Methods, apparatus, and computer program products for issuing and obtaining certificates

Abstract

Embodiments of the present disclosure relate to a method for issuing a certificate for an industrial device. In the method, a certificate management device receives, from an industrial device, network address information broadcasted by the industrial device. The certificate management device sends, to the industrial device, a request for a device identifier of the industrial device. The certificate management device receives, from the industrial device, the device identifier. The certificate management device verifies that the industrial device is trustworthy based on the device identifier. The certificate management device issues a certificate to the industrial device for establishing secure communication in an industrial network. In this way, the verification process is also implemented without human intervention. Therefore, the industrial device can obtain a certificate for secure communication with other devices, thereby reducing human workload and potential configuration errors.

Description

Technical Field

[0001] This invention relates to the field of electrical equipment, and more particularly to methods, apparatus, and computer program products for issuing and obtaining certificates. Background Technology

[0002] With the advent of the new industrial revolution, industrial networks, especially the Industrial Internet of Things (IIoT), have become the cornerstone of digital transformation. Technologies related to IIoT offer new growth opportunities for improving operational efficiency. Today, an increasing number of production networks are adopting these technologies. Due to this trend, traditional industrial systems whose components are not connected via networks are now transforming into "smart factories" and "smart manufacturing."

[0003] To implement the Industrial Internet of Things (IIoT) concept, all industrial devices that are components of such industrial systems need to be connected to an industrial network during the establishment of such industrial systems. As a result, during the production process of the industrial system, components in the industrial network can communicate with each other across the industrial network. Summary of the Invention

[0004] In view of the above problems, the exemplary embodiments of this disclosure propose a solution for allocating network addresses in industrial networks.

[0005] In a first aspect of this disclosure, exemplary embodiments provide a method for issuing certificates to industrial equipment. In this method, a certificate management device receives network address information broadcast by the industrial equipment. The certificate management device transmits a request for a device identifier for the industrial equipment to the industrial equipment. The certificate management device receives the device identifier from the industrial equipment. The certificate management device verifies that the industrial equipment is trustworthy based on the device identifier. The certificate management device issues a certificate to the industrial equipment for establishing secure communication within the industrial network.

[0006] In a second aspect, exemplary embodiments of this disclosure provide a method for obtaining a certificate. In this method, an industrial device broadcasts network address information within an industrial network. The industrial device receives a request for its device identifier from a certificate management device within the industrial network. The industrial device transmits the device identifier to the certificate management device. The industrial device receives a certificate from the certificate management device for establishing secure communication within the industrial network.

[0007] In a third aspect, an exemplary embodiment of this disclosure provides an electronic device. The electronic device includes: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the device to perform a method according to a first or second aspect of this disclosure.

[0008] In a fourth aspect, exemplary embodiments of this disclosure provide a computer program product including computer-readable instructions stored on a computer-readable storage medium. When executed by a computer, the computer-readable instructions cause the computer to perform a method according to a first or second aspect of this disclosure. Attached Figure Description

[0009] The above and other objects, features, and advantages of the exemplary embodiments disclosed herein will become more readily understood from the following detailed description taken in conjunction with the accompanying drawings. In the drawings, several exemplary embodiments disclosed herein are illustrated by way of example and not limitation, in which:

[0010] Figure 1 A block diagram schematically illustrates an industrial system that can implement exemplary embodiments of the present disclosure;

[0011] Figure 2A A signaling diagram schematically illustrates an example process for issuing a certificate according to an embodiment of this disclosure;

[0012] Figure 2B A signaling diagram schematically illustrates an example process for allocating network addresses according to an embodiment of this disclosure;

[0013] Figures 3A-3C A schematic diagram illustrating an example process for initial configuration of industrial equipment according to some embodiments of the present disclosure is shown.

[0014] Figure 4 A schematic diagram illustrating an example process for initial configuration of industrial equipment according to some embodiments of the present disclosure is shown.

[0015] Figure 5 A flowchart illustrating a method for issuing a certificate at a certificate management device according to an embodiment of the present disclosure is shown schematically.

[0016] Figure 6 A flowchart illustrating a method for obtaining a certificate at an industrial device according to an embodiment of this disclosure is shown schematically; and

[0017] Figure 7 A schematic diagram of an electronic device for implementing the method according to an embodiment of the present disclosure is shown.

[0018] Throughout the accompanying drawings, the same or similar reference numerals denote the same or similar elements. Detailed Implementation

[0019] The principles of this disclosure will now be described with reference to some exemplary embodiments. It should be understood that these embodiments are described for illustrative purposes only and to assist those skilled in the art in understanding and implementing this disclosure, and do not imply any limitation on the scope of this disclosure. The disclosure described herein can be implemented in various ways other than those described below.

