Access control in modular automation systems

Abstract

Embodiments of the present disclosure relate to methods for managing access control within a modular automation system. The present invention relates to a method for managing access control within a modular automation system comprising at least two automation modules. Each automation module is associated with an operation or a set of operations for performing a specific task. The method comprises: receiving a pattern of a common process comprising at least a sequence of processing steps of the modular automation system, wherein each processing step comprises one or more specific tasks of a specific task of the automation module; generating privilege associations for each processing step based on the pattern using one or more automation modules; and generating access control policies for the automation modules based on the privilege associations.

Description

Technical Field

[0001] The present invention generally relates to access control. The present invention more particularly relates to a method for managing access control within a modular automation system, and an automation security system for a modular automation system. Background Art

[0002] As market pressures increase, companies within the process industries are competing for profitable business while trying to overcome the challenges of fluctuating demand, shortened time to market, and shorter product lifecycles. Modular automation is an emerging technology in process automation industries, such as the chemical and pharmaceutical industries, that promises to address some of these challenges.

[0003] Modular automation provides a manufacturing environment with flexibility, for example, moving from laboratory experiments to production at a lower cost and effort, being able to increase or decrease production based on market demand, and customizing products according to specific customer requirements. The technology that implements modular automation is based on standardized autonomous modules, for example, described as modular type packages (MTPs) that perform specific tasks, such as heaters or distiller. These MTPs can be dynamically combined and reorganized to perform different collaborative operations with minimal engineering effort. Therefore, the different modules in a modular automation system are usually highly heterogeneous and dynamic, with the ability to complete specific tasks autonomously, and only senior engineering personnel are required to combine and reorganize modules to execute complete or holistic production modes. This allows a high degree of module customization and reuse.

[0004] In such dynamic and flexible systems, where communication paths are not predefined and production patterns are constantly changing, it becomes very difficult to detect malicious behavior. At the same time, the attack surface and complexity of the system is increasing, which increases the risk that legitimate modules / devices can be compromised in such systems. A compromised module / device under the control of a malicious actor can cause significant damage, not only financial losses to the plant owner, but also physical losses to people, machines, and the environment. The impact can be direct, for example, opening a valve can make a fuel tank overflow, or turning on a heating device in an empty reactor can cause a fire. The impact can also be indirect, for example, changing the ratio of materials used to produce a drug can make it harmful. Direct causes are usually mitigated by implementing secondary safety measures, while indirect causes can be more difficult to detect and mitigate.

[0005] Therefore, there is a need in industry to apply strict and specific access controls to modules in modular automation systems. Summary of the invention

[0006] The object of the present invention is to overcome at least some of the above problems and to provide an access control strategy within a modular automation system which is at least to some extent improved compared to prior art solutions. This object and other objects which will become apparent hereinafter are achieved by means of a method for managing access control within a modular automation system and an automation safety system for a modular automation system.

[0007] According to a first aspect of the invention, there is provided a method for managing access control within a modular automation system, the modular automation system comprising at least two automation modules, wherein each automation module is associated with an operation or a set of operations for performing a specific task, the method comprising:

[0008] - receiving a pattern of a common process comprising at least a sequence of processing steps of a modular automation system, each processing step comprising one or more specific tasks of the specific tasks of an automation module;

[0009] - based on the schema, generating privilege associations for each processing step using one or more automation modules;

[0010] -Generate access control policies for automation modules based on privilege associations.

[0011] Therefore, each automation module is strictly controlled by the associated processing steps, and therefore actions outside the active mode are prohibited. Based on the current access control policy (i.e., privilege rules), only those privileges specified by the processing needs can be granted. In other words, only privileged entities are allowed to access operations or data, and a restricted access control policy is provided. This can reduce the damage caused by malicious actors in the system, because only privileged entities are allowed to access modules / devices / operations or data, i.e., based on privilege associations. In addition, such a restricted access control policy increases the visibility of malicious actors, because rejected access control requests are usually monitored, for example using a security information and event monitoring (SIEM) system.

[0012] By using the processing steps of a modular automation system as the basis for an access control policy to the automation modules, the risk and associated impact of a malicious actor taking over control can be reduced.

[0013] According to at least one example embodiment, an automation module is simply referred to as a module within a modular automation system. Therefore, throughout the entire application text, module and automation module may be used interchangeably. The term "automation" in the automation module means that each module has the ability to complete a specific related task and may be independent of other modules in the automation module system. The automation module may, for example, be a standardized autonomous module, such as described as a modular package MTP. The automation module may include one or more devices, as well as any auxiliary equipment required for the (multiple) devices to perform an operation or a set of operations associated with a specific task of the specific automation module. In other words, each automation module is suitable for performing an operation or a set of operations associated with a corresponding specific task.

