Method and system for providing control applications for an industrial automation system

Description

[0001] The present invention relates to a monitoring method for providing control applications for an industrial automation system and a system for carrying out this method.

[0002] Industrial automation systems typically comprise a multitude of automation devices interconnected via an industrial communication network and are used to control or regulate systems, machines, or devices within the framework of production or process automation. Due to the time-critical conditions in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, Real-Time Ethernet, or Time-Sensitive Networking (TSN) are predominantly used for communication between automation devices. In particular, control services or applications can be automated and distributed among currently available servers or virtual machines of an industrial automation system, depending on the load.

[0003] Interruptions in communication connections between computer units of an industrial automation system or automation devices can lead to an unwanted or unnecessary retransmission of a service request. Furthermore, messages that are not transmitted or are not transmitted in full can, for example, prevent an industrial automation system from transitioning to or remaining in a safe operating state.

[0004] EP 3 813 315 A1 discloses a method for diagnosing data traffic in a cluster with multiple work nodes, in which containers or pods are provided by the work nodes. A cluster detection module collects information about which work nodes a node detection module is assigned to. If the cluster detection module receives a request to capture data packets, the cluster detection module contacts the node detection modules of the affected nodes, and the node detection modules capture data packets. Furthermore, the node detection modules forward the captured data packets or their duplicates to the cluster detection module. The cluster detection module, in turn, forwards the captured data packets or duplicates to the respective requesting unit.

[0005] WO 2021 / 104632 A1 relates to a method for capturing data packets originating from a first container within a cluster of containers. Each container is assigned multiple network interfaces for transmitting data packets. As soon as a first connection for transmitting data packets is detected via a first network interface assigned to the first container, an identifier assigned to the first container is inserted into a data stream associated with the first connection. The inserted identifier can be used to identify the first container for capturing data packets originating from it.

[0006] The earlier international patent application WO 2022 / 042905 A1 relates to a method for providing time-critical services, each of which is assigned at least one server component formed by a flow control component that can be loaded into and executed in a flow control environment. A functional unit for processing a communication protocol stack is made available for each server component, which is connected to a functional unit for processing a communication protocol stack assigned to the flow control environment. The services each comprise a directory service component for determining services provided by the flow control environment. The directory service components are connected to one another via a separate communication interface.An aggregator component formed by another flow control component is connected to the separate communication interface, which makes information about the services provided by the server components available outside the flow control environment.

[0007] WO 2020 / 249345 A1 discloses a method for providing control applications, in which a configuration control device queries a monitoring device for communication network addresses of process control components and identifiers of the process control components and assigns this information to the control applications. From the queried communication network addresses and identifiers, as well as from the designations of the control applications, the configuration control device generates configuration information for a forwarding device. The forwarding device receives requests from end devices for using the control applications and forwards them to a respective process control component according to the configuration information.

[0008] EP 3 557 463 A1 relates to an execution environment for preventing the execution of manipulated program code on field devices. The execution environment comprises a function memory configured to store verification functions, as well as a configuration memory configured to store execution requirements for verification areas. The configuration memory is protected by a tamper detection module. The execution requirements can be configured in a configuration mode of the execution environment. Furthermore, an execution unit is provided, which is configured to use the verification functions to determine a test result that indicates whether the respective verification area meets the execution requirements. Furthermore, the execution unit is configured to execute a respective program instruction or program code depending on the test result.

[0009] For the flexible provision of automation functions, control applications that can be loaded onto automation devices are increasingly being used, for example, through container virtualization. In particular, control applications for analyzing data traffic within an industrial automation system or for analyzing control processes running in automation devices require extensive privileges or security authorizations. Security vulnerabilities in such diagnostic applications often lead to significant security risks for automation devices or cells as a whole. The longer potentially manipulable control applications remain installed on automation devices, the greater the security risks within an industrial automation system.

[0010] The present invention is therefore based on the object of creating a secure method that can be implemented with little effort for providing control applications requiring extensive security authorizations for an industrial automation system and of specifying a suitable device for carrying out the method.

