Method and system for providing a control application

Abstract

In order to provide a control application by a process control component, in the case of execution of a control application that requires selected rights, each specification (212, 222) of the required security-critical resources (101-103) is established. In accordance with the specification, additional process control components (132) are each determined, the process control components being provided for providing access to the required security critical resources. Thus, execution of the respective process control component is initiated along with execution of the additional process control component. An interface (130) is configured through the flow control environment for inter-process communication between the respective flow control component and the additional flow control component. Access to the correspondingly required security critical resources is provided through inter-process communication between the respective flow control component and the additional flow control component.

Description

Technical Field

[0001] The present invention relates to a method for providing a control application, in particular a control application for an industrial automation system, and a system for executing the method. Background Art

[0002] Industrial automation systems usually include a variety of automation devices that are interconnected via an industrial communication network and are used for open-loop or closed-loop control of devices, machines and / or equipment within the framework of manufacturing automation or process automation. Due to the time-critical framework conditions in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, Real-Time Ethernet or Time Sensitive Networking (TSN) are mainly used for the purpose of communication between automation devices. In particular, control services or applications can be distributed in an automated and load-dependent manner to currently available servers or virtual machines in the industrial automation system.

[0003] Interruptions in communication connections between computing units of industrial automation systems or automation devices may lead to unnecessary or unwanted repetition of service request transmissions. In addition, untransmitted or incompletely transmitted messages may, for example, prevent an industrial automation system from transitioning to a safe operating state or remaining in a safe operating state.

[0004] WO 2022 / 042905Al relates to a method for providing time-critical services, each of which is assigned to at least one server component, which is formed by a process control component that can be loaded into a process control environment and executed therein. For each server component, a functional unit for processing a communication protocol stack is provided and the functional unit is connected to another functional unit assigned to the process control environment to process the communication protocol stack. The services each include a directory service component for determining the services provided by the process control environment. The directory service components are connected to each other via independent communication interfaces. The aggregator component formed by the additional process control components is connected to the independent communication interface so that the service details provided by the server components outside the process control environment are available.

[0005] In an earlier application with European patent application number 21212849.0, a method for providing control applications is described, wherein the control applications are each provided via a process control component, which can be loaded into and executed in a process control environment formed by a server entity. The control applications that require a selected security authorization are each assigned an identification code as a safety-critical control application. For those control applications that are assigned an identification code as a safety-critical control application, at least one process condition is each specified for the selected security authorization. The process control environment monitors any occurrence of the corresponding process condition during the execution of the process control component of the control application. If the corresponding process condition occurs, the execution of the process control component is always terminated.

[0006] US2019 / 182295 A1 relates to the allocation and management of services in a virtual environment. System services and applications are distributed in multiple containers, which run separately in the runtime environment of the service and the runtime environment of the application using the service. In particular, a service control manager is provided to allow communication between a client stub in a client runtime environment and a service in a service runtime environment.

[0007] A method for extended verification of a container image is known from EP 3 937 039 A1, the container image comprising a base image and at least one application layer, the application layer performing at least one change operation on the base image. First, a unique cryptographic base signature of the base image is generated by a device of the base image manufacturer. The base signature is provided to the container generation device. In addition, a container image is generated in the container generation device, the container image comprising at least the base image and the base signature. The container image is provided to a client, and the base signature in the container image is checked by the runtime environment of the client. The container image is executed only if the check of the base signature gives a positive check result.

[0008] As the functional implementation of industrial automation equipment becomes more and more flexible, dynamically loadable control applications are increasingly used in automation equipment. For example, these control applications can be provided through container virtualization. In particular, control applications used to analyze data traffic within industrial automation systems or to analyze control processes running in automation equipment require extensive privileges and / or security authorizations. Without additional protection measures, any compromise of such control applications may pose a serious security risk to at least the industrial automation equipment on which the compromised control application is installed. For this reason, it is critical to use the growing privileges of control applications transparently and in a supervised manner.

