Method and system for granting access rights to control applications of an industrial automation system

Abstract

The present invention relates to granting access rights to control applications of an industrial automation system. A first control application (113, 123) is provided by a software container that is loaded into a container runtime environment (112, 122) installed on a host operating system (111, 121) and executed there. The first control application is monitored and configured by an application management system (200). Furthermore, the first control application is authenticated by the application management system. A second control application (114, 124) is executed directly on the host operating system (111, 121) and cryptographically authenticated. After successful authentication, data flows (11) from the first and second control applications to a target device (103, 301) and / or a target application are authenticated by means of an at least temporarily valid access key (12) inserted into the data flow.

Description

Technical Field

[0001] The present invention relates to a method for granting access rights to a control application of an industrial automation system and a system suitable for executing the method. Background Art

[0002] Industrial automation systems typically consist of numerous automation devices interconnected via industrial communication networks to control systems, machines, or equipment as part of production or process automation. Due to the strict time constraints in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, Real-Time Ethernet, or Time-Sensitive Networking (TSN) are primarily used for communication between automation devices. In particular, control services or applications can be automatically distributed based on the load of the currently available hosts or virtual machines in the industrial automation system.

[0003] WO 2021 / 104632 A1 relates to a method for recording data packets from a first container within a container cluster. Each container is assigned multiple network interfaces for transmitting data packets. Upon detecting a first connection for transmitting data packets via a first network interface assigned to the first container, an identifier assigned to the first container is inserted into a data stream assigned to the first connection. The inserted identifier can be used to identify the first container for recording data packets.

[0004] An earlier European patent application, with application number 21212849.0, describes a method for providing control applications, wherein each control application is provided via a sequential control component that can be loaded into a sequential control environment formed by a server device and executed therein. Each control application requiring a selected security authorization is assigned a label as a safety-critical control application. For each control application assigned the label as a safety-critical control application, at least one expiration condition for the selected security authorization is defined. The sequential control environment monitors the occurrence of a corresponding sequential condition during execution of the sequential control component of the control application. When the corresponding execution condition occurs, execution of the sequential control component is terminated.

[0005] US 2019 / 182295 A1 discloses a method for granting access rights to a control application. The control application is provided using a software container that is loaded into a container runtime environment installed on a host operating system and executed there. An application management system is used to monitor and configure the control application. After successful authentication via a web proxy, data flow from the control application to a target device or target application is authorized using an access key inserted into the data flow.

[0006] In industrial automation systems, many control applications must authenticate themselves to other systems or system components. Problems often arise with existing (especially older) control applications or those from third-party providers because they don't support the authentication procedures required by the target system. This often means that the control application must painstakingly adapt to the required authentication procedures or even disable authentication altogether. Token-based approaches are also not a solution, as they typically don't identify the component accessing the target system. Summary of the Invention

[0007] The object of the present invention is to create a method for granting access rights to control applications, which method enables access to any target device or target application in an industrial automation system independently of the authentication method supported by the respective control application, and to provide a suitable device for carrying out the method.

[0008] According to the invention, this object is achieved by a method having the features specified in the invention and by a system having the features specified in the invention. Advantageous further developments are specified in the dependent claims.

[0009] According to the present invention, a method for granting access rights to a control application for an industrial automation system begins by providing a first control application via a software container. The software container is loaded into a container runtime environment installed on a host operating system and executed there. An application management system is used to monitor and configure the first control application. Furthermore, the application management system is used to authenticate the first control application. A second control application is executed directly on the host operating system and is cryptographically authenticated. Specifically, neither the first control application nor the second control application has or performs authentication functionality.

[0010] According to the present invention, the software container for the first control application can be migrated from an automation device with a container runtime environment to another automation device with a container runtime environment for execution there, or can be executed simultaneously on multiple automation devices with a container runtime environment. In addition, the application management system records the creation, deletion or change of the software container and registers the software container with the respective execution state of the software container. The creation, deletion or change of the software container includes the allocation or release of resources in the corresponding automation device with a container runtime environment. In this way, the first control applications can be consistently orchestrated by the application management system and authorized with respect to their data flows.

