EP4655697A1 - Procédé, instance de contrôle et produit-programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle - Google Patents

Procédé, instance de contrôle et produit-programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle

Info

Publication number
EP4655697A1
EP4655697A1 EP24713924.9A EP24713924A EP4655697A1 EP 4655697 A1 EP4655697 A1 EP 4655697A1 EP 24713924 A EP24713924 A EP 24713924A EP 4655697 A1 EP4655697 A1 EP 4655697A1
Authority
EP
European Patent Office
Prior art keywords
data
access
functions
confidentiality
user
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
EP24713924.9A
Other languages
German (de)
English (en)
Inventor
Annemarie Breu
Lukas Kohler
Tobias Siegel
Joseph Tylka
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Siemens AG
Siemens Corp
Original Assignee
Siemens AG
Siemens Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Siemens AG, Siemens Corp filed Critical Siemens AG
Publication of EP4655697A1 publication Critical patent/EP4655697A1/fr
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the invention relates to a method for controlling access to structured data or to functions of an industrial automation arrangement according to the preamble of patent claim 1, a control instance for controlling access to structured data or to functions of an industrial automation arrangement according to the preamble of patent claim 11, and a computer program product for controlling access to structured data or to functions of an industrial automation arrangement according to the preamble of patent claim 12.
  • edge computing e.g. in manufacturing, buildings, etc.
  • large amounts of data are generated and automatically transferred to local (on-device), on-premise (on-site) and cloud (e.g. Internet) hosted databases.
  • on-device on-premise
  • cloud e.g. Internet
  • customers require strict access control policies enforced throughout the data flow.
  • the present invention deals with the configuration and implementation of such data classification policies in industrial automation arrangements, in particular in industrial edge and cloud computing systems/infrastructures.
  • State-of-the-art database technologies enable access and authorization per database.
  • the databases are usually structured in semantic data models that represent a hierarchical asset structure.
  • Access control in database technologies is known in the state of the art.
  • Most modern databases e.g. PostgreSQL, MongoDB, InfluxDB, etc.
  • DBMS database management system
  • the underlying data structures offered within the database e.g. sub-databases, resources, buckets, tags, data points, shards, etc.
  • LDAP Lightweight Directory Access Protocol
  • Additional security features such as authorization tokens, Transport Layer Security / Secure Sockets Layer (TLS/SSL) encryption, etc. are standard features of such databases.
  • these features are mainly aimed at user access control - to moderate who can access which data -; However, they do not address a security/sensitivity classification of the data structures themselves.
  • Corporate classification levels for business documents are also known.
  • Corporate software such as the Microsoft Office suite may support company-specific sensitivity/classification levels.
  • the "Information Protection" function of MS Office assigns a company-specific sensitivity or confidentiality classification to the current document (e.g. Word, Excel, PowerPoint, etc.).
  • the data itself receives a "sensitivity classification”
  • the assigned classification is tied to the document in question.
  • the permissions or restrictions thus classified with the document in question apply to any use of (only this) document and are both binding and the same for all users of the document.
  • SCADA Supervisory Control and Data Access
  • SCADA systems offer user management tools to authorize which users can access the system and with which authorizations.
  • Siemens WinCC for example, login access and function/operation authorizations can be assigned per user, as shown in the table in Figure 1.
  • files, data streams or data objects e.g. variables, assets, functions, applications
  • data can be classified according to their required level of protection. This data classification is taken into account in an entire application, which can extend across many devices and organizational units, so that users can only access and influence objects of a certain classification based on their authorization level (e.g. read and write).
  • authorization level e.g. read and write
  • the central point of the classification system is to control the data or "assets" themselves.
  • the concept works both in a system that does not have a classic (personal) user management system and in systems that manage human or non-technical users.
  • Managing access to certain classifications requires a link to the system's user management system, but here a user is generally seen as an entity that uses or accesses the data or function or generally the "asset”, and can therefore also be an (external) device, service or other "data sink”.
  • the administrator can assign to each user (in the general sense) which classifications this user (or alternatively all users of a defined group) can access and with which interactions.
  • the data or functions are assigned a classification with a specific confidentiality class (0, ..., 3) from a plurality of confidentiality classes (0, ..., 3), whereby a user or a technical instance is assigned a user class from a number of user classes, whereby, preferably in the manner of a matrix, for many or each of the confidentiality classes (0, ..., 3) and for many or each of the An access authorization is specified for user classes, whereby the access authorization defines the restrictions on access by users or technical entities of the respective user class to the data or functions assigned to the respective confidentiality class (0, 3), and whereby access to the data or functions assigned to the respective confidentiality classes (0, ..., 3) is controlled by the users or technical entities assigned to the respective user classes on the basis of the respectively defined restrictions.
  • user or machine access and authorizations are controlled from the confidentiality classifications of the data or data structures or functions themselves, thus providing a comprehensive approach to automatically determine the authorization of known
  • control instance also called gatekeeper or system-level gatekeeper
  • control instance for controlling access to structured data or functions of an industrial automation arrangement
  • the control instance comprises an input interface for receiving the data to be accessed or an API or the like for accessing functions
  • the control instance is designed to control access to the data or functions according to one of the methods described above
  • the control instance comprises an output interface for accessing the data or functions.
  • the object is achieved by a computer program product for controlling access to structured data or functions of an industrial automation arrangement, wherein the computer program product, when executed on a computer, is designed to carry out one of the methods described in the patent claims.
  • the method or the control instance is particularly advantageously used in an industrial edge device that has access to (confidential) data from an industrial automation arrangement and at the same time has an interface to a public network (Internet, "cloud").
  • the control instance described here can also supplement any firewall by controlling access to data not (only) port-based, but content-based.
  • Industrial edge devices are often equipped with runtime environments for software containers, for example so-called Docker containers, which are managed with an administration system, e.g. Kubernetes.
  • the method or arrangement or service according to the invention can advantageously be encapsulated in its own container and/or run in its own runtime environment and control the data traffic of assigned neighboring containers.
  • a software container that is assigned to other containers or applications to implement a service is sometimes also called a sidecar container.
  • the type of access i.e. data operations