[0011] This object is achieved according to the invention by a method having the features specified in claim 1 and by a system having the features specified in claim 13. Advantageous further developments are specified in the dependent claims.

[0012] According to the inventive method for providing control applications for an industrial automation system, the control applications are each provided using sequential control components. The sequential control components can be loaded into a sequential control environment formed by a server device and executed there. Advantageously, one sequential control component can be loaded into the sequential control environment for each application instance and executed there. Furthermore, the sequential control components can be migrated to different server devices for execution there or executed simultaneously on different server devices.

[0013] In particular, the flow control components can be or include software containers, each of which runs isolated from other software containers or container groups, e.g., pods, within the flow control environment on a host operating system of a server device. In principle, alternative micro-virtualization concepts, such as snaps, can also be used for the flow control components. Preferably, the software containers, together with other software containers running on the respective server device, use a kernel of the host operating system of the server device. Memory images for the software containers can, for example, be retrieved from a storage and provisioning system that can be read or written to by a large number of users.

[0014] The flow control environment can, in particular, be a container runtime environment or container engine, through which virtual resources are created, deleted, or linked. The virtual resources include software containers, virtual communication networks, and the connections associated with them. For example, the flow control environment can include a Docker Engine or a Snap Core running on a server device.

[0015] According to the invention, control applications that require selected security authorizations are each assigned a designation as a safety-critical control application. For the control applications that are assigned a designation as a safety-critical control application, at least one execution condition is defined for the selected security authorizations. During execution of the sequence control components for the control applications, the sequence control environment monitors the occurrence of the respective execution condition. Upon occurrence of the respective execution condition, the execution of the sequence control components is terminated. Preferably, the execution of the sequence control components is only started if the execution condition has not yet occurred. Furthermore, the execution conditions can in particular each comprise a maximum execution duration for the respective sequence control component.This means that the process conditions can be defined simply and clearly.

[0016] The present invention can, for example, ensure that diagnostic applications with extensive security authorizations remain activated or installed on a device only for as long as their use requires. This prevents security-critical applications that represent potential attack targets from remaining installed on a device for an extended period of time after their use, or even continuing to run, for reasons of convenience or carelessness.

[0017] According to a preferred embodiment of the present invention, the execution of the sequence control components is terminated by executing an action defined in a security policy upon occurrence of the respective sequence condition. The defined action can, in particular, comprise stopping or deleting the respective sequence control component. Advantageously, the security policy defines the respective sequence condition depending on the designation of the respective control application. Overall, this enables flexible adaptation of the sequence conditions and defined actions to the requirements of operators of an industrial automation system.

[0018] Preferably, the labels of the control applications define a respective applicable security policy. Furthermore, the labels can be used to identify or specify functions of the control applications or security authorizations required to provide the control applications. This enables easy-to-use use of the labels to reliably define the required security authorizations or privileges of the control applications. Particularly simple handling results if, according to a further advantageous embodiment of the present invention, the labels are each added as a character string to metadata for the respective control application. In particular, labels can be defined in this way through administrative intervention, automatically, or when container images are published.

[0019] The system according to the invention for providing control applications for an industrial automation system comprises a sequential control environment formed by a server device and at least one sequential control component for providing a control application. The sequential control component can be loaded into the sequential control environment and executed there. Furthermore, the system is configured to assign control applications that require selected security authorizations a designation as a safety-critical control application, and to specify at least one execution condition for the selected security authorizations for each of the control applications that are assigned a designation as a safety-critical control application.In addition, the flow control environment is configured to monitor the occurrence of the respective flow condition during execution of the flow control components for the control applications and to terminate the execution of the flow control components when the respective flow condition occurs.

[0020] The present invention will be explained in more detail below using an exemplary embodiment with reference to the drawing. Figure 1 shows a system for providing control applications that require selected security authorizations, Figure 2 shows a representation of a process flow for providing control applications by means of the Figure 1 presented system.

[0021] The Figure 1The system illustrated comprises a server device 100 for providing control applications 201-204 of an industrial automation system. The control applications 201-204 of the industrial automation system are exemplary for time-critical services and can also include monitoring functions. The control applications can be provided, for example, based on OPC UA.

