METHOD AND SYSTEM FOR PROVIDING CONTROL APPLICATIONS

Description

[0001] The present invention relates to a method for providing control applications, in particular control applications for an industrial automation system, and a system for carrying out this method.

[0002] Industrial automation systems typically comprise a multitude of automation devices interconnected via an industrial communication network and serve to control or regulate plants, machines, or equipment within the context of manufacturing or process automation. Due to time-critical conditions in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, Real-Time Ethernet, or Time-Sensitive Networking (TSN) are predominantly used for communication between automation devices. In particular, control services or applications can be automatically and load-dependently distributed across currently available servers or virtual machines within an industrial automation system.

[0003] Interruptions in communication links between computer units of an industrial automation system or automation devices can lead to an unwanted or unnecessary retransmission of a service request. Furthermore, messages that are not transmitted or are incompletely transmitted can, for example, prevent an industrial automation system from transitioning to or remaining in a safe operating state.

[0004] WO 2022 / 042905 A1 concerns a method for providing time-critical services, each of which is assigned at least one server component. This server component is formed by a control flow component that can be loaded into and executed within a control flow environment. Each server component provides a functional unit for processing a stack of communication protocols, which is connected to a functional unit associated with the control flow environment for processing a stack of communication protocols. The services each include a directory service component for retrieving services provided by the control flow environment. The directory service components are interconnected via a separate communication interface.The separate communication interface is connected to an aggregator component formed by means of another flow control component, which makes information about the services provided by the server components available outside the flow control environment.

[0005] The earlier European patent application with application number 21212849.0 describes a method for providing control applications, in which the control applications are provided by means of sequence control components that can be loaded into and executed in a sequence control environment created by a server. Control applications requiring specific safety authorizations are each assigned a designation as a safety-critical control application. For each control application assigned a designation as a safety-critical control application, at least one execution condition is defined for the selected safety authorizations. During the execution of the sequence control components for the control applications, the sequence control environment monitors for the occurrence of each respective execution condition.The execution of the process control components is terminated upon the occurrence of the respective process condition.

[0006] US 2019 / 182295 A1 concerns the distribution and management of services in virtual environments. System services and applications are distributed across multiple containers, which run in separate runtime environments for services on the one hand and for the applications using the services on the other. In particular, a service control manager is provided to enable communication between a client stub within a client runtime environment and a service within a service runtime environment.

[0007] From EP 3 937 039 A1, a method for the extended validation of a container image is known, comprising a base image and at least one application layer that performs at least one modification operation on the base image. First, a unique cryptographic base signature is generated for the base image by a builder device of a base image manufacturer. The base signature is provided to a container builder device. Furthermore, a container image is created in the container builder device, comprising at least the base image and the base signature. The container image is provided to a guest computer, and the base signature in the container image is verified by a runtime environment of the guest computer. The container image is executed only if the verification of the base signature yields a positive result.

[0008] Due to the increasingly flexible functional design of industrial automation devices, the use of control applications that can be loaded into these devices is on the rise. These control applications can be made available, for example, through container virtualization. In particular, control applications for analyzing data traffic within an industrial automation system or for analyzing control processes running in automation devices require extensive privileges or security authorizations. Without additional protective measures, compromising such a control application can cause serious security risks, at least for the industrial automation device on which the compromised control application is installed. For this reason, the transparent and controlled use of elevated privileges for control applications is of crucial importance.

[0009] Granting elevated privileges to control applications is problematic because the intended use of these privileges is often unclear. This significantly complicates compliance with device security policies. Furthermore, a compromised control application can misuse elevated privileges for purposes for which it was not originally intended. Additionally, a control application's privileges are typically tied to its lifecycle. This necessitates the ongoing management of access permissions granted to control applications for security-critical interfaces. However, such access management is complex and prone to errors.