[0009] The problem when granting increased privileges to control applications is that the intended purpose of the requested increased privileges is often unclear. This makes, among other things, any oversight of compliance with device-related security policies considerably more difficult. Furthermore, a compromised control application may abuse the increased privileges for purposes that were not even intended by the control application. Furthermore, the privileges of a control application are often connected to its lifecycle. This requires continuous management of the access authorizations granted to the control application's security-critical interfaces. However, the management of such access authorizations is resource intensive and error prone. Summary of the invention

[0010] It is therefore an object of the present invention to provide a method for providing a control application requiring extensive security permissions, the method ensuring that privileges for the control application are granted in an unambiguous and needs-based manner, and to provide an apparatus suitable for performing the method.

[0011] This object is achieved according to the invention by a method having the features of claim 1 and a system having the features of claim 12. Advantageous developments are given in the dependent claims.

[0012] According to the method for providing control applications of the present invention, the control applications are each provided by a process control component, which can be loaded into a process control environment formed by a server entity and executed therein. In particular, the process control component can be a software container or include a software container, which is isolated by other software containers or container groups (such as Pods) in the process control environment and runs on the host operating system of the server entity. In principle, the process control component can also use an alternative micro-virtualization system, such as Snaps. Preferably, the software container uses a shared kernel of the host operating system of the respective server entity together with other software containers running on the corresponding server entity. The storage image of the software container can be retrieved, for example, from a storage system and configuration system to which a large number of users have read access and / or write access.

[0013] The process control environment can be in particular a container runtime or container engine, by means of which virtual resources can be created, deleted or connected. In this case, virtual resources include software containers, virtual communication networks and their assigned connections. For example, the process control environment can contain a Docker engine or a Snap Core, which runs on a server entity. In principle, other (orchestrated) container runtimes can also be used, such as podman or Kubernetes.

[0014] For control applications whose execution requires the selected privileges, a specification of the required security-critical resources is created for each. Based on the specification, an additional process control component is determined, which is used to provide access to the required security-critical resources. The determined additional process control component is loaded into the process control environment, and the execution of the corresponding process control component and the additional process control component is started.

[0015] In addition, according to the present invention, the process control environment creates an interface for inter-process communication between the corresponding process control component and the additional process control component. Therefore, access to the security-critical resources required by each is provided by the inter-process communication between the corresponding process control component and the additional process control component.

[0016] By means of the invention, control applications can each reliably, accurately and efficiently grant access to safety-critical functions, interfaces and / or resources by providing at least one suitable additional process control component. In principle, each safety-critical function, interface or resource can provide a dedicated additional process control component. By using additional process control components, in particular, the conventional identification of complex API callers (application programming interfaces) or the calculation process of assigning them to the corresponding control application is omitted.

[0017] Furthermore, the invention has the advantage over token-based methods for granting increasing privileges that the access rights granted by the additional process control component cannot be easily determined by other system components or potential attackers. In contrast, applications with broad read rights can very easily read and abuse the access token. Advantageously, the additional process control component monitors whether access to currently required security-critical resources is requested and / or provided according to the security policy that must be used for the corresponding process control component and / or for the corresponding host.

[0018] According to the present invention, the specifications are each created as part of the configuration information for the corresponding process control component. The configuration information each includes at least an indication of a storage image, which is used for the corresponding process control component and application-specific items. The configuration information is each used for loading and / or executing the corresponding process control component for this purpose. The configuration information can be deployment information of the control application, such as a docker-compose.yml configuration file. In this way, the access rights to security-critical functions, interfaces and / or resources required by the control application can be made transparent as part of the corresponding deployment information.

[0019] According to another embodiment of the present invention, the configuration information of the process control components each supplements the corresponding specifications. Preferably, the configuration information is evaluated by the management component assigned to the process control environment and appropriately extended according to the specifications. In this case, the process control environment only accepts those extensions of the configuration information performed by the management component, while the process control environment rejects configuration information extended by other means. Therefore, it can effectively ensure that safety-critical resources and / or interfaces can only be used in an intended manner.

[0020] The specification of the required safety-critical resources can also be checked individually by the management component according to the device-specific safety policy. Based on the results of the check, the management component adjusts the configuration information of the corresponding process control components. In this way, the use of safety-critical resources can be precisely supervised by applying the device-specific safety policy and taking into account the individual framework conditions.

