Device specific cryptographic content protection

A non-transitory computer-readable medium having stored thereon instructions to facilitate protecting control data used in an industrial automation environment, wherein the instructions, in response to execution, cause a system comprising a processor to perform operations, the operations comprising:

• generating a device-specific encryption key pair for an industrial controller, wherein the device-specific encryption key pair comprises a public key and a private key;
• storing the private key within a secure storage system of the industrial controller;
• encrypting controller program content using the public key to generate encrypted controller content;
• providing the encrypted controller content to the industrial controller, wherein the industrial controller is able to decrypt the encrypted controller content using the private key and execute the controller program content;
• creating new controller program content for the industrial controller;
• encrypting the new controller program content with the public key to generate new encrypted controller content;
• and
• providing the new encrypted controller content to an end user comprising the industrial controller and an additional device, wherein the industrial controller is able to decrypt the new encrypted controller content and the additional device is not able to decrypt the new encrypted controller content.

A system for protecting control data used in an industrial automation environment, the system comprising:

• a memory that stores executable components;
• and
• a processor, operatively coupled to the memory, that executes the executable components, the executable components comprising a content creation component configured to:
• generate a device-specific encryption key pair for an industrial controller, wherein the device-specific encryption key pair comprises a public key and a private key and the private key is stored within a secure storage system of the industrial controller;
• encrypt controller program content using the public key to generate encrypted controller content;
• and
• provide the encrypted controller content to the industrial controller, wherein the industrial controller is able to decrypt the encrypted controller content using the private key and execute the controller program content;
• create new controller program content for the industrial controller;
• encrypt the new controller program content with the public key to generate new encrypted controller content;
• and
• provide the new encrypted controller content to an end user comprising the industrial controller and an additional device, wherein the industrial controller is able to decrypt the new encrypted controller content and the additional device is not able to decrypt the new encrypted controller content.