Security services in a software defined control system
AssigneeFisher-Rosemount Systems, Inc.
InventorsAnthony Amaro, Jr., Mark J. Nixon
Life of this patent
Estimating the term…
Abstract
A software defined (SD) process control system (SDCS) includes a control container having contents which are executable during run-time of the process plant to control at least a portion of an industrial process. The SDCS also includes a security service associated with the control container and including contents which define one or more security conditions. The security service executes via a container on a compute node of the SDCS to control access to and/or data flow from the control container based on the contents of the security container.
Claims15
A method for role-based authorization in a software defined process control system (SDCS), the method comprising:
- obtaining, via a security service executing via a container on a compute node within the software defined process control system (SDCS), a request to access another service within the SDCS from a user;
- determining, by the security service, an authorization level of the user based on the request;
- determining, by the security service, whether the user is authorized to access the other service based on the authorization level;
- and
- in response to determining the user is authorized to access the other service, providing, by the security service, the user access to the other service.
A software defined process control system (SDCS) to control an industrial process in a process plant, the SDCS comprising:
- a certificate authority service executing via a container on a compute node of the SDCS to:
- obtain a request for a certificate from a physical or logical asset of the process plant utilized during run-time of the process plant to control at least a portion of the industrial process, the request including identification information for the physical or logical asset;
- verify an identity of the physical or logical asset based on the identification information;
- generate a certificate for the physical or logical asset including a cryptographic public key for the physical or logical asset, an identifier for the certificate authority service, and a digital signature for the certificate authority service to prove that the certificate has been generated by the certificate authority service;
- and
- provide the certificate to the physical or logical asset to be used to authenticate the physical or logical asset when interacting with other services of the SDCS.
A method for authenticating a physical or logical asset of a process plant, the method comprising:
- obtaining, by a security service executing via a container on a compute node within a software defined process control system (SDCS), a request from the physical or logical asset of the process plant to access another service executing via a container on a compute node within the SDCS, the request including a certificate, wherein the physical or logical asset of the process plant is utilized during run-time of the process plant to control at least a portion of the industrial process;
- verifying, by an authentication service executing via a container on a compute node of the SDCS, authenticity of the physical or logical asset based on the certificate;
- and
- providing, by the security service, access to the other service in response to verifying authenticity of the physical or logical asset.
Dependencies are inferred from the claim text.