[0020] In the following description and claims, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0021] References to "an embodiment," "an example embodiment," "an exemplary embodiment," etc., in this disclosure indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment must include that particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in connection with an embodiment, it should be understood that those skilled in the art will recognize that such features, structures, or characteristics can be implemented in combination with other embodiments, whether explicitly described or not.

[0022] It should be understood that although the terms “first” and “second” may be used herein to describe various elements, these elements should not be limited by these terms. These terms are used only to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, without departing from the scope of the exemplary embodiments. As used herein, the term “and / or” includes any and all combinations of one or more of the listed terms.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments. As used herein, the singular forms “a,” “an,” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that, when used herein, the terms “comprising,” “including,” “having,” “containing,” and / or “including” specify the presence of the stated features, elements, and / or components, but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0024] As mentioned above, components in IIoT-based industrial systems are connected via industrial networks. With industrial products connected to global networks, there is a greater need for cost-effective, standards-based technologies such as Ethernet and Transmission Control Protocol / Internet Protocol (TCP / IP). However, these IP-based networks are more vulnerable to cyberattacks. Consequently, networking industrial systems exposes them to increased threats from malware, ransomware, and viruses. Therefore, establishing an industrial cybersecurity architecture for IIoT-based industrial systems is crucial.

[0025] Traditionally, the secure device identifier according to IEEE 802.1AR is intended to be used as a secure device authentication credential interoperable with Extensible Authentication Protocol (EAP) and other industry-standard authentication and configuration protocols. Within this framework, each device in an industrial network can be configured with a DevID, which includes a globally unique initial device identifier provided by the manufacturer and stored in a manner that protects it from modification.

[0026] While IDevID-based architectures can provide secure networking capabilities, the device onboarding process—configuring a device with a specific identifier and network address within an industrial network—can be complex. For example, when a device is first deployed in an industrial network, a field engineer might insert it into a mounting slot. Then, a network engineer might configure the device's IP address, followed by an application engineer configuring the device's applications, and another engineer configuring redundancy. This process involves more than one engineer and may require sequential work. For industrial systems with multiple components, the onboarding process can be extremely cumbersome, requiring engineers to be on standby for potential system failures.

[0027] In view of the above, a zero-contact configuration mechanism is provided. In this mechanism, the certificate management device monitors network address information broadcast by industrial devices in the industrial network. Once the certificate management device receives network address information from a specific industrial device, it automatically verifies the industrial device and issues a certificate to the industrial device if the device is verified as trustworthy.

[0028] According to embodiments of this disclosure, when an industrial device is first deployed in an industrial system, it can automatically obtain a certificate without human intervention, thereby reducing human input and avoiding configuration errors that may be caused by human negligence.

[0029] Reference Figures 1 to 7 Describes the framework according to embodiments of this disclosure. Figure 1 A block diagram schematically illustrates an industrial system 100 that can implement an example embodiment of the present disclosure. The industrial system 100 may be a distributed control system (DCS). The industrial system 100 may include an operation level and a processing level. The operation level may include functions for operation, process monitoring, archiving and logging, trending, and alarms. The processing level may include open-loop and closed-loop control functions processed in a controller and communicating with actuators and sensors in the field. A network level also exists between the operation level and the processing level, connecting them.

[0030] like Figure 1As shown, the operational level of industrial system 100 includes configuration device 101. Configuration device 101 may also be referred to as an engineering station. Configuration device 101 is configured for the configuration and commissioning of all automation functions. The network level includes industrial bus 102 for connecting all components in the system, as well as auxiliary devices for supporting the bus and providing auxiliary functions. For example, industrial bus 102 may be Profibus. Auxiliary devices include network address server 103 for assigning network addresses to industrial devices in the network. Network address server 103 may be a Dynamic Host Configuration Protocol (DHCP) server. Auxiliary devices may also include certificate management device 104 for verifying industrial devices and issuing certificates to allow verified industrial devices to establish secure communication in the network using the certificates.

[0031] Furthermore, the network address server 103 and certificate management device 104 can be configured by the configuration device 101 according to the current project. In the illustrated embodiment, the configuration device 101 distributes a configuration file 108 to the network address server 103. The configuration file 108 can indicate the mapping of network addresses to registered industrial devices. Similarly, the configuration device 101 distributes a configuration file 109 to the certificate management device 104. The configuration file 109 can indicate whether the industrial device is trusted.