[0014] It should be understood that when at least two automation modules are combined together in a modular automation system, they can operate together so that the specific tasks of the automation modules cooperate to provide a common process (or an overall process or an overall sub-process). Such a common process is typically defined or described by various processing steps, wherein each processing step includes one or more specific tasks of the specific tasks of the automation module. The order of such processing steps can be summarized in a pattern (which can be referred to as a workflow description, protocol or recipe). In other words, the execution of the workflow in the modular automation system is described by a pattern, and the different processing steps include a set of specific tasks, and one or more modules are configured to perform the set of specific tasks. In addition, as described in more detail below but briefly mentioned here, a common process can be a sub-process and is part of an overall process of the modular automation system, wherein the overall process includes multiple common processes performed by various automation modules according to corresponding patterns. In addition, each automation module can be configured to perform more than one specific task, that is, an associated operation or a set of operations can be used to perform multiple specific tasks.

[0015] According to at least one example embodiment, a privilege association is a privilege generated between each processing step and one or more of the automation modules. In other words, the privilege or right to perform an action or access data is generated by the association between each processing step and one or more of the automation modules required to perform the specific processing step. In addition, by the privilege association based on the processing step, it is impossible to control the automation modules outside the mode. The steps of generating the privilege association and generating the access control policy based on the privilege association can be referred to as automatic generation of the access control policy. Generally, if the mode is updated, the privilege association associated with the updated mode will be updated together with the update of the access control policy.

[0016] According to at least one example embodiment, the privilege associations include specific tasks of automation modules in corresponding processing steps. For example, each privilege association may be established by a specific processing step, an automation module to be used during the processing step, and any associated specific tasks required to complete the processing step. Alternatively, or in other words, the generation of the access control policy includes generating privilege associations between the processing steps and the corresponding automation modules through corresponding (multiple) specific tasks.

[0017] According to at least one example embodiment, an access control policy may be described as a set of rules or directions related to privileges, controlling an access control model.

[0018] According to at least one example embodiment, the modular automation system comprises a central operating unit configured to communicate with each of the automation modules, wherein the method further comprises the following steps:

[0019] - Execute the mode through the central operation unit according to the generated access control policy.

[0020] Thus, an efficient method of controlling the operation of an automated modular system is provided.

[0021] According to at least one example embodiment, access control to the automation module by the central operating unit is restricted by an access control policy.

[0022] According to at least one example embodiment, the central operating unit is an orchestrator.

[0023] According to at least one example embodiment, a modular automation system includes a plurality of interconnected automation modules, or a plurality of interconnected subsets of automation modules (e.g., each subset having at least two automation modules operating in cooperation as described above). Alternatively or additionally, the modular automation system includes a plurality of central operating units (or orchestrators), wherein each central operating unit is configured to execute a specific mode associated with a corresponding automation module according to a generated access control policy. Thus, an automation module can be directed to execute its specific task at any given time.

[0024] Thus, a modular automation system may comprise a plurality of interconnected automation modules, which perform the actual processing at the physical level, and a plurality of central operating units, which direct the automation modules to perform a specific task at any given time. Thus, the actions to be performed are described by patterns. A modular automation system may be operated according to a plurality of patterns. The activity of formulating a pattern may be assigned to integration engineering, typically performed by experts in the specific process described by the pattern. Formulating a pattern does not require direct access to the specific physical functions of the modules. The task of pattern activation is assigned to operations engineering, typically performed by an operator. This task consists of specifying the modules (and possibly the central operating units) in the modular automation system that are actually used for production.

[0025] According to at least one example embodiment, the same automation module is configured to be operated by at least two different modes. According to such an embodiment, each automation module can generally only operate according to one mode at a time.

[0026] According to at least one example embodiment, the access control policy for the automation module is implemented into a policy data unit. According to these embodiments, the method may further comprise the step of accessing the access control policy of the policy data unit and implementing the policy by the central operating unit during the step of the execution mode.

[0027] According to at least one example embodiment, the step of the central operating unit executing the mode comprises applying a least privilege principle in access control for the automation modules.

[0028] Thus, the operation is controlled so that access is only allowed to the specific automation module(s) required when performing a specific process step (ie at a certain point in the pattern). That is, when the access control policy is executed, only the central operating unit is allowed to perform a certain task.

[0029] According to at least one example embodiment, the access control policy is based on attribute-based access control ABAC.

