Rapid file authentication on automation devices

A method for preventing execution of malicious code on an industrial device, comprising:

• generating, by an industrial device comprising a processor and configured to communicate over a network, a file authentication code (FAC) that is unique to the industrial device;
• in response to receiving a request for a copy of the FAC from a first client device, sending, by the industrial device, the copy of the FAC to the first client device conditional on a determination that the request is received via at least one of a local data port or a local memory port of the industrial device;
• receiving, by the industrial device, mobile code from the first client device or a second client device;
• in response to the receiving the mobile code and a determination that the mobile code is received via the network;
• generating, by the industrial device, a first hash-based message authentication code (HMAC) based on the FAC and content of the mobile code, and
• in response to determining that a second HMAC received with the mobile code does not correspond to the first HMAC or that the mobile code was received without the second HMAC, preventing, by the industrial device, execution of the mobile code on the industrial device;
• and
• in response to the receiving the mobile code and a determination that the mobile code is received via at least one of the local data port or the local memory port, permitting execution of the mobile code on the industrial device without performing the generating of the first HMAC.

A non-transitory computer-readable medium having stored thereon executable instructions that, in response to execution, cause an industrial device comprising at least one processor to perform operations, the operations comprising:

• generating a file authentication code (FAC) that is specific to the industrial device;
• in response to determining that a request for a copy of the FAC is received from a first client device via at least one of a local data port or a local memory port of the industrial device, sending the copy of the FAC to the first client device;
• receiving mobile code from the first client device or a second client device;
• in response to determining that the mobile code is received via the local data port or the local memory port, enabling execution of the mobile code on the industrial device;
• and
• in response to determining that the mobile code is received via a network port of the industrial device;
• generating a first hash-based message authentication code (HMAC) based on the FAC and content of the mobile code, and
• in response to determining that a second HMAC included with the mobile code is not equal to the first HMAC or that the mobile code was received without the second HMAC, disabling execution of the mobile code on the industrial device.