Automation System Secure Data Transmission via Digital Signature Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In automation systems, securing networked components against unauthorized access while ensuring data integrity and real-time capability is challenging, especially in distributed systems with unsecured communication networks, where traditional security methods like SSH or SSL/TLS are unsuitable due to their server-centric authentication and complexity in administration.
Innovation Solution
A method that detects unsecured network nodes in an automation system, generates and transmits network node-specific digital signature keys to select nodes, securing communication above the transport layer using SSL/TLS, allowing for automated and efficient security configuration without administrator intervention, and enabling monitoring and control of security mechanisms within the automation system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security methods like SSH or SSL/TLS are used to secure network communication, then data integrity and security are improved, but device complexity and administrative overhead increase significantly
Solution Approach 1:
The automation system performs self-authentication using pre-configured digital signatures and certificates, eliminating the need for manual administrator intervention during runtime. The system automatically verifies communication partners and establishes secure connections without requiring external security administration.
Solution Approach 2:
Security credentials including digital signatures and certificates are pre-configured in the automation system before deployment. This preliminary setup enables automatic authentication and secure communication establishment without requiring real-time administrator intervention or complex runtime configuration.
2Reliability
If network administrator intervention is used to secure communication networks, then security control is improved, but ease of operation deteriorates due to coordination complexity between network and automation system administrators
Solution Approach 1:
The security mechanism is segmented into two independent parts: network-level security handled by network administrators and application-level security handled by the automation system. Digital signatures and certificates operate at the application layer, allowing the automation system to establish secure communications independently of network administrator coordination.
Solution Approach 2:
Digital signatures and certificates act as an intermediary mechanism that bridges security requirements between network and automation system layers. The cryptographic credentials enable automatic verification and authentication, eliminating the need for direct coordination between different administrative domains.
3Reliability
If SSH or SSL/TLS security protocols are implemented, then communication security is improved, but real-time capability deteriorates due to authentication overhead
Solution Approach 1:
Authentication credentials are pre-configured and cached in the automation system, enabling immediate verification of communication partners without real-time administrator intervention. The pre-stored digital signatures and certificates allow rapid authentication that maintains real-time communication capabilities.
Solution Approach 2:
The time-consuming aspects of security authentication are extracted and performed offline during system configuration and deployment. Runtime authentication uses pre-computed credentials and certificates, removing the computational overhead from real-time communication operations and preserving real-time performance.
4Reliability
If digital signature keys are transmitted to all network nodes, then security coverage is improved, but loss of time increases due to transmission effort to all nodes including those already secured
Solution Approach 1:
Security credentials are distributed selectively to only those automation system components that require secure communication, rather than uniformly to all network nodes. The engineering system identifies and transmits digital signatures and certificates only to relevant components, reducing unnecessary transmission time and resources.
Solution Approach 2:
Instead of providing security credentials to all possible network nodes (excessive action), the system provides credentials only to the specific components that need them (partial action). This selective distribution optimizes the balance between security coverage and transmission efficiency.
Data Source
Figure 1
Figure 2
AI summary
The method involves detecting (101) network nodes, which are connected by an unsecured network, and determining (102) a range of network nodes on the basis of detected network nodes. A communication is secured (104) between nodes on the basis of the transmitted signature keys. Independent claims are included for the following: (1) a computer program for secured transmission of data; and (2) an automation system, which has network nodes.