SCALABLE AND FLEXIBLE INFORMATION SECURITY FOR INDUSTRIAL AUTOMATION

• US 20120089240A1
• Filed: 12/14/2011
• Published: 04/12/2012
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Chand, Sujeet, Farchmin, David W., Baier, John J., Kalan, Michael D., Marquardt, Randall A., Morse, Richard A., Briant, Stephen C.
• Granted Patent: US 8,607,307 B2
• Time in Patent Office: Days
• US Class Current: 700/79
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: Y02P 90/80 Management or planning

Abstract

A security system that relates to industrial automation security comprises a component that receives a request to modify security relating to a zone of a factory floor, the zone being less than an entirety of the factory floor. A zonal security component generates security procedures for the zone, the security procedures differ from security procedures implemented on the factory floor outside the zone.

Claims

1. A system, comprising:

a memory that stores computer executable components, the computer executable components comprising;

a security component that associates a factory floor security policy comprising security settings with a plurality of devices on a factory floor;

an interface component that receives a request to disable security to a first device of the plurality of devices on the factory floor; and

a zone generator component that determines a security zone comprising the first device and a second device of the plurality of devices,

wherein the security component disables security settings within the security zone and maintains security settings to all other devices of the plurality of devices; and

a processor that facilitates execution of at least one of the computer executable components.

2. The system of claim 1, wherein the plurality of devices on the factory floor are arranged in accordance with a hierarchically structured data model and the factory floor security policy is arranged in accordance with the hierarchically structured data model.

3. The system of claim 1, further comprising a verification component that verifies the request based on a time, a date, or the security policy.

4. The system of claim 1, wherein the request is a request to disable an alarm of the first device.

5. The system of claim 1, wherein the security component disables the security settings to the security zone for a time period and after the time period reinstitutes the security settings to the security zone.

6. An apparatus, comprising:

a memory that stores a hierarchically structured representation of a factory floor comprising a plurality of devices and computer executable components, comprising;

a security component that applies security settings associated with a factory floor security policy to the plurality of devices according to the hierarchically structured representation;

an interface component that receives a request to disable security to a first device of the plurality of devices; and

a zone generator component that determines a security zone comprising the first device and a second device of the plurality of devices based on a relationship between the first device and the second device defined in the hierarchically structured representation,

wherein the security component disables security settings within the security zone and maintains security settings to all other devices of the plurality of devices; and

a processor that facilitates execution of at least one of the computer executable components.

7. The apparatus of claim 6, further comprising a verification component that verifies the request based on a time, a date, or the security policy.

8. The apparatus of claim 6, wherein the request is a request to disable an alarm of the first device.

9. The apparatus of claim 6, wherein the security component disables the security settings to the security zone for a time period and after the time period reinstitutes the security settings to the security zone.

10. The apparatus of claim 6, wherein the request is related to a testing procedure of the first device, a debugging procedure of the first device or a maintenance procedure of the first device.

11. A method, comprising:

employing a processor executing computer executable instructions stored on a computer readable storage medium to perform acts, comprising;

receiving a request to disable security procedures of a first device on a factory floor;

querying a hierarchical data representation of a plurality of devices on the factory floor for a second device linked to the first device in a manufacturing operation based on the request;

setting a security zone comprising the first device and the second device; and

disabling security procedures of all devices within the security zone.

12. The method of claim 11, further comprising:

receiving an indication that the security procedures can be reinstated to the first device; and

reinstating security policy for the factory floor to the devices in the security zone related to the first device.

13. The method of claim 11, wherein the disabling further comprises retaining security policies of all other devices on the factory floor that are not part of the security zone.

14. The method of claim 11, further comprising verifying the security zone based on a device location or a time.

15. The method of claim 11, wherein the receiving further comprises receiving a request to disable an alarm of the first device.

16. The method of claim 15, wherein the disabling further comprises disabling an alarm of the second device.

17. The method of claim 11, further comprising receiving approval from an operator to disable the security procedures of all devices within the security zone.

18. The method of claim 11, wherein the receiving further comprises receiving the request related to request is related to a testing procedure of the first device, a debugging procedure of the first device or a maintenance procedure of the first device.

19. The method of claim 11, further comprising authenticating an entity initiating the request.

20. The method of claim 11, wherein the disabling further comprises employing a proxy server to disable security procedures of the second device.