Method for communication in an industrial control system, and industrial control system

Abstract

The invention relates to a method for communication in an industrial control system which comprises a first OT device (10) which initiates communication, a second OT device (20) and an authentication service (50). To maintain a communication channel (LCC) established between the first and second OT device (10, 20), the successful authorisation of a token with a predefined validity period is required, wherein the token is generated by the authentication service (50) and provided to the first OT device (10) if the first OT device (10) meets predefined criteria. If the token is not renewed before a validity period assigned to it expires, the communication channel (LCC) is deactivated. The token is processed by the second OT device (20) beyond the token validity period in order to authorise the communication channel if the provision of a subsequent token between the first OT device (10) and the authentication service is not possible or fails.

Description

[0001] Description

[0002] Method for communication in an industrial control system and industrial control system

[0003] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identity are included.

[0004] The invention relates to a method for communication in an industrial control system and an industrial control system.

[0005] An industrial control system is a so-called OT (Operational Technology) system that includes hardware and software used to control, regulate, and monitor machines, systems, and processes. The industrial control system, or OT system, is a closed system whose components communicate using proprietary protocols. These components include, in particular, so-called OT devices. An OT device refers to hardware and / or software that is used within the industrial control system to control, regulate, monitor, and control machines, systems, and processes.

[0006] When accessing application services over a communications network and the resources provided by these services, a decision must currently be made at one point as to which user or OT device is permitted to access which service and under which circumstances. This typically requires the user or OT device to authenticate itself ("Who am I"), and based on this, a decision is made as to which permissions are granted ("What am I permitted to do").

[0007] Traditionally, each service is configured so that, based on credentials (such as username and password), the appropriate permissions are granted by the application that implements the application service.

[0008] In order to improve usability on the one hand and simplify the administration of OT devices in the industrial control system on the other, authentication is being outsourced to a separate authentication service (Identity and Access Management, IAM). This service centrally configures which services of a requested OT device may be used by which user or which OT device and under what circumstances. This corresponds to authorization information. The authorization information is then forwarded to an application service of the requested OT device, which allows the permitted access and blocks others. This should enable robust and secure communication between the OT devices in the industrial control system.

[0009] In EP 22 156 834 . 8 by the applicant it was proposed to use a communication channel referred to as a channel, which describes a communication relationship between two communication partners - a first computing unit, such as an OT device, and an application service or service of another computing unit - which is regulated by the authentication service. The communication channel consists of information that is shared between the communication partners and is created by setting up the communication channel. The shared information can be linked to authorization information by suitable mechanisms, e.g. cryptographic methods. The authorization information represents a token that has a validity period or an expiration time. After the validity period or expiration time of the token has expired, there is no need to set up a new communication channel.Rather, an existing communication channel can continue to be used, provided the requesting processing unit presents a new token to the second processing unit (an application service or a client) that differs from the previous token in precisely defined attributes, e.g., only in the new validity period. As an alternative to a new token with a changed validity period, the authorization service can also issue a new token that references an existing token and extends its validity period. For this purpose, it can, for example, contain its hash value as an attribute.

[0010] The procedure described in EP 22 156 834 . 8 enables central authentication of the communication partners and thus robust and secure communication of the OT devices in the industrial control system. The availability of communication between the OT devices depends on the availability of the authentication service. In an industrial control system, the failure of OT devices is unacceptable, and high availability (24 / 7, i.e., 24 hours a day, 7 days a week) is a mandatory requirement.

[0011] It is an object of the invention to provide a method for communication in an industrial control system and an industrial control system which supports high availability.

[0012] These objects are achieved by a method according to the features of claim 1, a computer program product according to the features of claim 9 and an industrial control system according to the features of claim 10. Advantageous embodiments emerge from the dependent claims.

[0013] A method for communication in an industrial control system is proposed which is based on the method described in EP 22 156 834 . 8 . The content described in this application is incorporated in its entirety by reference. The industrial control system (= OT system) comprises a first OT device which initiates communication and a second OT device as well as an authentication service. The first OT device and / or the second OT device represent communication partners and can take the form of computing units and / or application services running on them. To establish communication and to maintain a logical communication channel established between the first and the second OT device, the successful authorization of a token (authorization information) by the second OT device is required.The token is generated by the authentication service and is provided to the first OT device for transmission and verification to the second OT device if the first OT device meets predetermined criteria. If the token is not renewed before the expiration of its assigned validity period or expiration time, the logical communication channel is terminated by the second OT device.

[0014] The term "successful authorization of a token" refers in particular to a verification of the token to determine whether the token is valid and whether it authorizes communication between the first and the second OT device.