  • the authorizations "read” and “read and write” is differentiated at least between the authorizations "read” and “read and write”. This allows the method to be used in a compatible manner with existing access control procedures.
  • access is preferably denied or another predefined measure is applied so that an administrator or similar does not have to fill in every possible combination of user class and confidentiality class, which saves unnecessary work, especially in the case of a matrix-like recording.
  • the inventive concept advantageously makes it possible to subsequently change the restrictions assigned to a confidentiality class and/or user class, with the changed restrictions being applied to subsequent access to the data concerned. This significantly simplifies general adjustments to the authorizations or restrictions.
  • a significant advantage of the invention is that both the data itself can be classified directly and the classification is first assigned to a variable or a data source and then automatically assigned to all data generated from values of this variable or data source or derived from them.
  • the classification it is also advantageously possible for the classification to be assigned to a data type and automatically assigned to all data of this type.
  • Inheritance to derived structures, data types or the like is also possible, with advantageously combined data or data types or data structures generated from individual data or data types or data structures, each with its own classification, inheriting the strictest of these classifications overall.
  • access to the data assigned to the respective confidentiality classes is controlled by the users assigned to the respective user classes of an external interface of a component of the automation arrangement with the data, in particular in a network interface, another data interface or software for a user interface (BuB - Operating and Monitoring; "HMI” - Human Machine Interface).
  • a component of the automation arrangement with the data, in particular in a network interface, another data interface or software for a user interface (BuB - Operating and Monitoring; "HMI” - Human Machine Interface).
  • HMI Human Machine Interface
  • the assignment of users, which also includes "technical users" in the sense of devices, applications or interfaces, to user classes can come from an internal usage management system.
  • external identity and access management systems IAM - Identity + Access Management
  • LDAP company directories
  • Active Directory Active Directory
  • Classification schemes for user classes can also be derived from company-wide systems such as MS Office and then correlated with authorizations.
  • Figure 1 shows the state of the art with an assignment of users to user groups and assigned authorizations or restrictions using the example of a SCADA system
  • Figure 2 shows an inventive classification of data or data structures with confidentiality classes and the associated user classes and the respectively associated restrictions.
  • the table in Figure 1 shows classic authorization definitions from the state of the art.
  • SCADA Supervisory Control and Data Access
  • SCADA systems offer user management tools to authorize which users are allowed to access the system and with which authorizations.
  • SCADA system Siemens WinCC for example, login, access and function/operation authorizations can be assigned per user, as shown in the table in Figure 1.
  • these authorizations are only implemented at the general system function level and are not tied to a concept of sensitivity or confidentiality classification of the underlying data structures.
  • Figure 2 shows in the top row of an authorization matrix the confidentiality classes 0, ..., 4, which can be directly assigned to the data or data structures or data sources to be protected; of course, system functions (saving, printing, sending, logging on, etc.) can also be classified as data in the broader sense or data operations whose access or use is controlled.
  • the table in Figure 2 shows an example of the assignment of user roles (left-hand column) as user classes and permitted interactions/operations per confidentiality class (subsequent columns), with the restrictions (e.g. hidden - read only, read and write) noted in the fields of the matrix.
  • the information can also be shown or saved in a way other than in a matrix, for example in the form of an XML file with appropriate tags.
  • the classification level of the data structure it is advantageous to implement a web-based user interface. Once entered, the classification level is inherited in an asset hierarchy.
  • subtrees of the data model cannot have a lower (i.e., more permissive) classification level than their parents.
  • Data access is then automatically enforced by a control instance, a so-called "gatekeeper" at the system level, which simply compares the access/authorization level of the current user for a specific operation (e.g. read/write) with the confidentiality or Sensitivity classifications of the relevant data structures.
  • a control instance e.g. read/write
  • Data structures that require a higher authorization level or confidentiality class than the current user or user group has are simply filtered out when a query response is returned to the user.
  • the modification of read-only data for a user is then just as easily prevented by the gatekeeper.
  • the present invention has the following main features:
  • User management in the sense of authorization management for users, devices, services or other entities accessing data is specifically implemented to map access rights to the data classification.
  • a system-level controller or gatekeeper is responsible for moderating or controlling the distribution of data to users or other data sinks by:
  • a filter is used that is adapted to the permissions or restrictions of the user in question.
  • the classification system is not (necessarily) classically user-based (user in the sense of a person). Based on the classification, it should be controlled whether the data can be processed in a certain function or the like or transferred via an interface. This means that the data flows and accesses of the interfaces/functions are controlled.
  • the link to the user exists insofar as the user interface (e.g. HMI - Human Machine Interface) also enables a data flow that must be controlled. This happens analogously to all other interfaces, e.g.:
  • Variable X has classification Y.
  • the data may only be used for reading via the cloud interface.
  • Variable X has classification Y.
  • the data may only be read by user Z via the user interface.
  • the present invention offers a crucial difference to existing similar technologies, namely that user access and permissions are automatically derived and enforced based on the Confidentiality classifications inherent in the data structures themselves. This ensures data confidentiality throughout the entire data flow.
  • Database technologies provide comprehensive user management and access control tools, but the underlying data structures generally do not contain specific sensitivity classification mappings unless they are manually/custom implemented.
  • SCADA / WinCC systems typically support user management and system function authorizations, but do not directly relate to an underlying concept of confidentiality classification of the available data structures.
  • WinCC restricts access only to entire system functions, not selectively within the function.
  • WinCC would only allow or prevent access to the entire data structure; the present invention, on the other hand, selectively controls which data is accessible.
  • Enterprise classification tools such as Microsoft Office's "Information Protection” feature provide a per-document classification of confidentiality, but enforcing who can access these highly sensitive documents depends on employees accurately implementing and adhering to confidentiality and data sharing policies.
  • system-level gatekeeper or gatekeeper for short (control authority; computer program/-
  • a system-level access control program product only needs to compare the user's authorization level from a user class for a desired operation (e.g. read/write) with the sensitivity or confidentiality classification of the data.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

