Containerized Control Applications Authentication Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control applications in industrial automation systems often lack support for required authentication methods, necessitating extensive adaptation or disabling authentication, and token-based methods fail to identify accessing components.
Innovation Solution
Implementing software containers for control applications with cryptographic authentication, using an application management system to monitor and configure them, and inserting temporary access keys into data traffic for authorization, while ensuring trusted channels and cryptographic verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control applications are extensively adapted to support required authentication methods, then authentication capability is improved, but device complexity and implementation effort increase
Solution Approach 1:
The patent introduces a proxy server as an intermediary component that handles all authentication operations. Control applications communicate authentication requests to the proxy server, which then performs the actual authentication with target systems. This mediator pattern allows control applications to remain simple while achieving robust authentication capability through the proxy's intervention.
2Reliability
If authentication functions are embedded in control applications, then authentication security is improved, but application portability and ease of deployment worsen
Solution Approach 1:
The patent extracts authentication functions from control applications and consolidates them into a separate proxy server component. By taking out the authentication logic from individual applications, the system achieves centralized security management while improving application portability, as applications no longer need to contain embedded authentication code.
3Ease of operation
If token-based authentication methods are used, then authentication process is simplified, but component identification capability is lost
Solution Approach 1:
The patent performs preliminary action by having the proxy server establish authenticated connections and obtain identification information before control applications need to access target systems. The proxy server pre-negotiates authentication credentials and component identities, then uses this pre-obtained information to facilitate subsequent communications without requiring applications to perform complex authentication themselves.
Data Source
Figure 1
AI summary
The invention relates to granting access rights to control applications of an industrial automation system. First control applications (113, 123) are provided by means of software containers which are loaded into a container runtime environment (112, 122) installed on a host operating system (111, 121), and executed there. The first control applications are monitored and configured by means of an application management system (200). In addition, the first control applications are authenticated by means of the application management system. Second control applications (114, 124) are executed and cryptographically authenticated directly on a host operating system (111, 121). Data traffic (11) from the first and second control applications to target devices (103, 301) and/or applications are authorised after successful authentication in each case by means of an at least temporarily valid access key (12) inserted into the data traffic.