Cloud Relay Authentication for Secure Mobile Process Control Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing process control systems lack secure authentication protocols, preventing operators from accessing and controlling process control systems remotely, leading to discontinuities in process management and potential impacts on product quality, plant efficiency, and safety.

Innovation Solution

A cloud-based authentication method using a relay element that validates mobile devices and servers, enabling secure communication between mobile devices and process control environments through a relay gateway service, allowing bidirectional data transmission while maintaining system security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If process control systems are isolated from external networks for security, then system security is improved, but remote access capability deteriorates

Engineering Contradiction:

Improvesystem securityVSAvoidremote access capability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces a cloud-based relay element as an intermediary between mobile devices and the process control system. This relay element enables remote access without direct network connection to the control system, maintaining security isolation while providing operational access through a trusted intermediate server that manages authentication and data transmission

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments the network architecture into distinct isolated zones: the process control network remains completely isolated, while a separate cloud-based relay infrastructure handles authentication and data transmission. This segmentation allows remote access functionality to be added without compromising the security isolation of the core control system

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If authentication protocols are simplified for ease of use, then ease of operation is improved, but security deteriorates

Engineering Contradiction:

Improveauthentication simplicityVSAvoidauthentication security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

Authentication credentials and device validation are performed in advance by the cloud-based relay element before establishing any connection to the process control system. The relay element pre-validates mobile devices, applications, and users through multi-factor authentication mechanisms, so that when access is granted, it is already secured without requiring complex real-time authentication during operation

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback loops where the relay element continuously monitors authentication status, device validity, and user credentials. Validation keys are exchanged and verified through multiple feedback cycles between the mobile device, relay element, and process control system, ensuring that authentication security is maintained through continuous verification rather than single-step validation

Inventive Principle:

Principle #23Feedback

3Adaptability or versatility

If mobile devices are allowed direct access to process control data, then remote monitoring capability is improved, but system vulnerability increases

Engineering Contradiction:

Improveremote monitoring capabilityVSAvoidsystem vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The cloud-based relay element serves as a mediating layer that all mobile device communications must pass through. This intermediary validates each request, filters data transmissions, and ensures that only authorized operations reach the process control system, thereby enabling remote monitoring while blocking potential attack vectors

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent converts the potential harm of open mobile access into a benefit by using the mobile device's connection requirements as an opportunity to implement robust authentication and validation protocols. The very act of requiring validation keys and authentication transforms what could be a security vulnerability into a security strength, as each access attempt becomes a validated, authorized operation

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS20210092107A1Secure off-premises access of process control data by a mobile device

Publication Date: 2021.03.25 FISHER ROSEMOUNT SYST INC

AI summary

A system and method for facilitating secure communication between a process control application executing on a mobile device and a mobile server communicatively coupled to a process control environment includes the instantiation, in a cloud-based environment, of a relay connection element. Each of the mobile server and any mobile applications executing on mobile devices authenticates itself to the relay connection element. The relay connection element, the process control applications executing on the mobile devices, and the mobile server, each receive the necessary credentials through a series of authenticated requests between a variety of elements in the cloud-based environment, such that elements in the system necessarily authenticate one another before any information is provided to another element.