[0022] Using the control applications 201-204, the server device 100 can, for example, implement functions of control devices of an industrial automation system, such as programmable logic controllers, or of field devices, such as sensors or actuators. In this way, the server device 100 can be used, in particular, for exchanging control and measurement variables with machines or devices controlled by the server device 100. The server device 100 can determine suitable control variables for the machines or devices from the acquired measurement variables.

[0023] Alternatively or additionally, the server device 100 can implement the functions of an operator control and monitoring station using the control applications 201-204 and can thus be used to visualize process data or measurement and control variables that are processed or acquired by automation devices. In particular, the server device 100 can be used to display values ​​of a control loop and to change control parameters or programs.

[0024] In addition, the Figure 1The system shown comprises a management system 200, by means of which a label 210 is assigned as a safety-critical control application for each control application 201-203 that requires selected security authorizations. In the present exemplary embodiment, the labels 210 are formed by tags, each of which can be added as a character string to metadata for the respective control application 201-203. Furthermore, the tags can be assigned, for example, automatically for first control applications 201, manually for second control applications 202, or when memory images or images are published in an app repository for third control applications 203. In principle, fourth control applications 204 that do not have a tag assignment can also be managed by means of the management system 200.

[0025] The labels 210 of the control applications 201-203 advantageously define a respective applicable security policy, which is stored as a data record in a corresponding database 220. Furthermore, the labels 210 preferably designate or predetermine functions of the control applications 201-203 or the security authorizations required to provide the control applications 201-203. In the present embodiment, the management system 200 also defines at least one expiration condition for the selected security authorizations for each of the control applications 201-203 that are assigned a label as a safety-critical control application. These expiration conditions are also recorded in the database 220.

[0026] After the control applications 201-204 have been recorded, provided, and classified, and the runtime conditions have been determined, a selection 301 of the control applications 201-204 to be provided by the server device 100 and a selection 302 of the security policies to be applied by the server device 100 are transmitted from the management system 200 to the server device. The selection 301 of the control applications 201-204 includes, in particular, their memory images. In principle, the server device can also retrieve images for software containers from a storage and provisioning system that can be accessed by multiple users for read and write purposes.

[0027] In the server device 100, the control applications 201-204 are each provided by means of process control components 131-133, which can be loaded into and executed in a process control environment 112 formed by the server device 100. The process control environment 112 is installed as an application on a host operating system 111 of the server device 100. Furthermore, process control components 131-133 can each be migrated from the server device 100 to another server device for execution there or can be executed simultaneously on other server devices.

[0028] In the present exemplary embodiment, the flow control components 131-133 are or comprise software containers, each of which runs isolated from other software containers, container groups, or pods within the flow control environment 112 on the host operating system 111 of the server device 100. The software containers, together with other software containers running on the server device 100, each use a kernel of the host operating system 111 of the server device 100. The flow control environment 112 is preferably a container runtime environment or container engine.

[0029] Isolation of process control components or isolation of selected operating system resources from each other can be achieved, in particular, using control groups and namespacing. Control groups can be used to define process groups to restrict available resources for selected groups. Namespaces can be used to isolate or hide individual processes or control groups from other processes or control groups.

[0030] According to the Figure 2In the method sequence shown, the control applications are first provided (step 1) and classified (step 2), and the execution conditions are defined (step 3) in the management system 100 in accordance with the above explanations. After loading the software containers 131-133 for the control applications, the sequence control environment 112 monitors the occurrence of the respective execution condition (step 4) during execution of the software containers 131-133. In particular, the execution of the software containers 131-133 is only started if the execution condition has not yet occurred. The execution conditions preferably each include a maximum execution duration for the respective software container 131-133.

[0031] If a check according to step 5 does not provide a basis for further execution, the execution of software containers 131-133 is terminated upon the occurrence of the respective execution condition (step 7). Otherwise, the execution of software containers 131-133 is continued according to step 6, and the occurrence of the respective execution condition is continuously monitored according to step 4.

