Authentication/authorization framework for a process control or automation system
An architecture supporting a process control or automation system may include an authentication service which determines whether an entity (e.g., a human, automated, virtual, or physical entity) is the party that/who the entity claims to be, and an authorization service which determines whether a request of the entity to access a resource is allowed or denied. The authentication service provides unique identities of entities and respective security credentials, which may include tokens utilized during authorization. The authorization service authorizes an entity to access a requested resource based on role-based permissions of a role to which the entity is assigned and resource access permissions protecting the requested resource. The role-based permissions and/or the resource access permissions may be respectively scoped to limit or restrict actions, activities, operations, and/or resource access based on specified criteria. Each entity may be authenticated, and each request of an authenticated entity may be respectively authorized.
1 . A system for authorizing entities to resources in a process control or automation system, the system comprising:
an authorization database storing indications of a respective set of role permissions for each role of a plurality of roles of the process control or automation system and indications of a respective set of roles for each entity of a plurality of entities of the process control or automation system;
an authorization service of the process control or automation system, the authorization service having read-only permissions for the authorization database and comprising a set of computer-executable instructions stored on one or more computer-readable media that, when executed by one or more processors, cause the system to, based on a request of an entity to access a resource of the process control or automation system:
determine a role of the requesting entity and access the authorization database to determine a set of role permissions of the role of the requesting entity, the requesting entity included in the plurality of entities and the requesting entity being a virtual or logical component of the process control or automation system implemented using an instantiated micro-encapsulated execution environment (MEEE);
grant access of the requesting entity to the resource when the set of role permissions and a set of resource access permissions for the resource are in accordance; and
deny access of the requesting entity to the resource when the set of role permissions and the set of resource access permissions are not in accordance; and
an entity administration service having read and write permissions for the authorization database, the entity administration service invoked by agents of the process control or automation system via a respective application programming interface (API) to at least one of:
define one or more roles included in the plurality of roles;
define respective mappings of the one or more roles to the respective sets of role permissions of the one or more roles;
define respective mappings of one or more entities included in the plurality of entities to the respective sets of roles of the one or more entities; or
define respective scopes of access of the one or more roles to respective one or more resources.
2 . The system of claim 1 , wherein:
the requesting entity is a first requesting entity and the resource is a first resource;
the authorization service causes the system further to:
grant access of a second requesting entity to a second resource requested by the second requesting entity when a set of role permissions of a role of the second requesting entity and a set of resource access permissions for the second resource are in accordance; and
deny access of the second requesting entity to the second resource when the set of role permissions corresponding to the second requesting entity and the set of resource access permissions corresponding to the second resource are not in accordance; and
the second requesting entity is one of: a human user, a physical or virtual device associated with the process control or automation system, a service provided by the process control or automation system, a service provided by a third-party, an application provided by the process control or automation system, an application provided by the third-party, a physical component of the process control or automation system, or another virtual or logical component of the process control or automation system.
3 . The system of claim 2 , wherein at least one of:
the physical or virtual device is a field device, a process control device, or a safety instrumentation device; or
at least one of: the service provided by the process control or automation system, the service provided by the third-party, the application provided by the process control or automation system, the application provided by the third-party, or the another virtual or logical component of the process control or automation system is implemented using a respective MEEE.
4 . The system of claim 1 , wherein the authorization service compares the set of role permissions corresponding to the requesting entity and the set of resource access permissions corresponding to the resource, and grants or denies the access of the requesting entity to the resource based on the comparison.
5 . The system of claim 1 , wherein the resource or a client service via which the resource is accessed compares the set of role permissions corresponding to the requesting entity and the set of resource access permissions corresponding to the resource, and grants or denies the access of the requesting entity to the resource based on the comparison.
6 . The system of claim 1 , wherein the set of resource access permissions for the resource indicate at least one of: (i) a subset, of the plurality of roles, that are the only roles permitted to access the resource, or (ii) a scope of access to the resource.
7 . The system of claim 6 , wherein at least some roles of the plurality of roles are respectively limited to accessing the resource based on a respective one or more scopes of access, the respective one or more scopes of access including at least one of: a piece of equipment, a unit, a physical location, a time of day, a time interval, or another restriction.
