Graph-Based Plant Data Access Control With Scoped Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to efficiently manage and control access to the vast amount of data generated in complex industrial plants, particularly in chemical plants, which involve intricate processes and numerous sensors, leading to challenges in data security and access management.
Innovation Solution
A graph database plant model is used to structure and represent industrial plant data, incorporating nodes, edges, and properties to store and link data items, with scopes and authorization providers defining access rights based on roles, enabling secure and hierarchical data access control through a graph structure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional access control systems are used to manage data in industrial plants, then implementation is simpler, but the system cannot efficiently handle the vast amount of data and complex access requirements from numerous sensors and processing elements
Solution Approach 1:
The patent segments the industrial plant into a hierarchical structure with multiple levels (plant level, site level, asset level) and organizes data into scopes with different access requirements. This segmentation allows the access control system to handle complex data efficiently by processing requests at appropriate hierarchical levels rather than treating all data uniformly.
Solution Approach 2:
The patent introduces a graph database structure that adds dimensional organization to data access control. By representing data relationships as nodes and edges in a graph, the system can efficiently query and control access to related data across multiple dimensions (temporal, spatial, hierarchical) simultaneously, improving productivity without proportional increases in complexity.
2Reliability
If fine-grained access control is implemented to protect sensitive data, then data security is improved, but the complexity of managing access rights increases
Solution Approach 1:
The patent implements preliminary action by pre-defining scopes and authorization rules in the graph database structure before data access requests occur. Access control policies are established in advance at different hierarchical levels, allowing the system to automatically enforce security rules without complex real-time decision-making, thus improving security while managing complexity through preconfiguration.
Solution Approach 2:
The patent introduces scopes as intermediary concepts between data and access requests. Scopes group related data elements and define access boundaries, acting as mediators that simplify the management of fine-grained access rights. Instead of managing permissions for individual data elements, the system manages permissions for scopes, reducing complexity while maintaining security.
3Ease of operation
If hierarchical access control is implemented to allow inheritance of access rights, then ease of operation is improved, but control over sensitive data from higher levels may be weakened
Solution Approach 1:
The patent applies local quality by allowing different access control characteristics at different levels of the hierarchy. While inheritance provides ease of operation, the system enables local overrides where sensitive data at specific levels can have restricted access that prevents inheritance from higher levels. This ensures that critical data maintains strict protection while non-sensitive data benefits from inheritance, balancing operational ease with security reliability.
Data Source
AI summary
A method for controlling access to data in an industrial plant is provided. Elements (11-18) are mapped to elements of a graph structure. Scopes (S10-S30) are defined, which are associated to elements (11-18) in the graph structure. An authorization provider (31-33) is associated a scope (S10-S30) provides an authorization of data from scopes (S10-S30). Identifiers for entities the elements in the graph structure are parsed. Each scope is associated to one of the elements or entities in the graph structure. A request from an entity for data is received. It is determined to which scope (S10-S30) the entity is related to. Authorization to the request is provided by the at least one authorization provider (31-33) associated to the scope (S10-S20). The requesting entity is granted access to the requested data of the target entity based on the authorized request.