System and method for enhanced control system security
AssigneeGeneral Electric Company
InventorsSusan Jean Brown, Richard William Shaw, Jr., Jeffery Martin Emery
Life of this patent
Estimating the term…
Abstract
A system including a controller having a data repository configured to store a first mapping associating a user to an Application Certificate and a second mapping associating the user to a user privilege. The system further includes an OPC Unified Architecture (UA) server configured to provide server access based on receiving the Application Certificate from an OPC UA client and enforcing the user privilege, in which the user privilege is retrievable based on the first and the second mappings.
Claims20
A system, comprising:
- a controller configured to control a turbine system;
- a data repository configured to store a first mapping data structure that associates an application certificate to a user identity and to store a second mapping data structure that associates the user identity to a user privilege;
- and
- an Object Linking and Embedding for Process Control (OPC) Unified Architecture (UA) server communicatively coupled to the controller, wherein the OPC UA server is configured to:
- receive the application certificate from an OPC UA client;
- determine the user identity of the OPC UA client using the first mapping data structure;
- determine the user privilege granted the OPC UA client using the second mapping data structure;
- and
- provide the OPC UA client access to the controller based on the user privilege to enable the OPC UA client to instruct the controller to perform control actions on the turbine system.
A method comprising:
- creating, using an application certificate management system, a first mapping data structure configured to associate an application certificate to a user identity;
- creating, using the application certificate management system, a second mapping data structure configured to associate the user identity to a user privilege;
- receiving the application certificate from an Object Linking and Embedding for Process Control (OPC) Unified Architecture (UA) client at an OPC UA server in a turbine system;
- verifying, using the OPC UA server, that the application certificate is stored in a trusted store;
- when the application certificate is stored in the trusted store:
- determining, using the OPC UA server, the user identity of the OPC UA client using the first mapping data structure;
- determining, using the OPC UA server, the user privilege granted the OPC UA client using the second mapping data structure;
- and
- enabling, using the OPC UA server, the OPC UA client to perform control actions in the turbine system by providing access to a controller configured to control the turbine system based on the user privilege.
A tangible, non-transitory, computer-readable medium storing a plurality of instructions executable by a processor of a turbine system, the instructions comprising instructions to:
- create a first mapping data structure, wherein the first map is configured to associate a user identity to an application certificate;
- create a second mapping data structure, wherein the second map is configured to associate the user identity to a user privilege;
- receive the application certificate from an Object Linking and Embedding for Process Control (OPC) Unified Architecture (UA) client requesting access to the turbine system;
- determine the user identity of the OPC UA client using the first mapping data structure;
- determine the user privilege granted the OPC UA client using the second mapping data structure;
- and
- enable the OPC UA client to perform control actions in the turbine system via a controller configured to control the turbine system, wherein the OPC UA client is provided access to the controller based on the user privilege granted the OPC UA client.
Dependencies are inferred from the claim text.