Method for operating a networked IoT device in an automation network, computer program, IoT device and automation network

Abstract

The present invention relates to a method for operating a system comprising a mobile radio module and an IoT device for configuring a mobile radio capability of the IoT device, in which method an extent of use of a subscriber identification module of the mobile radio module is configured depending on authorization information that depends on the IoT device.

Description

[0001] Description

[0002] Method for operating a networked IoT device in an automation network, computer program, IoT device and automation network

[0003] The invention relates to a method for operating a networked IoT device in an automation network with at least one application and a computer program, an IoT device and an automation network.

[0004] In IT environments, such as digitalized office environments, servers, or data centers, it is common practice to configure security policies and implement them on end devices managed via a network. These security policies specify, for example, which procedures may be used for network authentication, which root certificates are recognized, or whether and how an application may interact with other network components. On the one hand, IT security is the primary focus. On the other hand, the affected end devices are typically not restricted, so the additional burden of encrypting a connection is insignificant.

[0005] In industrial environments, i.e. in the area of ​​"Operation Technology" (OT) or the Industrial Internet of Things (IoT), it is often not possible to enforce a security policy during ongoing operation of a plant, since a security measure specified by a security guideline could impair the operation of the plant. Impairments can affect the regular process, e.g. through delays in processes or even total failure. Influences on the safety of a plant are also possible, so that hazards for the operating personnel can arise. It is therefore an object of the invention to specify an improved method for operating a networked IoT device in an automation network which in particular does not have the aforementioned disadvantages.Furthermore, it is an object of the invention to provide an improved computer program product, an improved IoT device and an improved automation network with which, in particular, the improved method can be carried out.

[0006] This object of the invention is achieved by a method having the features specified in claim 1, a computer program product having the features specified in claim 12, an IoT device having the features specified in claim 13, and an automation network having the features specified in claim 14. Preferred developments of the invention are specified in the associated subclaims, the following description, and the drawings.

[0007] The method according to the invention is a method for operating a networked IoT device in an automation network with at least one application running on the IoT device and with at least one security policy implemented on the IoT device with at least one security function. In the method according to the invention, at least one security function is selected for the at least one application depending on a device state of the IoT device in a productive process, and the IoT device is operated with the application with the at least one security function.

[0008] By means of the method according to the invention, a security policy with the at least one dynamically defined security function can advantageously be enforced even in industrial environments, i.e. in the field of Operation Technology (OT) and the Industrial Internet of Things (also referred to as I IoT: I IoT = (English) “Industrial Internet of Things”), since taking the device status into account enables continuous and risk-free operation of the networked IoT device. Consequently, dynamically defined security functions can also be used in 0T and / or I IoT environments without the productivity or reliable operation of the 0T or I IoT environment being impaired. The method according to the invention is particularly preferably used for operating industrial IoT devices.Advantageously, regular IT security scanning can also be carried out in industrial environments using the method according to the invention.

[0009] It is understood that the terms security policy and security function are preferably terms from security in the sense of IT security, regularly referred to as "IT security". Security policy means in particular a set of one or more security rules, which are also known as "security policy". Security function is preferably understood as "security functionality" or "security function".

[0010] By means of the method according to the invention, it is possible to provide a graded security policy that allows at least one security function adapted to the respective device state, which can also be used reliably in mission-critical 0T and / or I IoT environments.

[0011] In the method according to the invention, the IoT device is preferably a manufacturing device or a maintenance device or a control or regulating device for a manufacturing device or a maintenance device or a monitoring device for a manufacturing device or a maintenance device.

[0012] The manufacturing environment, in particular digital manufacturing, as well as maintenance, are safety-critical environments in which the method according to the invention either enables safer operation than previously known or a predetermined level of safety can be advantageously achieved during ongoing operations during manufacturing or maintenance, since the implementation of the safety guidelines does not require manual adjustment of the safety guidelines and, if necessary, an interruption of manufacturing or maintenance, but can be automated based on automated recording of the current device status in the production process.

[0013] In the method according to the invention, the device state preferably comprises an operating state of the IoT device, in particular an operating state for carrying out a current work step of the IoT device, or the device state is the operating state of the IoT device. In particular, the operating state of the IoT device is an essential parameter for implementing a security policy, since depending on the operating state of the IoT device, computing resources are available or not, for example for encrypted communication using an application set up for communication or for security monitoring of an application. In addition, depending on the operating state of the device, different privileges are regularly available for applications, for example in an update mode for updating software of the IoT device or in a maintenance mode for maintaining the IoT device.

