Semantic Annotation Access Control for Industrial Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face challenges in managing access rights securely and efficiently, particularly in large, distributed machine-to-machine scenarios, where existing role-based access control methods are neither economically feasible nor secure, and are prone to errors due to the complexity of managing user roles and data object-specific constraints.
Innovation Solution
A computer-implemented method and system that uses semantic data annotations and an access data structure to authorize access to digital data in industrial automation systems, allowing for robust and flexible access control by associating requester properties with meta-data identifiers, reducing the risk of incorrect permission assignments and enabling granular access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control is used to manage access rights, then access security is improved, but device complexity and management effort increase significantly
Solution Approach 1:
The patent extracts the access control logic from the device itself and places it in a centralized access control system. The device only stores simple annotations identifying data objects, while complex role-based access control policies are maintained and evaluated externally, significantly reducing device complexity while maintaining security.
Solution Approach 2:
The patent introduces a centralized access control system as an intermediary between data providers and requesters. This intermediary handles the complex role-based access control decisions, allowing devices to remain simple while still enforcing sophisticated security policies through the mediating access control system.
2Reliability
If access control lists are maintained on devices to control data access, then access security is improved, but ease of operation deteriorates due to maintenance complexity
Solution Approach 1:
The patent extracts access control list maintenance from embedded devices and relocates it to a centralized access control system. Devices only maintain simple annotations, while the complex access control lists are managed externally, significantly improving ease of operation and maintenance.
Solution Approach 2:
The patent uses annotations as simplified copies or references of data objects that point to their full descriptions stored externally. These annotations contain only essential identification information, allowing devices to operate simply while the centralized system maintains comprehensive access control information.
3Device complexity
If simple role concepts are applied to embedded devices, then device complexity is reduced, but access control precision and flexibility deteriorate
Solution Approach 1:
The patent segments the access control functionality into two parts: simple annotations stored on devices and complex access control policies maintained externally. This segmentation allows devices to remain simple while the centralized system provides precise and flexible access control through detailed role-based policies.
Solution Approach 2:
The patent moves access control precision from the device level to the system level by introducing a centralized access control dimension. Instead of embedding complex logic in devices, the system adds a new dimensional layer of abstraction where precise access control policies are managed externally and applied uniformly across all devices.
Data Source
Figure 1
Figure 1A~2
Figure 3
AI summary
Computer system, computer-implemented method and computer program product are provided for authorizing access to digital data (210) of a device (200) which forms part of an industrial automation system. The digital data (200) is annotated with one or more annotations (A1 to An) Each annotation is an identifier for meta-data of the digital data (210) characterizing the semantic meaning of the digital data in accordance with a semantic technical dictionary. A requester (10, 20) with one or more requester properties (50) defining access permissions for the requester submits a request (30) to access the digital data (210) on the device (200). An authorization check component (400) accesses an access data structure (300) in response to the request (30). The access data structure (300) stores associations (A1:RP1, A1:RP3, A2:RP2, A3:RP4, A4:RP3, An:R5) between requester properties (50) and the one or more annotations (A1 to An). The authorization check component further compares at least one requester property of the requester (RP1) with the requester properties (RP1 to RP5) associated with the annotations (A1 to An). If the at least one requester property (RP1) is part of at least one association (A1 :RP1), the requester (10, 20) is authorized to access the digital data represented by the at least one respective annotation (A1) which is associated with the at least one requester property (RP1). Thereby, authorizing is in accordance with permissions as defined by the at least one requester property.