[0015] In order to ensure the high availability of the industrial control system and its components even when the authentication service is not available, e.g. due to hardware or software malfunctions, the invention provides that the token is processed by the second OT device to authorize the logical communication channel beyond its validity period or expiration time. It is processed and accepted beyond the validity period or expiration time specified in the token. The token whose validity period has been exceeded or whose expiration time has been reached is referred to as an invalid token. The validity period or expiration time of a token can, for example, expire without a follow-up token being provided between the first OT device and the authentication service, for example because the provision is not possible or fails.A connection between the authentication service and the first OT device requesting the token is not possible, for example, if a connection to the authentication service fails, the authentication service is not accessible, or individual services of the authentication service are not available.

[0016] The proposed approach has the advantage that, in the situations described above, the logical communication connection can be avoided from being severed, allowing the logical communication channel between the first and second OT devices to be maintained. This maintains the functionality of the industrial control system as a whole, ensuring the desired high availability. This is made possible by the fact that the last token used is used beyond its validity period or expiration time in order to avoid the logical communication channel being severed and to ensure access to the components, in particular the second OT device.

[0017] In a practical embodiment, it can further be provided that the invalid token is used by the second OT device to establish a logical communication channel. This embodiment makes it possible to use the invalid token to establish the logical communication channel when a logical communication channel is just being established between the first and second OT devices if the provision of a token between the first OT device and the authentication service is not possible or has failed.

[0018] It is further expedient for the first OT device, if the provision of a follow-up token between the first OT device and the authentication service is not possible or fails, to switch to an alarm mode and transmit status information representing the alarm mode to the second OT device. In particular, upon receipt of the status information, the second OT device is prompted to process the invalid token for authorization. The status information can thus be used as a trigger for the second OT device to accept the invalid token for authorization of the logical communication channel.

[0019] In this context, it is also useful if the second OT device is also prompted to switch to an alarm mode upon receipt of the status information.

[0020] According to a further expedient embodiment, the first OT device switches to normal mode when the provision of a follow-up token between the first OT device and the authentication service is possible again. The receipt of the follow-up token from the authentication service can be used as a trigger to switch from alarm mode to normal mode.

[0021] It is also expedient for the first OT device to transmit the follow-up token, together with the updated status information representing normal mode, to the second OT device for processing and authorization. The updated status information and the follow-up token can also be transmitted to the second OT device one after the other. Upon receipt of the follow-up token and / or the status information representing normal mode, the second OT device is informed that communication is again taking place in the conventional manner, i.e. a token with a validity period or expiration time is "renewed" by a follow-up token before its expiration. This makes it possible to provide the high level of communication security described above. Furthermore, it is expedient for the second OT device to switch from alarm mode to normal mode upon receipt of the follow-up token.

[0022] According to a second aspect, a computer program product is proposed which comprises instructions which, when the program is executed by a computer, cause the computer to carry out the method or one or more embodiments thereof.

[0023] According to a further aspect, an industrial control system (OT system) is proposed which comprises a first OT device which initiates communication and a second OT device, as well as an authentication service. The authentication service is configured to generate a token if the first OT device meets predetermined criteria and is further configured to provide the token to the first OT device. The first OT device is configured to transmit the token received from the authentication service to the second OT device. The second OT device is configured to check the token for authorization and, if authorization is successful, to maintain a logical communication channel established between the first and second OT devices, and, if the token is not renewed before the expiration of the validity period or expiration time, to close down the logical communication channel.Furthermore, according to the invention, the second OT device is configured to process the token for authorizing the logical communication channel as an invalid token beyond its validity period or expiration time if the provision of a follow-up token between the first OT device and the authentication service is not possible or has failed. Furthermore, it is possible for the second device to check whether a second token is being provided for the second device. Only if this does not occur does the second device process the invalid token received from the first device.

[0024] The control system is further configured to carry out one or more preferred embodiments of the method according to the invention.

[0025] The invention will be explained in more detail below with reference to the drawing. In the drawing: Fig. 1 is a schematic representation of an industrial control system according to the invention in accordance with a first embodiment; and

[0026] Fig. 2 is a schematic representation of an industrial control system according to the invention in accordance with a second embodiment.

[0027] Fig. 1 shows a first embodiment of an industrial control system. This includes a first communication-initiating OT (Operational Technology) device 10, a second OT device 20, and an authentication service 50.

[0028] The OT device 10 comprises a first trust service (software) 11 and a first processing unit 12. The first trust service 11 can run on the first processing unit 12. The first trust service 11 can also run on a processing unit separate from the first processing unit 12 and not shown.