[0011] According to the present invention, after successful authentication, the data flow of the first and second control applications to the target device or target application is authorized using an at least temporarily valid access key inserted into the data flow. Advantageously, the access key is inserted into the respective data flow by an assigned injector component separate from the first and second control applications. The first and second control applications authenticate themselves to their respective assigned injector components. Furthermore, the data flow is preferably authorized only for the first and second control applications, respectively, which are trusted via a trust path and provided by a trust entity.

[0012] In contrast to the methods known from the prior art, in which communication connections are primarily protected by cryptography and can, in principle, be used by any application, the present invention identifies trusted control applications and authorizes access to critical resources on this basis. In particular, the control applications themselves do not need to include or provide authentication functionality.

[0013] Advantageously, the second control application is cryptographically authenticated using a digital signature, a calculated process identifier, or on the operating system side. A root key for authentication can be transferred to the automation device during the commissioning process of the automation device on which the second control application is installed. Such a root key is required on the automation device for successful authentication of the second control application. For example, the root key can be continuously exchanged during operation of the automation device, enabling the present invention to meet stringent security requirements.

[0014] According to another embodiment of the present invention, a first control application and a second control application are installed on an automation device included in a secure subnet assigned to the industrial automation system. In this case, access to the first and second control applications from outside the secure subnet occurs only after authorization by the application management system. This ensures secure interaction between the first and second control applications, particularly with a cloud computing system.

[0015] Furthermore, it can advantageously be provided that the first control application and the second control application authenticate themselves to an injector component associated with the application management system in order to access the cloud computing system outside the secure subnet. After successful authentication, the injector component associated with the application management system inserts an at least temporarily valid access key into the data flow from the first control application and the second control application to the cloud computing system. These access keys are then used to securely and efficiently authorize access to the cloud computing system for the first and second control applications.

[0016] A system according to the present invention is provided for performing the method according to the aforementioned embodiments and includes a plurality of automation devices designed and configured to provide a first control application via a software container that can be loaded into and executed in a container runtime environment installed on a host operating system. Furthermore, selected automation devices are designed and configured to execute a second control application directly on the host operating system and perform cryptographic authentication.

[0017] Furthermore, the system according to the present invention includes an application management system designed and configured to monitor, configure, and authenticate the first control application. Furthermore, the system is designed and configured to authorize, after successful authentication, the data flow from the first and second control applications to the target device or target application, respectively, by inserting an at least temporarily valid access key into the data flow. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present invention will be explained in more detail below using embodiments with reference to the accompanying drawings.

[0019] Figure 1 A system with multiple automation devices, an application management system, and a cloud computing system is shown. DETAILED DESCRIPTION

[0020] The system shown in the figure includes multiple automation devices 101-103, an application management system 200, and a cloud computing system 301. The automation devices 101-103 and the application management system 200 include a secure subnet 100, which is assigned to the industrial automation system. The secure subnet 100 is connected to the cloud computing system 301 via a wide area network 300, which in particular provides a connection to the internet. A firewall system is preferably provided for the secure subnet 100, which can be integrated into the application management system 200, for example. The cloud computing system 301 includes at least one server, which provides IT infrastructure such as storage space, computing power, or application software as a service, particularly for the automation devices 101-103 or the application management system 200.

[0021] Automation devices 101-103 can be, for example, operating and monitoring stations, programmable logic controllers (PLCs), RFID readers, or machine image processing systems. In addition to automation devices 101-103, secure subnet 100 can also include network infrastructure devices such as switches or routers. Network infrastructure devices are particularly useful for connecting programmable logic controllers (PLCs), input / output units (I / O modules), or operating and monitoring stations of industrial automation systems.

[0022] Each programmable logic controller comprises, for example, a communication module, a central unit, and at least one input / output unit. The input / output unit is used to exchange control and measurement variables between the programmable logic controller and the machine or device 110, 120, 130 controlled by the programmable logic controller. The central unit is used, in particular, to determine suitable control variables from the captured measurement variables. In principle, the input / output unit can also be designed as a local peripheral module located remotely from the programmable logic controller.

