Methods and apparatuses for defining authorization rules for peripheral devices based on peripheral device categorization

Patent metadata

Field	Value
Publication number	US-11592811-B2
Application number	US-202017038763-A
Country	US
Kind code	B2
Filing date	Sep 30, 2020
Priority date	Oct 2, 2019
Publication date	Feb 28, 2023
Grant date	Feb 28, 2023

Abstract

Method, apparatus and computer program product for detecting vulnerability in an industrial control system, predicting maintenance in an industrial control system, and defining authorization rules for peripheral devices based on peripheral device categorization are described herein.

First claim

What is claimed is:

1. A method, comprising:
at a device with one or more processors and a memory:
receiving an indication of a peripheral device, in response to the peripheral device being communicatively coupled to an industrial control system, wherein the indication comprises: a device identifier that identifies the peripheral device;
obtaining, based on the device identifier, device-level data for the peripheral device from one or more industrial control files; and
defining one or more authorization rules for the peripheral device based on the device-level data, wherein at least one authorization rule of the one or more authorization rules initiates an authentication process for the peripheral device, wherein the authentication process comprises:
rendering, on a user interface of the device, an authorization code;
inputting, by a user, via the user interface, the authorization code to authorize the peripheral device;
authorizing the peripheral device to access at least one portion of the industrial control system in response to inputting the authorization code; and
accessing, by the peripheral device, the at least one portion of the industrial control system in response to authorizing the peripheral device, wherein the at least one portion of the industrial control system is inaccessible to the peripheral device before the authentication process.

2. The method of claim 1 , the defining one or more authorization rules comprising defining the one or more authorization rules based on device categorization data indicative of category data for the peripheral device included in the device-level data wherein the device-level data comprises at least one of: a vendor identification, a product identification, a device subcategory, action data indicative of one or more actions for the peripheral device, count data indicative of a count, the peripheral device is able to connect to the industrial control system, boot time data indicating if at least one action of the action data is for a boot time mode or a non-boot time mode for the industrial control system, and user group data indicative of a security identifier for the user associated with the peripheral device.

3. The method of claim 1 , the defining one or more authorization rules comprising defining the one or more authorization rules based on at least one mode of the industrial control system, wherein the at least one mode is indicative of: a boot time mode and a non-boot time mode.

4. The method of claim 1 , further comprising:
creating a rule database hash file with the device-level data and the one or more authorization rules; and
storing the rule database hash file in a database for a secure media exchange platform associated with the industrial control system.

5. The method of claim 1 , further comprising:
querying the peripheral device to obtain device categorization data for the peripheral device; and
obtaining the device-level data from a simulation performed with respect to system operations system for the industrial control system.

6. The method of claim 1 , further comprising:
rendering, on the user interface, at least one of: the device-level data, device capability data, and an input data field, wherein the device capability data includes one or more capabilities of the peripheral device, and wherein the input data field allows the user to input the authorization code.

7. The method of claim 1 , wherein the defining one or more authorization rules further comprises defining at least one rule indicative of:
an access for the peripheral device to one or more portions of the industrial control system; and
a rejection of access for the peripheral device to the one or more portions of the industrial control system.

8. An apparatus comprising at least one processor and at least one non-transitory memory including computer program code instructions, the computer program code instructions configured to, when executed, cause the apparatus to:
receive an indication of a peripheral device, in response to the peripheral device being communicatively coupled to an industrial control system, wherein the indication comprises: a device identifier that identifies the peripheral device;
obtain, based on the device identifier, device-level data for the peripheral device from one or more industrial control files; and
define one or more authorization rules for the peripheral device based on the device-level data, wherein at least one authorization rule of the one or more authorization rules initiates an authentication process for the peripheral device, wherein the authentication process comprises:
rendering, on a user interface of the device, an authorization code;
inputting, by a user, via the user interface, the authorization code to authorize the peripheral device;
authorizing the peripheral device to access at least one portion of the industrial control system in response to inputting the authorization code; and
accessing, by the peripheral device, the at least one portion of the industrial control system in response to authorizing the peripheral device, wherein the at least one portion of the industrial control system is inaccessible to the peripheral device before the authentication process.

9. The apparatus of claim 8 , the one or more authorization rules defined based on device categorization data indicative of category data for the peripheral device included in the device-level data, wherein the device-level data comprises at least one of: a vendor identification, a product identification, a device subcategory, action data indicative of one or more actions for the peripheral device, count data indicative of a count, the peripheral device is able to connect to the industrial control system, boot time data indicating if at least one action of the action data is for a boot time mode or a non-boot time mode for the industrial control system, and user group data indicative of a security identifier for the user associated with the peripheral device.

10. The apparatus of claim 8 , the one or more authorization rules defined based on different at least one mode of the industrial control system, wherein the at least one mode is indicative of: a boot time mode and a non-boot time mode.

11. The apparatus of claim 8 , the computer program code instructions further configured to, when executed, cause the apparatus to:
create a rule database hash file with the device-level data and the one or more authorization rules.

12. The apparatus of claim 11 , the computer program code instructions further configured to, when executed, cause the apparatus to:
store the rule database hash file in a database for a secure media exchange platform associated with the industrial control system.

13. The apparatus of claim 8 , the computer program code instructions further configured to, when executed, cause the apparatus to:
query the peripheral device to obtain device categorization data for the peripheral device.

14. The apparatus of claim 8 , the computer program code instructions further configured to, when executed, cause the apparatus to:
obtain the device-level data from a simulation performed with respect to system operations system for the industrial control system.

15. The apparatus of claim 8 , wherein the user interface is further configured to render, at least one of: the device-level data, device capability data, and an input data field, wherein the device capability data includes one or more capabilities of the peripheral device, and wherein the input data field allows the user to input the authorization code.

16. The apparatus of

Assignees

• Honeywell Int Inc

Inventors

• Gadhe Ganesh
• Knapp Eric
• Young David
• Swain Doug
• Mehalek Virgil

Classifications

• G05B19/4183

  characterised by data acquisition, e.g. workpiece identification · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• G05B19/41865

  characterised by job scheduling, process planning, material flow · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/44

  Program or device authentication · CPC title