Secondary security authority

Patent metadata

Field	Value
Publication number	US-9613195-B2
Application number	US-201615160976-A
Country	US
Kind code	B2
Filing date	May 20, 2016
Priority date	May 29, 2015
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

Techniques to facilitate protecting control programs used in an industrial automation environment are disclosed herein. In at least one implementation, control system content provided by a primary entity is received along with a primary security authority provided by the primary entity, wherein the primary security authority defines primary usage rights for the control system content granted to a secondary entity. A secondary security authority provided by the secondary entity is received, wherein the secondary security authority defines secondary usage rights for the control system content that further restrict the primary usage rights. A request is received from a user associated with the secondary entity to perform an action associated with the control system content, and the request is processed with the secondary security authority to determine if the user is authorized to perform the action associated with the control system content based on the secondary usage rights.

First claim

What is claimed is:

1. A method of operating a computing system to facilitate protecting control programs used in an industrial automation environment, the method comprising:
receiving control system content provided by a primary entity, wherein the control system content comprises controller program code that directs an industrial controller to drive a machine system;
receiving a primary security authority provided by the primary entity, wherein the primary security authority defines primary usage rights for the control system content granted to a secondary entity;
receiving a secondary security authority provided by the secondary entity, wherein the secondary security authority defines secondary usage rights for the control system content that further restrict the primary usage rights granted to the secondary entity by the primary entity in the primary security authority;
receiving a request from a user associated with the secondary entity to perform an action associated with the control system content;
processing the request with the primary security authority to determine if the secondary entity is authorized to perform the action associated with the control system content based on the primary usage rights;
if the secondary entity is not authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then denying the request to perform the action;
if the secondary entity is authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then processing the request with the secondary security authority to determine if the user is authorized to perform the action associated with the control system content based on the secondary usage rights;
if the user is authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then granting the request to perform the action; and
if the user is not authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then denying the request to perform the action.

2. The method of claim 1 wherein the secondary usage rights define control system content permissions for one or more user groups associated with the secondary entity.

3. The method of claim 1 wherein the primary security authority grants permissions for the control system content to one or more user groups associated with the primary entity.

4. The method of claim 3 wherein the secondary security authority restricts one or more of the permissions for the control system content granted to the one or more user groups associated with the primary entity in the primary security authority.

5. One or more computer-readable storage media having program instructions stored thereon to facilitate protecting control programs used in an industrial automation environment, wherein the program instructions, when executed by a computing system, direct the computing system to at least:
receive control system content provided by a primary entity, wherein the control system content comprises controller program code that directs an industrial controller to drive a machine system;
receive a primary security authority provided by the primary entity, wherein the primary security authority defines primary usage rights for the control system content granted to a secondary entity;
receive a secondary security authority provided by the secondary entity, wherein the secondary security authority defines secondary usage rights for the control system content that further restrict the primary usage rights granted to the secondary entity by the primary entity in the primary security authority;
receive a request from a user associated with the secondary entity to perform an action associated with the control system content;
process the request with the primary security authority to determine if the secondary entity is authorized to perform the action associated with the control system content based on the primary usage rights;
if the secondary entity is not authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then deny the request to perform the action;
if the secondary entity is authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then process the request with the secondary security authority to determine if the user is authorized to perform the action associated with the control system content based on the secondary usage rights;
if the user is authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then grant the request to perform the action; and
if the user is not authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then deny the request to perform the action.

6. The one or more computer-readable storage media of claim 5 wherein the secondary usage rights define control system content permissions for one or more user groups associated with the secondary entity.

7. The one or more computer-readable storage media of claim 5 wherein the primary security authority grants permissions for the control system content to one or more user groups associated with the primary entity.

8. An apparatus to facilitate protecting control programs used in an industrial automation environment, the apparatus comprising:
one or more computer-readable storage media; and
program instructions stored on the one or more computer-readable storage media that, when executed by a processing system, direct the processing system to at least:
receive control system content provided by a primary entity, wherein the control system content comprises controller program code that directs an industrial controller to drive a machine system;
receive a primary security authority provided by the primary entity, wherein the primary security authority defines primary usage rights for the control system content granted to a secondary entity;
receive a secondary security authority provided by the secondary entity, wherein the secondary security authority defines secondary usage rights for the control system content that further restrict the primary usage rights granted to the secondary entity by the primary entity in the primary security authority;
receive a request from a user associated with the secondary entity to perform an action associated with the control system content;
process the request with the primary security authority to determine if the secondary entity is authorized to perform the action associated with the control system content based on the primary usage rights;
if the secondary entity is not authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then deny the request to perform the action;
if the secondary entity is authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then process the request with the secondary security authority to determine if the user is authorized to perform the action associated with the control system content based on the secondary usage rights;
if the user is authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage

Assignees

• Rockwell Automation Tech Inc

Inventors

• Brandt Robert A
• Case Clark L
• Wilkinson John C

Classifications

• G05B19/4155

  characterised by program execution, i.e. part program or machine function execution, e.g. selection of a program · CPC title

• G05B2219/31229

  Supervisor, leader, workstation controller, automation, machine control · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/104

  Grouping of entities · CPC title

• G05B2219/24159

  Several levels of security, passwords · CPC title