Abstract: Techniques to facilitate temporary escalation of access privileges for a control program associated with a machine system in an industrial automation environment are disclosed. In at least one implementation, a request is received from a user for a temporary access level increase to utilize protected functions of the control program. An encrypted string is generated comprising a temporary password authorized to access the protected functions of the control program. The encrypted string is provided to the user, wherein the user provides the encrypted string to an administrator and the administrator authenticates the user for the temporary access level increase, decrypts the temporary password, and provides the temporary password to the user. A login request is received from the user with the temporary password, and the temporary access level increase is responsively granted to allow the user to utilize the protected functions of the control program.

Abstract: An industrial control configuration can be a dynamic entity where different controllers are added, are subtracted, fail, etc. When dynamic functions occur, bindings of the configuration can benefit from a modification. Therefore, automatic adjustment of bindings can occur to facilitated improved operation. Automatic adjustment can be practiced when the industrial control configuration is a distributed control configuration without reliance upon a central database.

Abstract: An industrial precompile and encrypt system facilitates secure distribution of a digital industrial asset to a target device in an industrial automation environment while permitting common, expected user workflows such as interfacing with the asset; replacing failed target devices; verifying and validating the asset and its usage; securely troubleshooting the asset, editing the asset, or replacing the asset in a running system.

Abstract: System(s) and method(s) are provided for peer-to-peer exchange of data in a control system. Decentralized storage and multi-access paths provide complete sets of data without dependence on a specific or pre-defined data source or access paths. Data is characterized as data resources with disparate granularity. The control system includes a plurality of layers that act as logic units communicatively coupled through access network(s). Server(s) resides in a service layer, whereas client(s) associated with respective visualization terminal(s) are part of a visualization layer. Peer-to-peer distribution of data resource(s) can be based on available access network(s) resources and optimization of response time(s) in the control system. When client requests a data resource, all the locations of the data resource and the quickest source to retrieve it are automatically determined. The client stores copy of data resource.

Abstract: In an industrial control setting, different components can have information that can be valuable to various entities, such as other components, technicians, and the like. A decision can be made as to what information should be available to entities and a determination can be made if the information should be published in a directory or be discoverable. Security can be taken into account in determining if information should be published and decision making can employ adaptive learning, such that a publish and/or discovery decision criterion can be modified based on the learning.

Abstract: A model-based industrial security policy configuration system implements a plant-wide industrial asset security policy in accordance with security policy definitions provided by a user. The configuration system models the collection of industrial assets for which diverse security policies are to be implemented. An interface allows the user to define security policies for a plant environment at a high-level by grouping the industrial assets into security zones, and defining any additional communication permissions in terms of asset-to-asset, asset-to-zone, or zone-to-zone conduits. Based on the model and these policy definitions, the system generates asset-level security setting instructions configured to set appropriate security settings on one or more of the industrial assets, and deploys these instructions to the appropriate assets in order to implement the defined security policy.

Abstract: System(s) and method(s) are provided for peer-to-peer exchange of data in a control system. Decentralized storage and multi-access paths provide complete sets of data without dependence on a specific or pre-defined data source or access paths. Data is characterized as data resources with disparate granularity. The control system includes a plurality of layers that act as logic units communicatively coupled through access network(s). Server(s) resides in a service layer, whereas client(s) associated with respective visualization terminal(s) are part of a visualization layer. Peer-to-peer distribution of data resource(s) can be based on available access network(s) resources and optimization of response time(s) in the control system. When client requests a data resource, all the locations of the data resource and the quickest source to retrieve it are automatically determined. The client stores copy of data resource.

Abstract: System(s) and method(s) are provided for peer-to-peer exchange of data in a control system. Decentralized storage and multi-access paths provide complete sets of data without dependence on a specific or pre-defined data source or access paths. Data is characterized as data resources with disparate granularity. The control system includes a plurality of layers that act as logic units communicatively coupled through access network(s). Server(s) resides in a service layer, whereas client(s) associated with respective visualization terminal(s) are part of a visualization layer. Peer-to-peer distribution of data resource(s) can be based on available access network(s) resources and optimization of response time(s) in the control system. When client requests a data resource, all the locations of the data resource and the quickest source to retrieve it are automatically determined. The client stores copy of data resource.

