Industrial Control Interface with Cloud-Edge Request Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The NAMUR Open Architecture's Verification of Requests mechanism is not adequately implemented, leading to stability, security, and reliability issues in industrial control systems due to lack of effective plausibility checks and authentication for external clients writing values to Core Process Control variables, which can disrupt the industrial process and increase development, commissioning, and management costs.
Innovation Solution
A method and processor network architecture that utilize a cloud domain for client authentication and an edge domain for verification and authorization of requests, ensuring secure and efficient execution of requests to industrial control systems, with the ability to map logical actions to physical actions and provide audit trails, using a publish/subscribe arrangement for message exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If external clients are allowed to write values to CPC variables directly, then operational flexibility and responsiveness are improved, but system stability and security deteriorate due to lack of verification and potential malicious actions
Solution Approach 1:
The patent introduces an intermediary verification mechanism between external clients and the CPC system. The client's write request is intercepted and verified against a verification data set before being forwarded to the CPC variable. This intermediary layer allows operational flexibility by accepting client requests while ensuring system stability by blocking unauthorized or malicious changes through cryptographic verification.
2Reliability
If comprehensive verification and authentication mechanisms are implemented, then system security and reliability are improved, but device complexity and computational overhead worsen
Solution Approach 1:
The patent implements preliminary action by pre-generating a verification data set (such as a cryptographic hash or digital signature) that contains all necessary authentication information before actual client requests arrive. When a client sends a write request, the system simply compares the request against the pre-computed verification data set, avoiding complex real-time authentication computations and reducing both computational overhead and mechanism complexity.
3Reliability
If the server responds to each write call from external clients, then client-server interaction reliability is improved, but server computational load and response time worsen due to excessive requests
Solution Approach 1:
The patent extracts the verification function from the main server processing path. Instead of having the server respond to and process each individual write call from external clients, the verification of the write request is separated out and performed independently against a pre-stored verification data set. This extraction allows the server to efficiently handle multiple client requests without proportional increases in computational load, as the verification step becomes a simple comparison rather than a complex processing operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of executing a request to an industrial control system, which runs in a protected domain and is configured to control one or more field devices. Each step of the method is to be executed on processing resources of a cloud domain (CD), an edge domain (ED) or the protected domain. According to the first aspect, a step of receiving, from a client, a message with a request containing logical actions and a step of authenticating the client are performed using CD resources. Next, a step of initiating a verification of the message and a step of checking whether the authenticated client is authorized to perform the logical actions are performed using ED resources. Then, a step of mapping the logical actions to physical actions and a step where the industrial control system is caused to execute the physical actions are performed using resources in the protected domain.