Abstract:
Performing multi-layer network discovery of an operational technology (OT) network includes receiving a plurality of discovery data sets, each identifying a respective subset of a plurality of nodes within an OT network having a plurality of network layers, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers, identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets, generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets, and generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set.
Abstract:
An automation control system is provided that includes one or more components. The components include an embedded execution engine that is configured to execute one or more commands based upon data communicated to the one or more components from another component of the automation control system. The data is representative of a change to an object in the control system.
Abstract:
System(s) and method(s) are provided for peer-to-peer exchange of data in a control system. Decentralized storage and multi-access paths provide complete sets of data without dependence on a specific or pre-defined data source or access paths. Data is characterized as data resources with disparate granularity. The control system includes a plurality of layers that act as logic units communicatively coupled through access network(s). Server(s) resides in a service layer, whereas client(s) associated with respective visualization terminal(s) are part of a visualization layer. Peer-to-peer distribution of data resource(s) can be based on available access network(s) resources and optimization of response time(s) in the control system. When client requests a data resource, all the locations of the data resource and the quickest source to retrieve it are automatically determined. The client stores copy of data resource. Peer-to-peer distribution of data resource(s) can be implemented within the service layer or the visualization layer.
Abstract:
A model-based industrial security policy configuration system implements a plant-wide industrial asset security policy in accordance with security policy definitions provided by a user. The configuration system models the collection of industrial assets for which diverse security policies are to be implemented. An interface allows the user to define security policies for a plant environment at a high-level by grouping the industrial assets into security zones, and defining any additional communication permissions in terms of asset-to-asset, asset-to-zone, or zone-to-zone conduits. Based on the model and these policy definitions, the system generates asset-level security setting instructions configured to set appropriate security settings on one or more of the industrial assets, and deploys these instructions to the appropriate assets in order to implement the defined security policy.
Abstract:
Systems and/or methods are described relating to a security model that provides interoperability with foreign security domains while remaining scalable to small embedded devices. A security token service is provided, which is configured to issue, renew, and/or validate security tokens in response to a token request. A communication protocol, corresponding message structures, and the security tokens are defined in accordance with protocol buffer definitions.
Abstract:
A network security system comprises a first component that generates an address for identifying a communicating device on a network. A second component receives the address generated by the first component and facilitates transitioning from an existent address to the generated address. Such transitioning is effectuated in order to protect the network against attack while providing seamless communications with respect to the communicating device.
Abstract:
An automation control and monitoring system is provided that includes a common framework for components of the control and monitoring system through a resource oriented architecture (ROA). The ROA may enable enhanced scalability and distribution within the control and monitoring system. Further, the framework may provide a base set of functionalities to be implemented across components of the control and monitoring system, creating vertical scalability.
Abstract:
An enterprise-level security policy management tool receives, via a graphical user interface (GUI), inputs defining a security policy configured to be deployed within an enterprise that operates one or more operational technology (OT) networks, generates the security policy based on the inputs, and transmits the security policy to one or more computing devices running respective other instantiations of the enterprise-level security policy management tool, wherein the respective other instantiations of the enterprise-level security policy management tool are configured to facilitate enforcement of the security policy within the one or more OT networks operated by the enterprise.
Abstract:
Systems and methods are disclosed for performing a local update from a global catalog of device and system attributes. In certain embodiments, a system may comprise an edge server of an industrial automation environment, configured to update a local catalog from a cloud-based global catalog. The edge server may perform a device discovery operation to identify an industrial device connected to a local network on premises with the edge server, access the global catalog to obtain data about the industrial device, store the data about the industrial device to the local catalog, and respond to a query about the industrial device based on the data about the industrial device from the local catalog.
Abstract:
The present technology relates to artificial intelligence assisted device configuration. In an implementation, an interface service of a device design application receives an input comprising an association between a device and a controller of an automation system design. The interface service then generates a first prompt requesting an application type associated with the device. The interface service next transmits the first prompt to a large language model and receives a first response to the first prompt from the large language model, wherein the first response includes the application type. The interface service then generates a second prompt requesting configuration settings for the device based on the system information and the application type. The interface service next transmits the second prompt to the large language model and receives a second response to the second prompt that includes configuration settings for the device. The interface service then displays the second response.