Method, control instance and computer program product for controlling access to structured data or to functions of an industrial automation arrangement

Abstract

The invention relates to a method and a control instance for controlling access to structured data or functions of an industrial automation arrangement, wherein access to the data or functions is controlled. The data or functions are assigned a classification with a particular confidentiality class (0, …, 3) from a plurality of confidentiality classes (0, …, 3), wherein a user or a technical instance is assigned a user class from a number of user classes, wherein, preferably in the manner of a matrix, an access authorisation is defined for many or each of the confidentiality classes (0, …, 3) and for many or each of the user classes, wherein the access authorisation defines the access restrictions of the users or technical instance of the respective user classes to the data or functions assigned to the respective confidentiality classes (0, …, 3), and wherein, based on the defined restrictions, the access to the data or functions assigned to the respective confidentiality classes (0, …, 3) by the users or technical instances assigned to the respective user classes is controlled. As a result, user access or machine access and authorisations from the confidentiality classifications of the data, or data structures or functions themselves, are controlled and thus a comprehensive approach is provided for automatically determining the authorisation of known users or technical entities for access to and changing of particular data or data structures or functions.

Description

[0001] Description

[0002] Method, control instance and computer program product for controlling access to structured data or to functions of an industrial automation arrangement

[0003] The invention relates to a method for controlling access to structured data or to functions of an industrial automation arrangement according to the preamble of patent claim 1, a control instance for controlling access to structured data or to functions of an industrial automation arrangement according to the preamble of patent claim 11, and a computer program product for controlling access to structured data or to functions of an industrial automation arrangement according to the preamble of patent claim 12.

[0004] With the advent of edge computing in automation (e.g., in manufacturing, buildings, etc.), large amounts of data are generated and automatically transferred to local (on-device), on-premises (on-site), and cloud (e.g., internet) hosted databases. For some sensitive applications, e.g., in the medical and defense industries, customers require strict access control policies enforced throughout the entire data flow. The present invention addresses the configuration and implementation of such data classification policies in industrial automation arrangements, particularly in industrial edge and cloud computing systems / infrastructures.

[0005] As a representative implementation of classification levels, we use the following sensitivity scale (hereinafter also referred to as confidentiality classes):

[0006] 0 - Unrestricted;

[0007] 1 - Restricted (internal only);

[0008] 2 - Confidential; and

[0009] 3 - Strictly confidential. Please note that this scaling serves only as an example or standard specification. The present invention can be easily extended to accommodate user-defined or configurable sensitivity scales or confidentiality classes. In a hierarchical data model, such as typical asset / aspect / variable structures, this classification scheme can be laid out like a tree structure.

[0010] State-of-the-art database technologies enable access and authorization per database. Databases are typically structured into semantic data models that represent a hierarchical asset structure.

[0011] Access control in database technologies is known in the art. Most modern databases (e.g., PostgreSQL, MongoDB, InfluxDB, etc.) are distributed with an integrated database management system (DBMS) that provides access control policies and tools. Although the underlying data structures offered within the database (e.g., subdatabases, resources, buckets, tags, data points, shards, etc.) depend on its implementation, the DBMS will generally provide and manage user access rights for these structures. Many implementations also support integration with corporate directories via standard LDAP (Lightweight Directory Access Protocol) interfaces. Additional security features such as authorization tokens, TLS / SSL (Transport Layer Security / Secure Sockets Layer) encryption, etc., are standard features of such databases.However, these features are primarily aimed at user access control—moderating who can access which data—but they do not address any security / sensitivity classification of the data structures themselves.

[0012] Corporate classification levels for business documents are also known. Enterprise software such as the Microsoft Office suite may support company-specific sensitivity / classification levels. Within an organization, the "Information Protection" feature of MS Office assigns a company-specific sensitivity or confidentiality classification to the current document (e.g., Word, Excel, PowerPoint, etc.). In this case, the data itself receives a "sensitivity classification," but since it is primarily used for local and ad-hoc shared documents, there can be no comprehensive management of data access based on this sensitivity classification, and the assigned classification is tied to the document in question.The permissions or restrictions thus classified with the document in question apply to any use of (this document only) and are both binding and the same for all users of the document. Instead, how effectively a company can moderate the flow of sensitive data depends crucially on human employees' adherence to the established confidentiality policies. This means that employees are responsible not only for correctly assigning the classification but also for knowing and enforcing the conditions under which sensitive documents can be shared.

