Industrial Application Access Rights Adaptation by Usage Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing industrial applications and devices face challenges in managing access rights efficiently, particularly for third-party applications, where permissions are often not dynamically managed, leading to increased vulnerability and manual, time-consuming adjustments, and existing methods fail to account for unused permissions.
Innovation Solution
A method and arrangement that logs actual access rights during operation, compares them with the original set, and creates a new set by removing unused rights, automating the adjustment of access rights to match actual usage, thereby reducing vulnerabilities and simplifying management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access rights are assigned broadly to ensure application functionality, then application reliability is improved, but security vulnerability increases due to unused permissions
Solution Approach 1:
The system performs preliminary monitoring during the operation of the predecessor version to log which permissions are actually used. This advance information gathering enables the subsequent creation of a tailored access rights profile that matches actual usage, resolving the contradiction between broad permissions for reliability and restricted permissions for security.
Solution Approach 2:
The invention dynamically changes the access rights parameters from a static, broad set to a dynamic, usage-based set. By monitoring actual permission usage during operation and creating a new tailored profile, the system adapts the security parameters to match real requirements, eliminating unused permissions while maintaining necessary access.
2Manufacturing precision
If access rights are manually configured for each application version, then precision of permission allocation is improved, but time consumption increases significantly
Solution Approach 1:
The system enables self-service by automatically monitoring permission usage during the predecessor version's operation and generating a tailored access rights profile without manual intervention. The monitoring component logs actual permission usage, and the system automatically creates the optimized permission set, eliminating the need for manual configuration while maintaining high precision.
Solution Approach 2:
The invention implements a feedback mechanism where the system monitors actual permission usage during operation and uses this information to create an optimized access rights profile. This closed-loop feedback process automatically adjusts permissions based on real usage data, achieving precise allocation without manual time investment.
3Object-affected harmful factors
If access rights are restricted to minimize security risks, then security vulnerability is reduced, but application reliability deteriorates due to insufficient permissions
Solution Approach 1:
The system performs preliminary monitoring during the predecessor version's operation to identify which permissions are actually used. This advance observation ensures that when restrictions are applied in the successor version, only truly unused permissions are removed, preventing functional failures while maintaining security through minimized access rights.
4Ease of operation
If third-party applications are used without modification, then ease of operation is improved, but adaptability of access rights management deteriorates
Solution Approach 1:
The invention introduces an intermediary monitoring component that sits between the third-party application and the system resources. This mediator logs permission usage without requiring modifications to the third-party application, enabling adaptive access rights management for applications that were originally designed with static permission sets.
Data Source
Figure 1~2
AI summary
The invention relates to a method and an arrangement for adjusting access rights (ZR) of an industrial application (AW) or an industrial device (G) of an industrial automation arrangement, wherein a set of access rights (ZR) for accessing resources (R) of the automation arrangement, in particular data, network connections and automation components, is assigned to the application (AW) or the device (G) during installation or commissioning, and wherein, during operation of the application (AW) or the device (G), accesses and/or access attempts to the resources (R) are checked with regard to their permissibility with respect to the access rights (ZR) and accesses are allowed or blocked accordingly.During the operation of the application (AW) or device (G), the access rights (ZR) actually used for access are logged. These logged access rights (ZR) are compared with the original set of access rights (ZR). If at least some of the unused access rights (ZR) are removed from the original set of access rights (ZR), a new set of access rights (NZR) is created. Upon reinstallation of the application (AW) or a similar application (AW), or upon recommissioning of the device (G) or a similar device (G), this new set of access rights (NZR) is assigned to the application (AW) or device (G). This allows access rights to be managed automatically and without disrupting ongoing operation.Commissioning will be limited to the extent actually used in the previous operation.