[0021] A security policy (also called a security policy) is usually a technical or organizational document that implements and meets existing security requirements in an enterprise or organization. The core components include, in particular, ensuring the integrity, confidentiality, availability and authentication of protected information. For example, the security policy of a datagram filter component or a firewall specifies how the current configuration is performed, which access rights are granted, how logging is performed, or which defensive measures the datagram filter component or firewall takes in an attack scenario. Security policies can exist in particular as configuration files, XML files, or device configurations, which can be evaluated directly and automatically. Similarly, security policies that can also exist in text form can be evaluated using methods based on artificial intelligence or machine learning. In addition, security policies may exist in graphical form and be evaluated using image processing or pattern recognition methods.

[0022] Preferably, the additional process control component monitors and controls the access of the corresponding process control component to the respective required security-critical resources according to the security policy for the corresponding process control component. In particular, this can accurately determine the privileged operations actually performed by the control application. For example, the security policy can be simply and reliably derived from the specifications of the required security-critical resources by the additional process control component or by the management component assigned to the process control environment. In addition, the security policy can be adjusted in a time-independent manner or according to administrator intervention during the execution of the corresponding process control component. Therefore, the use of security-critical resources can be controlled more accurately.

[0023] According to a particularly preferred embodiment variant of the present invention, a plurality of additional process control components are preinstalled on a host computer having an operating system of a process control environment installed. This can significantly simplify the access management of control applications to the security-critical resources required by each. In particular, the life cycle of the preinstalled additional process control components can be simply and reliably connected to the process control components of the corresponding control applications. In addition, separate management of the additional process control components and the corresponding process control components is no longer required. Separate management is usually erroneous and complicated.

[0024] Advantageously, the operating system of the host provides an interface for interprocess communication between the corresponding process control component and the additional process control component. In contrast, the additional process control component preferably accesses the security-critical resources required by the corresponding process control component via the host interprocess communication interface. In this way, it is possible to ensure that the access to security-critical resources is particularly securely controlled.

[0025] The system for providing control applications according to the present invention is designed to perform methods corresponding to the aforementioned embodiments and includes a process control environment formed by a server entity and at least one process control component for providing control applications. In this case, the process control component can be loaded into the process control environment and executed therein. The system is configured so that for the control applications that require selected privileges for execution, specifications for required security-critical resources are established respectively. In addition, the system is configured so that additional process control components are determined respectively according to the specifications, which are used for this purpose to provide access to required security-critical resources.

[0026] The process control environment of the system according to the present invention is configured to load the determined additional process control components into the process control environment, the execution of the corresponding process control components and the additional process control components is initiated, and an interface for inter-process communication between the corresponding process control components and the additional process control components is established. In addition, the system is configured to provide access to the respective required security-critical resources through the inter-process communication between the corresponding process control components and the additional process control components. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The invention is explained in more detail below by means of examples and figures.

[0028] Figure 1 A system is shown for providing a control application requiring a selected security authorization, and

[0029] Figure 2 Shown by Figure 1 The system shown provides a method flow for controlling an application. DETAILED DESCRIPTION

[0030] Figure 1The system shown includes a host 100 for providing control applications of an industrial automation system via process control components 131, which in this embodiment are implemented via software containers. The control applications of the industrial automation system are examples of time-critical services and can also include monitoring functions.

[0031] The host 100 can realize the functions of a control device (such as a programmable logic controller) or a field device (such as a sensor or an actuator) in an industrial automation system, for example, by controlling an application. In this way, the host 100 can be used for the purpose of exchanging control variables and measurement variables for a machine or device controlled by the host 100. In this case, the host 100 can determine the appropriate control variables of the machine or device from the captured measurement variables.

[0032] Alternatively or additionally, the host 100 can also realize the functions of an operation station and a monitoring station through a control application, and thus can be used to visualize process data or measurement variables and control variables processed or captured by the automation device. In particular, the host 100 can be used to display variables of a closed-loop control loop and change closed-loop control parameters or programs.

[0033] also, Figure 1 The system shown includes a management system 200, by which application packages 201-203 for controlling applications can be provided. The application packages 201-203 each include at least a storage image 210, 220, 230 for a software container and related configuration information 211, 221, 231, and are provided in particular for a host 100. The configuration information can be deployment information, such as a docker-compose.yml configuration file. In particular, the configuration information 211, 221, 231 each includes at least an indication of a storage image for a corresponding software container and application-specific items. The configuration information 211, 221, 231 is each used for this purpose to load and execute a corresponding software container.

