Method and device providing secure vendor service access

• US 11,109,231 B2
• Filed: 03/21/2016
• Issued: 08/31/2021
• Est. Priority Date: 03/23/2015
• Status: Active Grant

• Current Assignee: ABB Schweiz AG (ABB Limited)
• Original Assignee: ABB Schweiz AG (ABB Limited)
• Inventors: Harvan, Matus, Schlegel, Roman, Obermeier, Sebastian, Locher, Thomas
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gundry, Stephen T
• Application Number:
  US15/075,577
• Publication Number:
  US 20160283702A1
• Time in Patent Office: 1,989 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 10/20 Administration of product repair or maintenance
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The present invention provides an approach for granting access and respectively denying access to an instruction set of a device. The technical teaching provides the advantage that unauthorized access can be effectively prevented. Hence, maintenance work can be performed by specialized staff and security sensitive parts of the instruction sets are secured.

Claims

1. A method for operating a device providing secure vendor service access for its maintenance, comprising:

providing a configuration storage providing a device configuration for operating the device; and

providing a security module being arranged to assign at least one access right for accessing the configuration storage;

wherein the device is only operable if the at least one access right is set;

wherein the device is arranged such that a transition from (1) a condition of access rights not being set, to (2) a condition of access enabled or access disabled, and vice versa, is shiftable; and

wherein the device is arranged such that a direct transition from (1) the condition of access rights enabled, to (2) access rights disabled, and vice versa, is prohibited, and

wherein providing secure vendor service access for the maintenance of the device includes providing service functionality for the maintenance of the device.

2. The method according to claim 1, further comprising provision of a transition model specifying enabled transitions of access right states.

3. The method according to claim 1, further comprising unlocking the device if the at least one access right is set.

4. The method according to claim 1, further comprising providing an assignment of access rights to at least a part of the stored device configuration.

5. The method according to claim 1, wherein the device only being operable if the at least one access right is set includes locking the normal operation of the device when the access right is not set.

6. The method according to claim 1, wherein access is granted to a technician when the device is in the condition of access rights not being set.

7. A method for operating a device providing secure vendor service access for its maintenance, comprising:

providing a configuration storage providing a device configuration for operating the device; and

providing a security module being arranged to assign at least one access right for accessing the configuration storage;

wherein the device is only operable if the at least one access right is set;

wherein the device is arranged such that a transition from (1) a condition of access rights not being set, to (2) a condition of access enabled or access disabled, and vice versa, is shiftable; and

wherein the device is arranged such that a direct transition from (1) the condition of access rights enabled, to (2) access rights disabled, and vice versa, is prohibited, and

wherein a transition from a first state to a second state and a subsequent transition from the second state to the first state results in the device being in an equivalent state to the first state before the transition, wherein

the first state and the second state include the condition of access rights not being set or the condition of access enabled or access disabled, and wherein

the first state comprises a different condition to the second state.

8. A method for operating a device providing secure vendor service access for its maintenance, comprising:

providing a configuration storage providing a device configuration for operating the device; and

providing a security module being arranged to assign at least one access right for accessing the configuration storage;

wherein the device is only operable if the at least one access right is set;

wherein the device is arranged such that a transition from (1) a condition of access rights not being set, to (2) a condition of access enabled or access disabled, and vice versa, is shiftable; and

wherein the device is arranged such that a direct transition from (1) the condition of access rights enabled, to (2) access rights disabled, and vice versa, is prohibited, and

wherein the device is further arranged such that a transition from the condition of access disabled to a condition of access temporarily enabled is shiftable.

9. The method according to claim 8, further comprising providing an assignment of access rights to at least a part of the stored device configuration, wherein

the method includes generating a password when transitioning from the condition of access rights not being set to the condition of access disabled.