Industrial Mobile Code Authentication Using Local FAC and HMAC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face challenges in ensuring the integrity and security of mobile code executed on industrial devices, as they are vulnerable to malicious attacks that can compromise the integrity or behavior of the devices, particularly due to unauthorized access and substitution of program files.
Innovation Solution
The implementation of a lightweight file authentication sequence that generates a unique file authentication code (FAC) stored on the industrial device, accessible only via local connections, and verifies the authenticity of mobile code by comparing hash-based message authentication codes (HMAC) before allowing execution, thereby preventing unauthorized execution of malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key infrastructure (PKI) is used for code authentication, then security is improved, but resource consumption and system complexity increase
Solution Approach 1:
The patent extracts the essential authentication function from the complex PKI system, keeping only the critical hash-based message authentication code (HMAC) verification mechanism. This removes unnecessary complexity while maintaining core security functionality for mobile code authentication in industrial devices.
Solution Approach 2:
The patent employs lightweight, computationally inexpensive authentication tokens (HMAC codes) instead of heavy cryptographic certificates. These simple authentication objects consume minimal resources and can be rapidly generated and verified, making them suitable for resource-constrained industrial automation devices.
2Reliability
If comprehensive code verification is implemented, then security against malicious code is improved, but execution time and processing overhead increase
Solution Approach 1:
The authentication code is pre-calculated and embedded within the mobile code package before transmission to the industrial device. This preliminary preparation eliminates the need for complex real-time verification computations, allowing rapid authentication during code execution while maintaining comprehensive security checks.
3Ease of operation
If file authentication code is made accessible for code updates, then ease of operation is improved, but vulnerability to unauthorized access increases
Solution Approach 1:
The patent introduces an intermediary authentication mechanism where the industrial device itself acts as the mediator for code updates. The device verifies authentication codes locally and controls the update process, preventing direct unauthorized access to authentication credentials while maintaining operational ease for authorized users through standard update procedures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An industrial device is configured to implement a lightweight file authentication sequence that rapidly verifies the integrity of mobile code supplied to the industrial device. The industrial device generates a file authentication code (FAC), which is stored on the industrial device and only made accessible to users via a local connection to the industrial device. The device-specific file FAC is installed on the program development application used to develop or edit the mobile code to be executed on the industrial device. The development application provides the mobile code to the industrial device together with a hash-based message authentication code (HMAC) generated using a retrieved copy of the FAC. The industrial device only permits execution of the mobile code if the HMAC included with the mobile code matches a locally created HMAC generated by the industrial device based on the mobile code and the device's local copy of the FAC.