the installation for performing a second remote service and (b) a second device within the installation, the second virtual tunnel connection beginning at a second remote endpoint in the second remote services system and terminating at a second installation endpoint within the installation, wherein the second remote endpoint is separate from the first remote endpoint and the second installation endpoint is separate from the first installation endpoint

wherein the first and second virtual tunnel connections share a common physical connection via a secure communication platform connected between the first remote services system and the second remote services system, the secure communication platform being linked to the Internet,

wherein the secure communication platform is programmed to;

receive a communication from one of a particular installation component or the first remote services system, the communication including first data intended for the other one of the particular installation component or the first remote services system,

store the first data in a data server of the secure communication platform,

establish an authenticated connection with the other one of the particular installation component or the first remote services system, and

only after establishing the authenticated connection, transmitting the stored first data to the other one of the particular installation component or the first remote services system via the first virtual tunnel connection, and performing a function at the particular installation component or at the first remote services based on the first data,

wherein the first virtual tunnel connection uses a first data encryption technology for communications between the first device remote from the installation and the first device within the installation, and the second virtual tunnel connection uses a second data encryption technology different from the first data encryption technology for communications between the second device remote from the installation and the second device within the installation, such that communications between the first device remote from the installation and the first device within the installation are encrypted differently than communications between the second device remote from the installation and the second device within the installation, and

wherein the second virtual tunnel connection runs through the first virtual tunnel connection.

7. The system of claim 6, wherein the secure communication platform is located in a demilitarized zone.

8. The system of claim 6, wherein the two remote service are linked to a common authentication entity.

9. The system of claim 6, wherein the first installation endpoint is a router within the installation and the second installation endpoint is a controller within the installation.

10. A method for providing remote services for a technical installation comprising one or more installation components, each comprising a device or service of the installation, the method comprising:

transmitting first data via a first virtual tunnel connection between (a) a first device remote from the installation for performing a first remote service and (b) a first device within the installation, the first virtual tunnel connection beginning at a first remote endpoint in the first remote services system and terminating at a first installation endpoint within the installation

transmitting second data via a second virtual tunnel connection between (a) a second device remote from the installation for performing a second remote service and (b) a second device within the installation, the second virtual tunnel connection beginning at a second remote endpoint in the second remote services system and terminating at a second installation endpoint within the installation, wherein the second remote endpoint is separate from the first remote endpoint and the second installation endpoint is separate from the first installation endpoint

wherein the first and second virtual tunnel connections share a common physical connection via a secure communication platform connected between the first remote services system and the second remote services system, the secure communication platform being linked to the Internet,

receiving, at the secure communication platform, a communication from one of a particular installation component or the first remote services system, the communication including first data intended for the other one of the particular installation component or the first remote services system,

storing the first data in a data server of the secure communication platform,

establishing, by the secure communication platform, an authenticated connection with the other one of the particular installation component or the first remote services system, and

only after establishing the authenticated connection, the secure communication platform transmitting the stored first data to the other one of the particular installation component or the first remote services system via the first virtual tunnel connection, and performing a function at the particular installation component or at the first remote services based on the first data,

wherein the first virtual tunnel connection uses a first data encryption technology for communications between the first device remote from the installation and the first device within the installation, and the second virtual tunnel connection uses a second data encryption technology different from the first data encryption technology for communications between the second device remote from the installation and the second device within the installation, such that communications between the first device remote from the installation and the first device within the installation are encrypted differently than communications between the second device remote from the installation and the second device within the installation, and

wherein the second virtual tunnel connection runs through the first virtual tunnel connection.

11. The method of claim 10, wherein the secure communication platform is located in a demilitarized zone.

12. The method of claim 10, wherein the first installation endpoint is a router within the installation and the second installation endpoint is a controller within the installation.