Field Device Access Recovery Without Reset Using Signed Query Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing field devices in process automation lack secure communication links, leading to insecure operation and loss of configuration when reset, with high computational complexity and effort in managing individual field-device keys, and requiring each new unit to be entered into security policies of all others, which is error-prone and a security risk.
Innovation Solution
A device that generates a unique random query key, transmitted via a secure connection to a trusted server using asymmetric encryption, allowing authenticated unlocking of the field device while maintaining existing configuration, with only one private key needed on the server, reducing key management effort.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a RESET button is used to unlock the field device after erroneous entries, then the device can be unlocked, but the configuration is lost and the device is reset to factory settings
Solution Approach 1:
The authentication mechanism is segmented into multiple independent components: individual field device public keys, a central server private key, and cryptographic authentication protocols. This allows the system to verify identity without requiring a reset, thus unlocking the device while preserving configuration.
Solution Approach 2:
A trusted server acts as an intermediary between the field device and the authentication system. The server holds the private key and verifies authentication requests, enabling secure unlocking without resetting the field device configuration. This mediator eliminates the need for the RESET button's destructive approach.
2Reliability
If asymmetric encryption with a trusted server is implemented, then security is improved and configuration is preserved, but computational complexity increases
Solution Approach 1:
The system uses asymmetric encryption where each field device has a unique public key and the central server has a private key. This asymmetric key structure enables secure authentication with optimized computational distribution: the server performs the heavy cryptographic verification while field devices only need to sign requests, reducing their computational burden.
Solution Approach 2:
Public keys are pre-configured in field devices during manufacturing or initial setup. This preliminary action eliminates the need for complex key exchange protocols during operation, as the authentication infrastructure is already in place and ready to verify identities immediately.
3Reliability
If each new field device is entered into security policies of all other devices, then secure communication is established, but the effort and error risk increase significantly
Solution Approach 1:
The central server's private key serves as a universal authentication credential that grants access to all field devices in the system. Instead of configuring each device pair individually, the server's single private key can authenticate with any number of field devices, greatly simplifying key management and eliminating manual pairing efforts.
Solution Approach 2:
Field devices automatically obtain their public keys during initialization and can independently authenticate with the trusted server using their pre-configured keys. This self-service authentication eliminates the need for manual key distribution and configuration between devices, reducing both effort and error risk.
Data Source
AI summary
A device for securely operating a field device includes: the field device, which includes at least one human-machine interface having a display device and a keyboard for operating the field device, and a communications interface for connecting a local operating device having a secure connection to a trusted server via a communications network, the secure connection being based upon an authentication feature of a local operator. The field device during use as intended does not have a secure connection to a network for process control. The field device provides and stores a query key. The field device is connected, at least logically, to the local operating device. The trusted server has a private key for providing a signed response key. The signed response key is based upon the query key.