[0030] Therefore, the access control policies and privilege associations are attribute-based, which is very suitable for privileges that connect automation modules with process steps. In other words, the model used for access control is ABAC. As an alternative to attribute-based access control, other types of identifiers can be assigned to process steps and / or automation modules, for example based on roles or access control lists (ACLs).

[0031] According to at least one example embodiment, the method further comprises:

[0032] - assigning to each processing step an attribute of a first type;

[0033] - assigning to each automation module a property of a second type;

[0034] The step of generating a privilege association for each processing step includes assigning privileges to each specific task using first-type attributes and second-type attributes.

[0035] By assigning attributes to items (automation modules and process steps), privilege associations can be easily set based on the attributes. In other words, the right to perform an operation is modeled as an association between attributes of the first type and the second type. For example, the first type association may be a subject association, and the second type association may be an object association.

[0036] According to at least one example embodiment, the principle of least privilege is embodied by utilizing the attributes.

[0037] According to at least one example embodiment, the step of generating a privilege association includes associating the corresponding first type attribute with the second type attribute by performing a specific task required for a specific processing step. Naturally, multiple automation modules and multiple specific tasks can be included to perform the processing steps. In addition, multiple specific tasks can be included in one privilege association.

[0038] According to at least one example embodiment, the method further comprises assigning a policy category to each attribute.

[0039] By assigning each attribute to a specific policy category, a grant of privileges, such as a grant for executing a specific task of a specific automation module (first type attribute) in a specific processing step (second type attribute), can be given only when the attributes are assigned to the same policy category.

[0040] According to at least one example embodiment, the mode is a sequential function chart SFC.

[0041] This provides a well-defined and suitable setting for describing and discretizing various processing steps. For such an embodiment, the automation module typically includes an SFC-based programmable logic controller PLC or another programmable component configured to execute the mode. The PLC or programmable component can be configured to communicate and control other assets within the automation modular system.

[0042] According to at least one example embodiment, the method further comprises the following steps:

[0043] -Deactivate the mode:

[0044] - Removed perk association for disabled modes.

[0045] Thus, granting of privilege associations based on inactive modes is avoided, which further enforces access control policies. According to at least one example embodiment, a previously deactivated mode may be reactivated, thereby requiring execution of a new generation of privilege associations.

[0046] According to at least one example embodiment, the generated access control policy is based on Next Generation Access Control NGAC or Extensible Access Control Markup Language XACML.

[0047] This provides a well-defined and suitable setting for describing and presenting access control policies.Thus, according to at least one example embodiment, the method according to the present invention may be formalized with a SFC model as input and a NGAC diagram with access privilege information as a result output.

[0048] According to at least one example embodiment, automation modules may be rearranged to perform different common processes.

[0049] In other words, at least the step of generating the access control policy may be based on a rearrangeable automation module.

[0050] According to at least one example embodiment, the common process is a first common process and the mode is a first mode, and at least two automation modules are operable according to a second common process corresponding to a second mode different from the first mode, wherein the method further comprises:

[0051] - based on the second mode, using one or more automation modules, generating updated privilege associations for each processing step;

[0052] - Based on the updated privilege associations, generate an updated access control policy for the automation module.

[0053] Thus, the method provides a dynamic and adaptable means for generating and managing access control policies.Note that in the first and second common processes, the specific tasks of each automation module may be the same.

[0054] According to at least one example alternative embodiment, the same generated access control policy is used for the first public process and the second public process. For this example embodiment, since the access control policy is based on the privilege association of each processing step, the order of the processing steps can be changed without changing the access control policy. Therefore, a general method for managing and generating access control is provided.

[0055] According to at least one example embodiment, as described above, each automation module may be a standardized autonomous module, such as an MTP. The MTP may be dynamically combined and reorganized to perform different collaborative operations, ie, different public processes.

[0056] According to at least one example embodiment, each automation module is associated with a respective network path to access or provide access to a central operating unit.Thus, the automation unit may be configured to communicate and collaborate with other network device(s) across the network.

[0057] According to one example embodiment, the method is a method for facilitating automation security of a modular automation system to mitigate unwanted intrusions or attacks from an associated network that may affect an automation module.

[0058] According to at least a second aspect of the present invention, there is provided an automated safety system for a modular automated system comprising at least two automated modules, wherein each automated module is associated with an operation or a set of operations for performing a specific task. The system comprises:

[0059] - means for receiving a pattern of a common process comprising at least a sequence of processing steps of a modular automation system, each processing step comprising one or more of the specific tasks of an automation module;

[0060] A data unit configured to generate a privilege association for each processing step using one or more automation modules based on the pattern, and to generate an access control policy for the automation modules based on the privilege association.