[0023] Automation devices 101-103 are designed and configured to provide a first control application 113, 123 using a software container. The software container can be loaded into and executed in a container runtime environment 112, 122 installed on a host operating system 111, 121. The first control application 113, 123 can, in particular, implement functions of the automation device, such as control and monitoring functions, or other time-critical services.

[0024] In this embodiment, the first control applications 113, 123 are monitored and configured using an application management system 200. The application management system 200 detects the creation, deletion, or modification of software containers and records the execution status of the respective software containers. The creation, deletion, or modification of software containers, in particular, involves allocating or releasing corresponding resources in the automation devices 101-102 having the container runtime environments 112, 122.

[0025] The application management system 200 also includes an image repository 213 for providing stored images for software containers. Alternatively or additionally, stored images for software containers can be retrieved from a storage and provisioning system (e.g., DockerHub or other container registry) that is read or write accessible to a large number of users.

[0026] In particular, the software container for the first control application 113, 123 can be migrated from an automation device 101, 102 having a container runtime environment 112, 122 to a different automation device 102, 101 having a container runtime environment 122, 112 to execute the software container there, or can be executed simultaneously on multiple automation devices 101-103 having a container runtime environment 112, 122. Preferably, the software container is designed and configured to run in isolation from other software containers or container groups (e.g., container clusters) within the container runtime environment on the corresponding host operating system 111, 121. Advantageously, the software container uses the kernel of the host operating system 111, 121 and other software containers running on the corresponding automation device. In principle, other micro-virtualization concepts such as snapshots can also be used for software containers as an alternative to Docker containers.

[0027] In this embodiment, the container runtime environment is a container engine, which is used to create, delete, or link virtual resources. In addition to software containers, virtual resources also include virtual communication networks and the connections assigned to them. In particular, the container runtime environment can include a Docker engine or Snap Core running on the corresponding automation devices 101-102.

[0028] Furthermore, the automation devices 101-102 are designed and configured to execute and cryptographically authenticate the second control applications 114, 124 directly on the respective host operating systems 111, 121. On the other hand, the first control applications 113, 123 are authenticated using the application management system 200. In particular, each of the first control applications 113, 123 and the second control applications 114, 124 does not have or perform an authentication function.

[0029] The second control applications 114, 124 can be authenticated, for example, using a digital signature, a calculated process identifier, or cryptographically by the operating system itself. In this exemplary embodiment, a root key on the respective automation device 101-102 is required to successfully authenticate the second control applications 114, 124. Preferably, the root key 14 is transferred to the automation devices 101, 102 and stored there in a key repository 115, 125 for authentication during the commissioning process of the respective automation device 101-102, on which at least one second control application 114, 124 is installed. The root key 14 can be transferred to the automation devices 101-102, for example, by the application management system 200. Advantageously, the root key 14 is exchanged continuously during the operation of each automation device 101-102.

[0030] After successful authentication, the data stream 11 from the first and second control applications to the target device 103 or the corresponding target application is authenticated using an at least temporarily valid access key 12 inserted into the data stream 11. The data stream 11 is only authenticated for trusted first and second control applications 113-114, 123-124 provided via a trust path or by a trusted entity, in particular, by the application management system 200. The access key 12 is inserted into the corresponding data stream 11 by an associated injector component 201-202, which is separate from the first and second control applications 113, 123, 114, 124. The first and second control applications 113, 123, 114, 124 are authenticated for the correspondingly assigned injector component 201-202.

[0031] The application management system 200 in this embodiment further includes an injector component 212 and an application management component 211. The injector component 212 ensures that access to the first control applications 113, 123 and the second control applications 114, 124 from outside the secure subnet 100 is possible only after authentication by the application management system 200. To this end, the application management system 200, for example, inserts an access key 32 into an access request to the cloud computing system 301, wherein access to the first control applications 113, 123 and the second control applications 114, 124 is authenticated using the access key 32.

[0032] In particular, the first control application and the second control application authenticate themselves with the injector component 212 of the application management system 200 in order to access the cloud computing system 301 outside the secure subnet 100. Furthermore, after successful authentication, the injector component 212 of the application management system 200 inserts an at least temporarily valid access key 12 into the data flow 11 from the first control application and the second control application to the cloud computing system 301. These access keys 12 are used to authenticate the access of the first control application and the second control application to the cloud computing system 301.

