# US 11,444,934 B2 · System and method for dynamic allocation of automation units to automation servers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,934 B2
- Document ID: US11444934B2
- Status: Granted
- Kind: B2
- Application number: 17/115,246
- Filed: 2020-12-08
- Published: 2021-06-10
- Granted: 2022-09-13
- Earliest claimed: 2019-12-09
- Assignees: Siemens Aktiengesellschaft
- Applicants: Siemens Aktiengesellschaft
- Inventors: Benjamin Lutz; Anna Palmin
- Web page: https://patentgrep.com/patent/US11444934B2

## CPC

- H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- G05B 19/4185: {characterised by the network communication}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04L 63/126: {the source of the received data}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)

## Abstract

An automation system includes at least one automation unit, multiple automation servers and a central management unit interconnected via a communication network, wherein the automation servers communicate with the automation unit using a pre validated certificate of the automation unit, where in order to validate the certificate, the automation servers check a chain of trust of the respective certificate and, by accessing a black list, the validity thereof, where communication of the respective chain of trust only occurs when corresponding chains of trust are revoked from all other automation servers beforehand, corresponding certificates are entered into the black list or the certificate is otherwise invalid.

## Claims

### Claim 1

A method for operating an automation system comprising at least one automation unit and a plurality of automation servers connected to the automation unit via a communication network, the method comprising:
utilizing, by the plurality of automation servers, a certificate of the at least automation unit to communicate with the at least one automation unit, said certificate being communicated to the plurality of automation servers;
validating, by the plurality of automation servers, the certificate of the automation unit prior to communication with the automation unit;
controlling, by the at least one automation unit, an installation part of an industrial technical installation in accordance with communication with a respective automation server of the plurality of automation servers;
checking, by the plurality of automation servers, a chain of trust of the certificate to validate the certificate and checking and accessing a black list to validate the certificate, the black list being stored at a storage location and a reference to the storage location being contained in the communicated certificate;
wherein the automation system further comprises a central management unit which is connected to the plurality of automation servers and the automation unit via the communication network, the method further comprising:
communicating, by the central management unit, a respective chain of trust to the respective automation server to enable communication of the respective automation server with the automation unit;
one of (i) revoking, by the central management unit, the respective chain of trust from the respective automation server of the plurality of servers to prevent the communication of the respective automation server with the automation unit and (ii) prompting the certificate of the automation unit, which has been valid until the prompting of the certificate occurs, to be entered into the black list; and
communicating, by the central management unit, the respective chain of trust to the respective automation server only when one of (i) the central management unit has previously revoked all chains of trust determined for communication with the automation unit from all other automation servers, (ii) the central management unit has prompted the certificate of the automation unit, which has been valid until the central management unit prompted the certificate, to be entered into the black list and (iii) the certificate of the automation unit is otherwise invalid.

### Claim 2 (depends on 1)

The operating method as claimed in claim 1, wherein the plurality of automation servers ascertain, based on a respective parameterization, whether said plurality of automation servers must communicate with the automation unit to perform an automation task specific to said plurality of automation servers;
and wherein the parameterization of the plurality of automation servers occurs independently of communication and revocation of chains of trust and blocking of certificates.

### Claim 3 (depends on 1)

The operating method as claimed in claim 1,
wherein the respective automation server requests allocation of the automation unit at the central management unit to obtain a respective chain of trust; and wherein the central management unit, based on the request, undertakes revocation of a chain of trust of a certificate of the automation unit communicated to another automation server, or prompts blocking of the certificate of the automation unit communicated to another automation server and undertakes communication of respective chain of trust to the requesting automation server.

### Claim 4 (depends on 2)

The operating method as claimed in claim 2,
wherein the respective automation server requests allocation of the automation unit at the central management unit to obtain a particular chain of trust; and wherein the central management unit, based on the request, undertakes revocation of a chain of trust of a certificate of the automation unit communicated to another automation server, or prompts blocking of the certificate of the automation unit communicated to another automation server and undertakes communication of the particular chain of trust to the requesting automation server.

### Claim 5

An automation system, comprising:
a communication network;
at least one automation unit;
a plurality of automation servers connected to the automation unit via the communication network;
wherein the plurality of automation servers are programmed utilize a certificate of the at least one automation unit to communicate with the at least one automation unit and validate the certificate of the automation unit prior to communication with the automation unit,
said certificate being communicated to the plurality of automation servers;
wherein the at least one automation unit is programmed to control an installation part of an industrial technical installation in accordance with communication with a respective automation server of the plurality of automation servers;
wherein the plurality of automation servers are further programmed to check a chain of trust of the certificate to validate the certificate and check and access a black list to validate the certificate, the black list being stored at a storage location and a reference to the storage location being contained in the communicated certificate;
wherein the automation system additionally comprises a central management unit, which is connected to the automation servers and the automation unit via the communication network;
wherein the central management unit is programmed to communicate a respective chain of trust to the respective automation server to enable communication of the respective automation server with the automation unit;
wherein the central management unit is programmed to one of (i) revoke the respective chain of trust from the respective automation server of the plurality of servers to prevent the communication of the respective automation server with the automation unit and (ii) prompt the certificate of the automation unit, which has been valid until the prompting of the certificate occurs, to be entered into the black list; and wherein the central management unit is programmed to only communicate the respective chain of trust to the respective automation server when one of (i) all chains of trust determined for communication with the automation unit from all other automation servers have been previously revoked, (ii) the certificate of the automation unit has been prompted to be entered into the black list, wherein the certificate has been valid until the certificate has been promoted, and (iii) the certificate of the automation unit is otherwise invalid.

### Claim 6 (depends on 5)

The automation system as claimed in claim 5, wherein the plurality of automation servers are programmed to ascertain, based on a respective parameterization, whether communication with the automation unit must occur in order to perform an automation task specific to said plurality of automation servers; and wherein the parameterization of the plurality of automation servers occurs independently of communication and revocation of chains of trust and blocking of certificates.

### Claim 7 (depends on 6)

The automation system as claimed in claim 6,
wherein the plurality of automation servers are programmed to request allocation of the automation unit at the central management unit to obtain a respective chain of trust; and wherein the central management unit is programmed, based on the request, to undertake revocation of a chain of trust of a certificate of the automation unit communicated to another automation server, or prompt the blocking of a certificate of the automation unit communicated to another automation server and undertake communication of respective chain of trust to the requesting automation server.

### Claim 8 (depends on 6)

The automation system as claimed in claim 6,
wherein the plurality of automation servers are programmed to request allocation of the automation unit at the central management unit to obtain a particular chain of trust; and wherein the central management unit is programmed, based on the request, to undertake revocation of a chain of trust of a certificate of the automation unit communicated to another automation server, or prompt the blocking of a certificate of the automation unit communicated to another automation server and undertake communication of the particular chain of trust to the requesting automation server.