[0010] The present invention therefore aims to provide a method for providing control applications requiring extensive security authorizations, which ensures a comprehensible and needs-based granting of privileges for the control applications, and to specify a suitable device for carrying out the method.

[0011] This problem is solved according to the invention by a method having the features specified in claim 1 and by a system having the features specified in claim 12. Advantageous embodiments are specified in the dependent claims.

[0012] According to the inventive method for providing control applications, the control applications are provided by means of process control components, which are loaded into and executed in a process control environment formed by a server. In particular, the process control components can be or comprise software containers, each of which runs in isolation from other software containers or container groups, e.g., pods, within the process control environment on a host operating system of a server. Alternatively, micro-virtualization concepts, such as Snaps, can also be used for the process control components. Preferably, the software containers, together with other software containers running on the respective server, use a common kernel of the server's host operating system.For example, memory images for the software containers can be retrieved from a storage and deployment system that is accessible for reading and writing by a large number of users.

[0013] The control environment can be, in particular, a container runtime environment or container engine, through which virtual resources are created, deleted, or linked. These virtual resources include software containers, virtual communication networks, and their associated connections. For example, the control environment can include a Docker Engine or a Snap Core running on a server. Other (orchestrated) container runtime environments, such as Podman or Kubernetes, can also be used.

[0014] For control applications whose execution requires specific privileges, a specification of the required safety-critical resources is created. Based on these specifications, an additional control flow component is identified that is intended to provide access to the required safety-critical resources. The identified additional control flow component is loaded into the control flow environment, and its execution is started along with the additional control flow component.

[0015] Furthermore, according to the invention, the sequence control environment provides an interface for interprocess communication between the respective sequence control component and the additional sequence control component. Accordingly, access to the required safety-critical resources is provided via interprocess communication between the respective sequence control component and the additional sequence control component.

[0016] The present invention enables control applications to be granted reliable, accurate, and efficient access to safety-critical functions, interfaces, or resources by providing at least one additional, suitable sequence control component. In principle, one additional, dedicated sequence control component can be provided for each safety-critical function, interface, or resource. The use of additional sequence control components eliminates the need for the otherwise complex identification of an API caller (application programming interface) or a computing process assigned to the respective control application.

[0017] Furthermore, the present invention offers an advantage over token-based approaches for granting elevated privileges in that access rights granted via the additional control flow component cannot be readily determined by other system components or by potential attackers. In contrast, an application with extensive read rights can easily read and misuse access tokens. Advantageously, the additional control flow component monitors whether access to the required security-critical resources is requested or provided in accordance with a security policy applicable to the respective control flow component or host.

[0018] According to the invention, the specifications are created as part of the configuration information for the respective control flow component. The configuration information includes at least one memory image for the respective control flow component and application-specific settings. The configuration information is used for loading and executing the respective control flow component. The configuration information can be deployment information for control applications, such as docker-compose.yml configuration files. In this way, the access rights required by control applications for safety-critical functions, interfaces, or resources can be made transparent as part of the respective deployment information.

[0019] According to a further embodiment of the present invention, the configuration information for the process control components is supplemented in accordance with the respective specifications. Preferably, the configuration information is evaluated by a management component assigned to the process control environment and supplemented according to the specifications. The process control environment accepts only additions to the configuration information made by the management component, while configuration information added by other means is rejected by the process control environment. This effectively ensures that safety-critical resources or interfaces can only be used in the intended manner.

[0020] Furthermore, the specifications of the required safety-critical resources can be checked against a device-specific security policy by the management component. Depending on the test result, the configuration information for the respective process control component is adjusted by the management component. In this way, the use of safety-critical resources can be precisely controlled by applying a device-specific security policy, taking individual circumstances into account.