Claims

1. A method for granting access rights to a control application of an industrial automation system, wherein: - providing a first control application (113, 123) by means of a software container, said software container being loaded into a container runtime environment (112, 122) installed on a host operating system (111, 121) and being executed in said container runtime environment, - the software container for the first control application can be migrated from one automation device having a container runtime environment to another automation device having a container runtime environment, in order to execute the software container in the other automation device, and / or the software container can be executed simultaneously on a plurality of automation devices having a container runtime environment, - monitoring and configuring said first control application by means of an application management system (200), - the application management system detects the creation, deletion and / or modification of the software containers and registers the software containers with their respective execution states, wherein the creation, deletion and / or modification of the software containers respectively includes allocating or releasing resources in the corresponding automation device having the container runtime environment, - authenticating the first control application with the aid of the application management system, - executing directly on the host operating system (111, 121) and cryptographically authenticating the second control application (114, 124), - after successful authentication, authenticating the data flow (11) from the first control application and the second control application to the target device (103, 301) and / or the target application by means of an at least temporarily valid access key (12) inserted into the data flow, wherein the access key (12) is inserted into the corresponding data stream (11) by means of an allocated injector component (201, 202, 212) separate from the first control application (113, 123) and the second control application (114, 124), respectively, and wherein the first control application and the second control application are authenticated for the respective allocated injector component.

2. The method according to claim 1, wherein The data flow (11) is only authenticated for a trusted first control application (113, 123) and a trusted second control application (114, 124) provided via a trusted path and / or by a trusted entity (200).

3. The method according to claim 1, wherein The second control application is cryptographically authenticated by means of a digital signature, a calculation process identifier, and / or by the operating system itself.

4. The method according to claim 3, wherein: For authentication during the commissioning process of an automation device (101-102) equipped with the second control application (114, 124), a root key (14) is transferred to the respective automation device, wherein the root key is required on the respective automation device for successful authentication of the second control application.

5. The method according to claim 4, wherein The root keys are respectively exchanged continuously during the operation of the automation device.

6. The method according to claim 1, wherein The first control application and the second control application each do not have and / or do not perform an authentication function.

7. The method according to claim 1, wherein The first control application and the second control application are installed on automation devices (101-102), which include a secure subnet (100) assigned to the industrial automation system, and wherein access to the first control application and the second control application from outside the secure subnet is only possible after authentication by the application management system (200).

8. The method according to claim 7, wherein: In order to access a cloud computing system (301) outside the secure subnet (100), the first control application (113, 123) and the second control application (114, 124) are authenticated to an injector component (212) assigned to the application management system (200), wherein, after successful authentication, the injector component assigned to the application management system inserts an at least temporarily valid access key (12) into the data flow (11) from the first control application and the second control application to the cloud computing system, and wherein access to the cloud computing system by the first control application and the second control application is securely and effectively authorized with the aid of the access key.

9. A system for performing the method according to any one of claims 1 to 8, the system comprising: - a plurality of automation devices (101-102) designed and configured to provide a first control application (113, 123) by means of a software container, said software container being loadable into a container runtime environment (112, 122) installed on a host operating system (111, 121) and being executable in said container runtime environment, wherein The selected automation device is designed and configured to execute directly on the host operating system and cryptographically authenticate a second control application (114, 124), - an application management system (200) designed and configured for monitoring, configuring and authenticating said first control application, wherein the software container for the first control application is respectively portable from one automation device having a container runtime environment to another automation device having a container runtime environment, in order to execute the software container on the other automation device, and / or is simultaneously executable on a plurality of automation devices having a container runtime environment, wherein the application management system is designed and configured to detect the creation, deletion and / or modification of software containers and to register the software containers with their respective execution states, wherein the creation, deletion and / or modification of the software containers respectively includes allocation or release of resources in the corresponding automation device having the container runtime environment, The system is designed and configured to authenticate, after successful authentication, the data stream (11) from the first control application and the second control application to the target device (103, 301) and / or the target application using an at least temporarily valid access key (12) inserted into the data stream.

Images