Securing access of a process control or automation system
A process plant and industrial control system architecture includes a generalized compute fabric that is agnostic or indifferent to the physical location at which the compute fabric is implemented, includes one or more physical control or field devices located at one or more specific sites at which a product or process is being manufactured and further includes a transport network that securely provides communications between the compute fabric and the pool of physical devices. The compute fabric includes an application layer that includes configured containers or containerized software modules that perform various control, monitoring and configuration activities with respect to one or more devices, control strategies and control loops, sites, plants, or facilities at which control is performed, and includes a physical layer including computer processing and data storage equipment that can be located at any desired location, including at or near a site, plant, or facility at which control is being performed, at a dedicated location away from the location at which control is being performed, in re-assignable computer equipment provided in the cloud, or any combination thereof. This control architecture enables significant amounts of both computer processing and IT infrastructure that is used to support a process plant, an industrial control facility or other automation facility to be implemented in a shared, in an offsite and/or in a virtualized manner that alleviates many of the communications and security issues present in current process and industrial control systems that attempt to implement control with shared or virtualized computing resources set up according to the well-known Purdue model. The industrial control system architecture is protected via more secure and customizable techniques as compared to those used in Purdue model-based control systems. For example, communications between any (and in some cases, all) endpoints of the system may be protected via one or more virtual private networks to which authenticated endpoints must be authorized to access. Endpoints may include, for example, containerized components, physical components, devices, sites or locations, the compute fabric, and the like, and the VPNs may include mutually-exclusive and/or nested VPNs. External applications and services, whether automated or executing under the purview of a person, may access information and services provided by the system via only APIs, and different sets of APIs may be exposed to different users that have been authenticated and authorized to access respective sets of APIs. A configuration system operates within the compute fabric to enable a user to easily make configuration changes to the compute fabric as the user does not generally need to specify the computer hardware within the compute fabric to use to make the configuration changes, making it possible for the user to deploy new configuration elements with simple programming steps, and in some cases with the push of a button.
1. A method performed by a process control or automation system, the method comprising:
first authenticating and/or authorizing, by the process control or automation system, an identity of an instantiated micro-encapsulated execution environment (MEEE) to communicate with a physical device that performs a physical function utilized in control of an industrial or automation process provided by an enterprise, the instantiated MEEE and the physical device associated with a control loop that has a unique identity within the process control or automation system;
second authenticating and/or authorizing, by the process control or automation system, an identity corresponding to the physical device to communicate with the instantiated MEEE; and
when both the identity corresponding to the physical device and the identity of the instantiated MEEE are authenticated and/or authorized, granting permission for the instantiated MEEE and the physical device to communicatively connect to thereby deliver information between the instantiated MEEE and the physical device for controlling at least a portion of the industrial or automation process via the control loop.
2. The method of claim 1 , wherein:
the first authenticating and/or authorizing of the identity of the instantiated MEEE includes authenticating the identity of the instantiated MEEE and authorizing the identity of the instantiated MEEE responsive to the authenticating of the identity of the instantiated MEEE; and
the second authenticating and/or authorizing of the identity corresponding to the physical device includes authenticating the identity corresponding to the physical device and authorizing the identity corresponding to the physical device responsive to the authenticating of the identity of the instantiated MEEE.
3. The method of claim 1 , wherein:
the identity of the instantiated MEEE and the identity corresponding to the physical device are unique identities within the process control and automation system; and
the identity corresponding to the physical device is the identity of the physical device or an identity of an intervening device that is communicatively disposed between the physical device and the instantiated MEEE.
4. The method of claim 3 , wherein the intervening device is a gateway, the physical device and the gateway are disposed at a first geographical location, and the instantiated MEEE executes on a hardware platform disposed at a second geographical location.
5. The method of claim 1 , wherein:
the identity of the instantiated MEEE is unique in the process control and automation system;
the process control or automation system further comprises I/O hardware that is communicatively disposed between the physical device and the instantiated MEEE;
the physical device is physically connected to a physical I/O interface included in the I/O hardware;
a combination of the physical device and the physical I/O interface is a physical component that is uniquely identified in the process control or automation system; and
the identity corresponding to the physical device is the identity of the physical component.
