# US 10,484,388 B2 · Span of responsibility access control system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,388 B2
- Document ID: US10484388B2
- Status: Granted
- Kind: B2
- Application number: 15/239,704
- Filed: 2016-08-17
- Published: 2017-04-13
- Granted: 2019-11-19
- Earliest claimed: 2015-10-11
- Assignees: Computational Systems, Inc.
- Applicants: Computational Systems, Inc.
- Inventors: Christopher G. Hilemon; Anthony J. Hayzen; Trevor D. Schleiss; Manikandan Janardhanan
- Web page: https://patentgrep.com/patent/US10484388B2

## CPC

- H04L 63/102: {Entity profiles}
- H04L 63/101: {Access control lists [ACL]}
- G05B 2219/24159: Several levels of security, passwords
- G05B 2219/24167: Encryption, password, user access privileges
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)

## Abstract

A span of responsibility access control system for use in plant process management and similar applications. The system leverages span-of-responsibility enabled user accounts and corresponding resource properties to assign, verify, and control access to assets and other resources in the plant process management system on a per user basis. Aspects of the system include configuration of properties for each monitored or controlled asset and association of a span of responsibility based on asset properties, such as asset type and location, with a user account. An access control module compares asset properties to the span of responsibility associated with the user account to determine whether the user is entitled to access any given asset, independent of determining permissions to act on such asset.

## Claims

### Claim 1

A system for controlling views of resources of a plant control environment, the system comprising:
user accounts for users of the plant control environment, each user account having associated credentials, permissions, and user-selected spans of responsibility corresponding to a user;
a plant hierarchy comprising an organized arrangement of location resources and asset resources, each asset resource linked to at least one location resource;
a user authentication module determining an identity of a user based on the credentials supplied by the user and controlling the identified user's ability to perform actions against the resources of the plant control environment based on the identified user's permissions; and
an access control module controlling the identified user's views of the resources of the plant control environment based on the identified user's selected span of responsibility, wherein each span of responsibility comprises at least one of a location component, an asset component, and an add-on component.

### Claim 2 (depends on 1)

The system of claim 1 wherein each asset resource includes an asset type property specifying a group of assets to which the asset resource belongs.

### Claim 3 (depends on 2)

The system of claim 2 wherein the span of responsibility comprises an asset type property, the asset resource falling within the span of responsibility of the identified user when the asset type property of the asset matches the asset type property of the span of responsibility.

### Claim 4 (depends on 2)

The system of claim 2 wherein the span of responsibility comprises an asset type property and a location property, the asset resource falling within the span of responsibility of the identified user when the asset type property of the asset matches the asset type property of the span of responsibility and the location property of the asset matches the location property of the span of responsibility.

### Claim 5 (depends on 2)

The system of claim 2 wherein the span of responsibility comprises an asset type property, a location property, and an add-on type property, the asset resource falling within the span of responsibility of the identified user when the location property of the asset matches the location property of the span of responsibility and one of the asset type property and the add-on type property of the asset matches the corresponding property of the span of responsibility.

### Claim 6 (depends on 1)

The system of claim 1 wherein the plant control environment includes at least one location and at least one asset associated with each location, the span of responsibility having an asset component defining at least one of the assets and asset types to which the identified user has access and a location component defining the locations within the plant control environment to which the identified user has access.

### Claim 7

A method of limiting views of resources of a plant control environment in a process plant management system, the method comprising the acts of:
identifying a user of the process plant management system;
retrieving permissions associated with the identified user;
determining the identified user's ability to perform actions against resources of the plant control environment based on the identified user's permissions;
retrieving a user-selected span of responsibility associated with the identified user;
determining resources managed by the process plant management system that fall within the span of responsibility of the identified user based on properties of the resources; and
presenting the resources within the span of responsibility of the identified user via an output device, wherein each span of responsibility comprises at least one of a location component, an asset component, and an add-on component.

### Claim 8 (depends on 7)

The method of claim 7 further comprising the acts of:
receiving a request from the identified user to access a selected resource managed by the process plant management system;
determining that the selected resource is accessible to the user based on the identified user's span of responsibility; and
when the selected resource is accessible to the identified user, determining actions performable by the identified user against the selected resource based on the permissions granted to the identified user.

### Claim 9 (depends on 7)

The method of claim 7 wherein the act of presenting the resources within the span of responsibility of the identified user via an output device further comprises the act of presenting only the resources within the span of responsibility of the identified user via the output device.

### Claim 10 (depends on 9)

The method of claim 9 further comprising the acts of:
receiving a request from the identified user to access a selected resource managed by the process plant management system and accessible to the identified user; and
determining actions performable by the identified user against the selected resource based on the permissions granted to the identified user.

### Claim 11 (depends on 7)

The method of claim 7 wherein the act of presenting the resources within the span of responsibility of the identified user to via an output device further comprises the act of presenting the resources of a plant hierarchy to the identified user via the output device with only the resources within the span of responsibility of the identified user being accessible to the identified user.

### Claim 12 (depends on 11)

The method of claim 11 further comprising the acts of:
receiving a request from the identified user to access a selected resource managed by the process plant management system and accessible to the identified user; and
determining actions performable by the identified user against the selected resource based on the permissions granted to the identified user.

### Claim 13 (depends on 7)

The method of claim 7 further comprising the act of receiving a request from the identified user to access resources managed by the process plant management system, the acts of determining the resources managed by the process plant management system that fall within the span of responsibility of the identified user based on properties of the resources and presenting the resources within the span of responsibility of the identified user to via an output device occurring in response to receiving the request.