Systems and methods to secure industrial sensors and actuators

• US 20150121507A1
• Filed: 03/24/2014
• Published: 04/30/2015
• Est. Priority Date: 10/28/2013
• Status: Active Grant

• Current Assignee: Maxim Integrated Products, Inc. (Analog Devices, Inc.)
• Original Assignee: Maxim Integrated Products, Inc. (Analog Devices, Inc.)
• Inventors: Kurkowski, Hal, Haija, Samer A., Yanamadala, Subbayya Chowdary
• Granted Patent: US 10,095,858 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Various embodiments of the invention provide for secure data communication in industrial process control architectures that employ a network of sensors and actuators. In various embodiments, data is secured by a secure serial transmission system that detects and authenticates IO-Link devices that are equipped with secure transceivers circuits, thereby, ensuring that non-trusted or non-qualified hardware is prevented from connecting to a network and potentially compromising system behavior.

Claims

1. A process control system to facilitate authentication of IO-Link devices within a process control network, the system comprising:

a PLC comprising a plurality of IO paths;

a serial link coupled to the PLC, the serial link is configured to operate an IO-Link;

an IO-Link device coupled to the serial link; and

a PLC compute node coupled to the PLC, the compute node configures the IO-Link device, wherein the serial link comprises;

an IO-Link secure master transceiver coupled to a programmable microcontroller; and

an authentication module configured to secure data received from an IO-link device secure transceiver.

2. The system according to claim 1, wherein the IO-Link secure master transceiver comprises multiple output ports to communicate secure data with multiple IO-Link devices in a point-to-point configuration.

3. The system according to claim 1, wherein the IO-Link secure device transceiver comprises memory to store security-related information.

4. The system according to claim 3, wherein the security-related information comprises a cryptographic key.

5. The system according to claim 1, wherein the IO-Link device is one of an actuator and a sensor.

6. The system according to claim 1, wherein the IO-Link secure master transceiver is configured to operate with both authenticated and an unauthenticated IO-Link devices.

7. The system according to claim 1, wherein the programmable microcontroller is electrically isolated by an optocoupler.

8. The system according to claim 1, wherein the serial link generates security and authentication functions that enable secure communication with the IO-Link device via a communication channel.

9. The system according to claim 8, wherein the communication channel is a three-conductor cable.

10. A method to authenticate an IO-Link device, the method comprising:

detecting the presence of a device that comprises an IO-Link secure transceiver;

sending an authorization request from an IO-Link secure master transceiver to the device;

receiving a response signal from the device in response to the authorization request;

validating the device based on the response signal; and

determining whether the device is compatible with another device; and

enabling a transmission via a communication channel in response to detecting that the response signal is valid.

11. The method according to claim 10, further comprising disabling the transmission via the communication channel in response to detecting that the response signal is invalid.

12. The method according to claim 10, wherein sending the authorization request comprises sending secret data.

13. The method according to claim 10, wherein validating comprises applying a security protocol to enabling the transmission.

14. The method according to claim 10, further comprising converting the response signal prior to processing.

15. The method according to claim 10, wherein the device is enabled by a communications module.

16. The method according to claim 10, further comprising transmitting encrypted data between the device and a master transceiver.

17. A device to authenticate an IO-Link device, the device comprising:

a first IO-Link secure transceiver configured to communicate with a programmable microcontroller;

and

authentication module configured to secure data that is transmitted to or received from a second IO-Link secure transceiver, the authentication module is configured to provide one of an encryption processing and a decryption processing of the data.

18. The device according to claim 17, wherein the data comprises one of diagnostic data, status data, and messages communicated using a protocol.

19. The device according to claim 17, wherein the first IO-Link secure transceiver is embedded in a control module.

20. The device according to claim 17, wherein the programmable microcontroller comprises memory that is configured to store data transmitted over a serial link.