6. The method of claim 1 , wherein:
the first authenticating and/or authorizing of the identity of the instantiated MEEE to communicate with the physical device is based on the identity corresponding to the physical device; and
the second authenticating and/or authorizing of the identity corresponding to the physical device to communicate with the instantiated MEEE is based on the identity of the instantiated MEEE.
7. The method of claim 1 ,
further comprising, based on the granted permission, communicatively connecting, via a secured point-to-point (PTP) or peer-to-peer (P2P) connection, the instantiated MEEE and the physical device, the instantiated MEEE being a first endpoint of the secured PTP or P2P connection, and one of the physical device or an intervening device communicatively disposed between the instantiated MEEE and the physical device being a second endpoint of the secured PTP or P2P connection; and
wherein:
the first authenticating and/or authorizing of the identity of the instantiated MEEE includes authenticating and/or authorizing the identity of the instantiated MEEE to communicate with the one of the physical device or the intervening device via the secured PTP or P2P connection, and
the second authenticating and/or authorizing of the identity corresponding to the physical device includes authenticating and/or authorizing an identity of the one of the physical device or the intervening device to communicate with the instantiated MEEE via the secured PTP or P2P connection.
8. The method of claim 7 , wherein the secured PTP or P2P connection is a secured P2P connection.
9. The method of claim 1 , wherein the instantiated MEEE is included in a plurality of instantiated MEEEs of the process control or automation system, the physical device is included in a plurality of physical devices; and the method further comprises:
respectively authenticating and/or authorizing a respective identity of each instantiated MEEE of the plurality of instantiated MEEEs to communicate with at least one of: a respective physical device, a respective intervening device communicatively disposed between the respective physical device and the respective instantiated MEEE, or a respective other instantiated MEEE; and
respectively authenticating and/or authorizing, to communicate with a corresponding instantiated MEEE, an identity of each physical device of the plurality of physical devices or an identity of a corresponding intervening device corresponding to the each physical device.
10. The method of claim 9 , wherein:
the plurality of instantiated MEEEs includes at least one of: a virtual process controller, a virtual safety controller; a virtual safety logic solver; a virtual I/O card, device, or node; a virtual wireless device; a virtual Ethernet device; a virtual operator workstation; a virtual user interface device; a virtual tool; a virtual gateway; a virtual electronic marshalling cabinet or system; a virtualization of another type of physical device or component disposed within a physical environment of an industrial process plant; a control service; a service providing a subsystem of the process control or automation system; or a service providing business logic of the process control or automation system; and
the business logic of the process control or automation system includes at least one of: a monitoring application or service, an operational application or service, a diagnostic application or service, a dashboard application or service, a user interface application or service, an analytics application or service, a safety routine application or service, a reporting application or service, a historization application or service, a configuration application or service, a simulation application or service, a process control resource and/or resource management service, an automation resource and/or resource management service, an external communications application or service, an alarm application or service, a licensing application or service, or a third-party application or service.
11. The method of claim 1 , wherein:
the first authenticating and/or authorizing of the identity of the instantiated MEEE includes authenticating and/or authorizing the identity of the instantiated MEEE to at least one of send or receive communications with a first set of nodes of the process control or automation system and not authorizing the identity of the instantiated MEEE to at least one of send or receive communications with a second set of nodes of the process control or automation system;
the first set of nodes includes the physical device or an intervening node communicatively disposed between the instantiated MEEE and the physical device; and
the second set of nodes includes at least one of another instantiated MEEE or another physical device.
12. The method of claim 1 , wherein:
the second authenticating and/or authorizing of the identity corresponding to the physical device includes authenticating and/or authorizing the identity corresponding to the physical device to at least one of send or receive communications with a first set of nodes of the process control or automation system and not authorizing the identity corresponding to the physical device to at least one of send or receive communications with a second set of nodes of the process control or automation system;
the first set of nodes includes the instantiated MEEE; and
the second set of nodes includes at least one other instantiated MEEE.
13. The method of claim 1 , wherein:
the physical device is a field device configured to perform a physical function responsive to a control signal generated by the instantiated MEEE or by another instantiated MEEE; and
the instantiated MEEE is a virtual process controller or a virtual safety controller that (i) operates on received data to generate a control signal to which the physical device is operably responsive, or (ii) operates on the information received from the physical device to thereby generate a control signal to which the physical device or another physical device is operably responsive.
14. The method of claim 1 , further comprising discovering, by the process control and automation system, the identity of the instantiated MEEE and the identity corresponding to the physical device.