[0032] Furthermore, the processing level of industrial system 100 may include field devices for providing various processing functions in the field. For example, field devices may include controllers, such as programmable logic controllers (PLCs). The controller may be modular and include a backplane and modular devices mounted on the backplane. Figure 1 As shown, a backplane 105 is provided on-site, configured to provide power and network interfaces for industrial equipment. Backplane 105 may include power supply circuitry and memory for storing basic information required to configure the installed industrial equipment. Backplane 105 includes four mounting slots 106-1, 106-2, 106-3, and 106-4 (which may also be individually or collectively referred to as mounting slot 106). Mounting slot 106-1 has the slot identifier SLOT001 and is unoccupied, meaning no industrial equipment is installed in mounting slot 106-1. Mounting slot 106-2 has the slot identifier SLOT002, and industrial equipment 107-1 with device ID DEV001 is installed in mounting slot 106-2. Mounting slot 106-3 has the slot identifier SLOT003, and industrial equipment 107-2 with device ID DEV002 is installed in mounting slot 106-3. The slot identifier of mounting slot 106-4 is SLOT004, and industrial device 107-3 (which may also be referred to individually or collectively as mounting slot 106 along with industrial devices 107-1 and 107-2) with device ID DEV003 is mounted on mounting slot 106-4.

[0033] When industrial device 107 is correctly installed in mounting slot 106, backplane 105 supplies power to industrial device 107 and connects industrial device 107 to industrial bus 102. Once industrial device 107 is connected to the network via industrial bus 102, the configuration process of industrial device 107 can begin automatically. During this process, industrial device 107 can broadcast a discovery message in the network to announce its presence and search for one of the network address servers in the industrial network. When network address server 103 receives the discovery message, network address server 103 determines an available network address that can be assigned to industrial device 107 and unicasts a provide message to notify industrial device 107 of the available network address. When industrial device 107 receives the provide message from network address server 103, industrial device 107 can decide to use the provided network address. Then, industrial device 107 broadcasts a message to confirm the use of the network address provided by network address server 103. When network address server 103 receives a request message, network address server 103 unicasts an acknowledgment message to industrial device 107.

[0034] During the network address allocation process, since the request message for confirming the network address is broadcast by industrial device 107, certificate management device 104 can also receive this request message. When certificate management device 104 receives the request message, it is also notified of the network address that industrial device 107 will use. Therefore, certificate management device 104 can connect to industrial device 107.

[0035] At this point, industrial device 107 requires a certificate to establish secure communication with other industrial devices on the network, which requires verification by certificate management device 104. In this case, certificate management device 104 automatically initiates a certificate issuance process upon receiving a broadcast message from industrial device 107 confirming its network address. Certificate management device 104 connects to industrial device 107 based on its network address and transmits a request for the device identifier of industrial device 107. When certificate management device 104 receives the device identifier from industrial device 107, it compares the received device identifier with trusted device identifiers configured by configuration file 109. If certificate management device 104 determines that the received device identifier is registered or recorded at certificate management device 104, it verifies that industrial device 107 is trusted. Then, certificate management device 104 issues a certificate to industrial device 107. Thus, the automatic certificate issuance process according to this disclosure is completed. Detailed procedures will be described later. Figure 2A-6 Describe it.

[0036] Figure 2AA signaling diagram of an example process 200A for issuing certificates according to an embodiment of this disclosure is schematically shown. For ease of discussion, process 200A will be combined with... Figure 1 The process 200A is described below. It is implemented between industrial equipment 201 and certificate management equipment 203. For example, certificate management equipment 203 may correspond to... Figure 1 The certificate management device 104 in the middle, and the industrial device 201 can be any one of the industrial devices 107-1, 107-2 and 107-3.

[0037] like Figure 2A As shown, at 202, industrial device 201 broadcasts network address information 205 in the industrial network, enabling devices monitoring such messages to receive the network address information. At 204, certificate management device 203 receives the network address information broadcast by industrial device 201. At 206, certificate management device 203 transmits a request for the device identifier of industrial device 201 to industrial device 201. At 208, industrial device 201 receives a request for the device identifier of industrial device 201 from certificate management device 203 in the industrial network. At 210, industrial device 201 transmits the device identifier to certificate management device 203. At 212, certificate management device 203 receives the device identifier from industrial device 201. At 214, certificate management device 203 verifies that industrial device 201 is trustworthy based on device identifier 225. At 216, certificate management device 203 issues a certificate to industrial device 201 for establishing secure communication in the industrial network. At 218, industrial device 201 receives a certificate from certificate management device 203 for establishing secure communication in the industrial network.

