Rockwell Automation Technologies Incorporated

Rockwell Automation, Inc.

Allen-bradley Company, LLC

Rockwell Automation Asia Pacific Business Center Pte. Ltd.

Rockwell Automated Technologies, Inc.

Rockwell Automation Asia Pacific Business Center Ptd. Ltd

Taryl Jon Jasper

Michael D Kalan

Douglas J Reichard

Subbian Govindaraj

John Joseph Baier

Robert Joseph McGreevy

Kenwood H Hall

Kenneth Scott Plache

Raymond John Staron

Robert J Kretschmann

Charles Martin Rischar

Robert J Herbst

Kevin George Gordon

Clifton Harold Bromley

Jack Michael Visoky

Ronald Eric Bliss

Frank Anthony Palmieri, Jr

Joseph Bronikowski

Daniel Baliey Seger

James Harry Jarrett

David Alan Vasko

Teunis Hendrik Schouten

Douglas W Reid

Christopher E Stanek

David Dale Brandt

Sujeet Chand

Brian Alan Batke

Rainer Hessmer

John T Campbell

Paul R D'Mura

Michael A Bush

Eugene Liberman

Clark L Case

Mark Burton Anderson

Terence Scott Tenorio

Sivaram Balasubramanian

Edward Alan Hill

Alex Laurence Nicoll

John Strohmenger

Russell William Brandes

Mark David Hobbs

Steven John Kowal

Bruce Gordan Fuller

David E Huffman

Robert A Brandt

Michael B Miller

John C Wilkinson

Kevin Michael Tambascio

David Thomas

Roman Vitek

Timothy C Mirth

Thaddeus A Palus

Radek Bartman

Neville J Parakh

Joseph P Izzo

Ramdas M Pai

Bruce Gordon Fuller

Kyle A Crum

Craig D Anderson

Kyle E Neet

Petr Ptacek

Salvatore T Conti

James Andrew Sinclair

Kevin E Colloton

Jessica E Forguites

Dukki Chung

Glenn B Schulz

Thomas J Burke

Steven Terry Seidlitz

Steven T Seidlitz

Eryn Amara Danielle Manela

James A Meeker

Pei Sin Ng

Colleen A Rinehart

Ng Pei Sin

William J Petro

Dustin A Molzon

Roch Mikolajczyk

Ramadas M Pai

Nicholas L Perrotto, Jr

Jeffrey A Shearer

Larry Dawson Armstrong

David P Sullivan

David H Huffman

Robert E Davitt

Joseph Broniskowski

Robert J Mcgreevy

W Douglas Reid

Clifford J Whitehead

Joseph Alan Kann

Juan L Asenjo

Paul R D`Mura

A method includes receiving, from an enterprise network, data associated with one or more industrial automation systems operated by an enterprise, wherein the data includes design artifacts of the one or more industrial automation systems, run time data collected from the one or more industrial automation systems, or both, inputting the data to a machine learning-based security policy development engine to generate a set of recommended security policies for the enterprise based on the data, receiving the set of recommended security policies for the one or more industrial automation systems output by the security policy development engine, wherein the set of recommended security policies define access, use, or both, of the one or more industrial automation systems operated by the enterprise; and transmitting the set of recommended security policies to the enterprise.

Systems and methods for artificial intelligence-based security policy development

A security device includes one or more processors and a memory that includes instructions, that when executed by the processors, cause the processors to perform operations. The operations include monitoring data traffic between industrial automation devices in an industrial system and one or more devices in an external network, determining that a first industrial automation device does not include native security features for receiving secure data from the devices in the external network or transmitting secure data to the devices in the external network, and implementing one or more security techniques in response to determining that the first industrial automation device does not include the native security features.

Systems and methods for automatic security enforcement for industrial automation devices

An OT device includes a processor and a memory, accessible by the processor. The memory stores a first policy that includes a first set of settings associated with operation of the OT device. The memory also stores instructions that, when executed by the processor, cause the processor to enforce the first policy, receive a second policy and an indication of a trigger, wherein the second policy comprises a second set of settings associated with the operation of the OT device, receive an indication that the trigger is enabled, determine that the trigger is true, and, in response to the receiving the indication that the trigger is enabled and the determining that the trigger is true, enforce the second policy.

Systems and methods for scheduled policy deployment in operational technology networks

An industrial topology discovery system autonomously discovers and documents industrial automation system topologies using orchestrated discovery agents of various types. The topology discovery system can reside on a cloud platform or another high level network and deploy discovery agents on plant networks and devices within an industrial facility. These discovery agents can implement different strategies for discovering system information, and can include agents configured to monitor and report on communication traffic across respective types of networks, agents configured to probe respective device types for identity and configuration information, and other types of agents. Discovery services executed by the topology discovery system can collect device and network information obtained by the agents and use this information to document the topology of the automation system as well as to orchestrate the discovery behavior of the agents to extract further information about the system based on defined discovery rules.