[0014] Ideally, the operating state of the IoT device for executing a current work step of the IoT device depends on this work step, i.e., the executed work step characterizes or defines precisely this operating state of the IoT device. This distinguishes the operating state from other operating states of the IoT device in the respective work steps being executed. Particularly preferably, the work step is a manufacturing step or a maintenance step, and the IoT device is preferably a manufacturing device or a maintenance device.

[0015] Alternatively or additionally, and also preferably, the current work step can be a control and / or regulation step for controlling a manufacturing step or maintenance step, wherein the IoT device is preferably a control and / or regulation device, or a monitoring step for monitoring a manufacturing step or maintenance step. In the latter case, the IoT device is preferably a monitoring device.

[0016] In the method according to the invention, the device state is expediently or includes a communication environment of the IoT device, in particular a signal connection of the IoT device. Depending in particular on the communication environment of the IoT device, one or more security functions with different security levels can be implemented. Thus, a different, usually lower, security standard applies to isolated communication within the automation network than to external communication leading into or out of the automation network.

[0017] In the method according to the invention, the device state suitably comprises a resource utilization, in particular a memory utilization and / or a processor utilization. The resource utilization is a particularly relevant parameter since the at least one safety function often requires a certain, relative, proportion or a certain, absolute, size of resources, for example of available memory or available computing power, for safe operation. If the resource utilization is too high as a result of the at least one additional safety function, IT security may be maintained, but the functional reliability of the IoT device may be disrupted. In this development of the method according to the invention, however, the functional reliability can be reliably maintained.

[0018] In the method according to the invention, the at least one security function is preferably selected from a database or from a configurable list of two or more security functions depending on the device status. Thus, at least two security functions are available for a tiered security policy, allowing dynamic adaptation of the security functions depending on the device status.

[0019] In the method according to the invention, the database for the IoT device preferably has two or more specific security functions. In an alternative or additional and likewise advantageous development of the method according to the invention, the database for a device class of the IoT device has two or more specific security functions.

[0020] In the method according to the invention, the security measure is selected when the IoT device is started and / or when the application is started and / or at repeated, successive, particularly regular, time intervals. This development of the invention enables continuous and ongoing dynamic adaptation of the security function.

[0021] In the method according to the invention, in an expedient development of the invention, the security function comprises specifications for authentication with communication partners of the IoT device and / or specifications for security protocols and / or specifications for monitoring communication connections. By means of the aforementioned security functions, the security of the method according to the invention is advantageously significantly increased.

[0022] The method according to the invention is preferably carried out in a computer-implemented manner.

[0023] The computer program product according to the invention is designed to carry out the method according to the invention as explained above when it is executed on an IoT device. The computer program product according to the invention has an input interface for information on the device status and a database with at least two security functions for operating at least one application as well as at least one selection component for selecting a security function for the application depending on the information on the device status and an enforcement component for enforcing the security function. In this development of the invention, the method according to the invention can therefore be computer-implemented and automated without manual intervention and can therefore be carried out particularly efficiently.

[0024] The IoT device according to the invention is designed to carry out a method according to the invention as described above and in particular has a computer program product as described above. The IoT device according to the invention has at least one application implemented on the IoT device and at least one security policy implemented on the IoT device with at least one security function, wherein the at least one security function for the at least one application can be activated depending on a device state of the IoT device and wherein the IoT device is designed to be operated with the application with the at least security function. The IoT device according to the invention advantageously results in the same advantages as already described for the method according to the invention.Preferably, the features optionally described in the description of the method according to the invention are implemented, to the extent feasible, for the IoT device according to the invention. These preferred developments also yield the previously described advantages of the invention.

[0025] The IoT device according to the invention is preferably a manufacturing device or a maintenance device or a control or regulating device for a manufacturing device or a maintenance device or a monitoring device for a manufacturing device or a maintenance device. In this development of the IoT device according to the invention, the IoT device is advantageously an industrial IoT device and / or an IoT device in an OT environment. The automation network according to the invention has at least one IoT device according to the invention as described above. The automation network is designed to carry out a method as described above and / or at least one, several or all of the at least one IoT device is / are an IoT device according to the invention as described above.

[0026] The invention is explained in more detail below using an exemplary embodiment illustrated in the drawing. In the drawings:

[0027] Fig. 1 shows an automation network according to the invention with IoT devices according to the invention for carrying out a method according to the invention schematically in a principle sketch and

[0028] Fig. 2 shows a flow diagram of the method according to the invention schematically in a flow diagram.