[0038] In such Figure 2A In the illustrated embodiment, the certificate management device is configured to automatically initiate an authentication process upon receiving network address information from the industrial device. This authentication process is also implemented without human intervention. Therefore, the industrial device can obtain certificates for secure communication with other devices, thereby reducing human intervention and potential configuration errors.

[0039] In addition to the automated certificate issuance process, the network address allocation process can also be automated. Figure 2B A signaling diagram of an example process 200B for allocating network addresses according to an embodiment of this disclosure is schematically shown. For ease of discussion, process 200B will be combined with... Figure 1 The process 200B is described below. It is implemented between industrial equipment 201 and network address server 207. For example, network address server 207 may correspond to... Figure 1 The certificate management device 104 in the middle, and the industrial device 201 can be any one of the industrial devices 107-1, 107-2 and 107-3.

[0040] At 220, industrial equipment 201 obtains the slot identifier of the mounting slot in which it is installed. For example, in... Figure 1 In the illustrated embodiment, the industrial device is mounted in a mounting slot. At 222, the industrial device 201 broadcasts a discovery message 245 to search for a network address server configured to allocate network addresses. In this case, the discovery message 245 includes a slot identifier. At 224, the network address server 207 receives the discovery message 245 from the industrial device 201. At 226, the network address server 207 assigns a network address corresponding to the slot identifier to the industrial device. At 228, the network address server 207 transmits the assigned network address 255 to the industrial device 201. At 230, the industrial device 201 receives the assigned network address 255, which may be available for use by the industrial device 201 at this time. At 232, the industrial device 201 broadcasts network address information 265 to the network address server 207 to notify the network address server 207 of the selected network address. At 234, the network address server 207 receives the network address information 265 from the industrial device 201. At point 236, network address server 207 transmits acknowledgment 275 to confirm receipt of network address information. At point 238, industrial equipment 201 receives the acknowledgment from network address server 207.

[0041] In such Figure 2B In the illustrated embodiment, the network address server can assign network addresses to industrial devices based on slot identifiers instead of the conventional Media Access Control (MAC) addresses. In this way, the network address server does not need to be configured with a mapping between the unique MAC address of each industrial device and the network address provided by the network address server. Therefore, the configuration of the network address server is simplified. Simultaneously, since industrial devices in the same slot will have the same network address, the replacement process for defective industrial devices is very smooth.

[0042] Figure 3A A schematic diagram of an example process 300A for configuration according to some embodiments of the present disclosure is shown. Figure 3AAs shown, the industrial system can be a DCS system. The industrial system includes a configuration device 301. The configuration device 301 can also be referred to as an engineering station or extended operator station. The configuration device 301 is configured for configuring and commissioning all automation functions. The industrial system includes an industrial bus 302 for connecting all components in the system, as well as auxiliary devices for supporting the bus and providing auxiliary functions. The industrial bus 302 can be implemented according to Profibus. Auxiliary devices include a server for assigning network addresses to industrial devices in the network. In the illustrated embodiment, this server is a DHCP server 303. The industrial system also includes a certificate management device 304 for verifying industrial devices and issuing certificates to allow verified industrial devices to establish secure communication in the network.

[0043] Industrial systems include field devices used to provide various processing functions in the field. For example... Figure 3A As shown, a backplane 305 is provided on-site, configured to provide power and network interfaces for industrial equipment. In some example embodiments, backplane 305 may include power supply circuitry and memory for storing basic information required to configure the installed industrial equipment. Backplane 305 includes four mounting slots 306-1, 306-2, 306-3, and 306-4 (which may also be individually or collectively referred to as mounting slot 306). The slot identifier for mounting slot 306-1 is SLOT001. The slot identifier for mounting slot 306-2 is SLOT002. The slot identifier for mounting slot 306-3 is SLOT003. The slot identifier for mounting slot 306-4 is SLOT004.

[0044] Before the production process of the industrial system begins, configuration device 301 configures DHCP server 303 and certificate management device 304 according to the current project to provide corresponding functions. As shown, configuration device 301 distributes configuration file 311 to DHCP server 303. Configuration file 311 indicates the mapping relationship between IP addresses and installation slots. As shown, configuration file 311 includes a mapping table of SLOT IDs and IP addresses. In this mapping table, slot identifier "SLOT ID001" is associated with IP address "10.10.0.1". Slot identifier "SLOT ID002" is associated with IP address "10.10.0.2". Slot identifier "SLOT ID003" is associated with IP address "10.10.0.3". Slot identifier "SLOT ID004" is associated with IP address "10.10.0.4". Therefore, DHCP server 303 is configured to assign IP addresses according to the stored mapping table. For example, when an industrial device (which can also be referred to as a DHCP client in this scenario) needs an IP address, the DHCP server 303 selects an IP address from the mapping table that corresponds to the slot identifier indicated by the industrial device.

