Dynamic Access Control Architecture for Manufacturing Systems

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing access control mechanisms in industrial automation and control systems (IACS) struggle to provide flexibility and dynamicity, especially in manufacturing environments with rapidly changing production needs, leading to challenges in balancing usability and security, and efficiently distributing policy data.

Innovation Solution

The proposed approach involves constructing an access control enforcement architecture that separates dynamic and static policy privileges, using a centralized authorization server for dynamic updates and local decision-making for static privileges, and employing claim-based tokens to formulate access control policies expressed using a standardized ABAC policy model.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If traditional access control methods are used in manufacturing systems, then security is maintained through static policies, but flexibility and adaptability deteriorate when production needs change rapidly

Engineering Contradiction:

Improveflexibility of access controlVSAvoidcomplexity of policy management

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements dynamic access control policies that can be updated in real-time based on changing production needs. The system allows policies to transition from static to dynamic states, enabling adaptability without requiring complete policy reconfiguration. This resolves the contradiction by making the system flexible while maintaining manageable complexity through controlled dynamic updates.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The access control system is segmented into modular policy components that can be independently updated and managed. This segmentation allows specific policy elements to be modified without affecting the entire system, providing flexibility while keeping management complexity localized and manageable.

Inventive Principle:

Principle #1Segmentation

2Reliability

If centralized policy management is implemented to improve policy distribution, then policy consistency is improved, but decision-making speed deteriorates due to communication overhead

Engineering Contradiction:

Improvepolicy decision consistencyVSAvoidpolicy decision time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-evaluating and caching policy decisions before they are needed. When access requests occur, the system can retrieve pre-computed decisions or quickly adjust from cached states, reducing real-time decision time while maintaining consistency through the preliminary centralized preparation work.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements local quality by allowing different parts of the system to have different policy evaluation capabilities. Critical path decisions use centralized evaluation for consistency, while non-critical decisions can use local cached evaluations for speed, optimizing the balance between reliability and response time.

Inventive Principle:

Principle #3Local quality

3Adaptability or versatility

If Attribute Based Access Control (ABAC) is used to increase flexibility, then adaptability to dynamic scenarios is improved, but policy complexity and management effort worsen

Engineering Contradiction:

Improvedynamic policy flexibilityVSAvoidmanagement effort

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The patent creates a universal policy management framework that handles both simple and complex ABAC policies through a unified interface. This multi-functional system can manage dynamic attributes and complex policies while presenting a simplified management interface, reducing the perceived complexity for operators while maintaining full ABAC flexibility.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Productivity

If static policy privileges are enforced locally to reduce communication overhead, then productivity is improved, but security responsiveness deteriorates when policy updates are needed

Engineering Contradiction:

Improveaccess decision speedVSAvoidpolicy update responsiveness

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The system implements dynamic policy privilege enforcement where local decision-making capabilities can be adjusted based on update needs. When policies are stable, local enforcement maximizes productivity. When updates are needed, the system dynamically transitions to centralized control for responsiveness, then returns to local enforcement for speed.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS12341783B2Access control enforcement architectures for dynamic manufacturing systems

Publication Date: 2025.06.24 ABB (SCHWEIZ) AG

AI summary

A computer system including: one or more resource servers with resources, to which access is controlled in accordance with an access-control policy specified in a computer-readable access-control language, and a centralized authorization server, which is common to the resource servers and implements a second-type policy decision point. The computer system further includes a first-type policy decision point, which is implemented by the authorization server and configured to decide on dynamic policy privileges, and one or more second-type policy decision points, which are implemented by respective ones of the resource servers and configured to decide on static policy privileges.