Industrial Automation License Server for Secure Function Allocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face limitations in managing functionality licenses due to the vast number of possible I/O and logic capabilities, and security concerns restrict the addition of new licenses, making it difficult to ensure all devices have the necessary functionalities.
Innovation Solution
A method and device for managing functionality licenses in a closed network, where a license database is operated to assign licenses based on functionality identifiers, with the ability to scan for connected devices, add new licenses, and securely connect to external databases when needed, ensuring only authorized devices have the required licenses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If functionality licenses are added to an industrial automation system, then the desired functionalities of I/O modules and devices are improved, but the network security and license quantity limitations are worsened
Solution Approach 1:
A license server is introduced as an intermediary component between devices and the license database. The license server manages license requests, validates functionality identifiers, and coordinates license assignment, thereby enabling expanded functionality while maintaining security through centralized control and authentication mechanisms.
Solution Approach 2:
The license management system is segmented into distinct components: a license database storing functionality licenses, a license server handling request processing, and participating devices making requests. This segmentation allows the system to manage multiple functionality licenses securely by distributing responsibilities across separate modules rather than consolidating all functions in a single vulnerable point.
2Adaptability or versatility
If the number of functionality licenses is increased, then the I/O and logic capabilities are improved, but the device complexity and license management overhead are worsened
Solution Approach 1:
The license server is designed as a universal management component that handles all license requests for diverse I/O modules and devices with different logic functions. Rather than creating separate management mechanisms for each device type or functionality, the single license server provides multi-functional license management, reducing overall system complexity while supporting expanded capabilities.
Solution Approach 2:
The system uses functionality identifiers as standardized copies or representations of complex functional capabilities. Instead of managing entire functional descriptions for each license, the system uses compact identifier codes that reference predefined functionalities in the license database, simplifying the license request and assignment process while maintaining support for diverse capabilities.
3Reliability
If devices are decoupled from external networks for security reasons, then network security is improved, but the ability to add functionality licenses is worsened
Solution Approach 1:
Functionality licenses are pre-stored in the local license database before the industrial automation system needs to expand its capabilities. When new functionalities are required, the system can assign licenses from the pre-loaded database without needing to connect to external networks, thereby maintaining security isolation while enabling flexible license management.
Solution Approach 2:
The license server acts as an intermediary that manages all license operations locally within the closed network. By handling license assignment, validation, and tracking internally without requiring external network communication, the license server enables full license management capability while maintaining the security benefit of network decoupling.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The application relates to a method (400) for managing functionality licenses in a closed network (101) to which a plurality of subscriber devices (110, 120, 130) are connected, comprising operating (410) a license database (110), wherein the license database contains a plurality of functionality licenses, each functionality license comprising a functionality identifier. The method further comprises receiving (420) a license request from the subscriber device (130) connected to the closed network (101), wherein the license request includes a functionality identifier.The procedure (430) further compares the functionality identifier of the license request with the functionality identifier of the plurality of functionality licenses and, if a functionality identifier of a functionality license from the plurality of device licenses matches the functionality identifier of the license request, it (440) assigns the functionality license corresponding to the license request to the subscriber device (130), the assignment including storing the subscriber device (130) as a licensed subscriber device in the license database. Furthermore, the application concerns a device that is configured to execute the procedure.