Secure provisioning of devices in industrial automation systems

Patent metadata

Field	Value
Publication number	US-12362912-B2
Application number	US-202217974693-A
Country	US
Kind code	B2
Filing date	Oct 27, 2022
Priority date	Oct 27, 2021
Publication date	Jul 15, 2025
Grant date	Jul 15, 2025

Abstract

A method for securely supplying data to be used in parameterizing a device for an industrial automation system includes a first party supplying a second party with a machine-readable standardized container for the exchange of device parameters in industrial automation systems, wherein the supplying comprises writing into the container an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system. In another aspect, a method for securely obtaining data to be used in parameterizing a device for an industrial automation system includes obtaining, from a first party, by a second party, a machine-readable standardized container for the exchange of device parameters in industrial automation systems, the container comprising an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system.

First claim

What is claimed is:

1. A method for securely supplying data to be used in parameterizing a device for an industrial automation system, the method comprising:
a first party supplying a second party with a machine-readable standardized container for the exchange of device parameters in industrial automation systems, wherein the supplying comprises writing into the container an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system, wherein the machine-readable standardized container supplied by the first party or obtained by the second party comprises further device parameters for parameterizing the device, wherein parameterizing the device comprises extracting, by the device, the encrypted primary security credential and decrypting the encrypted primary security credential, wherein the machine-readable standardized container comprises configuration data including functional data for parametrizing the device, the machine-readable standardized container comprising a device configuration sub model and an encrypted security sub model, wherein the configuration data is stored in the device configuration sub model that is integrated in the machine-readable standardized container, the primary security credential being integrated into the encrypted security sub model.

2. A method for securely obtaining data to be used in parameterizing a device for an industrial automation system, the method comprising:
obtaining, from a first party, by a second party, a machine-readable standardized container for the exchange of device properties in industrial automation systems, the container comprising an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system, wherein the machine-readable standardized container supplied by the first party or obtained by the second party comprises further device parameters for parameterizing the device, wherein parameterizing the device comprises extracting, by the device, the encrypted primary security credential and decrypting the encrypted primary security credential, wherein the machine-readable standardized container comprises configuration data including functional data for parametrizing the device, the machine-readable standardized container comprising a device configuration sub model and an encrypted security sub model, wherein the configuration data is stored in the device configuration sub model that is integrated in the machine-readable standardized container, the primary security credential being integrated into the encrypted security sub model.

3. The method of claim 1 , wherein the first party writes the primary security credential into the container using a secure local work environment, before supplying the second party with the container by transmitting the container to the second party over a public or private network.

4. The method of claim 1 , wherein the first party writes the primary security credential into the container by using a secondary security credential received from the second party to establish a secure channel to a remote work environment of the second party in which the container is stored, before writing the primary security credential into the container stored in the remote work environment.

5. The method of claim 4 , wherein the secondary security credential is transmitted from the second party to the first party by embedding it in the said container and transmitting the container.

6. The method of claim 1 , further comprising commissioning the parameterized device for use in the industrial automation system, wherein the commissioning comprises the device using the primary security credential to establish trust with the industrial automation system.

7. A method for parameterizing a device for an industrial automation system, the method comprising:
obtaining a machine-readable standardized container for the exchange of device properties in industrial automation systems, the container comprising an encrypted primary security credential to be used by the device for establishing trust with the industrial automation system, along with further device parameters for parameterizing the device; and
parameterizing the device using the device parameters from the container, wherein the parameterizing comprises the device extracting the primary security credential from the container and decrypting the primary security credential, wherein the machine-readable standardized container comprises configuration data including functional data for parametrizing the device, the machine-readable standardized container comprising a device configuration sub model and an encrypted security sub model, wherein the configuration data is stored in the device configuration sub model that is integrated in the machine-readable standardized container, the primary security credential being integrated into the encrypted security sub model.

8. The method of claim 7 , wherein the parameterizing is performed locally by downloading the container to the device from a secure local work environment in which the container is stored.

9. The method of claim 7 , wherein the parameterizing is performed remotely by accessing a remote work environment in which the container is stored, and downloading the container to the device from the remote work environment.

10. The method of claim 9 , wherein the device itself accesses the remote work environment according to predefined power-on behavior programmed into the device.

11. The method of claim 10 , wherein the predefined power-on behavior is input to the device by way of the said container.

12. The method of claim 7 , further comprising commissioning the parameterized device for use in the industrial automation system, wherein the commissioning comprises the device using the primary security credential to establish trust with the industrial automation system.

Assignees

• Abb Schweiz Ag

Inventors

• Schulz Dirk
• Finster Soeren
• Gruener Sten
• Gamer Thomas

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L9/0816 Primary

  Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title