Industrial Asset Multi-Factor Access for Privileged Mode Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures for remote terminal units (RTUs) and industrial assets in critical infrastructure are inadequate, allowing unauthorized access that compromises operational integrity, as software-only controls fail to securely switch between run-time and privileged modes.
Innovation Solution
A multi-factor authentication system requiring two or more credentials is implemented to access industrial assets, ensuring secure access to privileged functionality and preventing unauthorized access in run-time mode, with centralized credential management to restrict user privileges to active users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-only controls are used to switch between run-time and privileged modes, then ease of operation is improved, but security is worsened
Solution Approach 1:
A multi-factor authentication system acts as an intermediary between users and the RTU device, requiring multiple credentials (password, token, biometric) to verify identity before allowing mode transitions. This intermediary layer prevents unauthorized access while maintaining legitimate operational flexibility, resolving the contradiction between ease of operation and security.
2Adaptability or versatility
If developer access to root level features is allowed, then adaptability is improved, but security is worsened
Solution Approach 1:
The system segments access rights by separating developer mode and run-time mode with distinct authentication requirements. Developer mode requires multi-factor authentication and is limited to specific maintenance windows, while run-time mode has restricted access. This segmentation allows adaptability for developers when needed while maintaining operational integrity during normal operation.
3Reliability
If multi-factor authentication is implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The multi-factor authentication system is implemented as a separate intermediary component rather than embedding complexity directly into the RTU device. The authentication logic, credential verification, and security management are handled by an external authentication server or gateway, which mediates between users and the industrial asset. This approach improves security while minimizing the complexity burden on the critical industrial device itself.
Data Source
AI summary
A multi-factor authentication method and system enabling secure access to an industrial asset. A higher level of authentication to access a selected privileged operation of the industrial asset requires verification of two or more multi-factor access credentials.