15. The method of claim 1 , wherein the first authenticating and/or authorizing of the identity of the instantiated MEEE is based on a first certificate, and the second authenticating and/or authorizing of the identity corresponding to the physical device is based on a second certificate.
16. The method of claim 1 , further comprising digitally signing and encrypting the information delivered between the instantiated MEEE and the physical device.
17. A method performed by a process control or automation system, the method comprising:
first authenticating and/or authorizing, by the process control or automation system, an identity of an instantiated micro-encapsulated execution environment (MEEE) to communicate, via one of a secured point-to-point (PTP or P2P) connection or at least one of another secured PTP or P2P connection, a secured point-to-multipoint (PTM) connection, or a secured multipoint-to-multipoint (MTM) connection, with a physical device that performs a physical function utilized in control of an industrial or automation process provided by an enterprise;
second authenticating and/or authorizing, by the process control or automation system, an identity corresponding to the physical device or to an intervening device communicatively disposed between the instantiated MEEE and the physical device to communicate with the instantiated MEEE via the other one of the secured PTP or P2P connection or the at least one of the another secured PTP or P2P connection, the secured PTM connection, or the secured MTM connection; when both the identity corresponding to the physical device and the identity of the instantiated MEEE are authenticated and/or authorized, granting permission for the instantiated MEEE and the physical device to communicatively connect to thereby deliver information between the instantiated MEEE and the physical device for controlling at least a portion of the industrial or automation process; and
based on the granted permission, communicatively connecting the physical device and the instantiated MEEE via the secured PTP or P2P connection and the at least one of the another secured PTP or P2P connection, the secured point-to-multipoint (PTM) connection, or the secured multipoint-to-multipoint (MTM) connection.
18. A method performed by a process control or automation system, the method comprising:
first authenticating and/or authorizing, by the process control or automation system, an identity of an instantiated micro-encapsulated execution environment (MEEE) to communicate, via a first virtual private network (VPN) of a plurality of VPNs, with a physical device that performs a physical function utilized in control of an industrial or automation process provided by an enterprise;
second authenticating and/or authorizing, by the process control or automation system, an identity corresponding to the physical device to communicate with the instantiated MEEE via the first VPN or a second VPN of the plurality of VPNs;
when both the identity corresponding to the physical device and the identity of the instantiated MEEE are authenticated and/or authorized, granting permission for the instantiated MEEE and the physical device to communicatively connect to thereby deliver information between the instantiated MEEE and the physical device for controlling at least a portion of the industrial or automation process; and
based on the granted permission, communicatively connecting the instantiated MEEE and the physical device via the plurality of VPNs.
19. A method performed by a process control or automation system, the method comprising:
first authenticating and/or authorizing, by the process control or automation system, an identity of an instantiated micro-encapsulated execution environment (MEEE) to communicate with a physical device that performs a physical function utilized in control of an industrial or automation process provided by an enterprise, the instantiated MEEE included in a plurality of instantiated MEEEs, and the plurality of instantiated MEEEs including a packet router or switch service;
second authenticating and/or authorizing, by the process control or automation system, an identity corresponding to the physical device to communicate with the instantiated MEEE; and
when both the identity corresponding to the physical device and the identity of the instantiated MEEE are authenticated and/or authorized, granting permission for the instantiated MEEE and the physical device to communicatively connect to thereby deliver information between the instantiated MEEE and the physical device for controlling at least a portion of the industrial or automation process.
20. A method performed by a process control or automation system, the method comprising:
first authenticating and/or authorizing, by the process control or automation system, an identity of an instantiated micro-encapsulated execution environment (MEEE) to communicate with a physical device that performs a physical function utilized in control of an industrial or automation process provided by an enterprise, the instantiated MEEE included in a plurality of instantiated MEEEs, and the plurality of instantiated MEEEs including at least one of: a software defined compute service, a software defined storage service, or a software defined networking service;
second authenticating and/or authorizing, by the process control or automation system, an identity corresponding to the physical device to communicate with the instantiated MEEE; and
when both the identity corresponding to the physical device and the identity of the instantiated MEEE are authenticated and/or authorized, granting permission for the instantiated MEEE and the physical device to communicatively connect to thereby deliver information between the instantiated MEEE and the physical device for controlling at least a portion of the industrial or automation process.