Field Device User Administration via Smartphone Transport Medium
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low-power field devices in process automation technology lack central user administration capabilities, making it difficult to manage user access and security, especially in scenarios where online administrative connections are not feasible.
Innovation Solution
A method involving a smartphone as a transport medium to synchronize and transmit user data, including encrypted tickets, between a central user database and field devices, using cryptographic techniques like Diffie-Hellman key exchange and message authentication codes to ensure secure and tamper-proof user access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If local user administration is implemented in field devices, then user management is possible without online connection, but security control and user updates become difficult and centralized management is lost
Solution Approach 1:
A smartphone or control device serves as an intermediary between the central directory service and the field device. The intermediary downloads user data from the central directory service and transfers it to the field device via wireless communication, enabling centralized user management without requiring the field device to maintain a continuous online connection.
Solution Approach 2:
User data is preliminarily downloaded and cached on the smartphone or control device before being transferred to the field device. This preliminary action allows the field device to receive updated user information offline, ensuring security control and user management capabilities are maintained even when online connection is not available.
2Reliability
If field devices are physically separated or isolated by firewalls, then network security is improved, but connection to central directory services is blocked
Solution Approach 1:
The smartphone or control device acts as a mediator that bridges the isolated field device and the central directory service. It maintains the firewall isolation while enabling data transfer by downloading user information from the directory service and transmitting it wirelessly to the field device, thus providing access without compromising network security.
Solution Approach 2:
The solution moves the communication dimension from direct network connection to wireless short-range communication. By using a different communication dimension (wireless proximity-based transfer via smartphone), the system bypasses firewall restrictions while maintaining security, allowing field devices to receive user data without establishing traditional network connections.
3Speed
If user data is transmitted without encryption, then transmission speed is improved, but data integrity and confidentiality are compromised
Solution Approach 1:
Instead of encrypting all user data comprehensively, the solution applies selective encryption only to sensitive information such as passwords and authentication credentials. This partial encryption approach maintains data integrity and confidentiality for critical elements while avoiding the overhead of encrypting entire data sets, thus preserving transmission speed.
Solution Approach 2:
The system changes the encryption parameter by applying different encryption strengths to different data elements. Highly sensitive data receives strong encryption, while less sensitive operational data may be transmitted with minimal or no encryption, optimizing the balance between security and transmission efficiency.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Enables secure, centrally controlled user administration for field devices without requiring an online connection to central directory services, allowing for efficient user access management and security updates, such as revoking access rights or adding new users, while maintaining data integrity and confidentiality.
Implementation Method 1
a public key of the field device and a public key of the user database are exchanged via the transport medium. The field device computes, using the public key of the user database and its own private key, a shared secret, in particular with a Diffie-Hellman key exchange
Implementation Method 2
The characteristic data in the ticket are encrypted with a first key derived from the shared secret, such as via one or more hash functions
Implementation Method 3
The ticket comprises a message authentication code, wherein the ticket may follow the characteristic data. The message authentication code is also referred to as a MAC. A message authentication code serves to achieve certainty about the origin of data or messages, and to check their integrity
Data Source
AI summary
The present disclosure relates to a method for user administration of a field device of process automation technology, comprising the steps of connecting a transport medium, such as a smartphone, to a user database, synchronizing user data from the user database with the transport medium, and connecting the transport medium to the field device. The method also includes transmitting the user data from the transport medium to the field device, checking of the user data by the field device, and granting access to the field device on the basis of verified valid user data.