[0034] For executing a control application that requires selected privileges, the configuration information 211, 221 each includes specifications 212, 222 of required security-critical resources 101-103. The quote from the docker-compose.yml configuration file shows the specification of read-only access to the Docker-Socket using a label or key value, which is bolded in the quote below:

[0035] services:

[0036] my-app-service:

[0037] image:my-app-image:latest

[0038] build:

[0039] context:.

[0040] labels:

[0041] -"com.my-app-service.description=My service app"

[0042] -"com.my-app-service.host-interfaces.docker-socket-mode

[0043] =read-only"

[0044] -"com.my-app-service.host-interfaces.docker-socket-endpoints=containers"

[0045] …

[0046] A process control environment 112 is installed as an operating system application on the operating system 111 of the host 100. The software container and the process control component 131 can be loaded into the process control environment 112 and executed there. Basically, the process control component 131 can be migrated from the host 100 to another host to be executed there, or can be executed simultaneously on other hosts.

[0047] In the current exemplary embodiment, the software container is isolated from other software containers, container groups or Pods on the operating system 111 of the host 100 within the process control environment 112. In this case, the software container and other software containers running on the host 100 each use one or the same kernel of the operating system 111. The process control environment 112 is preferably a container runtime environment or a container engine.

[0048] Isolation of software containers or isolation of selected operating system resources from each other can be achieved in particular through control groups and namespaces. Control groups can define groups of processes in order to limit the available resources to selected groups. Namespaces allow individual processes or control groups to be isolated or hidden from other processes or control groups, where the resources of the operating system kernel are virtualized.

[0049] For the purpose of providing control applications that require selected security authorization, according to Figure 2In step 1 of the method flow shown, specifications 212, 222 of the required safety-critical resources 101-103 are created for these control applications, each as part of the configuration information 211, 221. The configuration information 211, 221 is evaluated by the management component 113 assigned to the process control environment 112 (step 2) and expanded according to the existing specifications 212, 222 (step 3). In this case, the management component 113 in the exemplary embodiment also checks the specifications 212, 222 of the respectively required safety-critical resources 101-103 according to the device-specific, cryptographically protected security policy 115. Based on the results of the check, the management component 113 adjusts the configuration information 211, 221 of the corresponding process control component 131.

[0050] Preferably, the management component 113 stores the extended and adjusted configuration information 141 in the local memory 114 with the application data 140. In addition to the adjusted configuration information 141, these application data 140 also each include a security policy 142, which must be used to monitor and control access to the security-critical resources 101-103 in order to be applied to the corresponding process control component 131. In the exemplary embodiment, the security policy 142 is based on Figure 2 In step 4 of the method sequence shown in FIG. 1 , the required security-critical resources 101 - 103 are derived from the corresponding specifications 212 , 222 by the management component 113 and are preferably cryptographically protected.

[0051] With respect to the above quote, the following quote from the docker-compose.yml configuration file shows adjustments made by the management component 113, which are shown in bold in the following quote:

[0052] services:

[0053] my-app-service:

[0054] image:my-app-image:latest

[0055] build:

[0056] context:.

[0057] labels:

[0058] -"com.my-app-service.description=My service app"

[0059] -"com.my-app-service.host-interfaces.docker-socket-mode=read

[0060] -only"

[0061] -"com.my-app-service.host-interfaces.docker-socket-endpoints=

[0062] containers"

[0063] volumes:

[0064] -type:bind

[0065] source: / var / lib / docker / edge-iot-core / my-app / proxy-socket

[0066] .sock

[0067] target: / var / run / docker.sock

[0068] …

[0069] docker-socket-sidecar-proxy:

[0070] image:docker-socket-sidecar:latest

[0071] volumes:

[0072] -type:bind

[0073] source: / var / lib / docker / edge-iot-core / my-

[0074] app / socket-policy.json

[0075] target: / var / run / socket-policy.json

[0076] -type:bind

[0077] source: / var / lib / docker / edge-iot-core / my-

[0078] app / proxy-socket.sock

[0079] target: / var / run / proxy-socket.sock

[0080] -type:bind

[0081] source: / var / run / docker.sock

[0082] target: / var / run / docker.sock

[0083] …

[0084] The above example of configuration information 141 adjusted by management component 113 shows an added service (docker-socket-sidecar-proxy) having access to application-specific security policy 142 (socket-policy.json) exported and generated by management component 113, to a local inter-process communication interface (Unix Domain socket proxy-socket.sock), and to a host inter-process communication interface (API socket of Docker Daemon docker.sock). For the software container (my-app-service) that controls the application itself, only access to the local inter-process communication interface is granted.