[0061] The effects and features of the second aspect of the present invention are generally similar to those described above in conjunction with the first aspect of the present invention. The embodiments mentioned in relation to the first aspect of the present invention are substantially compatible with the second aspect of the present invention, some of which are illustrated below, but their advantageous effects are not repeated.

[0062] For example, the system further includes

[0063] - a central operating unit configured to communicate with each of the automation modules and to execute the mode;

[0064] - a policy data unit comprising an access control policy, wherein the central operating unit is adapted to execute the mode according to the access control policy.

[0065] According to at least one example embodiment, access control to an automation module is based on attribute-based access control ABAC.

[0066] According to at least one example embodiment, the mode is a sequential function chart SFC, and the central operating unit is configured to execute the SFC, and / or wherein the access control policy is based on Next Generation Access Control NGAC or Extensible Access Control Markup Language XACML.

[0067] According to at least one example embodiment, a system is configured to, in response to deactivation of a mode, remove privilege associations related to the deactivated mode.

[0068] According to at least one example embodiment, the central operating unit is adapted to execute the mode while utilizing the principle of least privilege in access control of the automation modules.

[0069] According to at least one example embodiment, a system is configured for automation modules that can be rearranged to perform different common processes.

[0070] According to at least one example embodiment, the common process is a first common process and the mode is a first mode, and at least two automation modules are operable according to a second common process corresponding to a second mode, the second mode being different from the first mode, and wherein the data unit is adapted to generate, based on the second mode, an updated privilege association for each processing step using one or more automation modules, and to generate an updated access control policy for the automation modules based on the updated privilege associations.

[0071] According to at least one example embodiment, the system is configured to perform a method according to the first aspect of the invention.

[0072] Any reference to standard or non-standard language or policy in this application should be based on the directives in effect on the priority date of this application.Further advantages and features of the present invention are disclosed and discussed in the following description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] These and other aspects of the inventive concept will now be described in more detail with reference to the accompanying drawings showing example embodiments of the inventive concept, in which:

[0074] Figure 1 The access control architecture applicable to the present invention is schematically shown.

[0075] Figure 2 Schematically shows an automated safety system according to an embodiment of the present invention,

[0076] Figure 3 Another embodiment of the present invention is schematically shown.

[0077] Figure 4 A sequential function chart SFC applicable to the present invention is shown.

[0078] Figure 5 is a flowchart describing steps according to an example embodiment of the present invention. DETAILED DESCRIPTION

[0079] In the following description, specific details such as specific components, interfaces, technologies, etc. are set forth for purposes of explanation rather than limitation in order to provide a thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention may be implemented in other embodiments that deviate from these specific details. In other instances, detailed descriptions of known devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary details.

[0080] Figure 1 The access control architecture applicable to the present invention is schematically shown. In addition to generating access control model policies, policy enforcement is also an important feature of the access control architecture. Figure 1 A typical architecture 1000 depicting the entities involved in an access control enforcement architecture is depicted. Figure 1 The architecture 1000 in FIG. 1 includes a principal 1002, an administrator 1004, a policy enforcement point PEP 1006, a policy decision point PDP 1008, a policy information point PIP 1010, and a policy administration point PAP 1012. Figure 1 , policy data 1014 and resource 1016 are shown. Policy data 1014 may be included in a policy data unit as described below, for example, and resource 1016 may be one of the automation modules as also described below.

[0081] In order for the current access control mechanism to work properly, the only way for the subject 1002 to access the resource 1016 is through the policy enforcement point 1006. Therefore, the policy enforcement point 1006 is preferably kept physically close to the resource 1016, usually implemented on a device / unit in the resource 1016. Typically, a privilege request is initiated, for example, by the subject 1002, and thereafter the policy enforcement point 1006 requests the policy decision point 1008 to make a decision that defines whether the request should be granted. In order to answer the request, the policy decision point 1008 queries the policy data 1014 through the policy information point 1010. The policy data 1014 is managed by the administrator 1004 through the policy management point 1012. The actual placement and implementation of these policy interaction points 1006, 1008, 1010, 1012 is known to the skilled person as it affects the functionality and scalability of the access control mechanism. In addition, in Figure 1 In the architecture 1000 of , a prerequisite for secure access control is that the identities of all involved entities can be trusted. Many methods known to those skilled in the art can be used to implement secure authentication of entities, including using x.509 certificates.

