Fisher-rosemount Systems, Inc

Matthew Villarrubia

Narayanan Doraiswamy

Antonio Ubach

Sean Hernandez

Sireesha Dakoju

Krishna Joshi

Mark J Nixon

Aaron C Jones

Brian Lamothe

An architecture supporting a process control or automation system may include an authentication service which determines whether an entity (e.g., a human, automated, virtual, or physical entity) is the party that/who the entity claims to be, and an authorization service which determines whether a request of the entity to access a resource is allowed or denied. The authentication service provides unique identities of entities and respective security credentials, which may include tokens utilized during authorization. The authorization service authorizes an entity to access a requested resource based on role-based permissions of a role to which the entity is assigned and resource access permissions protecting the requested resource. The role-based permissions and/or the resource access permissions may be respectively scoped to limit or restrict actions, activities, operations, and/or resource access based on specified criteria. Each entity may be authenticated, and each request of an authenticated entity may be respectively authorized.

Authentication/authorization framework for a process control or automation system

A process plant and industrial control system architecture includes a generalized compute fabric that is agnostic or indifferent to the physical location at which the compute fabric is implemented, includes one or more physical control or field devices located at one or more specific sites at which a product or process is being manufactured and further includes a transport network that securely provides communications between the compute fabric and the pool of physical devices. The compute fabric includes an application layer that includes configured containers or containerized software modules that perform various control, monitoring and configuration activities with respect to one or more devices, control strategies and control loops, sites, plants, or facilities at which control is performed, and includes a physical layer including computer processing and data storage equipment that can be located at any desired location, including at or near a site, plant, or facility at which control is being performed, at a dedicated location away from the location at which control is being performed, in re-assignable computer equipment provided in the cloud, or any combination thereof. This control architecture enables significant amounts of both computer processing and IT infrastructure that is used to support a process plant, an industrial control facility or other automation facility to be implemented in a shared, in an offsite and/or in a virtualized manner that alleviates many of the communications and security issues present in current process and industrial control systems that attempt to implement control with shared or virtualized computing resources set up according to the well-known Purdue model. The industrial control system architecture is protected via more secure and customizable techniques as compared to those used in Purdue model-based control systems. For example, communications between any (and in some cases, all) endpoints of the system may be protected via one or more virtual private networks to which authenticated endpoints must be authorized to access. Endpoints may include, for example, containerized components, physical components, devices, sites or locations, the compute fabric, and the like, and the VPNs may include mutually-exclusive and/or nested VPNs. External applications and services, whether automated or executing under the purview of a person, may access information and services provided by the system via only APIs, and different sets of APIs may be exposed to different users that have been authenticated and authorized to access respective sets of APIs. A configuration system operates within the compute fabric to enable a user to easily make configuration changes to the compute fabric as the user does not generally need to specify the computer hardware within the compute fabric to use to make the configuration changes, making it possible for the user to deploy new configuration elements with simple programming steps, and in some cases with the push of a button.

Securing access of a process control or automation system

Growing community of inventors

Round Rock, TX, United States of America

Matthew Villarrubia