[0021] A security policy (also known as a security policy) is typically a technical or organizational document used to implement and achieve existing security requirements within companies or institutions. Key components include ensuring the integrity, confidentiality, availability, and authenticity of protected information. For example, a security policy for a datagram filter component or a firewall specifies how a particular configuration is implemented, which access rights are granted, how logging is handled, and what defensive measures the datagram filter component or firewall takes in an attack scenario. A security policy can be in the form of a configuration file, an XML file, or a device configuration that is directly machine-readable.It is also possible for a security policy to exist in textual form, which is evaluated using methods based on artificial intelligence or machine learning. Furthermore, it is possible for a security policy to exist in graphical form, which is evaluated using image processing or pattern recognition methods.

[0022] Preferably, the additional control flow component monitors and controls access to the required security-critical resources by the respective control flow component, based on a security policy applicable to that component. In particular, this allows for precise determination of which privileged operations a control application actually performs. The security policy can be easily and reliably derived, for example, from the specification of the required security-critical resources by the additional control flow component or by an administrative component associated with the control flow environment. Furthermore, the security policy can be adapted during the execution of the respective control flow component based on events or administrator intervention.This allows for even more precise control over the use of safety-critical resources.

[0023] According to a particularly preferred embodiment of the present invention, several additional sequence control components are pre-installed on a host on whose operating system the sequence control environment is installed. This significantly simplifies the management of access for the control applications to the required safety-critical resources. In particular, a pre-installed additional sequence control component can be easily and reliably linked to the lifecycle of the sequence control component of the respective control application. Furthermore, this eliminates the need for separate management of the additional sequence control component and the respective sequence control component. Separate management is typically error-prone and complex.

[0024] Advantageously, the interface for interprocess communication between the respective process control component and the additional process control component is provided by the host operating system. Conversely, the additional process control component preferably accesses the safety-critical resources required by the respective process control component via a host interprocess communication interface. This ensures particularly secure control of access to the safety-critical resources.

[0025] The system according to the invention for providing control applications is designed to carry out a method as described above and comprises a sequence control environment formed by means of a server and at least one sequence control component for providing a control application. The sequence control component is loaded into the sequence control environment and executed there. The system is configured to create a specification of required safety-critical resources for control applications whose execution requires specific privileges. Furthermore, the system is configured to determine, based on these specifications, an additional sequence control component that is intended to provide access to the required safety-critical resources.

[0026] The process control environment of the system according to the invention is configured to load the identified additional process control component into the process control environment, to start the execution of the respective process control component together with the additional process control component, and to establish an interface for interprocess communication between the respective process control component and the additional process control component. Furthermore, the system is configured to provide access to the required safety-critical resources via interprocess communication between the respective process control component and the additional process control component.

[0027] The present invention is explained in more detail below using an exemplary embodiment with reference to the drawing. It shows Figure 1 shows a system for providing control applications that require selected security authorizations; Figure 2 shows a process flow for providing control applications using the system described in Figure 1. Figur 1 depicted system.

[0028] The in Figur 1 The depicted system comprises a host 100 for providing control applications of an industrial automation system by means of sequence control components 131, which in this embodiment are implemented by software containers. The control applications of the industrial automation system are exemplary for time-critical services and can also include monitoring functions.

[0029] The Host 100 can, for example, implement functions of control devices in an industrial automation system, such as programmable logic controllers (PLCs), or of field devices, such as sensors or actuators, using control applications. In this way, the Host 100 can be used, in particular, for exchanging control and measurement variables with machines or devices controlled by the Host 100. The Host 100 can then determine suitable control variables for the machines or devices from the acquired measurement variables.

[0030] Alternatively or additionally, the Host 100 can implement the functions of an operator and monitoring station using control applications, and thus be used to visualize process data or measurement and control variables that are processed or acquired by automation devices. In particular, the Host 100 can be used to display values ​​of a control loop and to change control parameters or programs.