[0082] Figure 2 An automation safety system 100 for a modular automation system 200 is schematically shown. Figure 2The modular automation system 200 in the embodiment includes a first automation module 202 and a second automation module 204, wherein each of the first automation module 202 and the second automation module 204 is configured to perform a specific task. Each specific task can be established in turn by an operation or a set of operations performed by one or more devices within the corresponding modules 202, 204. For example, the first automation module 202 can be configured to perform a first specific task. In order to perform the first specific task, the first automation module 202 includes a first device, and the first device is configured to perform a first set of operations to complete the first specific task. Accordingly, the second automation module 204 is configured to perform a second specific task. Each of the first automation module 202 and the second automation module 204 can be configured to perform more than one specific task. The modular automation system 200 is configured to perform a common process, and the first automation module 202 and the second automation module 204 cooperate in the common process. Such a common process usually includes a plurality of processing steps, here a first processing step 302 and a second processing step 304, wherein each of the first processing step 302 and the second processing step 304 includes one or more specific tasks, here respectively a first specific task and a second specific task. At least the sequence of the processing steps 302, 304 can be described in a workflow process pattern 300, here referred to as a sequential function chart SFC. Figure 1 , the first processing step 302 includes a first specific task indicated by a dashed line 402, which is performed by the first automation module 202. However, it should be noted that the first processing step 302 may include more specific tasks, for example, performed by another automation module. Furthermore, the second processing step 304 includes a second specific task indicated by a dashed line 404, which is performed by the second automation module 204. Accordingly, it should be noted that the second processing step 304 may include more specific tasks, for example, performed by another automation module. Figure 1 , the first processing step 302 is performed before the second processing step 304.

[0083] The automation safety system 100 includes a central operation unit 102, which is configured to communicate with each of the first automation module 202 and the second automation module 204. In addition, as previously described, the central operation unit 102 is configured to execute a pattern 300 of a common process of the modular automation system 200, and is therefore configured to execute SFCs. The automation safety system 100 also includes a data unit 104 or a data unit arrangement 104, which is configured to generate privilege associations for each processing step 302, 304 by the automation modules 202, 204 based on the pattern 300, and to generate access control policies (in Figure 3 and Figure 4 104). The data unit 104 or the data unit arrangement 104 typically includes a data policy unit, which includes at least the generated access control policy. The central operation unit 102 is adapted to execute the mode 300 by accessing the automation modules 202, 204 according to the access control policy of the data unit 104. Note that the data unit 104 may include Figure 1 1004, PDP 1008, PIP 1010, and PAP 1012. Alternatively, the automation modules 202, 204 may communicate with the PEP and further verify whether the action requested by the central operation unit 102 falls within the access control policy.

[0084] According to at least one example embodiment, according to the first mode 300, the first processing step 302 and the first specific task 402 are performed before the second processing step 304 and the second specific task 404. Therefore, the first automation module 202 is activated before the second automation module 204. However, according to the second mode, the order of the processing steps 302, 304 can be changed, and the second processing step 304 can be performed before the first processing step 302. For these embodiments, the central operation unit 102 is configured to preferentially execute the first mode, and is configured to execute the second mode. Generally, when a new mode (here, the second mode) is introduced into the system, the access control policy will be automatically updated based on the new mode. For some cases, the same access control policy can be used when executing the first mode and the second mode.

[0085] The number of automation modules and processing steps shown are examples. It should be appreciated that there may be more automation modules in the automation module system, as well as more processing steps (but also possibly fewer). However, all automation modules in the automation module system are members of a common collaboration group, i.e., a group that collaborates to perform a common process, e.g., for producing a product.

[0086] exist Figure 3 In FIG. 1 , another embodiment of the present invention is schematically shown. Figure 3 In FIG. 1 , the access control policy 101 and the modular automation system 201 are described as using an NGAC policy that uses attributes (e.g., ABAC) assigned to different entities. Figure 3 The access control of the automation modules 212, 214, 216, 218 in is based on attribute-based access control, and the access control policy is based on NGAC.

[0087] The following describes an example of a modular automation system 201 for producing a specific product. Figure 3The access control policy 101 of the modular automation system 201. In more detail, the automation module system 210 includes a first automation module 212 (here a reactor), a second automation module 214 (here a distiller), a third automation module 216 (here a filter), and a fourth automation module 218 (here a packaging unit). The common process of the modular automation system 201 or the overall process here can be described according to the following mode:

[0088] 1) The reactor 212 is filled with three different materials in a specific ratio;

[0089] 2) Reactor 212 mixes and heats the mixture and maintains a fixed temperature for a specified amount of time;

[0090] 3) the resulting mixture is distilled by distiller 214;

[0091] 4) The distillate is further purified by filter 216;

[0092] 5) The final product discharged from the filter 216 is packaged into a container by the packaging unit 218.

