IP Library › Granted Patent US 8,327,130
Granted Patent B2
US 8,327,130 · App. 11/861,082 · Granted Dec 4, 2012

Unique identification of entities of an industrial control system

Assignee: Rockwell Automation Technologies, Inc.
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,327,130
App. No.
11/861,082
Granted
Dec 4, 2012
Kind
B2
Abstract

Systems and methods are provided for issuing unique identification credentials to a plurality of devices, and their constituent components, in an industrial control system. Identification credentials are granted by an identification authority and conveyed to each of the credentialed devices and/or component through an identity token. The identification credentials include (1) a unique device identifier, (2) an identification authority component identifier, and (3) an indication of the location of the identification authority component. To secure the issued credentials, such credentials are encrypted and the identification token can be embedded with biometrics features. Identification credentials provide for the following prominent features: (i) Secure access to a device form a client and (ii) determination a topology of a set of credentialed devices in an industrial control system. The topology is network agnostic and facilitates organizational modeling of processes in the industrial control system.

Claims (32)

1. A method of installing an industrial automation device in an industrial automation network, comprising:

communicating industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

issuing an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify an identification authority component that issues the industrial automation device identification credential; and

establishing communication with the industrial automation device across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component in response to authenticating the industrial automation device identification credential.

2. The method of claim 1 , wherein the communicating industrial automation device information includes storing the industrial automation device information in an access control list associated with an identification authority component.

3. The method of claim 1 , wherein the communicating industrial automation device information includes communicating industrial automation device information across the industrial automation network in response to a periodic broadcast message from an identification authority component.

4. The method of claim 1 , further including storing the industrial automation device identification credentials in an identity token component adapted to reside in the industrial automation device.

5. The method of claim 1 , wherein the communicating with the industrial automation device includes obtaining the industrial automation device identification credential from the industrial automation device, and receiving the operational credentials from an identification authority component based on the industrial automation device identification credentials obtained from the industrial automation device.

6. The method of claim 1 , wherein the functionality of the industrial automation device further includes a reporting capability of the industrial automation device.

7. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution, cause at least one device to perform operations comprising:

communicating industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

issuing an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify an identification authority component that issues the industrial automation device identification credential; and

establishing communication with the industrial automation device across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component in response to authenticating the industrial automation device identification credential.

8. The non-transitory computer-readable medium of claim 7 , further including storing the industrial automation device identification credentials in an identity token component adapted to reside in the industrial automation device.

9. The non-transitory computer-readable medium of claim 7 , wherein the communicating with the industrial automation device includes obtaining the industrial automation device identification credential from the industrial automation device, and receiving the operational credentials from an identification authority component based on the industrial automation device identification credentials obtained from the industrial automation device.

10. The non-transitory computer-readable medium of claim 7 , wherein the functionality of the industrial automation device further includes a reporting capability of the industrial automation device.

11. A system for installing an industrial automation device in an industrial automation network, comprising:

an identification authority component configured to:

receive industrial automation device information across an industrial automation network, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

issue an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify the identification authority component;

authenticate communication between a component and the industrial automation device across the industrial automation network based on the industrial automation device identification credential; and

transmit operational credentials to the industrial automation device.

12. The system of claim 11 , wherein the functionality of the industrial automation device further includes a reporting capability of the industrial automation device.

13. A system for installing an industrial automation device in an industrial automation network, comprising:

means for communicating industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

means for issuing an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify an identification authority component that issues the industrial automation device identification credential; and

means for establishing communication with the industrial automation device across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component in response to authenticating the industrial automation device identification credential.

14. A system for installing an industrial automation device in an industrial automation network, comprising:

the industrial automation device configured to:

transmit industrial automation device information across an industrial automation network to an identification authority component, the industrial automation device information including a type of industrial automation device being installed and at least one functionality of the industrial automation device being installed, wherein the functionality of the industrial automation device is at least one of a role or a level of criticality of the industrial automation device in an industrial automation process;

receive from the identification authority component an industrial automation device identification credential based at least in part on the industrial automation device information communicated across the industrial automation network, the industrial automation device identification credential including a device identifier to uniquely identify the industrial automation device and an identification authority component identifier to uniquely identify the identification authority component; and

establish communication with a component across the industrial automation network and receiving operational credentials including an access control list associated with the industrial automation device from the identification authority component based on the industrial automation device identification credential.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 25, 2007
From: WILKINSON, JOHN C., JR.; HALL, KENWOOD HENRY; JASPER, TARYL JON; KALAN, MICHAEL DEAN
To: ROCKWELL AUTOMATION TECHNOLOGIES, INC.
Reel/Frame 019876/0011 →
Continuity (1)
Related Publication 20090083843A1 · Mar 26, 2009