US 12,437,114 B2
Method and system for granting access rights to control applications of an industrial automation system
Peter Kob, Heroldsberg (DE); and Maximilian Hoch, Adelsdorf (DE)
Assigned to Siemens Aktiengesellschaft, Munich (DE)
Appl. No. 18/849,595
Filed by Siemens Aktiengesellschaft, Munich (DE)
PCT Filed Feb. 27, 2023, PCT No. PCT/EP2023/054785
§ 371(c)(1), (2) Date Sep. 23, 2024,
PCT Pub. No. WO2023/180009, PCT Pub. Date Sep. 28, 2023.
Claims priority of application No. 22164332 (EP), filed on Mar. 25, 2022.
Prior Publication US 2025/0165653 A1, May 22, 2025
Int. Cl. G06F 9/455 (2018.01); G06F 9/54 (2006.01); G06F 21/41 (2013.01); G06F 21/53 (2013.01); G06F 21/62 (2013.01); H04L 9/32 (2006.01); H04L 29/06 (2006.01)
CPC G06F 21/629 (2013.01) [G06F 9/45558 (2013.01); G06F 2009/45562 (2013.01); G06F 2009/4557 (2013.01)] 12 Claims
OG exemplary drawing
 
1. A method of granting access rights to control applications of an industrial automation system, the method comprising:
providing first control applications via software containers which are loaded into and executed in a container runtime environment installed on a host operating system, the software containers for the first control applications each being at least one of (i) migratable from one automation device having a container runtime environment to another automation device having a container runtime environment for execution there and (ii) executable simultaneously on a plurality of automation devices having a container runtime environment;
monitoring and configuring the first control applications via an application management system;
detecting, by the application management system, at least one of creation, deletion and modification of the software containers, and registering, by the application management system, the software containers with their respective execution status, at least one of the creation, deletion and modification of the software containers each comprising allocating or releasing resources in a respective automation device having a container runtime environment;
authenticating the first control applications via the application management system;
executing and cryptographically authenticating second control applications directly on a host operating system; and
authorizing data traffic from at least one of (i) the first and the second control applications to target devices and (ii) target applications following successful authentication in each case via an at least temporarily valid access key inserted into the data traffic;
wherein the first and second control applications are installed on automation devices which comprise a secured subnetwork which is assigned to the industrial automation system; and
wherein the first and the second control applications are accessed from outside the secured subnetwork only following authorization by the application management system.