[0029] Similarly, the second OT device 20 comprises a second trust service 21 (software) and a second processing unit 22. The second trust service 21 can be executed on the second processing unit 22. The second trust service 21 can also be executed on a processing unit (not shown) separate from the second processing unit 22.

[0030] The first processing unit 12 of the first OT device 10 and the second processing unit 22 of the second OT device 20 do not represent secure communication partners. In contrast, the first trust service 11 and the second trust service 21 are "secure components." The first and second trust services 11, 21 can be configured, for example, as proxies. The first and second OT devices 10, 20 or their trust services 11, 21 communicate via a logical communication channel LCC, which is only established after authorization by the second OT device 20. Once established, data can be transmitted in both directions via the logical communication channel LCC between the OT devices 10, 20 or their trust services 11, 21.

[0031] The OT devices 10, 20 and the logical communication channel LCC are components of the industrial control system, i.e., an OT (Operational Technology) system. In contrast, the authentication service 50 is part of the classic IT (Information Technology).

[0032] The task of the authentication service 50 is to issue a token (authorization information) upon request from the OT device 10 or its first trusted service 11, provided the appropriate criteria are met, and to transmit it to the first OT device 10 or its trusted service 11. The first OT device 10 or its trusted service 11 transmits the token to the second OT device 20 for authorization in order to enable the establishment of the logical communication channel LCC.

[0033] This procedure, which is known in principle from EP 22 156 834.8, is described below with reference to Fig. 2, in which further components of the authentication service 50 are shown.

[0034] The authentication service 50 comprises a first to fifth service 51,..., 55, whose respective functions for establishing the logical communication channel LCC are explained in more detail below. Furthermore, an information source service 60 for the authentication service 50 is shown.

[0035] The request to establish a communication channel between the OT devices 10, 20 is made by the first processing unit 12, e.g., based on an automated request or the receipt of user information (e.g., user input into the first processing unit 12). The first processing unit 12 forwards the request to the first trust service 11. In a first step S1, the first trust service 11 authenticates itself to the first service 51, an authentication service. In addition, the initiator of the request, i.e., the first processing unit 12 or a user operating the first processing unit 12, authenticates itself to the first service 51. This establishes proof of the identities of both the first trust service 11 and the initiator of the request (human user or the first processing unit 12).In step S2, the identities of the first trust service 11 and the initiator of the request are transmitted from the first service 51 to the second service 52.

[0036] (Policy Enforcement Point, PEP), which submits a request to the third service 53 (Policy Decision Point, PDP) to implement a decision.

[0037] In step S3, the third service 53 decides whether the initiator of the request, ie the first computing unit 12 or the user operating the first computing unit, receives permission to communicate with the second OT device 20 and in particular its second computing unit 22 based on predefined access rights.

[0038] In step S4, the third service 53 evaluates the access rights provided by a fourth service 54 (Policy Administration Point, PAP).

[0039] In step S5, in a case where the access rights require additional attributes from other information sources, these are retrieved from a fifth service 55 (Policy Information Point, PIP). This information is optionally provided to the fifth service 55 in a step S6 by a sixth service (OT Detection Services, OTDS). The sixth service 61 is one of several information sources 60 (not shown in further detail). For example, the sixth service 61 can inform the fifth service 55 whether the user operating the first computing unit 12 or the first computing unit 12 itself has been compromised or whether the configuration of the first computing unit 12 has compatibility problems for communication with the second OT device 20.

[0040] If all information is correct, a token is issued by the first service 51 and transmitted to the first trust service 11 in step S7.

[0041] In step S 8 , the first trust service 11 transmits the token together with a request to establish the aforementioned logical communication channel LCC to the second trust service .

[0042] In step S9, the second trust service 21 checks the information contained in the token and, if all information is correct, authorizes the first OT device 10. Then, the logical communication channel LCC can be established between the OT devices 10, 20 and their trust services 11, 21.

[0043] The token issued by the first service 51 includes a validity period or expiration time. The operation of the OT system is such that after the expiration of the validity period of the token, a new logical communication channel does not have to be established, but rather the existing communication channel LCC can continue to be used, provided that the OT device 10 that initiated the request presents a new token that differs from the previous token in predetermined attributes, e.g., a new validity period. As an alternative to a new token with a changed validity period, a new token can also be issued by the authentication service 50 that references a specific token (e.g., by containing its hash value as an attribute) and extends its validity period. Likewise, a token can be revoked, i.e., declared invalid. The procedure in this regard is described in the aforementioned EP 22 156 834.8. In order to ensure the high availability of the industrial control system even in the event that one of the services 51, ..., 55 of the authentication service 50 fails, e.g., due to a software malfunction, or communication between the first OT device 10 and the authentication service 50 is not possible, the invention proposes using the most recently issued token by the second OT device 20 to authorize the logical communication channel LCC beyond its validity period or expiration time. This avoids the dismantling of the logical communication connection LCC, thus continuing to ensure the availability of and access to the OT devices.

