Field Device Access Keys With Device-Specific Time-Limited Hashing

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current access key systems for field devices in industrial automation are insecure, as they allow universal access to all devices from a manufacturer, compromising security, especially in environments with high security requirements.

Innovation Solution

A method to generate time-limited access keys for specific field devices, incorporating a validity period and using a bit mask and offset value within the hash value to ensure secure access, where the access key is only valid for a specified period and includes a unique identifier and time information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a universal access key is used for all field devices from a manufacturer, then ease of operation is improved (access to any device is possible), but security is worsened (unauthorized access to all devices is possible)

Engineering Contradiction:
Improveaccess convenienceVSAvoidsecurity
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent segments the universal access concept into device-specific access keys. Each field device has its own unique access key generated by hashing a manufacturer-specific secret with the device's identification feature. This segmentation allows access control to be tailored to each individual device while maintaining the convenience of a standardized access mechanism across the manufacturer's product line.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by making each access key unique to its specific device through the use of device-specific identification features (such as serial numbers or device IDs) in the hashing process. This ensures that the security properties are localized to each device, preventing universal unauthorized access while maintaining ease of operation for authorized users on each specific device.

Inventive Principle:
Principle #3Local quality

2Reliability

If access keys are made device-specific with time limitations, then security is improved (unauthorized access is prevented), but device complexity is worsened (key generation and validation become more complex)

Engineering Contradiction:
ImprovesecurityVSAvoidaccess key system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements preliminary action by pre-generating access keys with embedded time validity information during device manufacturing or initial setup. The access key includes or is associated with validity period data, so that when the key is presented for authentication, the system can automatically verify both the key's correctness and its temporal validity without requiring complex real-time key generation or external validation infrastructure.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent uses a hashing function as an intermediary mechanism to generate access keys from manufacturer secrets and device identification features. This intermediary process simplifies the overall system by providing a deterministic, reversible (in the sense that the original inputs can be recovered if needed) method for key generation that balances security requirements with implementation simplicity. The hash function acts as a mediator between the need for secure, unique keys and the desire for manageable system complexity.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3391611B1Access key for a field device
Publication Date: 2023.04.19 ENDRESS HAUSER FLOWTEC AG
  • EP3391611B1 patent drawingFigure 1
  • EP3391611B1 patent drawingFigure 2

AI summary

Method for providing an access key (203) for an automation field device (300), wherein the access key (203) provides access to the field device (300), wherein the method has the following steps of: - producing an individual key (204, 304); - storing the individual key (204) in a database (202), wherein the database (202) additionally stores an identification feature (205) of the field device (300) together with the individual key (204), - storing the individual key (304) in the field device (300) which is intended to be released on the basis of an access key (203) which has been input; - determining at least the identification feature (205) of the field device (300) for which the access key (203) is intended to be provided; - forming/producing/generating the access key (203), with the result that the latter comprises a hash value (206), wherein the hash value (206) is formed at least from the individual key (204) which has been read from the database (202) with the aid of the determined identification feature (205).