[0031] Furthermore, this includes in Figur 1 The depicted system is a management system 200, through which application packages 201-203 are provided for control applications. The application packages 201-203 each comprise at least one image 210, 220, 230 for a software container, as well as associated configuration information 211, 221, 231, and are provided specifically for the host 100. The configuration information can be deployment information, such as docker-compose.yml configuration files. Specifically, the configuration information 211, 221, 231 each include at least one specification of an image for the respective software container and application-specific settings. The configuration information 211, 221, 231 is used for loading and executing the respective software container, respectively.

[0032] For control applications whose execution requires selected privileges, configuration information 211, 221 each includes a specification 212, 222 of required safety-critical resources 101-103. The following excerpt from a docker-compose.yml configuration file shows an example of a specification for read-only access to a Docker socket using labels or key-value pairs, which are shown in bold in the following excerpt: services: my-app-service: image: my-app-image:latest build: context: . labels: "com.my-app-service.description=My service app" "com.my-app-service.host-interfaces.docker-socket-mode=read-only" "com-my-app-service.host-interfaces.docker-socket-endpoints=containers" ...

[0033] On an operating system 111 of host 100, a flow control environment 112 is installed as an operating system application. The software containers or flow control components 131 can be loaded into this flow control environment 112 and executed there. Flow control components 131 can, in principle, be migrated from host 100 to another host for execution there, or executed simultaneously on other hosts.

[0034] In the present embodiment, the software containers each run in isolation from other software containers, container groups, or pods within the control environment 112 on the operating system 111 of host 100. The software containers, together with other software containers running on host 100, use the same kernel of the operating system 111. The control environment 112 is preferably a container runtime environment or container engine.

[0035] Isolation of software containers or of selected operating system resources from one another can be achieved primarily through control groups and namespaces. Control groups allow you to define process groups to restrict available resources to selected groups. Namespaces allow you to isolate or hide individual processes or control groups from other processes or control groups by virtualizing resources of the operating system kernel.

[0036] To provide control applications that require selected security permissions, these control applications are configured according to step 1 of the process described in Figur 2 In the depicted process flow, a specification 212, 222 of the required safety-critical resources 101-103 is created as part of the configuration information 211, 221. The configuration information 211, 221 is evaluated by a management component 113 assigned to the process control environment 112 (step 2) and supplemented according to existing specifications 212, 222 (step 3). In this embodiment, the management component 113 also checks the specifications 212, 222 of the required safety-critical resources 101-103 against a device-specific, cryptographically protected security policy 115. Depending on the test result, the management component 113 adjusts the configuration information 211, 221 for the respective process control component 131.

[0037] Preferably, the management component 113 stores the supplemented or adapted configuration information 141 in local storage 114 along with application data 140. In addition to the adapted configuration information 141, this application data 140 also includes a security policy 142, which is used to monitor or control access to the security-critical resources 101-103 for the respective process control component 131. In the present embodiment, the security policies 142 are defined according to step 4 of the [reference to be added]. Figur 2 The procedure shown is derived by the management component 113 from the respective specifications 212, 222 of the required safety-critical resources 101-103 and is advantageously cryptographically protected.

[0038] The following excerpt from a docker-compose.yml configuration file shows modifications made by management component 113 compared to the excerpt above; these modifications are shown in bold in the following excerpt:

[0039] The above example of configuration information 141, customized by management component 113, shows an added service (docker-socket-sidecar-proxy) that has access to an application-specific security policy 142 (socket-policy.json) derived and generated by management component 113, a local interprocess communication interface (Unix domain socket proxy-socket.sock), and a host interprocess communication interface (Docker Daemon API socket docker.sock). The software container (my-app-service) of the control application itself is only granted access to the local interprocess communication interface.

[0040] In contrast to previous service mesh solutions like Istio, a sidecar container is placed in front of a workload container, and routes to the workload container are redirected via the sidecar container, for example, using iptables. In contrast, in this implementation, each individual software container is provided with its own interprocess communication interface, such as a Unix domain socket, a dedicated network interface, or a dedicated shared memory segment. Specifically, this implementation does not involve sharing a network namespace or operating on the same network interface.