[0044] In this case, it is also possible to allow the establishment of a new logical communication connection even though the token used for authentication is no longer current or invalid.

[0045] If and as soon as the provision of a new token, which is referred to as a follow-up token, between the first OT device or its first trust service and the authentication service 50 is not possible or fails, the first OT device 10 switches to an alarm mode and transmits status information representing the alarm mode to the second OT device 20. This is expedient because the second OT device 20 itself does not need to have or has no contact with the authentication service 50. By receiving the status information representing the alarm mode, the second OT device 20 is prompted to process invalid tokens for authorization in the future due to expired validity period or exceeded expiration time. Optionally, the second OT device 20 can also switch to an alarm mode upon receiving the status information representing the alarm mode.

[0046] When the first OT device 10 receives a token from the authentication service 50 again, it switches to normal mode and transmits status information representing the normal mode, along with the token, to the second OT device for processing and authorization. Upon receipt of the (follow-up) token, the second OT device switches back from alarm mode to normal mode. The usual procedure for authorizing the logical communication channel LCC is then continued.

[0047] Without having to provide redundancy, the described procedure makes it possible to ensure the availability of the components in an OT system, even if the components required for authorization in the authentication service 50 (as part of an IT system) are not or temporarily unavailable.

[0048] Automation components, especially in production environments, are subject to different requirements than familiar IT applications, where the focus is on pure software applications. In OT systems, both hardware and software must always be considered. The proposed approach ensures that the availability of OT components is not affected by a failure in the authentication chain. The OT system can ensure secure operation even without the authentication service, since existing connections remain valid beyond the validity of the last issued token.

Claims

Patent claims 1. A method for communication in an industrial control system comprising a first OT device (10) initiating communication and a second OT device (20) as well as an authentication service (50), in which the successful authorization of a token with a predetermined validity period by the second OT device (20) is required to maintain a logical communication channel (LCC) established between the first and second OT devices (10, 20), wherein the token is generated by the authentication service (50) and provided to the first OT device (10) for transmission and verification to the second OT device (20) if the first OT device (10) meets predetermined criteria, wherein, if the token is not renewed before the expiration of a validity period or expiration time assigned to it, the communication channel (LCC) is terminated,in which: the token is processed by the second OT device (20) for authorizing the logical communication channel (LCC) beyond its validity period or expiration time as an invalid token if the provision of a subsequent token between the first OT device (10) and the authentication service (50) is not possible or fails., 2. Method according to claim 1, characterized in that the invalid token is processed by the second OT device (20) to establish a logical communication channel (LCC).

3. Method according to claim 1 or 2, characterized in that if the provision of a follow-up token between the first OT device (10) and the authentication service (50) is not possible or fails, the first OT device (10) switches to an alarm mode and transmits status information representing the alarm mode to the second OT device (20).

4. The method according to claim 3, characterized in that upon receipt of the status information, the second OT device (20) is prompted to process the invalid token for authorization.

5. Method according to claim 3 or 4, characterized in that the second OT device (20) is caused to switch to an alarm mode upon receipt of the status information.

6. Method according to one of claims 3 to 5, characterized in that the first OT device (10) switches to a normal mode when the provision of a follow-up token between the first OT device (10) and the authentication service (50) is again possible.

7. The method according to claim 6, characterized in that the first OT device (10) transmits the follow-up token together with the status information, or in chronological succession, to the second OT device (20) for processing and authorization.

8. The method according to claim 7, characterized in that the second OT device (20) changes from the alarm mode to the normal mode upon receipt of the follow-up token.

9. A computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 8.

10. Industrial control system, comprising a first communication-initiating OT device (10) and a second OT device (20) and an authentication service (50), wherein the authentication service (50) is configured to generate a token if the first OT device (10) meets predetermined criteria and to provide the token to the first OT device (10), the first OT device (10) is configured to transmit the token received from the authentication service (50) to the second OT device (20), the second OT device (20) is configured to check the token for authorization and, if authorization is successful, to maintain a logical communication channel (LCC) established between the first and the second OT device (10, 20), and, if the token is not renewed before the expiration of the validity period, to dismantle the logical communication channel (LCC), wherein the second OT device (20) is further configured to process the token for authorizing the logical communication channel (LCC) beyond its validity period or expiration time as an invalid token if the provision of a follow-up token between the first OT device (10) and the authentication service (50) is not possible or has failed.

11. Control system according to claim 9, which is further arranged to carry out the method according to one of claims 2 to 8.

Images