Automation Control Certificate Provisioning for Secure Plant Networks

Solution Overview

Problem

Efficiently constructing a safe network topology in a plant automation system is difficult due to insecure data communication and time-consuming certificate management processes.

Innovation Solution

An automation system that uses a self-signed certificate transmission to a management server, followed by a certificate authority signature certificate generation and encryption for secure data communication, automating the certificate management process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional certificate management processes are used in plant automation systems, then network security can be maintained, but engineering work becomes time-consuming and complex

Engineering Contradiction:

Improvenetwork securityVSAvoidengineering time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by automatically generating certificates and configuring security parameters before the automation system goes into operation. The certificate authority signature certificate is obtained and stored in advance, and the system automatically manages certificate validity periods and renewal processes, eliminating the need for manual security configuration during time-critical engineering phases.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The automation system performs self-service by automatically obtaining certificates from a certificate authority, storing them in secure storage units, and managing certificate validity without requiring manual intervention. The system autonomously handles certificate renewal processes and validates certificates during data communication, freeing engineers from repetitive security management tasks.

Inventive Principle:

Principle #25Self-service

2Reliability

If manual certificate management is performed, then certificate validity can be controlled, but the process becomes complex and error-prone

Engineering Contradiction:

Improvecertificate validity controlVSAvoidcertificate management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system implements self-service by automatically obtaining certificates from a certificate authority, storing them in secure storage units, and managing certificate validity without requiring manual intervention. The system autonomously handles certificate renewal processes and validates certificates during data communication, freeing engineers from repetitive security management tasks.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system incorporates feedback mechanisms by continuously monitoring certificate validity periods and automatically initiating renewal processes before certificates expire. The system validates certificates during data communication and provides feedback to the communication process, ensuring that only valid certificates are used and preventing security breaches from expired certificates.

Inventive Principle:

Principle #23Feedback

3Reliability

If secure data communication is implemented using certificates, then network security is enhanced, but system setup becomes more difficult

Engineering Contradiction:

Improvedata communication securityVSAvoidsystem setup ease

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The system performs preliminary actions by automatically generating certificates and configuring security parameters before the automation system goes into operation. The certificate authority signature certificate is obtained and stored in advance, and the system automatically manages certificate validity periods and renewal processes, eliminating the need for manual security configuration during time-critical engineering phases.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The automation system performs self-service by automatically obtaining certificates from a certificate authority, storing them in secure storage units, and managing certificate validity without requiring manual intervention. The system autonomously handles certificate renewal processes and validates certificates during data communication, freeing engineers from repetitive security management tasks.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12609840B2Control apparatus, control method, and computer-readable recording medium for automation system

Publication Date: 2026.04.21 YOKOGAWA ELECTRIC CORP

AI summary

A control apparatus transmits a self-signed certificate to a management server, receives a certificate authority signature certificate generated by the management server according to the self-signed certificate, and executes data communication in the control system that executes control of a system on the basis of the certificate authority signature certificate.