[0093] The above modes can be operated by the central operation unit 112 with reference to Figure 2 The corresponding method is executed.

[0094] like Figure 4 As shown, you can use SFC and reference Figure 3 The above patterns are described by the automation modules in the SFC. SFC usually consists of process steps and transitions. Each process step in the pattern describes (multiple) specific tasks or operations to be performed in that particular process step. In addition, each process step contains zero or more outward-directed transitions. Figure 4 An arc is shown in the figure as describing the condition for continuing to the next (multiple) processing steps. That is, the arc represents a transition point to one or more subsequent processing steps. In the case of more than one processing step, once the condition annotated on the transition that enables the processing step is met, the following processing steps are executed in parallel. In order to connect parallel executions, two (or more) edges point to the same processing step. In this case of connection, the conditions of all edges pointing to the same processing step must be met to trigger the step. It should be noted that an SFC can contain loops ( Figure 4 not shown).

[0095] The SFC starts with a simple startup operation in which no operation is active. Subsequently, the reactor 212 is filled according to the first process step in the above-mentioned mode, represented here by step 312'. Next, when the conditions for filling the reactor are met, the reactor 212 mixes and heats the mixture according to the second process step in the above-mentioned mode, represented here by step 314'. Accordingly, when the conditions of step 314' are met, the process continues to empty the reactor 212 and start distillation according to the third process step in the above-mentioned mode, represented here by step 316'. When the distillation is completed (i.e., the conditions of step 316' are met), two subsequent process steps in the above-mentioned mode, i.e., the fourth process step and the fifth process step, can be performed in parallel, represented here by step 318' (filtration) and step 320' (packaging), respectively. In more detail, in step 318', the filter 216 filters the distillate from step 316', and in step 320', the packaging unit 218 packages the final product. Therefore, it should be understood that step 318' and step 320' may be performed in parallel, that is, packaging 320' may begin once a sufficient number of end products are available. The SFC ends with an end operation, wherein no operations are active.

[0096] Return to Figure 3 Each of the automation modules 212, 214, 216, 218 collected in block 201 is generally assigned a module attribute 230. In more detail, the reactor 212 is assigned a reactor attribute 222, the distiller 214 is assigned a distiller attribute 224, the filter 216 is assigned a filter attribute 226, and the encapsulation unit 218 is assigned an encapsulation unit attribute 228.

[0097] Accordingly, here is the reference Figure 4 Each processing step in the pattern 301 of the depicted processing steps 312', 314', 316', 318', 320' is assigned a processing step attribute. In more detail, the processing step 312' is assigned a first processing step attribute 312, the processing step 314' is assigned a second processing step attribute 314, the processing step 316' is assigned a third processing step attribute 316, the processing step 318' is assigned a fourth processing step attribute 318, and the processing step 320' is assigned a fifth processing step attribute 320. Furthermore, the central operating unit 112 is assigned a central operating unit attribute 114.

[0098] Additionally, the specific tasks or operations of the automation modules 212, 214, 216, 218 performed to perform the process steps 312', 314', 316', 318', 320' are indicated by the dashed lines connecting the process step attributes 312, 314, 316, 318, 320 with the module attributes 222, 224, 226, 228. In more detail, the first process step attribute 312 is connected to the reactor attribute 222 by the specific task of filling 412 the reactor 212, the second process step attribute 314 is connected to the reactor attribute 222 by the specific task of mixing and heating the mixture 414 in the reactor 212, the third process step attribute 316 is connected to the reactor attribute 222 by the specific task of emptying 416 the reactor 412, and is connected to the distiller attribute 224 by the specific task of distilling 418 in the distiller 212, the fourth process step attribute 318 is connected to the distiller attribute 224 by the specific task of emptying 420 the distiller 214, and is connected to the filter attribute 226 by the specific task of filtering 422 through the filter 216, and the fifth process step attribute 320 is connected to the packaging unit attribute 228 by the specific task of packaging 424 of the packaging unit 228 (for example, filling bottles with the final product).

[0099] Each combination of process step attributes, module attributes, and interconnected specific tasks or operations as shown above can be described as a privileged association in the access control policy. For example, a first privileged association of a first process step attribute 312 and a reactor attribute 222 can be included in the access control policy by a specific task of filling 412 the reactor 212. Another example is a second privileged association of a second process step attribute 314 and a reactor attribute 222 by a specific task of mixing and heating a mixture 414 in the reactor 212. Further privileged associations can be described based on each combination of process step attributes, module attributes, and interconnected specific tasks or operations.

