Securing devices to process control systems

• US 9,772,623 B2
• Filed: 07/18/2016
• Issued: 09/26/2017
• Est. Priority Date: 08/11/2014
• Status: Active Grant

• Current Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Original Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Inventors: Nixon, Mark J., Beoughter, Ken J., Christensen, Daniel D., Chen, Deji, Moore, Jr., James H.
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US15/212,399
• Publication Number:
  US 20160327942A1
• Time in Patent Office: 435 Days
• Field of Search: 713168
• CPC Class Codes: G05B 19/418 Total factory control, i.e. centrally controlling a plurality of machines, e.g. direct or distributed numerical control [DNC], flexible manufacturing systems [FMS], integrated manufacturing systems [IMS] or computer integrated manufacturing [CIM]
• CPC Class Codes: G05B 19/41855 by local area network [LAN], network structure
• CPC Class Codes: G05B 2219/24167 Encryption, password, user access privileges
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Techniques for securing a device for use in or with a process plant include provisioning the device with a key generated at least in part from data indicative of necessary conditions and/or attributes that must be met before the device is allowed access to a network of the process plant. Upon initialization, the device determines, based on the key, whether or not the necessary conditions are met, and the device isolates itself or accesses the process control network accordingly. Keys and the necessary conditions/attributes indicated therein may be based on, for example, location, time, context, customer, supplier, particular plant, manufacturer, user, data type, device type, and/or other criteria. Additionally, sub-keys associated with a key may be generated from another set of necessary conditions/attributes. Sub-keys may be provided by a different entity than the key provider entity.

Claims

1. A method for securing devices in a process control plant, the method comprising:

determining, at a computing device, a seed used to generate a key, the seed at least partially based on a number that is randomly generated or pseudo-randomly generated;

determining, at the computing device, key generation data, wherein;

the key generation data is indicative of a set of necessary conditions that are required for a host device that is provisioned with the key to communicate using a network of the process control plant to at least one of;

(i) configure the host device, (ii) transmit real-time data to cause a process to be controlled in the process control plant, or (iii) receive real-time data to cause the process to be controlled, and

the set of necessary conditions includes one or more characteristics of an environment in which the host device is able to be located;

generating, at the computing device, the key from the seed and the key generation data; and

causing, by the computing device, a process control device to be provisioned with the generated key so that the provisioned process control device is the host device, and so that the provisioned process control device authenticates to the network using the generated key and based on a comparison of the set of necessary conditions and a set of current conditions corresponding to a current environment in which the provisioned process control device is located upon boot-up.

2. The method of claim 1, wherein determining the seed used to generate the key comprises determining the seed further based on an identification of the process control device.

3. The method of claim 1, wherein causing the process control device to be provisioned with the generated key comprises causing the generated key to be stored in a non-volatile memory of the process control device prior to the process control device communicating with any other device to at least one of:

(i) configure the process control device, (ii) transmit real-time data to cause the process to be controlled, or (iii) receive real-time data to cause the process to be controlled.

4. The method of claim 1, wherein the set of necessary conditions includes at least one of:

a geo-spatial location of the host device, a specific time, a specific time interval, a specific date or range of dates, or a specific area of the process control plant.

5. The method of claim 1, wherein the set of necessary conditions includes at least one of:

a type of real-time data transmitted by the host device, a type of real-time data received by the host device, or a manufacturer of the host device.

6. The method of claim 1, wherein the set of necessary conditions includes at least one of:

an identity of the process control plant, an identity of an organizational entity operating the process control plant, or an identity of a country in which the process control plant is located.

7. The method of claim 1, wherein:

the computing device is a first computing device, the key is a first key, the seed is a first seed, the key generation data is first key generation data, the set of conditions is a first set of necessary conditions, the host device is a first host device, and the process control device is a first process control device;

the method further comprises;

determining a second seed to generate a second key, the second seed based on second key generation data indicative of a second set of necessary conditions that are required for a second host device to communicate via the network of the process control plant;

generating the second key from the second seed; and

causing a second device to be provisioned with the second key so that the second device is the second host device, and so that the provisioned second device authenticates to the network using the generated second key and based on a comparison of the second set of necessary conditions and a set of current conditions corresponding to a current environment in which the provisioned second device is located upon boot-up; and

the provisioned second device is a second process control device or a second computing device.