[0045] Similarly, configuration device 301 also distributes configuration file 312 to certificate management device 304. Configuration file 312 indicates whether the industrial devices are trusted. As shown, configuration file 312 includes a trusted device identifier table. For example, according to IEEE 802.1AR, the device identifier can be IDevID. The table in configuration file 312 lists three IDevIDs, including DEV001, DEV002, and DEV003 for the corresponding industrial devices. Therefore, certificate management device 304 is configured to verify devices introduced into the industrial system network according to the IDevID table. In some example embodiments, when the equipment (i.e., components) of the industrial system is purchased and acquired, the IDevID of the corresponding device may be recorded in this table.

[0046] After the DHCP server 303 and certificate management device 304 are correctly configured, the deployment of industrial system components can begin. Figure 3B A schematic diagram of an example process 300B for allocating network addresses according to some embodiments of the present disclosure is shown.

[0047] like Figure 3B As shown, industrial device 307-1 with device identifier DEV001 is installed in mounting slot 306-1 of backplane 305. Backplane 305 supplies power to industrial device 307-1 and connects industrial device 307-1 to industrial bus 302. Once industrial device 307-1 accesses the network via industrial bus 302, the configuration process of industrial device 307-1 begins automatically. During this process, industrial device 307-1 connects to mounting slot 306-1 and reads the slot identifier SLOT001 of mounting slot 306-1 from the memory of backplane 305. Then, industrial device 307-1 includes the slot identifier "SLOT001" in the DHCP discovery message. It should be understood that "SLOT001" is merely one representation of the slot identifier. In some example embodiments, the format of the slot identifier may be the same as the MAC address. In this way, the slot identifier can be included in the client identifier field of the DHCP discovery message. Therefore, DHCP server 303 does not require configuration other than the mapping table.

[0048] Industrial device 307-1 broadcasts a DHCP Discover message on the network to announce its existence. When DHCP server 303 receives the discovery message broadcast by industrial device 307-1, DHCP server 303 extracts the slot identifier from the DHCP Discover message. DHCP server 303 selects an available IP address from the pool of IP addresses applicable to that slot identifier. According to the IP address to slot identifier mapping table 313, the IP address assigned to slot identifier "SLOT001" is "10.10.0.1". DHCP server 303 determines that the IP address should be "10.10.0.1" and unicasts a DHCP Offer message to notify industrial device 307 of the available IP address "10.10.0.1". After receiving the DHCP Offer message, industrial device 307-1 decides to use the assigned IP address and broadcasts a DHCP Request message on the network to confirm that the assigned IP address "10.10.0.1" is being requested. One DHCP request message 309-1 is received by the DHCP server 303, and another DHCP request message 309-2 is received by the certificate management device 304. On the one hand, after receiving the DHCP request message 309-1, the DHCP server 303 sends a DHCP confirmation message to the industrial equipment 307-1.

[0049] On the other hand, when the certificate management device 304 receives the request message, it is also notified of the IP address "10.10.0.1". The certificate management device 304 connects to the industrial device 307 based on the IP address "10.10.0.1". The certificate management device 304 requests a device identifier to verify the industrial device and sends a request for the device identifier to the industrial device 307-1. The industrial device 307-1 receives the request for the device identifier and, for example, sends its device identifier in a response message. When the certificate management device 304 receives the device identifier from the industrial device 307-1, it compares the received device identifier with trusted device identifiers stored in the identifier table 314 on the certificate management device 304. The certificate management device 304 determines that the received device identifier has been registered or recorded in the identifier table 314. The certificate management device 304 verifies that the industrial device 307-1 is trusted. Then, the certificate management device 304 issues a certificate and pushes the certificate to the industrial device 307-1.

[0050] During the production process of an industrial system, industrial equipment 307-1 may malfunction for some reason. In this case, the field engineer replaces the malfunctioning industrial equipment 307-1 with a new industrial equipment 307-2 to ensure that the same functionality can be continuously provided. Figure 3CA schematic diagram of an example process 300C for allocating network addresses during industrial equipment replacement, according to some embodiments of the present disclosure, is shown.

[0051] like Figure 3C As shown, the malfunctioning industrial device 307-1 is removed from its mounting slot, and a new industrial device 307-2 with device identifier DEV002 is installed in mounting slot 306-1 of backplane 305. Backplane 305 supplies power to industrial device 307-2 and connects it to industrial bus 302. Similarly, once industrial device 307-2 is connected to the network via industrial bus 302, its configuration process begins automatically. During this process, industrial device 307-2 connects to mounting slot 306-1 and reads the slot identifier SLOT001 of mounting slot 306-1 from the memory of backplane 305. Then, industrial device 307-2 also includes the slot identifier "SLOT001" in its DHCP discovery message.

