Authentication between industrial elements in an industrial control system

A secure industrial control system, comprising:

• one or more industrial elements, the one or more industrial elements including at least one input/output module configured to be communicatively coupled to a field device;
• and
• a set of redundant communications/control modules that drive the one or more industrial elements, each of the redundant communications/control modules including at least one respective processor coupled to a respective non-transitory medium that stores instructions executable by the at least one respective processor;
• the set of redundant communications/control modules including a first communications/control module and a second communications/control module, the first and second communications/control modules both being communicatively coupled with the at least one input/output module and configured to monitor and control the at least one input/output module, the first and second communications/control modules configured to perform an authentication sequence where the first communications/control module queries authentication of the second communications/control module and the second communications/control module queries authentication of the first communications/control module, at least one of the first or second communications/control modules being further configured to be at least one of partially disabled, completely disabled, or restricted from communicating to other devices when the first and second communications/control modules fail to authenticate one another,
• wherein the authentication sequence includes at least:
• transmitting a request datagram from the first communications/control module to the second communications/control module, the request datagram including a first nonce, a first device authentication key certificate, and a first identity attribute certificate;
• transmitting a response datagram from the second communications/control module to the first communications/control module, the response datagram including a second nonce, a first signature associated with the first and second nonces, a second device authentication key certificate, and a second identity attribute certificate;
• and
• transmitting a failed authentication datagram from the first communications/control module to the second communications/control module when the response datagram is invalid, the failed authentication datagram including a signature associated with the second nonce and an error message generated by the first communications/control module.