[0013] In the industrial sector, access control in SCADA systems (SCADA = Supervisory Control and Data Access) is also common. SCADA systems generally offer user management tools to authorize which users are allowed to access the system and with which authorizations. In Siemens WinCC, for example, login access and function / operation authorizations can be assigned per user, as shown in the table in Figure 1.

[0014] The publication US 2015 / 0205977 Al - Rundle et al. "COMPARTMENT-BASED DATA SECURITY" proposes bundling data in special storage structures ("compartments"), each of which is assigned a classification. A user requires the same or a higher classification to access the data in the respective storage structure. The publication EP 3 515 035 Al - Schulz "COMPUTER SYSTEM AND METHOD FOR CONTROLLING ACCESS TO DIGITAL DATA OF A DEVICE" discloses the assignment of property information to a user and access information to digital data, wherein for a user to access data, the user's property information is compared with the respective access information.

[0015] The publication Sandhu et al. "Access Control: Principles and Practice" (IEEE COMMUNICATIONS MAGAZINE, IEEE SERVICE CENTER, PISCATAWAY, US, Vol. 32, No. 9, September 1, 1994 (1994-09-01), pages 40-48) discloses a role-based access concept in which a number of rules ("policies") must be fulfilled simultaneously to access data.

[0016] It is therefore an object of the present invention to control access to data in an industrial environment more reliably and to adapt access authorizations flexibly to the needs of different users and the confidentiality of different data.

[0017] Within the scope of the inventive solution to this problem, files, data streams, or data objects (e.g., variables, assets, functions, applications), or the like—in short, data—can be classified according to their required level of protection. This data classification is taken into account throughout an application, which can span many devices and organizational units, so that users can only access and influence objects of a specific classification (e.g., read and write) based on their authorization level. Typical user interactions that must be managed include:

[0018] - Displaying (reading) assets / aspects / variables and especially the data associated with them,

[0019] - Editing (writing) assets / aspects / variables and especially the data associated with them,

[0020] - Export and import, backup and restore.

[0021] The central point of the classification system is to control the data or "assets" themselves. The concept works both in a system that lacks traditional (personal) user management, as well as in systems that manage human or non-technical users. Managing access to certain classifications requires a link to the system's user management, whereby a user is generally understood as an entity that uses or accesses the data or function or, in general, the "asset," and can therefore also be, in particular, an (external) device, a service, or another "data sink." Even if the examples often shown refer to human users or, in general, persons to whom rights, roles, or the like are assigned, the present invention generally relates to data sinks, interfaces, or APIs.The administrator can assign to each user (in the general sense) which classifications this user (or alternatively all users of a defined group) can access and with which interactions.

[0022] Specifically, the problem is solved by a method according to patent claim 1, a control instance according to patent claim 11 and by a computer program product according to patent claim 12.

[0023] A method for controlling access to structured data or functions of an industrial automation system is proposed, whereby access to the data or functions is controlled. The data or functions are assigned a classification with a specific confidentiality class (0, ..., 3) from a plurality of confidentiality classes (0, ..., 3). A user or a technical instance is assigned a user class from a number of user classes. Preferably, in the form of a matrix, for many or each of the confidentiality classes (0, ..., 3),, 3) and an access authorization is defined for many or each of the user classes, wherein the access authorization defines the access restrictions of the users or technical instance of the respective user class to the data or functions assigned to the respective confidentiality class (0, 3), and wherein, on the basis of the respectively defined restrictions, access to the data or functions assigned to the respective confidentiality classes (0, ..., 3) is controlled by the users or technical instances assigned to the respective user classes. In this way, user or machine access and authorizations are controlled from the confidentiality classifications of the data or data structures or functions themselves, thus providing a comprehensive approach to automatically determine the authorization of known users or technical entities to access and modify certain data or data structures or functions.