[0032] The execution of the software containers 131-132 is terminated by executing an action defined in an applicable security policy 113 upon the occurrence of the respective expiration condition. For example, the defined action can include stopping or uninstalling the respective software container 132, 133. For this purpose, a corresponding stop command 114 or a delete command 115 is advantageously sent. The security policy 113 preferably defines the expiration condition depending on the identifier 210 of the respective control application 201-204.

[0033] In addition to stopping or uninstalling a software container, a variety of other or additional actions can be executed when the respective expiration condition occurs, for example Warning an operator, setting a switching signal, flashing an LED on a device, generating a log entry, restricting access rights of a control application.

[0034] The actions can generally be initiated or executed by the server device 100 or by the management system 200. For example, a stop command can be generated by the container runtime environment 112 itself or by the management system 200. In the latter case, the management system 200 transmits a stop command to the container runtime environment 112 for execution.

[0035] The present invention is fundamentally applicable to all devices that enable the reloading of container virtualization-based applications (apps), particularly those with elevated privileges. For example, apps can be reloaded in this way into edge devices, IoT gateways, industrial PCs, on-premises server systems, or cloud server systems. Elevated app privileges can, for example, be provided in Linux-based systems for special Linux capabilities, such as CAP NET ADMIN for administering network resources, particularly routing tables or network interfaces, for extensive access to a host file system, or for using certain system calls (syscalls). Furthermore, elevated privileges are also regularly required for diagnostic applications that have extensive access rights to network interfaces of other applications.For diagnostic applications, for example, a security policy can specify that control applications assigned a "diagnostic" tag may not be installed on a device for longer than 12 hours and are to be automatically uninstalled by a container runtime environment after this time.

[0036] The above statements are explained in more detail below using a practical implementation example. First, when publishing a network diagnostics app deployed using a Docker container engine, a docker-compose.yml configuration file defines a tag in the form of an image label (key-value pair): com.siemens.ie.systemapp.expires=true. This tag identifies the network diagnostics app as an app whose usage period should be restricted.

[0037] Subsequently, a manufacturer of an automation device – in this example, Siemens – in which the network diagnostics app is to run specifies a simple policy that causes an app with the above tag to be stopped and deleted 8 hours after its installation, and a warning is sent to a device or system operator. In principle, this policy can also be overwritten by the device or system operator as needed.

[0038] The network diagnostics app is then loaded onto the automation device and used by the device operator for diagnostics. Due to the assigned tag com.siemens.ie.system-app.expires=true, the container engine also begins to regularly check the network diagnostics app for its status. If the container engine determines during such a check that the network diagnostics app has been installed and is still running for at least 8 hours, the container engine stops the network diagnostics app, uninstalls it, and notifies the device operator that the network diagnostics app has been uninstalled. This scenario can occur if the device operator has forgotten to uninstall the network diagnostics app after using it.

[0039] As an alternative to the device operator defining the tag for the network diagnostics app, the tag can be explicitly defined by a developer of the network diagnostics app. This can be done, for example, when creating a container image or by selecting an app category, such as "diagnostics" or "regular operation," from a predefined set when publishing the app. Even if the device operator defines the tag, it can be selected from a predefined set to simplify use, management, and portability to other systems. According to another alternative, a tag can be assigned automatically or implicitly, particularly depending on the permissions requested by an app. It is contained in deployment information for an app, for example, in a docker-compose.yml configuration file that the app wants to share a host's process ID namespace, a corresponding tag can be automatically added to the app's metadata. This can occur, in particular, when publishing the app, downloading the app to the management system 200, or loading the app onto the server device 100.

[0040] A simple version of the network diagnostics app policy can be defined for the entire automation device on which the network diagnostics app is running. For example, such a policy can ensure that the device operator is warned about all apps with the "diagnostic" tag if the respective app has been installed on the automation device for more than 11 hours. Furthermore, such a warning can include a note that the respective app will be automatically uninstalled 12 hours after its installation. The device operator can optionally be offered the option of keeping the app installed on the automation device even after the 12 hours have elapsed, at their express request.