[0052] Industrial device 307-2 broadcasts a DHCP discovery message on the network to announce its existence. When DHCP server 303 receives the discovery message broadcast by industrial device 307-1, DHCP server 303 extracts the slot identifier from the DHCP discovery message. DHCP server 303 selects an available IP address from the IP address pool corresponding to slot identifier SLOT001. According to the IP address to slot identifier mapping table 313, the IP address assigned to slot identifier "SLOT001" is also "10.10.0.1". DHCP server 303 again confirms that the IP address should be "10.10.0.1" and unicasts a DHCP offer message to notify industrial device 307-2 of the available IP address "10.10.0.1". After receiving the DHCP offer message, industrial device 307-2 decides to use the assigned IP address and broadcasts a DHCP request message on the network to confirm that the assigned IP address "10.10.0.1" is being requested. One DHCP request message 310-1 is received by the DHCP server 303, and another DHCP request message 310-2 is received by the certificate management device 304. On the one hand, after receiving the DHCP request message 310-1, the DHCP server 303 sends a DHCP confirmation message to the industrial equipment 307-2.

[0053] On the other hand, the certificate management device 304 receives a DHCP request message 310-2. In the case of a standard DHCP request message, the DHCP request message can be configured to indicate the use of the assigned IP address, or to indicate a request to extend the lease of the current IP address, or to indicate a request to verify the current IP address. If the certificate management device 304 determines, based on the content of the "option" field of the DHCP request message 310-2, that the DHCP request message 310-2 indicates a request to extend the lease of the current IP address or a request to verify the current IP address, the certificate management device 304 will ignore the DHCP request message 310-2. The certificate management device 304 only initiates the verification process if it determines that the DHCP request message 310-2 indicates the use of the assigned IP address.

[0054] Since the certificate management device 304 is also notified of the IP address "10.10.0.1", it connects to the industrial device 307 based on the IP address "10.10.0.1". The certificate management device 304 sends a request for a device identifier to the industrial device 307-2. The industrial device 307-2 receives the request for the device identifier and sends its device identifier "DEV002" to the certificate management device 304 in a response message. When the certificate management device 304 receives the device identifier "DEV002" from the industrial device 307-2, it compares the received device identifier "DEV002" with the trusted device identifiers "DEV001", "DEV002", and "DEV003" stored in the identifier table 314 on the certificate management device 304. The certificate management device 304 determines that the received device identifier "DEV002" has been registered or recorded in the identifier table 314, and verifies that the industrial device 307-2 is trusted. Then, the certificate management device 304 issues a certificate and pushes the certificate to the industrial equipment 307-2.

[0055] exist Figures 3A-3C In the illustrated embodiment, both network address allocation and device verification processes are automated for newly installed and replaced industrial equipment. This ensures that when an industrial device malfunctions and is replaced by a new device of the same model, the new device can obtain the same IP address. This facilitates subsequent configuration phases and the acquisition of certificates for establishing secure communication, thereby allowing the replacement process to be automated and smooth.

[0056] Figure 4 A signaling diagram of an example process 400 for configuring industrial equipment according to some embodiments of this disclosure is illustrated schematically. For ease of discussion, it will be combined with... Figures 3A-3CProcess 400 is described below. Process 400 is implemented by industrial device 401, network address server 403, and DHCP server 407. For example, industrial device 401 may correspond to... Figures 3A-3C Industrial equipment 307-1 or industrial equipment 307-2. Certificate management device 403 may correspond to... Figures 3A-3C The certificate management device 304 in the middle. The DHCP server 407 can correspond to... Figures 3A-3C The DHCP server 303 is located in the industrial system. Accordingly, the industrial equipment 401, the certificate management device 403, and the DHCP server 407 are deployed in the industrial system connected via an industrial network.

[0057] like Figure 4 As shown, at 402, industrial device 401 obtains the slot identifier (e.g., one of "SLOT001", "SLOT002", "SLOT003", and "SLOT004") of the mounting slot in which it is installed. At 404, industrial device 401 broadcasts a DHCP discovery message 405 to search for a DHCP server configured to assign network addresses, and this DHCP discovery message 405 includes the slot identifier. At 406, DHCP server 407 receives one of the DHCP discovery messages 405 from industrial device 401. In this case, at 408, certificate management device 403 also receives one of the DHCP discovery messages 405 from industrial device 401.