[0100] It should be noted that instead of using NGAC, the access control policy may be based on another standard or language, such as the Extensible Access Control Markup Language XACML.

[0101] Now refer to Figure 5 The present invention is described with reference to the flowchart in FIG. The flowchart schematically shows the steps of a method for managing access control in a modular automation system, such as Figure 2 Modular automation system 200 or Figure 3 A modular automation system 201 in FIG. 1 . Thus, the modular automation system comprises at least two automation modules, wherein each automation module is associated with an operation or a set of operations for performing a specific task.

[0102] In step 501, a pattern of a common process comprising at least a sequence of processing steps of a modular automation system is received. The pattern may be, for example Figure 2 Mode 300 or Figure 3 Mode 301 (indicates reference Figure 4 Thus, each processing step includes one or more specific tasks of the automation module 5. Preferably, the mode is a sequential function chart SFC. Step 501 can be implemented in any suitable way, for example, including Figure 2 The data unit 104 or the data unit arrangement 104 is shown in FIG.

[0103] In step 503, a privilege association is generated for each processing step and one or more automation modules based on the pattern. The privilege association can be, for example, as shown in FIG. Figure 3 Generated as described.

[0104] In step 505, an access control policy for the automation module is generated based on the privilege association. The access control policy may be similar to Figure 3 The access control policy 101. Such an access control policy may be included in Figure 1 The policy data 1014 is stored in Figure 2 In the data unit 104 shown in . Therefore, the generated access control policy can be based on the next generation access control NGAC.

[0105] For a system in which the central operating unit is configured to communicate with each of the automation modules (such as ( Figure 2 and Figure 3 In an embodiment of communication between the central operation units 102, 112), the method may include step 507, in which the central operation unit executes the pattern received in step 501 according to the access control policy generated in step 505.

[0106] According to at least one example embodiment, step 507 includes applying the principle of least privilege in access control of the automation modules. In other words, the execution of the common process is controlled so that access is only allowed to the specific automation module attributes (multiple) required to complete a specific task in a specific processing step (i.e., at a certain point in the pattern). That is, when executing the access control policy, the central operating unit is only allowed to perform one specific task at a time according to the pattern. The principle of least privilege can be implemented in the access control policy. Therefore, for Figure 2 and Figure 3 According to the embodiment shown in FIG. 3 , during the execution of the modes 300 , 301 , the central operating units 102 , 112 are operated based on the principle of least privilege in the access control of the automation modules.

[0107] As reference Figure 3As described above, step 503 and / or step 505 may be performed by utilizing attribute-based access control ABAC, and may be performed by Figure 2 Thus, the method may include using a first type of attribute (i.e., a processing step attribute, such as Figure 3 312, 314, 316, 318, 320) in step 502A of assigning each processing step, and using attributes of the second type (i.e., module attributes, such as Figure 3 Step 502B of assigning each automation module the attributes 222, 224, 226, 228 in the first type of attribute. Thus, step 503 may include granting privileges to each specific task having the first type of attribute and the second type of attribute.

[0108] Optionally, Figure 5 The method comprises a step 509 of disabling the mode and a step 511 of removing the privilege association that disables the mode (i.e., the privilege association generated in step 503). Figure 2 and Figure 3 In the embodiment shown in , the central operating units 102 , 112 are configured to remove privilege associations related to the deactivated mode when the mode is deactivated.

[0109] Alternatively, Figure 5 The method in is applied to the automated module system, as in Ref. Figure 2 The method may include a method for executing a first mode of access control, wherein the automation modules may be rearranged to execute different common processes. Thus, the common process may be referred to as a first common process, and the mode may be referred to as a first mode, and at least two automation modules may operate according to a second common process corresponding to a second mode, wherein the second mode is different from the first mode. Thus, the method may include a step 507A of executing the first mode and a step 507B of executing the second mode. For the second mode, steps 501, 503, and 505 are typically repeated to generate an updated access control policy for the second mode. Such an update may be performed by utilizing the data unit 104.

[0110] It should be understood that reference Figure 5 The described method or at least some of its steps can be implemented in one or more control units, such as, for example, the data unit 104 , of an automated safety system or a modular automation system.