[0024] The problem is also solved by a control instance (also called a gatekeeper or system-level gatekeeper) for controlling access to structured data or functions of an industrial automation system. The control instance comprises an input interface for receiving the data to be accessed or an API or the like for accessing functions. The control instance is designed to control access to the data or functions according to one of the methods described above, and the control instance comprises an output interface for accessing the data or functions. This allows the advantages already discussed in the course of the method to be achieved.

[0025] Furthermore, the object is achieved by a computer program product for controlling access to structured data or functions of an industrial automation arrangement, wherein the computer program product, when executed on a computer, is designed to carry out one of the methods described in the patent claims. The method or the control instance is particularly advantageously used in an industrial edge device which has access to (confidential) data of an industrial automation arrangement and at the same time has an interface to a public network (Internet, "cloud"). In this case, the control instance described here can also supplement any firewall by controlling access to data not (only) on a port-based basis, but also on a content-based basis. Industrial edge devices are often equipped with runtime environments for software containers, for example so-calledDocker containers, equipped with an administration system, e.g., Kubernetes, are used. Industrial applications then run encapsulated in a runtime environment. The method or arrangement or service according to the invention (in short: the control instance) can advantageously be encapsulated in its own container and / or run in its own runtime environment and control the data traffic of associated neighboring containers. A software container that is associated with other containers or applications in this way to implement a service is sometimes also referred to as a sidecar container.

[0026] Further advantageous embodiments of the method according to the invention are specified in the dependent patent claims. The features and their advantages described therein also apply mutatis mutandis to the device according to the invention and the computer program product according to the invention. Advantageous embodiments can be implemented both individually and in appropriate combinations with one another.

[0027] In an advantageous embodiment, the type of access, i.e., data operations, distinguishes at least between "read" and "read and write" permissions. This allows the method to be used in a manner compatible with existing access control procedures.

[0028] In the case of access information not being available for a specific combination of confidentiality class and user class, access is advantageously denied or another predefined measure is applied, so that an administrator or similar does not have to fill in every possible combination of user class and confidentiality class, which saves unnecessary work, especially in the case of a matrix-like recording.

[0029] The inventive concept advantageously makes it possible to subsequently modify the restrictions assigned to a confidentiality class and / or user class, with the modified restrictions being applied to subsequent access to the affected data. This significantly simplifies general adjustments to the authorizations or restrictions.

[0030] A key advantage of the invention is that both the data itself can be classified directly and the classification is first assigned to a variable or data source and then automatically assigned to all data generated from or derived from values ​​of this variable or data source. In this case, it is also advantageously possible for the classification to be assigned to a data type and automatically assigned to all data of this type. Inheritance to derived structures, data types or the like is also possible, with advantageously combined data or data types or data structures generated from individual data or data types or data structures, each with its own classification, inheriting the strictest of these classifications overall.

[0031] Advantageously, access to the data assigned to the respective confidentiality classes is controlled by the users of an external interface of a component of the automation arrangement with the data, particularly in a network interface, another data interface or software for a user interface (BuB - Operator Control and Monitoring; "HMI" - Human Machine Interface), who are assigned to the respective user classes. As a result, the internal data flow in a device or a related automation arrangement ("domain") is not disrupted by the control and yet the data is protected from external access, for example by other devices, other programs, network access, access by operating and monitoring devices or the like.

[0032] The assignment of users, which also includes "technical users" in the sense of devices, applications, or interfaces, to user classes can come from an internal usage management system. Alternatively, external identity and access management systems (IAM - Identity + Access Management) such as company directories (LDAP) or the Active Directory familiar from network management can be used. Classification schemes for user classes can also be derived from company-wide systems such as MS Office and then correlated with authorizations.

[0033] The invention is explained below with reference to the drawings.

[0034] Showing:

[0035] Figure 1 shows the state of the art with an assignment of users to user groups and assigned authorizations or restrictions using the example of a SCADA system, and

[0036] Figure 2 shows an inventive classification of data or data structures with confidentiality classes and the associated user classes and the respective associated restrictions.