[0041] As in the example above, privilege specifications can be implemented using key-value pairs in the form of labels. Alternatively, a dedicated manifest file, an API, or user configuration options can be used. This allows users to adjust their privileges even after installing a control application.

[0042] Preferably, the process control environment 112 is configured to accept only modifications to the configuration information 211, 221 made by the management component 113. Any other modified configuration information is rejected by the process control environment 112.

[0043] Based on specifications 212, 222 or on the adapted configuration information 141, step 5 of the procedure described in Figur 2 In the described procedure, an additional control component 132, pre-installed on host 100, is identified, which is intended for providing access to the required safety-critical resources 101-103. If no suitable additional control component 132 can be identified among several additional control components pre-installed on host 100, the specifications 212, 222 are adjusted in step 10, and the configuration information 211, 221 is re-evaluated (step 2) by the management component 113. Alternatively, the execution of the respective control application can be aborted if a requested resource cannot be provided securely.

[0044] According to step 6 of the in Figur 2 In the depicted process flow, the identified additional sequence control component 132 is loaded into the sequence control environment 112, and an execution of the respective sequence control component 131 is started together with the additional sequence control component 132. The sequence control environment 112 establishes an interface 130 for interprocess communication between the respective sequence control component 131 and the additional sequence control component 132. Access to the required safety-critical resources 101-103 is provided via interprocess communication between the respective sequence control component 131 and the additional sequence control component 132.

[0045] In this embodiment, the interface 130 for interprocess communication between the respective sequence control component 131 and the additional sequence control component 132 is provided by the operating system 111 of the host 100. The additional sequence control component 132, on the other hand, accesses the safety-critical resources 101-103 required by the respective sequence control component 131 via a host interprocess communication interface 110. If the resource is a system file, the additional sequence control component 132 can access it directly.

[0046] The additional flow control component 132 monitors and controls access to the required safety-critical resources 101-103 by the respective flow control component 131 according to step 7 of the [document / section]. Figur 2The depicted process flow depends on the security policy 142, which applies to the respective process control component 131. Accordingly, access to the security-critical resources 101-103 is granted (step 8) or denied (step 9). The security policy 142 can be adjusted during the execution of the respective process control component 131 based on events or administrator intervention. Furthermore, if access to the security-critical resources 101-103 is denied, the specifications 212 and 222 (step 10) and the configuration information 211 and 221 can be re-evaluated (step 2) by the management component 113.Alternatively, if access is denied, a corresponding log entry can be created and the respective control application terminated, especially if the control application attempts to abuse its privileges.

[0047] As an alternative to deriving the security policies 142 by the management component 113, the security policies 142 can also be derived by the respective additional flow control component 132 from the specifications 212, 222 of the required safety-critical resources 101-103. This is particularly possible if only pre-installed, cryptographically secured additional flow control components 132 are used.

[0048] Furthermore, the additional control flow components 132 can be used to monitor, and in particular to log, whether access to the required security-critical resources 101-103 is requested or provided in accordance with a security policy 115, 142, which is to be applied to the respective control flow component 131 or to a respective host 100. According to another embodiment, the additional control flow components 132 can log in a learning mode which resources are being accessed. In this way, a security policy 142 can be created, which is then used operationally after the learning mode has ended.

Claims

1. Method for providing control applications, in which - the control applications are provided in each case by means of sequence control components (131) which are loaded into a sequence control environment (112) formed by a server entity (100) and executed there, - a specification (212, 222) of required security-critical resources (101-103) is established in each case for control applications whose execution demands selected privileges, - an additional sequence control component is loaded into the sequence control environment, - execution of both the respective sequence control component and the additional sequence control component is started, - an interface (130) for interprocess communication between the respective sequence control component and the additional sequence control component is set up by means of the sequence control environment, - the access to the security-critical resources that are required in each case is provided by means of interprocess communication between the respective sequence control component and the additional sequence control component, characterised in that - the additional sequence control component (132) is determined on the basis of the specifications in each case and is used for the purpose of providing access to the required security-critical resources, - the specifications (212, 222) are established in each case as part of configuration information (211, 221) for the respective sequence control component, - the configuration information comprises in each case at least a designation of a memory image (210, 230) for the respective sequence control component and application-specific entries, and is used in each case for the purpose of loading and / or executing the respective sequence control component.