[0085] According to existing service mesh solutions, such as Istio, the Sidecar container is connected before the workload container, and the route to the workload container is redirected via the Sidecar container, for example, via IPtables. In contrast, in this embodiment, each individual software container provides a dedicated inter-process communication interface, such as a Unix DomainSocket, a dedicated network interface, or a dedicated shared storage segment. In particular, in this embodiment, the network namespace is not shared and does not operate on the same network interface.

[0086] The specification of privileges can be implemented through tags in the form of key-value pairs according to the above examples. For example, it is also possible to use a dedicated manifest file, provide an API, or provide a setting option for the user. In this way, the user can adjust the privileges after installing the control application.

[0087] The process control environment 112 is preferably configured to only accept adjustments to the configuration information 211, 221 made by the management component 113. The process control environment 112 will reject configuration information that is otherwise adjusted.

[0088] According to specification 212, 222 or according to the adjusted configuration information 141, Figure 2In step 5 of the method flow shown in the embodiment, an additional process control component 132 pre-installed on the host 100 is determined, which is designed to provide access to the required security-critical resources 101-103. If a suitable additional process control component 132 cannot be determined from the plurality of additional process control components pre-installed on the host 100, then in the present embodiment, the specifications 212, 222 are adjusted according to step 10 and the configuration information 211, 221 is re-evaluated (step 2) by the management component 113. Alternatively, if the requested resources cannot be provided in a secure manner, the execution of the corresponding control application can be terminated.

[0089] exist Figure 2 In step 6 of the method flow shown in , the determined additional process control component 132 is loaded into the process control environment 112, and the execution of the corresponding process control component 131 and the additional process control component 132 is started. In this case, the process control environment 112 establishes an interface 130 for inter-process communication between the corresponding process control component 131 and the additional process control component 132. Access to the required security-critical resources 101-103 is provided by the inter-process communication between the corresponding process control component 131 and the additional process control component 132.

[0090] In this embodiment, the operating system 111 of the host 100 provides an interface 130 for inter-process communication between the corresponding process control component 131 and the additional process control component 132. However, the additional process control component 132 accesses the security-critical resources 101-103 required by the corresponding process control component 131 via the host inter-process communication interface 110. If this is a system file, the additional process control component 132 can directly access such resources.

[0091] The additional process control component 132 monitors and controls the access of the corresponding process control component 131 to the currently required security-critical resources 101-103 according to the security policy 142 for the corresponding process control component 131 (eg Figure 2 7 of the method flow shown in FIG. 1 ). Access to the security-critical resources 101 -103 is thereby granted (step 8) or denied (step 9). In this case, during the execution of the corresponding process control component 131, the security policy 142 can be adjusted in an event-related manner or according to an administrator intervention. Furthermore, if access to the security-critical resources 101 -103 is denied, the specifications 212 , 222 can usually be adjusted by the management component 113 (step 10) and the configuration information 211 , 221 can be re-evaluated (step 2). If access is denied, a corresponding log entry can be created as an alternative and the corresponding control application can be terminated, in particular if the control application attempts to abuse its privileges.

[0092] As an alternative to management component 113 deriving security policy 142, security policy 142 can also be derived from specifications 212, 222 of required security-critical resources 101-103 by corresponding additional process control components 132. This is possible in particular if only pre-installed, cryptographically protected additional process control components 132 are used.

[0093] In addition, the additional process control component 132 can be used to monitor, in particular log, whether the access request or provision to the currently required security-critical resources 101-103 complies with the security policy 115, 142, which must be used for the corresponding process control component 131 or the corresponding host 100. According to two other exemplary embodiments, the additional process control component 132 can record access requests to those resources in the learning mode. In this way, a security policy 142 can be created, which is used in operation after the learning mode is completed.