[0111] The above functions of the entity can be implemented using hardware and software resources known to those skilled in the art, for example, associated hardware resources, such as a processing unit provided in the form of one or more processors, and processing software including a computer program memory (including a computer program code for performing its functions). Alternatively, it can be provided in the form of an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The computer program code can also be provided on one or more data carriers, and when the program code thereon is loaded into the processing entity, the data carrier performs the function of the entity. One of the data carriers with the computer program code is a CD-ROM disc. Alternatively, such a computer program can be provided on a server and downloaded into the processing entity.

[0112] Therefore, although the present invention has been described in conjunction with what are currently considered to be the most practical and preferred embodiments, it should be understood that the present invention is not limited to the disclosed embodiments, but rather, the present invention is intended to cover various modifications and equivalent arrangements. In addition, variations of the disclosed embodiments can be understood and implemented by a skilled person studying and practicing the claimed inventive concepts for the drawings, the present disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the indefinite article "a" or "an" does not exclude pluralities. The fact that certain measures are recited in mutually different dependent claims does not indicate that benefits cannot be obtained by combining these measures.

Claims

1. A method for managing access control within a modular automation system, the modular automation system comprising at least two automation modules, wherein each automation module is associated with an operation or a set of operations for performing a specific task, the method comprising: - receiving a pattern of a common process comprising at least a sequence of processing steps of said modular automation system, each processing step comprising one or more of said specific tasks of said automation modules; - generating, based on the schema, privilege associations for each processing step using one or more automation modules, wherein the privilege associations are privileges generated between each processing step and one or more of the automation modules; - Based on the privilege association, generating an access control policy for the automation module so that only access based on the privilege association is allowed.

2. The method according to claim 1, wherein the modular automation system comprises a central operating unit configured to communicate with each of the automation modules, and wherein the method further comprises the steps of: -According to the generated access control policy, the mode is executed by the central operating unit. 3 . The method of claim 2 , wherein the step of executing the pattern by the central operating unit comprises applying a principle of least privilege in the access control for the automation module.

4. The method according to any one of claims 1-3, wherein the access control policy is based on attribute-based access control (ABAC).

5. The method according to any one of claims 1-3, wherein the pattern is a sequential function chart (SFC).

6. The method according to any one of claims 1 to 3, further comprising the following steps: -deactivate the mode; -Removing the privilege association for the disabled mode.

7. The method according to any one of claims 1-3, wherein the generated access control policy is based on Next Generation Access Control (NGAC) or Extensible Access Control Markup Language (XACML).

8. The method of any one of claims 1-3, wherein the automation modules can be rearranged to perform different common processes.

9. The method of claim 8, wherein the common process is a first common process and the mode is a first mode, and the at least two automation modules are operable according to a second common process corresponding to a second mode, the second mode being different from the first mode, wherein the method further comprises: - based on the second mode, using one or more automation modules, generating updated privilege associations for each processing step; - Based on the updated privilege association, generating an updated access control policy for the automation module.

10. An automated safety system for a modular automated system, the modular automated system comprising at least two automated modules, each automated module being associated with an operation or a set of operations for performing a specific task, the system comprising: - means for receiving a pattern of a common process comprising at least a sequence of processing steps of a modular automation system, each processing step comprising one or more of said specific tasks of said automation module; - A data unit configured to generate a privilege association for each processing step using one or more automation modules based on the pattern, wherein the privilege association is a privilege generated between each processing step and one or more of the automation modules, and based on the privilege association, generate an access control policy for the automation module so that only access based on the privilege association is allowed.

11. The system according to claim 10, further comprising: - a central operating unit configured to communicate with each of said automation modules and to execute said mode; - a policy data unit comprising said access control policy, wherein said central operation unit is adapted to execute said mode according to the access control policy.

12. The system according to any one of claims 10 to 11, wherein the access control to the automation module is based on attribute-based access control (ABAC).

13. A system according to any one of claims 10 to 11, wherein the pattern is a sequential function chart (SFC), and the central operation unit is configured to execute the sequential function chart (SFC), and / or wherein the access control policy is based on Next Generation Access Control (NGAC) or Extensible Access Control Markup Language (XACML).

14. The system of any one of claims 10 to 11, wherein the system is configured to, in response to deactivation of a mode, remove the privilege association associated with the deactivated mode.

15. The system according to any one of claims 10 to 11, wherein the common process is a first common process and the mode is a first mode, and the at least two automation modules are capable of operating according to a second common process corresponding to a second mode, the second mode being different from the first mode, and wherein the data unit is suitable for generating an updated privilege association for each processing step based on the second mode using one or more automation modules, and generating an updated access control policy for the automation module based on the updated privilege association.

16. The system according to any one of claims 10 to 11, wherein the system is configured to perform the method according to any one of claims 1 to 9.

Images