2. Method according to claim 1, in which the configuration information (211, 221) for the sequence control components (131) is extended on the basis of the respective specification (212, 222) in each case.

3. Method according to one of claims 1 or 2, in which the configuration information (211, 221, 231) is evaluated by a management component (113) assigned to the sequence control environment (112) and is extended according to the specifications (212, 222), in which the sequence control environment only accepts extensions to the configuration information that are made by the management component, and in which configuration information that has been extended by other means is rejected by the sequence control environment.

4. Method according to claim 3, in which the specifications (212, 222) of the required security-critical resources (101-103) are checked in each case by the management component (113) against a device-specific security policy (115) and in which the configuration information (211, 221) for the respective sequence control component (131) is adapted by the management component as a function of a check result.

5. Method according to one of claims 1 to 4, in which the additional sequence control component (132) monitors and / or controls the access by the respective sequence control component (131) to the security-critical resources (101-103) that are required in each case, as a function of a security policy (142) which must be applied for the respective sequence control component.

6. Method according to claim 5, in which the security policy (142) is derived by the additional sequence control component (132) or by a management component (113) assigned to the sequence control environment (112) from the specification (212, 222) of the required security-critical resources (101-103) in each case.

7. Method according to one of claims 5 or 6, in which the security policy (142) is adapted during the execution of the respective sequence control component (131) in an event-dependent manner and / or as a function of an administrator intervention.

8. Method according to one of claims 1 to 7, in which a plurality of additional sequence control components (132) are preinstalled on a host (100) on whose operating system (111) the sequence control environment (112) is installed.

9. Method according to claim 8, in which the interface (130) for interprocess communication between the respective sequence control component (131) and the additional sequence control component (132) is provided by the operating system (111) of the host (100) and in which the additional sequence control component accesses the security-critical resources (101-103) that are required for the respective sequence control component via a host interprocess communication interface (110).

10. Method according to one of claims 1 to 9, in which the additional sequence control component (132) monitors whether the access to the security-critical resources (101-103) that are required in each case is requested and / or provided in compliance with a security policy (115, 142) which must be applied for the respective sequence control component (131) and / or for a respective host (100).

11. Method according to one of claims 1 to 10, in which the sequence control components (131, 132) are software containers and in which the sequence control environment (112) is a container runtime environment.

12. System for providing control applications, comprising - a sequence control environment (112) which is formed by a server entity (100), - at least one sequence control component (131) for providing a control application, wherein the sequence control component can be loaded into the sequence control environment (112) and executed there, - wherein the system is set up such that a specification (212, 222) of required security-critical resources (101-103) is established in each case for control applications whose execution demands selected privileges, and such that - on the basis of the specifications, an additional sequence control component (132) is determined in each case for the purpose of providing access to the required security-critical resources, wherein the specifications (212, 222) are established in each case as part of configuration information (211, 221), which comprises in each case at least a designation of a memory image (210, 230) for the respective sequence control component and application-specific entries and is used in each case for the purpose of loading and / or executing the respective sequence control component, for the respective sequence control component, - wherein the sequence control environment (112) is set up such that the determined additional sequence control component is loaded into the sequence control environment, such that - execution of both the respective sequence control component and the additional sequence control component is started, and such that - an interface (130) for interprocess communication between the respective sequence control component and the additional sequence control component is set up, - wherein the system is moreover set up such that the access to the security-critical resources that are required in each case is provided by means of interprocess communication between the respective sequence control component and the additional sequence control component.