[0037] The table in Figure 1 shows classic authorization definitions from the state of the art. In the industrial sector, for example, access control in SCADA systems (SCADA = Supervisory Control and Data Access) is known. SCADA systems generally offer user administration tools to authorize which users are allowed to access the system and with which authorizations. In the well-known SCADA system Siemens WinCC, for example, login, access and function / operation authorizations can be assigned per user, as shown in the table in Figure 1. However, these authorizations are only implemented at the general system function level and are not tied to a concept of sensitivity or confidentiality classification of the underlying data structures.

[0038] Figure 2 shows the confidentiality classes 0, ..., 4 in the top row of an authorization matrix, which can be directly assigned to the data or data structures or data sources to be protected; of course, system functions (saving, printing, sending, logging on, etc.) can also be classified as data in the broader sense or as data operations whose access or use is controlled. The table in Figure 2 shows an example of the assignment of user roles (left-hand column) as user classes and permitted interactions / operations per confidentiality class (subsequent columns), with the restrictions (e.g. Hidden - Read Only, Read and Write) being noted in the fields of the matrix. Of course, the information can also be displayed or stored in ways other than a matrix, for example in the form of an XML file with appropriate tags.

[0039] To configure the classification level of the data structure, a web-based user interface is advantageously implemented. Once entered, the classification level is inherited in an asset hierarchy.

[0040] Furthermore, subtrees of the data model cannot have a lower (i.e., more permissive) classification level than their parents.

[0041] Data access is then automatically enforced by a system-level control authority, a so-called "gatekeeper," which simply compares the current user's access / permission level for a particular operation (e.g., read / write) with the confidentiality or sensitivity classifications of the relevant data structures. Data structures requiring a higher permission level or confidentiality class than the current user or user group possesses are simply filtered out when a query response is returned to the user. Modification of read-only data for a user is then just as easily prevented by the gatekeeper.

[0042] In summary, the present invention has the following main features:

[0043] • The confidentiality or sensitivity classification is stored as an inherent property of each asset / variable / object (generally: data).

[0044] • User management (in the sense of authorization management for users, devices, services or other entities accessing data) is specifically implemented to map access rights to the data classification.

[0045] • A system-level controller or gatekeeper is responsible for moderating or controlling the distribution of data to users or other data sinks by:

[0046] • Checks permissions before releasing data to a user;

[0047] • When querying a database, a filter is used that is adapted to the permissions or restrictions of the user in question; and

[0048] • User permissions are checked before changes to the data are allowed.

[0049] Although the above implementation requires a specifically configured assignment of permissions per classification (see table in Figure 2), integration with an existing corporate directory and classification scheme is also possible.

[0050] The classification system is not (necessarily) classically user-based (user in the sense of a person). Based on the classification, it is intended to control whether the data may be processed in a certain function or similar or transmitted via an interface. Thus, the data flows and access of the interfaces / functions are controlled.

[0051] The connection to the user (in the sense of a person) exists insofar as the user interface (e.g., HMI - Human Machine Interface) also enables a data flow that must be controlled. This happens analogously to all other interfaces, e.g.:

[0052] - Variable X has classification Y. The data may only be read via the cloud interface.

[0053] - Variable X has classification Y. The data may only be read via the user interface by user Z.

[0054] Thus, there is no specific function of a (human) user in this system; rather, the "HMI" or other access is one of many interfaces that allow data flows that must be controlled. If a product does not have "human" user management, this concept essentially remains unchanged. What is essential is access control to data, data sources, functions, interfaces, applications, or other "assets" by human users or technical entities, where the latter can in turn be devices, applications, interfaces, functions, or other entities.

[0055] The present invention offers a crucial distinction from existing similar technologies: user access and permissions are automatically derived and enforced based on the confidentiality classifications inherent in the data structures themselves. Thus, data confidentiality is ensured throughout the entire data flow.

[0056] In comparison:

[0057] • Database technologies provide comprehensive user management and access control tools, but the underlying data structures generally do not contain specific sensitivity classification assignments unless they are implemented manually / custom-defined.

