# US 10,375,049 B2 · System and method for securely changing network configuration settings to multiplexers in an industrial control system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,049 B2 - Document ID: US10375049B2 - Status: Granted - Kind: B2 - Application number: 15/609,202 - Filed: 2017-05-31 - Published: 2017-12-07 - Granted: 2019-08-06 - Earliest claimed: 2016-06-02 - Assignees: Hubbell Incorporated - Applicants: Hubbell Incorporated - Inventors: Michael David Kramarczyk - Web page: https://patentgrep.com/patent/US10375049B2 ## CPC - G05B 19/058: {Safety, monitoring} - G05B 19/05: Programmable logic controllers, e.g. simulating logic interconnections of signals according to ladder diagrams or function charts - H04J 3/14: Monitoring arrangements {(for SDH/SONET rings H04J3/085)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 67/125: involving control of end-device applications over a network - H04L 63/1433: {Vulnerability analysis} - Y04S 40/00: Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them - Y04S 40/18: Network protocols supporting networked applications, e.g. including control of end-device applications over a network - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - H04J: MULTIPLEX COMMUNICATION (transmission in general H04B; peculiar to transmission of digital information H04L5/00; systems for the simultaneous or sequential transmission of more than one television signal H04N7/08; in exchanges H04Q11/00; stereophonic systems H04S) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract A secure control system includes a network of multiplexers that control end/field devices of an infrastructure system, such as an electric power grid. The multiplexers have a default secure lockdown state that prevents remote access to data on the multiplexers and prevents modification of software or firmware of the multiplexer. One or more of the multiplexers include a physical authentication device that confirms the physical proximity of a trusted individual when remote access is requested. A user accesses the network and one of the multiplexers remotely by way of login credentials. The trusted individual confirms the identity of the remote user and operates the physical authentication device connected with and in proximity to that multiplexer, thereby confirming that the remote user can be trusted to access data and reconfigure the multiplexers. The multiplexer connected with the physical authentication device generates a token that is passed to each of the multiplexers that the remote user needs access to. The token may specify a time period, after which, the multiplexers will reenter secure lockdown mode. ## Claims ### Claim 1 An industrial control system comprising: a plurality of interconnected multiplexers forming a network, each multiplexer having a default secure lock-down mode for preventing any change to settings of the multiplexer; a physical authentication device for indicating a physical presence of a person proximate to a control multiplexer, the control multiplexer being one of the plurality of multiplexers; a network management computer connected to the network and adapted to communicate with the multiplexers, the network management computer running a network management application having a first user authentication module for authenticating a user; and a token generator adapted to generate a token for instructing at least one selected multiplexer to exit the secure lock-down mode to allow the user to make a change to the setting of the at least one selected multiplexer. ### Claim 2 (depends on 1) The control system of claim 1, wherein the multiplexers are remotely located from one another. ### Claim 3 (depends on 1) The control system of claim 1, wherein one or more of the multiplexers communicate with or control an industrial field device. ### Claim 4 (depends on 1) The control system of claim 1, wherein the physical authentication device comprises an identification device to identify the person as a trusted individual. ### Claim 5 (depends on 4) The control system of claim 4, wherein the identification device comprises a biometric sensor. ### Claim 6 (depends on 5) The control system of claim 5, wherein the biometric sensor is one or more of a fingerprint sensor, a retina pattern sensor, an iris pattern sensor, a vein pattern sensor, a hand geometry sensor, an earlobe geometry sensor, a voice pattern analyzer, a DNA analyzer, a handwriting analyzer, a signature analyzer, and a facial recognition sensor. ### Claim 7 (depends on 4) The control system of claim 4, wherein the physical authentication device comprises one or more of a Universal Serial Bus (USB) key fob type device, a serial port device, a parallel port device, and a proprietary cable. ### Claim 8 (depends on 1) The control system of claim 1, wherein the user is remote from the network of multiplexers and communicates via a user computer connected to a communication network. ### Claim 9 (depends on 1) The control system of claim 1, wherein the token is encrypted. ### Claim 10 (depends on 1) The control system of claim 1, wherein the token comprises a time limit instructing the selected multiplexer to reenter secure lockdown mode after a first predetermined period of time. ### Claim 11 (depends on 1) The control system of claim 1, wherein each multiplexer further comprises a default timer, the default timer controlling the multiplexer to reenter secure lockdown mode after a second predetermined period of time. ### Claim 12 A method of operating an industrial control system comprising the steps of: providing a plurality of interconnected multiplexers forming a network, each multiplexer having a default secure lock-down mode for preventing any change to settings of the multiplexer; providing a physical authentication device for indicating a physical presence of a person proximate to a control multiplexer, the control multiplexer being one of the plurality of multiplexers; providing a network management computer connected to the network and adapted to communicate with the multiplexers, the network management computer running a network management application having a first user authentication module for authenticating a remote user; providing a token generator adapted to generate a token for instructing at least one selected multiplexer to exit the secure lock-down mode to allow the user to make a change to the setting of the at least one selected multiplexer; contacting the network management computer via a communication network by the remote user; operating the first authentication device to authenticate the remote user, wherein the remote user logs onto the network; establishing communication between the remote user and the person proximate to the control multiplexer, wherein the person confirms the identity of the remote user as a trusted individual; operating the physical authentication device by the person; generating the token; and communicating the token to the selected multiplexers of the network, wherein the selected multiplexers exit secure lockdown mode. ### Claim 13 (depends on 12) The method of claim 12, wherein the token comprises a time limit instructing the selected multiplexer to reenter secure lockdown mode after a first predetermined period of time and further comprising the step of reestablishing secure lockdown mode of the selected multiplexers at the expiry of the first predetermined period of time. ### Claim 14 (depends on 12) The method of claim 12, wherein each multiplexer further comprises a default timer, the default timer controlling the multiplexer to reenter secure lockdown mode after a second predetermined period of time and further comprising the step of reestablishing secure lockdown mode of the selected multiplexers at the expiry of the second predetermined period of time.