[0029] The two IIoT components (IIoT = "industrial internet of things") IIOTC shown in Figure 1 each form networked production devices, each of which is integrated into an automation network AN via signal connections. In the illustrated embodiment, these I IoT components IIOTC have various sensors S and actuators A. The sensors S provide information that is used directly to control the actuators A of the I IoT component IIOTC to which the sensors S belong. This is accomplished with an IO module application IOMA, which runs on the respective IIoT component IIOTC in a runtime environment RTE, which is embedded in a firmware FIW. The sensor information is simultaneously forwarded to other I IoT components IIOTC, which use it to control their locally connected actuators A.For each locally installed IO module application I0MA as well as for other applications that run on the I IOT components I IOTC, a security guideline, i.e. a security policy, is provided by an Application Manager AM. This security policy is managed by the Security Policy Manager SPM. The security policy defines security-relevant boundary conditions for the execution of various security mechanisms for one of the aforementioned applications or for a group of applications. The current utilization of the local, i.e.Information is transmitted about the resources managed by the respective I IOT component I IOTC, here storage space and available CPU time, as well as about the current operating state of the component, so that the Security Policy Manager SPM uses the security policies to determine the respective security measures based on the resource utilization. The operating state of the I IOT component I IOTC, which determines the respective security policy, and the resource utilization, which determines the respective security measures based on the respectively determined security policy, together form the device state of the I IOT component I IOTC within the meaning of the present application.

[0030] In this case, the Security Policy Manager (SPM) can determine a security policy for the IOT component for possible operating states of the I IoT component I IOTC and for each individual application. Using a determination step EVALDEVSTA (see Fig. 2), the operating state of the I IoT component I IOTC is first determined.

[0031] To select a security policy for the respective application, the Security Policy Manager uses an assignment table to execute an assignment step CONSSECPOL. The assignment table contains an assignment of operating states and security policies for each application, so that a security policy can be assigned to each operating state determined using the determination step EVALDEVSTA using the assignment step CONSSECPOL. For this purpose, the assigned security policy is selected based on the determined operating state and specified in a determination step DECSECPOL. The security policies define the respective security measures based on predefined absolute and relative limits for the respective resource utilization, i.e. for the memory utilization and the available CPU time.

[0032] Thus, in the case of the I IoT components I IOTC according to the invention, the security measures are automatically determined depending on a device state characterized by the respective resource utilization and the respective operating state.

[0033] Each security policy of the assignment table maintained by the Security Policy Manager SPM now determines which security mechanisms are possible, for example, when opening a communication connection or when locally authenticating a user based on the operating state and resource utilization of the I IOT component I IOTC.

[0034] In the illustrated embodiment, the security guidelines contain an assignment to the respective application for which the respective security guideline is valid, as well as an indication of the dependency on the respective boundary conditions for the respective application, in the illustrated embodiment the dependency of the respective security measures on the currently available memory and the current processor load as well as on the respective manufacturing step undertaken by the I IoT component I IOTC and the currently used communication protocol.

[0035] The security measures specified in the security policy are now determined in a security measure determination step EVALSECMEAS depending on the current boundary conditions, i.e. the current resource utilization in accordance with the security policy. In the illustrated embodiment, neither the resource utilization nor the respective operating state of the I IoT component I IOTC are constant, but also depend on applications currently running on the respective I IoT component I IOTC as well as on a production step currently being executed by the I IoT component I IOTC. Therefore, in the illustrated embodiment, the respective device state of the I IoT component I IOTC is monitored using the monitoring step MONDEVSTA.If the operating state of the I IoT component I IOTC or the resource utilization of the I IoT component I IOTC changes, the security policy is adapted depending on the operating state and the security measure provided in the security policy is adapted depending on the resource utilization.

[0036] In addition, the security policy contains a predefined security measure for the respective application for authentication for local access and / or remote access as well as for integrity or confidentiality protection of communication with other I IoT components I IOTC and for authorization for access to the application or from the application, whereby the predefined security measure provides alternative security measures depending on the respective resource utilization, which replace the predefined security measure, whereby the alternative security measures provide for extended local logging and the inclusion of a security policy support component SPSC available in the automation network AN by means of address information of the security policy support component SPSC laid down in the security policy,which is designed to monitor the respective application on the respective I IoT component I IOTC.,

[0037] In addition, the security policy stipulates that information about the use of weaker security mechanisms of the respective I IoT component I IOTC be transmitted to such edge component or such I IoT components I IOTC that are signal-connected to the affected I IoT component I IOTC for data exchange. This information can be taken into account by the signal-connected edge component or the signal-connected I IoT components I IOTC during data evaluation by the signal-connected edge component or the signal-connected I IoT components I IOTC.

