US 9,191,203 B2Granted

Secure industrial control system

AssigneeBedrock Automation Platforms Inc.

InventorsAlbert Rooyakkers, James G. Calvin, Samuel Galpin, Timothy Clish

Life of this patent

Estimating the term…

Loading patent…

Abstract

A secure industrial control system is disclosed herein. The industrial control system includes a plurality of industrial elements (e.g., modules, cables) which are provisioned during manufacture with their own unique security credentials. A key management entity of the secure industrial control system monitors and manages the security credentials of the industrial elements starting from the time they are manufactured up to and during their implementation within the industrial control system for promoting security of the industrial control system. An authentication process, based upon the security credentials, for authenticating the industrial elements being implemented in the industrial control system is performed for promoting security of the industrial control system. In one or more implementations, all industrial elements of the secure industrial control system are provisioned with the security credentials for providing security at multiple (e.g., all) levels of the system.

Claims17

Dependent claims

A secure industrial control system, comprising:

at least one control module provisioned with a first unique security credential, the at least one control module including a first memory device and a first processor coupled to the second first memory device;
and
at least one input/output module provisioned with a second unique security credential, the at least one input/output module including a second memory device and a second processor coupled to the second memory device, the at least one input/output module being operable to receive industrial sensor information or send control information to an industrial actuator or motor,
wherein the at least one control module and the at least one input/output module are operable to bi-directionally communicate with one another based on the first and second unique security credentials,
wherein the at least one control module and the at least one input/output module are configured to receive the first and second unique security credentials at respective points of manufacture from a key management entity, the first and second unique security credentials being stored in respective ones of the first and second memory devices,
wherein the first processor is configured to implement a modification, authentication or revocation of the first unique security credential in response to a first communication received from the key management entity while the at least one control module is operated at a site different from the respective point of manufacture of the at least one control module and is configured to implement an authentication or revocation of the first unique security credential in response to a second communication received from a second control module, and
wherein the second processor is configured to implement a modification, authentication or revocation of the second unique security credential in response to a second third communication received from the key management entity or from the at least one control module while the at least one input/output module is operated at a site different from the respective point of manufacture of the at least one input/output module, is configured to implement an authentication or revocation of the second unique security credential in response to a fourth communication received from the at least one control module, and is configured to implement an authentication or revocation of the second unique security credential in response to a fifth communication received from a second input/output module.

4 more elements

A secure industrial control system, comprising:

an input/output module provisioned with a first unique security credential, the input/output module including a first memory device and a first processor coupled to the first memory device, the input/output module being operable to receive industrial sensor information or send control information to an industrial actuator or motor;
a control module provisioned with a second unique security credential, the control module including a second memory device and a second processor coupled to the second memory device, the control module being configured to monitor and control the input/output module and further configured to connect the input/output module to at least a second input/output module that is also monitored and controlled by the control module;
and
a backplane including a communications link that physically and communicatively couples the control module and the input/output module,
wherein the control module and the input/output module are configured to receive the first and second unique security credentials at respective points of manufacture from a key management entity, the first and second unique security credentials being stored in respective ones of the first and second memory devices, and
wherein the input/output module is configured to receive a modification, authentication or revocation of the first unique security credential from the key management entity, is configured to receive an authentication or revocation of the first unique security credential from the control module, and is configured to receive an authentication or revocation of the first unique security credential from the second input/output module.

3 more elements

A secure industrial control system, comprising:

an input/output module provisioned with a first unique security credential, the input/output module including a first memory device and a first processor coupled to the first memory device, the input/output module being operable to receive industrial sensor information or send control information to an industrial actuator or motor;
a control module provisioned with a second unique security credential, the control module including a second memory device and a second processor coupled to the second memory device, the control module being configured to monitor and control the input/output module and further configured to connect the input/output module to at least a second input/output module that is also monitored and controlled by the control module;
a power module provisioned with a third unique security credential, the power module including a third memory device and a third processor coupled to the third memory device, the power module being configured to supply power for at least one of the input/output module or the control module;
and
a backplane including a communications link that physically and communicatively couples the control module, the input/output module, and the power module,
wherein the control module, the input/output module, and the power module are configured to receive the first, second, and third unique security credentials at respective points of manufacture from a key management entity, the first, second, and third unique security credentials being stored in respective ones of the first, second, and third memory devices, and
wherein the input/output module is configured to receive a modification, authentication or revocation of the first unique security credential from the key management entity, is configured to receive an authentication or revocation of the first unique security credential from the control module, and is configured to receive an authentication or revocation of the first unique security credential from the second input/output module.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/469,931Filed 27 Aug 2014 · continuation
Priority: 6 Aug 2013
Published: US 2015/0046701 A112 Feb 2015
Granted: 17 Nov 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/44
Authentication, i.e. establishing the identity or authorisation of security principals: program or device authentication
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 9/083
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…:…
H04L 9/3263
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…