[0041] Another example of a possible policy for apps is when a specified period of inactivity has been exceeded. Such a policy can be device-specific or valid for a range of devices. Alternatively or additionally, other apps running on a device can also be taken into account by a policy. In particular, it can be specified that apps with a specific tag are allowed to remain installed and running on a device as long as another app, for example, one that processes critical production data, is not running at the same time.

[0042] A policy can also take device states into account. For example, if a device is in a setup or maintenance state, selected apps can run without time restrictions. If, however, the device is in an active operating mode, the respective expiration conditions are checked. In particular, the policy can be set dialog-based by the device operator during device setup. For this purpose, the following options are queried, for example, in a graphical user interface or a command-line interface: "Automatically uninstall diagnostic applications 12 hours after last use? [Y / N]", ("Automatically uninstall application after stopping? [Y / N]" before loading an app or "Ask every 2 hours whether to stop the app? [Y / N]".

[0043] In this way, policies tailored to individual requirements can be created with little effort.

Claims

1. Method for providing control applications for an industrial automation system, in which - the control applications (201-204) are in each case provided by means of sequential control components (131-133), which can be loaded into a sequential control environment (112) formed by means of a server facility (100), where they can be executed, characterised in that - control applications (201-203) that require selected safety permissions are in each case assigned an identifier (210) as safety-critical control application, - for the control application (201-203) to which an identifier (210) is assigned as safety-critical control application, at least one sequence condition is stipulated for the selected safety permissions in each case, - during an execution of the sequential control components (131-133), the sequential control environment (112) monitors an occurrence of the respective sequence condition for the control applications in each case, - the execution of the sequential control components is terminated on the occurrence of the respective sequence condition in each case.

2. Method according to claim 1, in which the execution of the sequential control components is terminated in each case by execution of an action, defined in a safety guideline, on the occurrence of the respective sequence condition.

3. Method according to claim 2, in which the defined action comprises stopping and / or removing the respective sequential control component.

4. Method according to one of claims 2 or 3, in which the sequence condition is stipulated in each case by the safety guideline as a function of the identifier of the respective control application.

5. Method according to one of claims 1 to 4, in which a safety guideline to be applied in each case is stipulated by the identifiers of the control applications.

6. Method according to one of claims 1 to 5, in which functions of the control applications and / or safety permissions necessary to provide the control applications are designated or specified by the identifiers in each case.

7. Method according to one of claims 1 to 6, in which the identifiers are added to metadata for the respective control application as a character string in each case.

8. Method according to one of claims 1 to 7, in which the execution of the sequential control components in each case is only started when a sequence condition has not yet occurred.

9. Method according to one of claims 1 to 8, in which the sequence conditions comprise a maximum execution duration for the respective sequential control component in each case.

10. Method according to one of claims 1 to 9, in which the sequential control components are software containers and in which the sequential control environment is a container runtime environment.

11. Method according to claim 10, in which storage maps for the software containers can be retrieved from a storage and provision system that can be accessed by a large number of users in a reading and / or writing manner.

12. Method according to one of claims 1 to 11, in which the sequential control components can be migrated to other server facilities in each case, where they are executed, and / or can be executed simultaneously on other server facilities in each case.

13. System for providing control applications for an industrial automation system with - a sequential control environment (112) formed by means of a server facility (100), - at least one sequential control component (131-133) for providing a control application (201-204), wherein the sequential control component can be loaded into the sequential control environment (112), where it can be executed, - characterised in that the system is configured so that control applications (201-203) that require selected safety permissions are in each case assigned an identifier (210) as safety-critical control application, and that - for the control application (201-203) to which an identifier (210) is assigned as safety-critical control application, at least one sequence condition is stipulated for the selected safety permissions in each case, - wherein the sequential control environment (112) is configured, during an execution of the sequential control components (131-133), so as to monitor an occurrence of the respective sequence condition for the control applications in each case and that - the execution of the sequential control components is terminated on the occurrence of the respective sequence condition in each case.