[0058] At 410, DHCP server 407 assigns an IP address corresponding to the slot identifier to industrial device 401. For example, DHCP server 407 determines, based on a mapping table stored thereon, that the IP address "10.10.0.1" corresponds to the slot identifier "SLOT001" and assigns the IP address "10.10.0.1" to the industrial device. At 412, DHCP server 407 sends a DHCP offer message 415 to industrial device 401 including the assigned IP address "10.10.0.1". At 414, industrial device 401 receives the DHCP offer message 415. At 416, industrial device 401 broadcasts a DHCP request message 425 in the industrial network, enabling it to notify DHCP server 407 about the selected network address. At 418, DHCP server 407 receives one of the DHCP request messages 425, and at 420, certificate management device 403 also receives one of the DHCP request messages 425 from industrial device 401. At point 422, DHCP server 407 sends acknowledgment message 435 to confirm receipt of DHCP request message 425, thus completing the IP address allocation process. At point 424, industrial device 401 receives acknowledgment message 435 from DHCP server 407.

[0059] At 426, upon receiving a DHCP request message 425 broadcast by industrial device 401, certificate management device 403 sends a request 435 for the device identifier of industrial device 401 to industrial device 401. At 428, industrial device 401 receives the request 435 for its device identifier from certificate management device 403 in the industrial network. At 430, industrial device 401 sends its device identifier 445, such as "DEV001", to certificate management device 403. At 432, certificate management device 403 receives the device identifier "DEV001" from the industrial device. At 434, certificate management device 403 determines that the device identifier "DEV001" is registered in a device table that includes trusted device identifiers such as "DEV001", "DEV002", and "DEV003", and verifies that industrial device 401 is trusted. At 436, certificate management device 403 issues a certificate 455 to industrial device 401 for establishing secure communication in the industrial network. At 438, industrial device 401 receives certificate 455 from certificate management device 403 for establishing secure communication in the industrial network.

[0060] Figure 5 A flowchart illustrating a method 500 for issuing certificates at a certificate management device according to an embodiment of the present disclosure is shown schematically. For ease of discussion, it will be combined with... Figure 1 Method 500 is described. For example, method 500 may be derived from, for example, Figure 1 The certificate management device 104 shown is used to implement this.

[0061] like Figure 5 As shown, at point 502, the certificate management device receives network address information broadcast by an industrial device within the same industrial network. At point 504, the certificate management device sends a request for a device identifier for the industrial device to the industrial device. At point 506, the certificate management device receives the device identifier from the industrial device. At point 508, the certificate management device verifies the industrial device's trustworthiness based on the device identifier. At point 510, the certificate management device issues a certificate to the industrial device to establish secure communication within the industrial network.

[0062] Figure 6 A flowchart illustrating a method 600 for obtaining a certificate at an industrial device according to an embodiment of this disclosure is shown schematically. For ease of discussion, it will be combined with... Figure 1 Method 600 is described. For example, method 600 can be derived from, for example, Figure 1 This can be achieved by any one of the industrial devices 107 shown.

[0063] like Figure 6As shown, at 602, industrial device 107 broadcasts network address information in the industrial network. At 604, industrial device 107 receives a device identifier request for its device identifier from a certificate management device in the industrial network. At 606, industrial device 107 sends its device identifier to the certificate management device. At 608, industrial device 107 receives a certificate from the certificate management device for establishing secure communication in the industrial network.

[0064] In some embodiments of this disclosure, a computing device is provided for implementing the methods 500 and 600 described above. Figure 7 A schematic diagram of an electronic device 700 for implementing a method according to an embodiment of the present disclosure is shown. The electronic device 700 may correspond to... Figure 1 The industrial equipment 107 and certificate management equipment 104 are included. Electronic device 700 includes at least one processor 710 and at least one memory 720. The at least one processor 710 can be coupled to the at least one memory 720. The at least one memory 720 includes instructions 722 that, when executed by the at least one processor 710, implement methods 500 and 600.

[0065] In some embodiments of this disclosure, a computer-readable medium is provided for adjusting a robot path. This computer-readable medium stores instructions that, when executed on at least one processor, cause the processor to perform the methods for managing a camera system as described in the preceding paragraphs, the details of which are not repeated here.

[0066] Generally, the various embodiments of this disclosure can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of this disclosure are shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as non-limiting examples in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0067] This disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which execute in a device on a target real or virtual processor to perform the functions described above. Figure 2A-6The process or method described herein. Typically, a program module includes routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. The functionality of a program module can be combined or split among program modules as needed in various embodiments. The machine-executable instructions used for a program module can execute on a local or distributed device. In a distributed device, a program module can reside on both local and remote storage media.

