Method and System for Granting Access Rights to Control Applications of an Industrial Automation System

A method of granting access rights to control applications of an industrial automation system, the method comprising:

• providing first control applications via software containers which are loaded into and executed in a container runtime environment installed on a host operating system, the software containers for the first control applications each being at least one of (i) migratable from one automation device having a container runtime environment to another automation device having a container runtime environment for execution there and (ii) executable simultaneously on a plurality of automation devices having a container runtime environment;
• monitoring and configuring the first control applications via an application management system;
• detecting, by the application management system, at least one of creation, deletion and modification of the software containers, and registering, by the application management system, the software containers with their respective execution status, at least one of the creation, deletion and modification of the software containers each comprising allocating or releasing resources in a respective automation device having a container runtime environment;
• authenticating the first control applications via the application management system;
• executing and cryptographically authenticating second control applications directly on a host operating system;
• and
• authorizing data traffic from at least one of (i) the first and the second control applications to target devices and (ii) target applications following successful authentication in each case via an at least temporarily valid access key inserted into the data traffic.

A system comprising:

• a plurality of automation devices which are configured to provide first control applications via software containers which are loadable into and executable in a container runtime environment installed on a host operating system, selected automation devices being configured to execute and cryptographically authenticate second control applications directly on a host operating system;
• an application management system which is configured to monitor, configure and authenticate the first control applications;
• wherein the software containers for the first control applications are each at least one of (i) migratable from one automation device having a container runtime environment to another automation device having a container runtime environment for execution there and (ii) executable simultaneously on a plurality of automation devices having a container runtime environment;
• wherein the application management system is configured to detect at least one of creation, deletion and modification of the software containers and to register the software containers with their respective execution status, at least one of the creation, deletion and modification of the software containers each comprising allocating or releasing resources in the respective automation device having a container runtime environment;
• wherein the system is configured to authorize data traffic (11) from the first and the second control applications to at least one of (i) target devices and (ii) target applications following successful authentication in each case via an at least temporarily valid access key inserted into the data traffic.