8 . The system of claim 6 , wherein:
the authorization service has read-only permissions for the authorization database;
an entity administration service has read and write permissions for the authorization database; and
the entity administration service is invoked by agents of the process control or automation system to define at least one of: a mapping of the resource to the only roles permitted to access the resource, and respective scopes of access, to the resource, of at least some roles of the plurality of roles.
9 . The system of claim 8 , wherein at least one of:
the entity administration service is invoked via a respective application programming interface (API); or
the entity administration service is implemented via a respective micro-encapsulated execution environment (MEEE).
10 . The system of claim 1 , wherein:
the plurality of entities includes two or more of: a human user, a physical or virtual device associated with the process control or automation system, a service provided by the process control or automation system, a service provided by a third-party, an application provided by the process control or automation system, an application provided by the third-party, a physical component of the process control or automation system, a virtual or logical component of the process control or automation system, or another micro-encapsulated execution environment (MEEE); and
the access of the authorization database is further to determine the respective set of roles of the requesting entity, the respective set of roles of the requesting entity including the role of the requesting entity.
11 . The system of claim 1 , wherein the entity administration service is invoked via a respective application programming interface (API) and is implemented via a respective micro-encapsulated execution environment (MEEE).
12 . The system of claim 1 ,
further comprising a session established, by a client service, between the requesting entity and a second service corresponding to the resource and via which the resource is accessed; and
wherein the request of the requesting entity to access the resource is received by the client service, and the authorization service is invoked within the session subsequent to the reception of the request of the requesting entity.
13 . The system of claim 12 , wherein at least one of:
at least one of the client service, the authorization service, or the second service corresponding to the resource is accessed or invoked via a respective application programming interface (API); or
at least one of the client service, the authorization service, or the second service corresponding to the resource is implemented via a respective micro-encapsulated execution environment (MEEE).
14 . The system of claim 13 , wherein:
the client service is accessed by the requesting entity via the respective API of the client service;
the second service corresponding to the resource is accessed by the requesting entity within the session via the respective API of the second service;
the authorization service is invoked within the session via the respective API of the authorization service; and
the authorization service, the client service, and the second service are implemented via respective micro-encapsulated execution environments (MEEEs).
15 . The system of claim 12 , wherein within the session:
the authorization service provides an indication of the set of role permissions for the role of the requesting entity; and
the access of the requesting entity to the resource is granted or denied based on a comparison of the set of role permissions corresponding to the requesting entity and the set of resource access permissions corresponding to the resource.
16 . The system of claim 12 , further comprising an authentication service that authenticates identities of entities to the process control or automation system; and wherein upon the requesting entity initially accessing the client service via a respective application programming interface (API):
the client service invokes the authentication service to authenticate an identity of the requesting entity; and
subsequent to a successful authentication of the requesting entity by the authentication service, the client service establishes the session between the requesting entity and the second service.
17 . The system of claim 16 , wherein:
the authentication service authenticates identities of one or more of: a human user, a physical or virtual device associated with the process control or automation system, a service provided by the process control or automation system, a service provided by a third-party, an application provided by the process control or automation system, an application provided by the third-party, a physical component of the process control or automation system, a virtual or logical component of the process control or automation system, or another micro-encapsulated execution environment (MEEE) to the process control or automation system; and
at least one of: the authentication service is invoked via a respective application programming interface (API), or the authentication service is implemented via a respective MEEE.
18 . The system of claim 16 , wherein:
upon the successful authentication of the identity of the requesting entity, the authentication service generates a token corresponding to the requesting entity and the client service; and
the access of the requesting entity to the resource is granted or denied further based on a validity of the token within the session.
19 . The system of claim 18 , further comprising a token validation service to determine the validity of the token, and at least one of:
the token validation service is invoked via a respective application programming interface (API); or
the token validation service is implemented via a respective micro-encapsulated execution environment (MEEE).
20 . The system of claim 16 , further comprising a multi-tenant identity provider, and wherein:
the authentication service authenticates identities of devices, services, applications, and at least a first portion of a plurality of users of the process control or automation system based on a first tenant of the multi-tenant identity provider; and
the authentication service authenticates identifies of a least a second portion of the plurality of users of the process control or automation system based on a second tenant of the multi-tenant identity provider.