[0068] Program code used to perform the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that, when executed by the processor or controller, the program code enables the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a stand-alone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0069] The aforementioned program code may be embodied on a machine-readable medium, which may be any tangible medium capable of containing or storing a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. More specific examples of machine-readable storage media will include electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable optical disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0070] Furthermore, although the operations are depicted in a specific order, this should not be construed as requiring such operations to be performed in the specific order shown or sequentially, or requiring all shown operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this disclosure, but rather as a description of features that may be specific to particular embodiments. Certain features described in the context of a single embodiment may also be implemented in combination in a single embodiment. On the other hand, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0071] Although the subject matter has been described in language relating to structural features and / or methodological actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are disclosed as examples of implementing the claims.

[0072] It should be understood that the detailed embodiments described above are for illustrative purposes only and are not intended to limit the scope of this disclosure. Therefore, any modifications, equivalent substitutions, and improvements made without departing from the spirit and scope of this disclosure should be included within its protection scope. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the claims or their equivalents.

[0073] It should be understood that the summary portion is not intended to identify key or essential features of embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description.

Claims

1. A method for issuing certificates for industrial equipment, comprising: The certificate management device receives network address information broadcast by the industrial equipment from the industrial equipment. The certificate management device sends a request for the device identifier of the industrial equipment to the industrial equipment; The certificate management device receives the device identifier from the industrial equipment; The certificate management device verifies the trustworthiness of the industrial equipment based on the device identifier; as well as The certificate management device issues certificates to the industrial equipment for establishing secure communication within the industrial network.

2. The method according to claim 1, wherein verifying the trustworthiness of the industrial equipment includes: The trusted device identifier is obtained from the certificate management device; The certificate management device determines that the device identifier is included in the trusted device identifier; as well as The certificate management device determines that the device identifier is trustworthy.

3. The method of claim 2, wherein the certificate management device is configured with an identifier table including the trusted device identifier.

4. The method of claim 1, wherein the network address information is included in a Dynamic Host Configuration Protocol (DHCP) request message broadcast by the industrial equipment.

5. The method of claim 4, wherein the identifier request is sent in response to determining that the industrial equipment requires verification, and Determining that the industrial equipment requires the verification includes: Upon receiving the DHCP request message, the certificate management device determines the option information of the DHCP request message; as well as In response to determining the option information indicating a DHCP offer message providing an available network address, the certificate management device determines that the industrial device requires the authentication.

6. The method of claim 5, wherein determining that the industrial equipment requires the verification further comprises: In response to determining that the option information indicates an extension of the lease or verification of a previously assigned network address, the certificate management device determines that the industrial device does not require the verification.

7. A method for obtaining a certificate for industrial equipment, comprising: Network address information is broadcast by industrial equipment within an industrial network; The industrial equipment receives a request for a device identifier for the industrial equipment from a certificate management device in the industrial network; The industrial equipment sends the device identifier to the certificate management device; as well as The industrial equipment receives a certificate from the certificate management device for establishing secure communication within the industrial network.

8. The method according to claim 7, further comprising: The industrial equipment obtains a slot identifier for a mounting slot in the backplane, and the industrial equipment is mounted on the mounting slot. The industrial equipment broadcasts a discovery message for a network address server, the network address server being configured to allocate network addresses, the discovery message including the slot identifier; and The industrial equipment receives a network address assigned to it from the network address server.

9. The method according to claim 8, further comprising: The industrial equipment receives an acknowledgment message in response to the network address information from the network address server.

10. The method of claim 8, wherein the discovery message is a Dynamic Host Configuration Protocol (DHCP) discovery message, and the network address information is included in the DHCP request message.

11. The method of claim 10, wherein the DHCP discovery message includes the slot identifier in the client identifier field.

12. The method of claim 10, wherein the DHCP discovery message includes an options field indicating one of the following: A response to a DHCP offer message that provides an available network address; Extension of the lease; or Verification of the previously assigned network address.

13. The method of claim 7, wherein the network address is assigned based on a mapping table of slot identifiers to the predefined network addresses.

14. An electronic device, comprising: At least one processor; as well as At least one memory, the at least one memory storing instructions that, when executed by the at least one processor, cause the device to perform the method according to any one of claims 1-6 or any one of claims 7-13.

15. A computer program product comprising computer-readable instructions stored on a computer-readable storage medium, wherein, when executed by a computer, the computer-readable instructions cause the computer to perform a method for issuing a certificate for industrial equipment according to any one of claims 1-6, or a method for obtaining a certificate for industrial equipment according to any one of claims 7-13.

Images