# US 2018/0322274 A1 · Plant-Specific, Automated Certificate Management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0322274 A1 - Document ID: US20180322274A1 - Status: Published application - Kind: A1 - Application number: 15/972,325 - Filed: 2018-05-07 - Published: 2018-11-08 - Earliest claimed: 2017-05-08 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Benjamin Lutz; Anna Palmin - Web page: https://patentgrep.com/patent/US20180322274A1 ## CPC - G06F 21/44: Program or device authentication - G05B 19/406: characterised by monitoring or safety (G05B19/19 takes precedence) - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G05B 2219/23317: Safe mode, secure program, environment in case of error, intrusion - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for authenticating devices and/or applications, specifically web applications, in a control system for an industrial plant, wherein the control system includes at least one local registration service and at least one software inventory, where the method includes determining by the at least one local registration service information about which communications protocols and/or applications are supported by the devices and/or applications and/or which communications protocols and/or applications are active, during authentication of the devices and/or applications within the control system, and storing the device-specific information determined by the local registration service in the at least one software inventory of the control system. ## Claims ### Claim 1 A method for authenticating at least one of devices and applications web applications in a control system for an industrial plant, wherein the control system includes at least one local registration service and at least one software inventory, the method comprising: a) determining by the at least one local registration service information regarding at least one of (i) which communications protocols and/or applications are supported by the devices and/or the applications and (ii) which communications protocols and/or applications are active, during authentication of at least one of (i) the devices and (ii) the applications within the control system; and b) storing the device-specific information determined by the at least one local registration service in the software inventory of the control system. ### Claim 2 (depends on 1) The method as claimed in claim 1, wherein at least one of (i) the devices and (ii) applications authenticate themselves to the local registration service upon start-up of the industrial plant to register themselves as trustworthy communication participants in the industrial plant. ### Claim 3 (depends on 2) The method as claimed in claim 2, wherein at least one of (i) the devices and (ii) the applications authenticate themselves to the local registration service during runtime of the industrial plant to register themselves as trustworthy communication participants in the industrial plant. ### Claim 4 (depends on 1) The method as claimed in claim 1, wherein information regarding a configuration of at least one of (i) the control system and (ii) the industrial plant operated with the control system is stored in the software inventory. ### Claim 5 (depends on 4) The method as claimed in claim 4, wherein the control system comprises an engineering component from which the information with regard to the configuration of at least one of (i) the control system and (ii) the industrial plant is read out and stored in the software inventory. ### Claim 6 (depends on 1) The method as claimed in claim 1, wherein at least one of (i) the devices and (ii) the applications are authenticated based on operating certificates. ### Claim 7 (depends on 4) The method as claimed in claim 4, wherein the local registration service reads out the information stored in the software inventory to check, during authentication of at least one of (i) the devices and (ii) the applications, which operating certificate is assignable to at least one of (a) respective device and (ii) a respective application; and wherein at least one of (i) the devices and (ii) the applications are authenticated based on operating certificates. ### Claim 8 (depends on 5) The method as claimed in claim 5, wherein the local registration service reads out the information stored in the software inventory to check, during authentication of at least one of (i) the devices and (ii) the applications, which operating certificate is assignable to at least one of (a) respective device and (ii) a respective application; and wherein at least one of (i) the devices and (ii) the applications are authenticated based on operating certificates. ### Claim 9 (depends on 1) The method as claimed in claim 1, wherein the authentication of at least one of (i) the devices and (ii) the applications has a specific period of validity which is stored as device-specific information in the software inventory, wherein, prior to expiration of the specific period of validity of the authentication and independently of a request by at least one of (i) the devices and (ii) the applications, the local registration service of the control system reads out information regarding the period of validity from the software inventory and renews the authentication to extend the period of validity thereof. ### Claim 10 (depends on 1) The method as claimed in claim 1, wherein the applications comprise web applications. ### Claim 11 A control system for an industrial plant, comprising: a processor including memory; and a local registration service configured to authenticate one of (i) devices and (ii) applications by: a) determining information regarding at least one of (i) which communications protocols and/or applications are supported by the devices and/or the applications and (ii) which communications protocols and/or applications are active, during authentication of at least one of (i) the devices and (ii) the applications within the control system; and b) storing the device-specific information determined in a software inventory of the control system ### Claim 12 (depends on 11) The control system as claimed in claim 11, further comprising: at least one software inventory for storing information. ### Claim 13 (depends on 11) The control system as claimed in claim 11, further comprising: at least one process data archive; wherein the software inventory is integrated in the process data archive. ### Claim 14 (depends on 11) The control system as claimed claim 11, further comprising: at least one of (i) at least one engineering component and (ii) at least one operator system; wherein the local registration service is integrated into at least one of the engineering component and the operator system. ### Claim 15 (depends on 12) The control system as claimed claim 12, further comprising: at least one of (i) at least one engineering component and (ii) at least one operator system; wherein the local registration service is integrated into at least one of the engineering component and the operator system. ### Claim 16 (depends on 13) The control system as claimed claim 13, further comprising: at least one of (i) at least one engineering component and (ii) at least one operator system; wherein the local registration service is integrated into at least one of the engineering component and the operator system. ### Claim 17 (depends on 11) The control system as claimed in claim 11, wherein an industrial plant is operated by the control system. ### Claim 18 (depends on 12) The control system as claimed in claim 12, wherein an industrial plant is operated by the control system. ### Claim 19 (depends on 13) The control system as claimed in claim 13, wherein an industrial plant is operated by the control system. ### Claim 20 (depends on 14) The control system as claimed in claim 14, wherein an industrial plant is operated by the control system. ### Claim 21 (depends on 11) The control system as claimed in claim 11, wherein the applications comprise web applications.