System and method for dynamic allocation of automation units to automation servers

A method for operating an automation system comprising at least one automation unit and a plurality of automation servers connected to the automation unit via a communication network, the method comprising:

• utilizing, by the plurality of automation servers, a certificate of the at least automation unit to communicate with the at least one automation unit, said certificate being communicated to the plurality of automation servers;
• validating, by the plurality of automation servers, the certificate of the automation unit prior to communication with the automation unit;
• controlling, by the at least one automation unit, an installation part of an industrial technical installation in accordance with communication with a respective automation server of the plurality of automation servers;
• checking, by the plurality of automation servers, a chain of trust of the certificate to validate the certificate and checking and accessing a black list to validate the certificate, the black list being stored at a storage location and a reference to the storage location being contained in the communicated certificate;
• wherein the automation system further comprises a central management unit which is connected to the plurality of automation servers and the automation unit via the communication network, the method further comprising:
• communicating, by the central management unit, a respective chain of trust to the respective automation server to enable communication of the respective automation server with the automation unit;
• one of (i) revoking, by the central management unit, the respective chain of trust from the respective automation server of the plurality of servers to prevent the communication of the respective automation server with the automation unit and (ii) prompting the certificate of the automation unit, which has been valid until the prompting of the certificate occurs, to be entered into the black list;
• and
• communicating, by the central management unit, the respective chain of trust to the respective automation server only when one of (i) the central management unit has previously revoked all chains of trust determined for communication with the automation unit from all other automation servers, (ii) the central management unit has prompted the certificate of the automation unit, which has been valid until the central management unit prompted the certificate, to be entered into the black list and (iii) the certificate of the automation unit is otherwise invalid.