Industrial Device Provisioning With Encrypted Credential Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securely connecting devices to industrial automation systems fail to protect security-sensitive data against manipulation and forgery during exchange between plant operators and vendors, lacking satisfactory protection mechanisms.
Innovation Solution
A method involving the use of a standardized container with cryptographic material for secure data exchange, utilizing public and private key encryption, and secure channels to ensure secure provisioning of devices, enabling zero-touch provisioning and automated configuration without human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security-sensitive data is exchanged between plant operator and vendor for device parameterization, then device can be pre-configured securely, but data is vulnerable to manipulation, eavesdropping and forgery
Solution Approach 1:
The patent applies preliminary action by generating and embedding cryptographic credentials (public keys, certificates) into the device during manufacturing before the device is deployed. This pre-provisioning of security materials eliminates the need to exchange sensitive data later, as the device already possesses its own authentication credentials when it first connects to the industrial automation system.
Solution Approach 2:
The patent introduces an intermediary approach by using standardized container formats (such as AASX packages) that encapsulate device configuration and security data. These containers act as secure intermediaries that can be exchanged between systems without exposing the underlying sensitive credentials, as they use standardized encryption and signing mechanisms.
2Reliability
If manual device parameterization is performed in plant workshop, then device can be configured with security credentials, but process is time-consuming and costly
Solution Approach 1:
The patent implements self-service by enabling devices to automatically authenticate and register with the industrial automation system using credentials that were pre-loaded during manufacturing. The device independently performs its own provisioning and configuration without requiring manual intervention from plant operators, thereby eliminating the time-consuming and costly manual parameterization process.
Solution Approach 2:
By pre-configuring security credentials during device manufacturing, the system eliminates the need for subsequent manual parameterization work. The device arrives at the customer site already equipped with the necessary authentication materials, allowing immediate deployment without requiring technician time for security configuration.
3Reliability
If security credentials are transferred during device connection process, then authentication can be established, but transfer may not be secure and compromises system security
Solution Approach 1:
The patent applies preliminary action by establishing that security credentials are generated and embedded into the device during the manufacturing process, before the device is ever connected to the customer's system. This means authentication credentials are already in place when the device first connects, eliminating the need to transfer sensitive security data over networks where it could be intercepted or compromised.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a method for securely supplying data to be used in parameterizing a device for an industrial automation system, the method comprising: a first party supplying a second party with a machine-readable standardized container for the exchange of device parameters in industrial automation systems, wherein the supplying comprises writing into the container an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system. There is also provided a method for securely obtaining data to be used in parameterizing a device for an industrial automation system, the method comprising: obtaining, from a first party, by a second party, a machine-readable standardized container for the exchange of device parameters in industrial automation systems, the container comprising an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system.