8. A device for use in a process control plant, the device comprising:

a processor;

a non-volatile memory storing a key and a sub-key derived from the key, wherein;

the key is generated at least in part based on key generation data that is indicative of a first set of necessary conditions that are required for a host device that is provisioned with the key to communicate with a network of the process control plant, the first set of necessary conditions corresponding to an environment in which the host device is able to be located, and

the sub-key is generated at least in part based on sub-key generation data that is indicative of a second set of necessary conditions that are required for the host device that is provisioned with the sub-key to communicate with the network of the process control plant, the second set of necessary conditions corresponding to the environment in which the host device is able to be located; and

computer-executable instructions stored on the non-volatile memory or another memory of the device, the computer-executable instructions executable by a processor to cause the device to;

determine, based on the key or the sub-key, whether or not a set of current conditions of a current environment in which the device is located adheres to the respective set of necessary conditions;

when the set of current conditions adheres to the respective set of necessary conditions, allow the device to communicate with another device of the process control plant to at least one of;

(i) configure the device, or (ii) at least one of transmit or receive real-time data generated by controlling a process, and

when the set of current conditions does not adhere to the respective set of necessary conditions, prevent the process control device from communicating with the another device of the process control plant to at least one of;

(i) configure the device, or (ii) at least one of transmit or receive the real-time data generated by controlling the process.

9. The device of claim 8, wherein the another device is a node in at least one network included in the process control plant.

10. The device of claim 8, further comprising additional computer-executable instructions that, when executed by the processor, cause the device to determine the set of current conditions of the current environment in which the device is located.

11. The device of claim 8, further comprising additional computer-executable instructions that, when executed by the processor, cause the device to authenticate with the another device or with a certificate authority using the key or the sub-key prior to the device communicating with the another device of the process control plant to at least one of:

(i) configure the device, or (ii) at least one of transmit or receive the real-time data generated by controlling the process.

12. The device of claim 8, further comprising additional computer-executable instructions that, when executed by the processor, cause the device to establish a session for communicating between the device and the another device to at least one of:

(i) configure the device, or (ii) at least one of transmit or receive the real-time data generated by controlling the process, and wherein at least one of the key or the sub-key is unique to the session.

13. The device of claim 12, wherein the session corresponds to the another device or to a network of which the another device is a node.

14. The device of claim 8, wherein at least one of the first set of necessary conditions or the second set of necessary conditions includes at least one of:

a geo-spatial location, a specific time, a specific time interval, a date, or an area of the process control plant.

15. The device of claim 8, wherein at least one of the first set of necessary conditions or the second set of necessary conditions includes at least one of:

a type of data transmitted by the device to control the process, a type of data received by the device to control the process, or a manufacturer of the device.

16. The device of claim 8, wherein at least one of the first set of necessary conditions or the second set of necessary conditions includes at least one of:

an identification of the process control plant, an identification of an area of the process control plant, an identification of an organizational entity operating the process control plant, or an identification of a country in which the process control plant is located.

17. The device of claim 8, wherein at least one of the first set of necessary conditions or the second set of necessary conditions includes an attribute of a user of the device.

18. The device of claim 8, wherein the device is one of:

a process controller, a field device, or an input/output (I/O) card in connection with the process controller.

19. The device of claim 8, wherein the device is a computing device configured to at least one of transmit or receive data corresponding to at least one of:

a process controller, a field device, or an input/output (I/O) card in connection with the process controller.

20. The device of claim 8, wherein the device is a mobile computing device including a user interface, and wherein a mobile control room application executes on the mobile computing device.

21. The device of claim 8, wherein at least one member of the first set of necessary conditions is defined by a provider of the device, and wherein at least one member of the second set of necessary conditions is defined by a user of the device.

22. The device of claim 8, wherein the real-time data generated by controlling the process and transmitted or received by the device is encrypted.

23. The device of claim 22, wherein the real-time data is encrypted based on one of the key or the sub-key.

24. The device of claim 22, wherein all data is transmitted by the device is encrypted at least in part based on the key or the sub-key.

25. The device of claim 8, wherein all data transmitted by the device is encrypted.