ALARM/EVENT ENCRYPTION IN AN INDUSTRIAL ENVIRONMENT

• US 20080079597A1
• Filed: 09/29/2006
• Published: 04/03/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Dorgelo, Eric G., Baier, John J., Johnson, David K., Hall, Kenwood H., Rischar, Charles M., Tambascio, Kevin
• Granted Patent: US 7,541,920 B2
• Time in Patent Office: Days
• US Class Current: 340/679
• CPC Class Codes: G05B 2219/25205 Encrypt communication
• CPC Class Codes: G05B 2223/06 Remote monitoring
• CPC Class Codes: G05B 23/027 Alarm generation, e.g. communication protocol; Forms of alarm
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: Y02P 90/80 Management or planning

Abstract

Systems and methods that can enhance protection of alarms and events within an industrial control environment are provided. An alarm security component employs cryptographic mechanisms and techniques to encrypt alarms and/or events related to field devices of an industrial controller system. The specification also discloses two-way mutual authentication using cryptography, thereby ensuring that an alarm is a valid alarm and that the clients using the alarms are authorized alarm clients. Effectively, the innovation can regulate access to alarms and events by unauthorized external entities (e.g., monitors and/or users) by employing cryptographic mechanisms.

Claims

1. A security system in an industrial automation environment, comprising:

a receiver component that receives an alarm related to a field device; and

an encryption component that encrypts the alarm and secures delivery to a monitor.

2. The system of claim 1, further comprising a field device that generates the alarm.

3. The system of claim 2, further comprising an alarm generator component that establishes the alarm.

4. The system of claim 1, the encryption component employs a cryptographic key to protect the alarm.

5. The system of claim 1, further comprising a plurality of field devices, one of the field devices generates the alarm.

6. A security system in an industrial automation environment, comprising:

a receiver component that receives a request to subscribe to an alarm; and

an encryption component that encrypts and communicates the alarm to an entity.

7. The system of claim 6, the entity is one of a user and a monitor server.

8. The system of claim 6, further comprising a field device that generates information that identifies the alarm.

9. The field device of claim 8 being a controller.

10. The system of claim 6, further comprising a key management component that identifies a cryptographic key, the encryption component employs the cryptographic key to encrypt the alarm.

11. The system of claim 10, further comprising a key retrieval component that retrieves the key based upon identity of the entity.

12. The system of claim 11, the key is a public key that corresponds to a private key associated with the entity.

13. The system of claim 12, further comprising a key store that maintains the public key related to the entity.

14. The system of claim 6, further comprising a key management component that establishes a cryptographic key pair, the encryption component employs one of the cryptographic key pair to encrypt the alarm.

15. The system of claim 14, further comprising a key generation component that generates the cryptographic key pair based at least in part upon identity of the entity.

16. The system of claim 15, further comprising a key distribution component that securely delivers one of the cryptographic key pair to the entity, the entity employs the one of the cryptographic key pair to decrypt the alarm.

17. The system of claim 6, the entity is an authorized user.

18. The system of claim 6, the entity is a remote access server.

19. A controller comprising the system of claim 6.

20. A method for securing an alarm/event, comprising:

generating one of an alarm and an event within a field device; and

encrypting the one of an alarm and an event using one of a cryptographic key pair.

21. The method of claim 20, further comprising locating the one of the cryptographic key pair based at least in part upon a characteristic of the one of an alarm and an event.

22. The method of claim 20, further comprising:

transmitting the encrypted one of an alarm and an event; and

employing the other of the cryptographic key pair to decrypt the alarm.

23. The method of claim 20, further comprising:

receiving a request for the one of an alarm and an event from an entity;

establishing identity of the entity; and

encrypting the one of an alarm and an event as a function of the identity.

24. The method of claim 23, further comprising mapping the identity to a public key, the public key is used to encrypt the one of an alarm and an event.

25. The method of claim 23, further comprising retrieving a key as a function of the identity and employing the key to encrypt the one of an alarm and an event.

26. The method of claim 20, further comprising generating a cryptographic key pair, one of the cryptographic key pair is employed to encrypt the one of an alarm and an event and the other of the cryptographic key pair is employed to decrypt the one of an alarm and an event.