Abstract: Techniques to facilitate temporary escalation of access privileges for a control program associated with a machine system in an industrial automation environment are disclosed. In at least one implementation, a request is received from a user for a temporary access level increase to utilize protected functions of the control program. An encrypted string is generated comprising a temporary password authorized to access the protected functions of the control program. The encrypted string is provided to the user, wherein the user provides the encrypted string to an administrator and the administrator authenticates the user for the temporary access level increase, decrypts the temporary password, and provides the temporary password to the user. A login request is received from the user with the temporary password, and the temporary access level increase is responsively granted to allow the user to utilize the protected functions of the control program.

Abstract: A network security system comprises a first component that generates an address for identifying a communicating device on a network. A second component receives the address generated by the first component and facilitates transitioning from an existent address to the generated address. Such transitioning is effectuated in order to protect the network against attack while providing seamless communications with respect to the communicating device.

Abstract: Systems and/or methods are described relating to a security model that provides interoperability with foreign security domains while remaining scalable to small embedded devices. A security token service is provided, which is configured to issue, renew, and/or validate security tokens in response to a token request. A communication protocol, corresponding message structures, and the security tokens are defined in accordance with protocol buffer definitions.

Abstract: An automation control and monitoring system includes a server configured to receive a subscription request from a client component. The subscription request provides one or more criteria to the server. The server is configured to provide a set of data, via a first notification, to the client component based upon the one or more criteria in the subscription request. The server is configured to provide, via additional notifications based on the subscription request, additional sets of data, modifications to the set of data, or both, when additional data or modifications corresponding to the one or more criteria are available.

Abstract: An automation control and monitoring system includes a server configured to receive a subscription request from a client component. The subscription request provides one or more criteria to the server. The server is configured to provide a set of data, via a first notification, to the client component based upon the one or more criteria in the subscription request. The server is configured to provide, via additional notifications based on the subscription request, additional sets of data, modifications to the set of data, or both, when additional data or modifications corresponding to the one or more criteria are available.

Abstract: In a distributed directory configuration, different nodes can retain information pertinent an industrial control configuration. As information changes in one node, replicas of the information in other nodes can be updated. However, updating can take time and a query can be run upon the directory while nodes have conflicting information. Conflicting information can be identified and resolved such that a query obtains a correct answer.

Abstract: An automation control and monitoring system includes an operating system and a data model. The operating system is configured to receive a request for instantiation of an object representing an attribute of the automation control and monitoring system. The operating system is also configured to generate an object identifier when the request for instantiation is received, wherein the object identifier is unique from any other object identifiers employed by the operating system. The data model is configured to store and associate the object with the generated object identifier such that any component of the automation control and monitoring system may access the object by referencing the object identifier.

Abstract: Systems and/or methods are described relating to a security model that provides interoperability with foreign security domains while remaining scalable to small embedded devices. A security token service is provided, which is configured to issue, renew, and/or validate security tokens in response to a token request. A communication protocol, corresponding message structures, and the security tokens are defined in accordance with protocol buffer definitions.

Abstract: Systems and/or methods are described relating to a security model that provides interoperability with foreign security domains while remaining scalable to small embedded devices. A security token service is provided, which is configured to issue, renew, and/or validate security tokens in response to a token request. A communication protocol, corresponding message structures, and the security tokens are defined in accordance with protocol buffer definitions.

Abstract: A remote asset server allows an industrial asset (e.g., a controller, motor drive, etc.) to be remotely and securely monitored and managed by an owner of the industrial asset as well as other relevant entities, such as original equipment manufacturers (OEMs). The remote asset server acts as a network infrastructure device that regulates access to the industrial asset by different entities in accordance with security policies defined by an end user. These defined security policies are implemented in a cloud platform as role-specific portals by a connectivity broker, the portals serving as secure connection pipelines to the industrial asset via the remote asset server. Using this architecture, an end user can define which aspects of an industrial asset are allowed to be remotely viewed, accessed, or modified by outside entities such as OEMs or system integrators.

Abstract: An industrial control configuration can be a dynamic entity where different controllers are added, are subtracted, fail, etc. When dynamic functions occur, bindings of the configuration can benefit from a modification. Therefore, automatic adjustment of bindings can occur to facilitated improved operation. Automatic adjustment can be practiced when the industrial control configuration is a distributed control configuration without reliance upon a central database.

Abstract: An industrial control configuration can be a dynamic entity where different controllers are added, are subtracted, fail, etc. When dynamic functions occur, bindings of the configuration can benefit from a modification. Therefore, automatic adjustment of bindings can occur to facilitate improved operation. Automatic adjustment can be practiced when the industrial control configuration is a distributed control configuration without reliance upon a central database.