Industrial automation system topology with point to point representation paths

Background discovery agent orchestration

An enterprise-level security policy management tool receives, via a graphical user interface (GUI), inputs defining a security policy configured to be deployed within an enterprise that operates one or more operational technology (OT) networks, generates the security policy based on the inputs, and transmits the security policy to one or more computing devices running respective other instantiations of the enterprise-level security policy management tool, wherein the respective other instantiations of the enterprise-level security policy management tool are configured to facilitate enforcement of the security policy within the one or more OT networks operated by the enterprise.

Systems and methods for enterprise-level security policy management tool

A model-based industrial security policy configuration system implements a plant-wide industrial asset security policy in accordance with security policy definitions provided by a user. The configuration system models the collection of industrial assets for which diverse security policies are to be implemented. An interface allows the user to define zone-specific security configuration and event management policies for a plant environment at a high-level based on a security model that groups the industrial assets into security zones. Based on the model and these policy definitions, the system generates asset-level security setting instructions configured to set appropriate device settings on one or more of the industrial assets to implement the security event management policies, and deploys these instructions to the appropriate assets in order to implement the defined policies.

Centralized security event generation policy

Performing multi-layer network discovery of an operational technology (OT) network includes receiving a plurality of discovery data sets, each identifying a respective subset of a plurality of nodes within an OT network having a plurality of network layers, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers, identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets, generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets, and generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set.

Systems and methods for network discovery in a multi-layer operational technology network

A model-based industrial security policy configuration system implements a plant-wide industrial asset security policy in accordance with security policy definitions provided by a user. The configuration system models the collection of industrial assets for which diverse security policies are to be implemented. An interface allows the user to define zone-specific security configuration and event management policies for a plant environment at a high-level based on a security model that groups the industrial assets into security zones. When new industrial devices are subsequently installed on the plant floor, the system determines whether a security policy defined by the model is applicable to the new device and commissions the new device to comply with any relevant security policies. This mitigates the necessity for a system administrator to manually configure individual devices to comply with plant-wide security policies.

Automatic endpoint security policy assignment by zero-touch enrollment

An industrial safety architecture integrates employee identity and enterprise-level security policy into plant-floor functional safety systems, allowing control and safety systems on the plant floor to regulate safe interactions with hazardous controlled machinery based on user identity or role. The architecture leverages existing employee identity and security policy data maintained on the corporate level of an industrial enterprise to manage identity- and/or role-based control and safety on the plant level. Safety authority systems at both the corporate level and the plant level of the industrial enterprise obtain employee and security policy data from corporate-level systems and provides this data in as SIL-rated manner to industrial control and safety systems on the plant floor, where the identity and security policy information is used by functional safety systems to control access to industrial systems as a function of user identity, role, certifications, or other qualifications.

User security credentials as an element of functional safety

An automation control system is provided that includes one or more components. The components include an embedded execution engine that is configured to execute one or more commands based upon data communicated to the one or more components from another component of the automation control system. The data is representative of a change to an object in the control system.

Control environment command execution

A device may include a communication component that may communicatively couple to a first network. The device may also include a processor that may transmit a first signal via the communication component to a network address translation (NAT) system, the first signal including a first request to discover a server device. The NAT system may communicatively couple to the first network and a second network, such that the first network is inaccessible to the second network. The processor may then receive location data associated with the server device and transmit a second signal addressed to the server device based on the location data. The second signal is transmitted to the NAT system, such that the second signal may include a second request for a security policy from the server device. The processor may then receive the security policy via the NAT system and adjust one or more communication operations based on the security policy.

Securely deploying security policy and configuration through network address translation systems

An industrial security policy configuration system generates and implements security policies for industrial automation systems based on design data for the industrial systems generated by device manufacturers, system integrators, original equipment manufacturers, or the owners of the industrial assets during the design of the industrial systems. the collected design data to a security rule set defining device-level communication privileges. The system translates the collected design data to a security rule set defining device-level communication privileges, which are then translated to a comprehensive set of security policies customized to the requirements of the industrial systems represented by the design data. By leveraging the rich set of available design data to identify or infer security requirements and generate suitable security configurations, the system can mitigate the need to manually configure security policies based on human judgments regarding normal and abnormal network traffic.

Automated discovery of security policy from design data

Techniques to facilitate protection of control system content used in an industrial automation environment are disclosed herein. In at least one implementation, the control system content for use in the industrial automation environment is received, wherein the control system content comprises controller program code that directs an industrial controller to drive a machine system. Content protection instructions for the control system content are also received, wherein the content protection instructions comprise restrictions on execution of the control system content. An execution license that includes process-related constraints for the control system content is generated based on the content protection instructions. The execution license is applied to the control system content to generate protected content, wherein use of the control system content is granted subject to the process-related constraints of the execution license.

Industrial automation control system content protection

Growing community of inventors

South Euclid, OH, United States of America

Taryl Jon Jasper