[0058] • Similarly, SCADA / WinCC systems typically support user management and system function authorizations, but do not directly relate to an underlying concept of confidentiality classification of the available data structures. Furthermore, WinCC restricts access only to entire system functions, not selectively within the function. Likewise, WinCC would only allow or prevent access to the entire data structure; the present invention, however, selectively controls which data is accessible.

[0059] • Enterprise classification tools such as Microsoft Office's "Information Protection" feature provide a per-document classification of confidentiality, but enforcement of who can access these highly sensitive documents depends on employees accurately implementing and adhering to confidentiality and data sharing policies.

[0060] Put more simply, according to the present invention, user access and permissions, or permitted operations, are controlled based on the sensitivity classifications of the data structures themselves. Consequently, a comprehensive approach is provided for automatically determining the authorization of known users to access and modify a specific data structure – the "system-level gatekeeper" (control authority; computer program / program product for access control) at the system level only needs to compare the user's authorization level from a user class for a desired operation (e.g., read / write) with the sensitivity or confidentiality classification of the data.

Claims

Patent claims 1. A method for controlling access to structured data or functions of an industrial automation arrangement, wherein access to the data or functions is controlled, characterized in that the data or functions are assigned a classification with a specific confidentiality class (0, ..., 3) from a plurality of confidentiality classes (0, ..., 3), that a user or a technical instance is assigned a user class from a number of user classes, that, preferably in the manner of a matrix, an access authorization is specified for many or each of the confidentiality classes (0, ..., 3) and for many or each of the user classes, wherein the access authorization restricts the access of the user or technical instance of the respective user class to the data of the respective confidentiality class (0, ..., 3) are defined, and that, on the basis of the respectively defined restrictions, access to the data or functions assigned to the respective confidentiality classes (0, ..., 3) is controlled by the users or technical instances assigned to the respective user classes.

2. Method according to claim 1, characterized in that the access authorizations distinguish at least between the authorizations "read" and "read and write" as permissible operations on the data.

3. Method according to one of the preceding claims, characterized in that if access authorization is not available for a specific combination of confidentiality class (0, ..., 3) and user class, access is denied.

4. Method according to one of the preceding claims, characterized in that the restrictions assigned to a confidentiality class (0, ..., 3) and / or user class are subsequently changed, the changed restrictions being applied to subsequent accesses to the data or functions concerned.

5. Method according to one of the preceding claims, characterized in that the confidentiality class (0, ..., 3) is assigned to a variable or a data source and is automatically assigned to all data generated from or derived from values ​​of this variable or data source.

6. Method according to one of the preceding claims, characterized in that the confidentiality class (0, ..., 3) is assigned to a data type and is automatically assigned to all data of this type.

7. Method according to one of the preceding claims, characterized in that the respective confidentiality class (0, ..., 3) is stored together with the respective data.

8. Method according to claim 7, characterized in that the confidentiality class (0, ..., 3) is stored as meta-information with a data record or a data stream, preferably preceded by the latter.

9. Method according to one of the preceding claims, characterized in that combined data or data types or data structures which are generated from individual data or data types or data structures, each with its own confidentiality class (0, ..., 3), inherit the strictest of these confidentiality classes (0, ..., 3) as a whole.

10. Method according to one of the preceding claims, characterized in that the access to the data assigned to the respective confidentiality classes (0, ..., 3) is controlled by the users assigned to the respective user classes of an external interface of a component of the automation arrangement with the data, in particular in a network interface, another data interface or software for a user interface.

11. Control instance for controlling access to structured data or functions of an industrial automation arrangement, characterized in that the control instance comprises an input interface for receiving the data to be accessed or an access interface, in particular an API, for accessing the functions, the control instance is designed to control access to the data or functions according to one of the methods described above, and the control instance comprises an output interface for accessing the data or the functions.

12. A computer program product for controlling access to structured data or to functions of an industrial automation arrangement, characterized in that the computer program product, when executed on a computer, is designed to carry out one of the methods according to patent claims 1 to 10.

Images