[0038] Furthermore, security measures can be enforced in a security policy enforcement module (PEP). This can, for example, prevent external communication from being established directly with the affected I IoT component I IOTC if the security measure requires end-to-end security. In this case, communication can be established via the security policy support component SPSS as a proxy, which can then implement the necessary security mechanisms instead of the I IoT component I IOTC.

[0039] Below is an example list of security policies (left column) depending on the operating state (middle column) of the respective I IoT component I IOTC for a respective application. The security policies include individually specific dependencies (right column) on the resource utilization of the respective I IoT component I IOTC and other dependencies as specified for the security policy.

[0040] In further embodiments not specifically illustrated, the I IoT component I IOTC is a control and / or regulating device, wherein the respective manufacturing step can be replaced by a control and / or regulating step for controlling a manufacturing step, or the I IoT component I IOTC is a monitoring device for monitoring a manufacturing step. In the latter case, the I IoT component I IOTC is preferably a monitoring device.

[0041] In the above-mentioned embodiments, a maintenance step can also be carried out instead of the respective manufacturing step.

Claims

Patent claims 1. Procedure for operating a networked IoT device (IIOTC) in an automation network (AN) with at least one application (APP) and with at least one security policy implemented on the IoT device (IIOTC) with at least one security requirement, in which at least one security function for the at least one application is selected depending on a device state of the IoT device (IIOTC) (EVALSESCMEAS) and in which the IoT device (IIOTC) is operated with the application with the at least one security function.

2. A method according to the preceding claim, wherein the IoT device (IIOTC) is a manufacturing device or a maintenance device or a control and / or regulating device for a manufacturing device or a maintenance device or a monitoring device for a manufacturing device or a maintenance device.

3. Method according to any of the preceding claims, wherein the device state comprises an operating state of the IoT device (IIOTC).

4. A method according to any of the preceding claims, wherein the device state is an operating state of the IoT device (IIOTC) for performing a current work step of the IoT device (IIOTC) or comprises such an operating state of the IoT device for performing a current work step of the IoT device (IIOTC), wherein the work step is preferably a manufacturing step or maintenance step or a control and / or regulation step for controlling a manufacturing step or maintenance step or a monitoring step for monitoring a manufacturing step or maintenance step. A method according to any one of the preceding claims, wherein the device state is or comprises a communication environment of the IoT device (IIOTC), in particular a signal connection of the IoT device (IIOTC). A method according to any one of the preceding claims, wherein the device state comprises resource utilization, in particular memory utilization and / or processor utilization. A method according to any one of the preceding claims, wherein the at least one security function is selected from a database or from a configurable list of two or more security measures, depending on the device state. A method according to any one of the preceding claims, wherein the database has security functions specific to the IoT device (IIOTC). A method according to any one of the preceding claims, wherein the database has security functions specific to a device class of the IoT device (IIOTC).A method according to any of the preceding claims, wherein the security measure is selected (EVALSESCMEAS) upon startup of the IoT device (IIOTC) and / or upon startup of the application and / or at repeatedly successive, in particular regular, time intervals. A method according to any of the preceding claims, wherein the security function comprises specifications for authentication with communication partners of the IoT device (IIOTC) and / or specifications for security protocols and / or specifications for monitoring communication connections. Computer program product for executing a method according to one of the preceding claims, when executed on an IoT device (IIOTC) which has an input interface for information on the device state, a database with at least two security functions for operating at least one application, and at least one selection component for selecting a security function for the application depending on the information on the device state, and an enforcement component for enforcing the security function.IoT device configured to execute a method according to one of the preceding claims, in particular with a computer program product according to claim 11, with at least one application (APP) implemented on the IoT device (IIOTC) and with at least one security policy implemented on the IoT device (IIOTC) with at least one security function, wherein the at least one security function for the at least one application can be activated depending on a device state of the IoT device (IIOTC) and wherein the IoT device (IIOTC) is configured to be operated with the application with the at least one security function, wherein the IoT device is in particular a manufacturing device or a maintenance device or a control or regulation device for a manufacturing device or a maintenance device or a monitoring device for a manufacturing device or a maintenance device. Automation network with at least one IoT device. (IIOTC) , wherein the automation network is configured to execute a method according to one of claims 1 to 10 and / or at least one, several or all of the at least one IoT device (IIOTC) is an IoT device (IIOTC) according to one of claims 12 or 13. Automation network according to the preceding claim, which is a manufacturing network or a maintenance network.

Images