Claims

1. A method for providing a control application, wherein: - providing the control applications in each case by means of a process control component (131), which process control component can be loaded into a process control environment (112) formed by the server entity (100) and can be executed in the process control environment, - establishing specifications (212, 222) of required security-critical resources (101-103) for each control application that requires the selected privileges for execution, - additional flow control components (132) are respectively determined according to the specification and are used for the purpose of providing access to the required safety-critical resources, - loading the determined additional process control components into the process control environment, - starting the execution of the corresponding process control component and the additional process control component, - creating an interface (130) by means of the process control environment, the interface being used for inter-process communication between the corresponding process control component and the additional process control component, - providing access to the currently required safety-critical resources by means of inter-process communication between the respective process control component and the additional process control component, - the specifications (212, 222) are each established as part of the configuration information (211, 221) for the corresponding process control component, - the configuration information each comprises at least an indication of a storage image (210, 230) for the respective flow control component and application-specific items, and the configuration information each serves the purpose of loading and / or executing the respective flow control component.

2. The method according to claim 1, wherein: The configuration information (211, 221) for the flow control component (131) is each expanded according to the corresponding specification (212, 222).

3. The method according to claim 1 or 2, wherein: The configuration information (211, 221, 231) is evaluated by a management component (113) assigned to the process control environment (112), and the configuration information is extended according to the specification (212, 222), wherein the process control environment only accepts extensions of the configuration information generated by the management component, and wherein configuration information that has been extended by other means is rejected by the process control environment.

4. The method according to claim 3, wherein: The specifications (212, 222) of the required security-critical resources (101-103) are each checked by the management component (113) for a device-specific security policy (115), and the configuration information (211, 221) for the corresponding process control component (131) is adjusted by the management component based on the checking results.

5. The method according to any one of claims 1 to 4, wherein: The additional process control components (132) each monitor and / or control access by the corresponding process control component (131) to the required security-critical resources (101-103) according to the security policy (142) required for the corresponding process control component.

6. The method according to claim 5, wherein: The security policy (142) is derived by the additional process control component (132) or by a management component (113) assigned to the process control environment (112), respectively, from the specification (212, 222) of the required security-critical resources (101-103).

7. The method according to claim 5 or 6, wherein: The security policy (142) is adapted during the execution of the corresponding process control component (131) in an event-related manner and / or as a function of an administrator intervention.

8. The method according to any one of claims 1 to 7, wherein: A plurality of additional process control components (132) are preinstalled on a host (100), and the process control environment (112) is installed on an operating system (111) of the host.

9. The method according to claim 8, wherein: The interface (130) for inter-process communication between the corresponding process control component (131) and the additional process control component (132) is provided by the operating system (111) of the host (100), and wherein the additional process control component accesses the security-critical resources (101-103) required for the corresponding process control component via the host inter-process communication interface (110).

10. The method according to any one of claims 1 to 9, wherein: The additional process control component (132) monitors whether access to the currently required security-critical resources (101-103) is requested and / or provided according to the security policy (115, 142) that must be applied to the corresponding process control component (131) and / or the corresponding host (100).

11. The method according to any one of claims 1 to 10, wherein: The process control component (131, 132) is a software container, and wherein the process control environment (112) is a container runtime environment.

12. A system for providing a control application, the system comprising: - a process control environment (112) formed by the server entity (100), - at least one process control component (131) for providing a control application, wherein: The process control component can be loaded into the process control environment (112) and executed in the process control environment, - wherein the system is configured such that for each control application requiring selected privileges for execution, a specification (212, 222) of required security-critical resources (101-103) is established, and - determining an additional flow control component (132) in each case according to the specification and using the additional flow control component for the purpose of providing access to the required safety-critical resource, wherein the specifications (212, 222) are each established as part of configuration information (211, 221) for the respective flow control component, the configuration information each comprising at least an indication of a storage image (210, 230) for the respective flow control component and application-specific items, and the configuration information each being used for the purpose of loading and / or executing the respective flow control component, wherein the process control environment (112) is configured to load the determined additional process control component into the process control environment, thereby - starting the execution of the corresponding process control component and the additional process control component, and - creating an interface (130) for inter-process communication between the corresponding process control component and the additional process control component, - wherein the system is further configured to provide access to the currently required safety-critical resources by means of inter-process communication between the corresponding process control component and the additional process control component.

Images