L'invention concerne un procédé et une instance de contrôle pour contrôler un accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle, l'accès aux données ou aux fonctions étant contrôlé. Les données ou les fonctions se voient attribuer une classification ayant une classe de confidentialité particulière (0, ..., 3) parmi une pluralité de classes de confidentialité (0, ..., 3), un utilisateur ou une instance technique se voyant attribuer une classe d'utilisateur parmi un certain nombre de classes d'utilisateur, une autorisation d'accès étant définie, de préférence à la manière d'une matrice, pour plusieurs ou chacune des classes de confidentialité (0, ..., 3) et pour plusieurs ou chacune des classes d'utilisateur, l'autorisation d'accès définissant les restrictions d'accès des utilisateurs ou de l'instance technique des classes d'utilisateur respectives aux données ou aux fonctions attribuées aux classes de confidentialité respectives (0, ..., 3), et, sur la base des restrictions définies, l'accès aux données ou fonctions attribuées aux classes de confidentialité respectives (0, ..., 3) par les utilisateurs ou les instances techniques attribuées aux classes d'utilisateur respectives est contrôlé. Par conséquent, un accès d'utilisateur ou un accès machine et des autorisations à partir des classifications de confidentialité des données, ou des structures de données ou des fonctions elles-mêmes, sont contrôlés et ainsi une approche complète est fournie pour déterminer automatiquement l'autorisation d'utilisateurs ou d'entités techniques connus à des fins d'accès à des données ou des structures de données ou des fonctions particulières et de leur modification.
EP24713924.9A 2023-04-11 2024-03-05 Procédé, instance de contrôle et produit-programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle Pending EP4655697A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP23167273.4A EP4446921A1 (fr) 2023-04-11 2023-04-11 Procédé, entité de commande et produit programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industriel
PCT/EP2024/055647 WO2024213312A1 (fr) 2023-04-11 2024-03-05 Procédé, instance de contrôle et produit-programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle

Publications (1)

Publication Number Publication Date
EP4655697A1 true EP4655697A1 (fr) 2025-12-03

Family

ID=85985225

Family Applications (2)

Application Number Title Priority Date Filing Date
EP23167273.4A Withdrawn EP4446921A1 (fr) 2023-04-11 2023-04-11 Procédé, entité de commande et produit programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industriel
EP24713924.9A Pending EP4655697A1 (fr) 2023-04-11 2024-03-05 Procédé, instance de contrôle et produit-programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle

Family Applications Before (1)

Application Number Title Priority Date Filing Date
EP23167273.4A Withdrawn EP4446921A1 (fr) 2023-04-11 2023-04-11 Procédé, entité de commande et produit programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industriel

Country Status (3)

Country Link
EP (2) EP4446921A1 (fr)
CN (1) CN120937007A (fr)
WO (1) WO2024213312A1 (fr)

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10242222B2 (en) * 2014-01-14 2019-03-26 Baker Hughes, A Ge Company, Llc Compartment-based data security
EP3515035B1 (fr) * 2018-01-23 2021-06-02 ABB Schweiz AG Système informatique et procédé permettant de contrôler l'accès à des données numériques d'un dispositif

Also Published As

Publication number Publication date
WO2024213312A1 (fr) 2024-10-17
EP4446921A1 (fr) 2024-10-16
CN120937007A (zh) 2025-11-11

Similar Documents

Publication Publication Date Title
DE69601149T2 (de) Systen und Verfahren zum Implementieren einer hierarchischen Politik für die Administration eines Computersystems
DE112020001688B4 (de) Richtlinienbasiertes auslösen einer überarbeitung von zugriffssteuerungsinformationen
DE69934894T2 (de) Verfahren und vorrichtung zur wahlweisen einstellung des zugangs zu anwendungsmerkmalen
EP2843585B1 (fr) Procédé et système de mise à disposition de données rendues anonymes issues d'une base de données
DE112010003464B4 (de) Modifikation von Zugangskontrolllisten
DE69730321T2 (de) Verfahren und vorrichtung zum schützen von daten mit mehreren auf datenelementebene anwendbaren verschlüsselungsstufen
DE69832946T2 (de) Verteiltes System und Verfahren zur Steuerung des Zugriffs auf Netzmittel und Ereignismeldungen
DE102020133597A1 (de) Personalprofile und fingerabdruckauthentifizierung für configuration engineering- und laufzeitanwendungen
DE202018006346U1 (de) Gemeinsames Nutzen bzw. Teilen von Daten in einem mandantenfähigen Datenbanksystem
DE112013000473T5 (de) Verfahren zum Optimieren der Verarbeitung von Daten mit eingeschränktem Zugriff
DE19963673A1 (de) Verfahren, Systeme und Computerprogrammprodukte zur Dokumentenverwaltung für Software-Entwicklungssysteme
EP4016338A1 (fr) Contrôle d'accès aux données sauvegardées dans un nuage
EP3767505B1 (fr) Procédé et système de fourniture des informations de sécurité sur un récipient d'application pour un terminal industriel
DE102006012311A1 (de) Verfahren und Vorrichtung zur Pseudonymisierung von digitalen Daten
DE102008019103A1 (de) Verfahren und Vorrichtung zum Umschlüsseln bei einer verschlüsselungsbasierten Zugriffskontrolle auf eine Datenbank
EP3539044A1 (fr) Contrôles d'accès à des objets de données
EP3539045B1 (fr) Système à contrôle d'accès basé sur certificat
DE102004047146A1 (de) Rechteverwaltung
DE60017438T2 (de) System zur betriebsmittelzugriffsteuerung
EP3878197B1 (fr) Contrôle de droits d'accès dans un système en réseau avec traitement de données
WO2024213312A1 (fr) Procédé, instance de contrôle et produit-programme informatique pour contrôler l'accès à des données structurées ou à des fonctions d'un agencement d'automatisation industrielle
DE69520689T2 (de) Verbesserungen an zugangsrechten für oder zu dateien
DE102017202183A1 (de) Zugriffsverwaltungssystem zum Export von Datensätzen
DE10152121B4 (de) Regelbasierte Verarbeitungskontrolle mobiler Information
EP2169588A1 (fr) Procédé destiné à la garantie de la sécurité

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20250829

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR