DE202020005937U1 - Retrofit module for a field device and modular field device - Google Patents

Abstract

Retrofit module (201, 301, 401) for a field device (101, 105, 108, 402) of process automation technology with field device electronics (112, 405) with at least one communication interface, characterized in that the retrofit module (201, 301, 401) has a security module, the security module (401, 409) having the field device electronics (112, 4th 05) works together in such a way that a specified IT security level (SL) is achieved.

Description

Various types of field devices are known from the prior art.

Various technical devices that are directly related to a production process are subsumed under the term field device. Field devices can thus in particular be actuators, sensors and measuring transducers and/or evaluation devices.

In the terminology used in the present application, higher-level units, which are to be assigned to the area of control rooms, must be clearly distinguished from field devices.

Known field devices for process automation have hitherto only had devices and methods defined specifically by the manufacturer for implementing aspects of IT security. Recent legal requirements in various countries require the implementation of specified security levels (Security Level, SL) for critical infrastructure facilities (KRITIS).

As process measuring devices, field devices have been reliably measuring process-relevant measured variables of media in a wide variety of applications for many years. In the early years of process control technology, the measured values determined were usually transmitted in an analog manner using analog interfaces, for example a 4-20mA interface, from a process measuring device to a higher-level unit, e.g. an evaluation device or a process control center. In the course of digitization, this standard was expanded by additional impressing of digital signals, for example according to the HART standard, which also made bidirectional communication between the process measuring device and the process control center possible. However, it was characteristic of such process control systems that the systems were essentially operated in island mode. A connection between different process control systems from different locations or different companies or a connection of the systems to the World Wide Web was not planned.

In recent years, especially with the beginnings of the fourth industrial revolution (Industry 4.0), the need has emerged to link entire process control systems or entire production sites with one another through a higher degree of networking, for example via the World Wide Web. However, the associated networking of industrial IT systems and office IT systems leads to a number of new challenges, especially in the area of IT security, which makes it absolutely necessary to further develop existing devices and components.

A further area of application results from autonomous field devices, in particular autonomous sensors, which have been available for a short time. Sensors, i.e. field devices in this product family, are characterized by particularly simple installation without attaching a communication or supply line. The measured values determined by these field devices are typically transferred to a cloud, i. H. transferred to a server on the World Wide Web. Typical application scenarios for such field devices include areas such as flood forecasting, inventory management or other distributed measurement tasks. Due to the direct connection to the World Wide Web, such field devices are inherently exposed to a permanent threat of hacker attacks from the network.

In order to ensure the availability of productive systems in the future, standards are currently being defined by various industries, which aim to harden the components of process control systems in terms of their resilience to external attacks initiated by negligence or willfully, and thus to increase the availability of the field devices and thus secure the productivity of the plant operator.

In addition, legislators are formulating new requirements for operators and manufacturers of devices that aim to make critical infrastructure facilities (KRITIS) such as energy (electricity, gas, oil), transport (air, rail, water, road), drinking water supply or digital infrastructure resistant to negligent or malicious hacker attacks. An example of this is Directive 2016/1148 (NIS Directive) passed by the European Parliament, which has meanwhile been implemented into national law by the member states of the European Union.

Depending on the level of risk at the respective place of use, the existing cyber security standards (e.g. IEC 62443, ISO 27001 ) required that the devices used there meet a standardized IT security level, also known as Security Level (SL).

For example, IEC 62443 (as of 08/2013) has defined the following security levels, which are classified according to the means available to the attacker, the material and financial resources available, the technical skills and the underlying motivation. Attacker's Abilities Middle resources capabilities motivation SL0 no risk of impairment / manipulation SL1 accidental/casual interference/manipulation SL2 simply limited generally low SL3 sophisticated middle domain specific middle SL4 sophisticated extensive domain specific high

The security level SL0 is a purely theoretical construct in which there is no risk of impairment or manipulation and therefore no measures are necessary.

The security level SL1 describes the ability of a system to avoid accidental and unintentional impairments or manipulations.

Security level SL2 describes the ability of a system to ward off intended manipulations by interested individuals and companies with generic security knowledge.

The security level SL3 describes the ability of a system to ward off intentional manipulations by experts and companies who develop and use effective but cost-oriented attack scenarios with clear goals.

The security level SL4 describes the ability of a system to ward off intentional manipulations by organizations with experts, in which the achievement of the specifically selected attack target at almost any price is in the foreground.

For the manufacturers of field devices, especially for the manufacturers of level and pressure sensors, the need arises from these framework conditions to implement the IT security requirements anchored in various (industry-specific) standards and laws.

This implementation of extended measures regularly makes it necessary to integrate additional hardware components and/or additional software components into the field devices. If compliance with a security level (SL) is required for existing devices, or if the requirements for obtaining certification for a defined security level (SL) change, this regularly means that the mechanical and electrical construction of such devices has to be revised. Devices that have already been delivered must then be replaced by the customer with the correspondingly certified successor devices, which leads to corresponding costs and maintenance work.

There is also the problem that industry-specific standards with the IT security levels SL defined therein must be technically taken into account. In addition, the different regulations on the part of the legislature must be taken into account.

In addition, there is the problem on the part of the manufacturer that devices for different safety standards and different safety levels (SL), possibly also in accordance with the different standards in different countries, have to be developed, manufactured and sold.

An obvious solution is to provide devices in a targeted manner for the different industries, which technically take into account the respective required, industry-specific IT security levels SL. In order to be prepared for all possible applications within a refinery, for example, different devices must be provided for each IT security required by the customer level to be provided. It is obvious that this approach massively increases the variety of device variants and thus makes the development and manufacture of corresponding field devices uneconomical. If, on the other hand, only a single industry-specific device were provided that implements the highest security level, this would lead to high hardware costs and high energy consumption combined with reduced ergonomics when operating the devices.

There is also the problem that a specific implementation is only possible for new devices, but existing devices may no longer be operated under correspondingly increased IT security requirements.

The object of the present invention is to create a way in which new devices can be flexibly adapted to different IT security requirements and existing devices can also continue to be operated under increased IT security requirements.

This problem is solved by a retrofit module with the features of patent claim 1 . Advantageous developments are the subject of dependent patent claims.

A retrofit module according to the invention for a field device used in process automation technology, the field device having field device electronics with at least one communication interface, is characterized in that the retrofit module has a security module, the security module working together with the field device electronics in such a way that a specified IT security level is achieved.

Both new devices and existing devices can be equipped with such a retrofit module. Both new devices and existing devices can be equipped with an adapted IT security module that implements a desired IT security level.

It is thus possible to equip or provide both new devices and existing devices with different IT security levels using a number of different retrofit modules, without it being necessary to provide a completely new device that implements the respective IT security level. This makes it easier for manufacturers to offer adapted field devices, although a basic device remains identical and is only supplemented by the corresponding retrofit module. This opens up the possibility for users or operators of existing devices to adapt their existing devices to changed IT security requirements without having to replace the respective existing devices. The existing devices are retrofitted with a retrofit module that implements the desired IT security level and is thus upgraded for operation under increased IT security requirements.

The basic idea of the present invention is to provide a retrofit module and thus to design new devices or existing devices in such a way that they are able to implement specified IT security levels.

A corresponding retrofit module can be used particularly well with modular field devices.

Modular field devices are composed of a modular field device concept. With a modular field device concept, a number of combinable sensors, housings, electronic units and operating and/or display units can be selected and a corresponding field device can be set up. Such a modular field device concept is offered, for example, by the company Vega Grieshaber KG. A sensor, a corresponding electronics module that provides measured value processing and an interface to a controller and, if applicable, a fieldbus that is used, as well as various display and/or operating units can generally be combined. The sensors, electronic modules and display and/or operating units are adapted both to one another and to various available housings.

The retrofit module can have a plurality of functional units for implementing the specified IT security level. In this way, several different retrofit modules with different functional units can be made available, which implement different IT security levels in interaction with a field device.

Alternatively, a retrofit module can be designed in such a way that it can implement several different IT security levels in cooperation with a field device. That means in this Context that at least two different IT security levels can be implemented by at least two functional units. Depending on the given requirements, individual functional units that are not required or not permitted for the implementation of a specific IT security level can then be deactivated or required, or prescribed functional units can be activated, so that several different IT security levels can be implemented with a retrofit module.

In the present application, functional units are understood to be functional blocks implemented in hardware or software, which are crucial for compliance with the specified IT security levels. In particular, the IT security levels of different levels usually differ at least in one functional unit, i. H. that at least one functional unit is activated or deactivated for the implementation of one IT security level, which is not activated or deactivated accordingly for the implementation of another IT security level.

The IT security levels on which this application is based can relate to various aspects of IT security and can be implemented by various measures, which are summarized in the functional units in the present application.

Aspects of IT security, as they can be implemented in the IT security levels that are the subject of the application, include various levels of identification and authentication of users, devices and software, usage control, protection of the communication of the field device with regard to authentication and integrity and, for example, required response times.

For this purpose, the retrofit module can have a first electrical interface for connecting the field device electronics of the filling level measuring device and a communication module for connecting to a higher-level unit. The retrofit module can be connected to the field device electronics, preferably a communication interface, more preferably a wired communication interface of the field device electronics, by means of the first electrical interface. With the communication module, the retrofit module can establish communication to the outside. In this sense, to the outside means to a unit outside the field device, in particular a higher-level unit, an operating device or other field devices.

In this context, in addition to evaluation devices and computers, for example in a control room, higher-level units can also be servers in a LAN (Local Area Network) or WAN (Wide Area Network) environment. This also includes devices in virtual private networks (VPN).

The first interface of the retrofit module is preferably designed for connection to the communication interface of the field device. In this way, a simple connection of the retrofit module to the field device electronics is made possible. If necessary, existing plug contacts or connection terminals can be used for this purpose and thus a direct connection of the retrofit module to the field device electronics can be implemented.

If the communication interface of the field device is a wired interface and this is connected to the retrofit module in this way, a suitable configuration of the connection can also result in other, possibly unsecured, external communication connections being set up from the communication interface of the field device. In the simplest case, a slot in the communication interface is occupied by the retrofit module connected to it and there is therefore no further connection option.

In order to achieve the greatest possible protection against manipulation, a connection between the first interface and the communication interface can be designed to be mechanically irreversible. This means that once the connection is made, it cannot be broken. For example, the connection cannot be released without destroying the connection, or at least a detectable break in the security level.

This can be achieved, for example, in that a connection between the first interface and the communication interface irreversibly interrupts a connection between the field device electronics and the superordinate unit. If the connection to the retrofit module is released again, a direct connection between the field device electronics and the superordinate unit is also interrupted, which can be detected by the latter, for example.

One possibility for such an irreversible interruption can be achieved, for example, by means of insulation displacement connectors, which interrupt a cable connection from the field device electronics to the superordinate unit and at the same time establish the connection to the retrofit module. If this connection is released again, the connection from the field device electronics to the superordinate unit is also interrupted. Since this connection cannot easily be reestablished without a brief interruption, an attempt at manipulation is recognized and an appropriate response can be made.

In addition or as an alternative, the retrofit module can have a mechanical interface for irreversible connection to the filling level measuring device. Such a mechanically irreversible connection ensures that the connection between the filling level measuring device and the retrofit module can no longer be loosened and the retrofit module can therefore also no longer be removed.

The mechanically irreversible connection between the retrofit module and the field device can irreversibly anchor the retrofit module, for example, in a housing chamber in which it is arranged. This means that once the retrofit module has been properly installed, it cannot be removed.

Both the correct installation and a possibly inadmissible removal can be monitored using appropriate contact switches. Such a sabotage contact would report to the higher-level unit if the retrofit module was unlawfully removed or tampered with. The unlawful interference is thus recognized and countermeasures can be taken.

The mechanically irreversible connection can be designed, for example, as an irreversible snap-in connection and/or an irreversible screw connection and/or an irreversible adhesive connection and/or comprise an irreversible barrier.

An irreversible barrier can e.g. B. be a housing cover that irreversibly closes a housing chamber in which the retrofit module is arranged. For this purpose, an original housing cover can be exchanged and replaced with a self-locking cover. A self-locking cover can, for example, have latching hooks or the like that prevent the cover from opening after it has been completely closed for the first time. Additionally or alternatively, the self-locking cover can have an adhesive bond that fixes the cover in a screwed position.

In one embodiment, the retrofit module has a crypto module for signing and/or encrypting data. A recipient can use a signature to ensure that data originates from a specific originator, here the retrofit module and indirectly from the field device equipped with it. Furthermore, the data integrity can be ensured, i.e. a recipient of the data can verify that the data has not been changed since it was signed by the sender, i.e. the retrofit module. Overall, data transmission from the field device, which is equipped with the retrofit module, to higher-level units can be configured more securely using such a crypto module.

It should be emphasized at this point that the crypto module, as described above, does not necessarily cause encryption, but that the task of a crypto module according to the present application can simply be to provide the sent data with a signature.

The crypto module can be designed both as hardware and as a software module, i. H. that there are hardware components, in particular a dedicated crypto chip, as well as software components, d. H. be embodied as corresponding computer program code which, when executed by a processor, effects the signing and/or encryption of the data.

In the present application, software components are understood to mean parts or modules of software, i. H. Computer program code that, when executed by a processor, causes the processor to execute instructions to implement the desired functionality of the software component.

The retrofit module can additionally or alternatively have an authentication module. An authentication module can include different components depending on the desired IT security level. For example, it can have user and password management, authorization management, a module for multi-factor authentication and any necessary hardware interfaces for this. Corresponding hardware interfaces can be, for example, sensors for presence detection, input fields for a pin, sensors for biometric data, for example fingerprint sensors or retina scanners, and/or Interfaces for reading mechanical keys and/or electrically readable tokens, in particular NFC interfaces for reading NFC tokens or the like.

The user authentication can not only include authentication of operating personnel, but also implement authentication of authorized operating devices and/or communication partners.

The retrofit module can also have an authentication interface for an external, second authentication module. Such an external, second authentication module can, for example, be an authentication module of an operating device, so that the user authentication on the operating device is also taken over for the field device if the operating device has sufficiently authenticated itself to the retrofit module.

Authentication can thus take place not only for operators but also for devices that communicate with the field device.

The authentication module can also be configured as a hardware component and, if no hardware is required, also as a software component.

Additionally or alternatively, the retrofit module can have a firewall, in particular a packet filter. A firewall functionality can ensure that only authorized users can establish a connection to the retrofit module and thus the field device (connection filter) or that only harmless packets pass through the retrofit module and thus reach the field device for further processing.

In one embodiment, the retrofit module can be designed as a display and/or operating module, or alternatively have such a module. For example, in the case of modular field devices in particular, a regularly present display and/or operating module can be replaced by the retrofit module, which is designed as a display and/or operating module, or by a display and/or operating module that has the retrofit module.

In the case of the applicant's modular field device system in particular, it makes sense to integrate the retrofit module into the existing modular system.

The security module can have a plurality of functional units for implementing a plurality of predetermined IT security levels of different levels, the security module having a selection element for selecting an IT security level, the functional units necessary for implementing the selected IT security level being activated and/or functional units which are not necessary being deactivated on the basis of the selection.

It should be noted at this point that activation and deactivation relate to an operation, i. H. refers to the switched-on state of the retrofit module or field device and, in this context, means persistent commissioning or decommissioning of the respective functional units. A deactivation or in other words, a switching off of the entire field device has no influence on the status of the functional units after the field device is switched on again.

In one embodiment of the retrofit module, the security module is designed in such a way that the IT security level can be selected once. In this context, this means that the IT security level can be selected once and then fixed, i.e. it cannot be changed. In particular, the IT security level can be selected once by the user. This means that the retrofit module in the delivery state can have no IT security level or any IT security level that can be specified by the manufacturer, which can then be changed once by the user.

A one-off selection by the user can mean in particular that it is not possible for the user to subsequently change the IT security level. In certain embodiments, a distinction can be made between a user-side change in the IT security level and an administrator-side change in the IT security level. This means that in one embodiment it can be provided that an administrator can also subsequently change the IT security level even after it has been set for the first time during commissioning. For this purpose, however, it can be provided, for example, that, in addition to authentication as an administrator, this can only be done with a device-specific unlock code and/or with an additional release from the manufacturer.

To ensure that the field device provided with the retrofit module can only be operated with the desired security level, the security module can be configured in such a way that the IT security level can be selected when the field device provided with the retrofit module is put into operation, and in particular is necessary.

In this way, the operator of a plant can be encouraged to select the appropriate security level when commissioning a new or upgraded field device. This is then set and defined during commissioning. In addition or as an alternative to the procedure described above, the IT security level can be subsequently changed by resetting the field device to the factory settings, i. H. to the delivery status and thus be associated with a renewed start-up.

A one-off selection option can be realized, for example, by designing the selection element to be mechanically irreversible. A mechanically irreversible configuration of the selection element can be achieved, for example, by suitable latching of a setting once it has been made. Such locking can, for. B. be designed in such a way that a change in the selection element is only possible towards a higher IT security level. Alternatively, the selection element can also be fixed mechanically, for example glued or fixed in some other way. Additionally or alternatively, a mechanical selection element can also have a predetermined breaking point, i. This means that the selection element breaks off at this predetermined breaking point when the user is setting the IT security level for the first time, making it impossible to change the IT security level at a later date.

Additionally or alternatively, the security module can be designed in such a way that a selection of the IT security level is electronically irreversible. This can be achieved, for example, by interrupting the electrical connections required for this after the selection element has been read out for the first time. This can be done, for example, by deliberately interrupting built-in fuses or destroying the electrical readability of the selection element in some other way. Additionally or alternatively, when setting the IT security level, functional elements that are deactivated to implement the selected IT security level can be prevented from reactivation by permanently interrupting the electrical connection to these functional elements.

For example, in order to implement a certain IT security level, it can be stipulated that a radio interface is deactivated. In the embodiment described above, reactivation of the radio interface can be prevented by, for example, permanently interrupting an electrical connection to the radio interface, or, for example, by making a transmission element dysfunctional in a targeted manner.

Additionally or alternatively, the security module can be designed in such a way that a selection of the IT security level is irreversible in terms of software technology. For example, part of a program code that reads out the selection element and sets the IT security level can be deleted after the IT security level has been set successfully or otherwise changed in such a way that the selection element cannot be read out again. In this embodiment, the selection element could then - if a change is not also prevented at this point - be changed to the selection of a different IT security level than the set one, but this changed selection is no longer read out and the IT security level is therefore not changed.

In order to ensure that once an IT security level has been selected, it is at least not reduced, i. H. If an IT security level with a lower IT security level is subsequently selected, it can be provided that the retrofit module has the lowest IT security level on delivery and the security module is designed in such a way that only an increase in the IT security level is possible. This functionality can be achieved both by a suitable design of the hardware, for example the selection element, and a suitable software implementation.

Alternatively, it is also possible for the retrofit module to be delivered with the highest IT security level, and only a lowering of the IT security level is possible.

In one embodiment, the selection element can be designed as a hardware switch, preferably as a slide switch or rotary switch. Such a hardware switch can cause an off IT security level can be selected intuitively and user-friendly. An embodiment of the selection element implemented in hardware can provide effective protection against network-based attacks and thus contribute to protecting the field device.

In a further embodiment, the selection element can be designed as a selection menu in a user interface. Typically, the process of commissioning the retrofit module or the field device provided with the retrofit module includes various parameterization steps into which a selection of the IT security level can be seamlessly inserted in this way.

In one embodiment of the retrofit module, the selection element can control a multiplexer that is connected to the functional units for implementing the IT security level, at least in the delivery state. In this way, the various functional units for implementing the IT security level can be activated or deactivated via a suitable control of the multiplexer.

Furthermore, the retrofit module can also include a firmware update for the existing field device. Such a firmware update for the field device can, for example, ensure that, for example, the field device electronics—depending on the selected security level—only accept certain communication paths, remote stations, or add-on modules, and/or deinstallation of the retrofit module is refused.

According to the invention is also a modular field device of process automation technology with field device electronics with at least one communication interface, wherein the field device has a retrofit module according to one of the preceding claims, which is connected to the communication interface of the field device electronics.

• 1 zwei Feldgeräte gemäß dem Stand der Technik,
• 2 ein Ausführungsbeispiel gemäß der vorliegenden Anmeldung,
• 3 ein drittes Ausführungsbeispiel eines Feldgeräts gemäß der vorliegenden Anmeldung mit einem Nachrüstmodul und
• 4 ein Ausführungsbeispiel für ein Verfahren gemäß der vorliegenden Anmeldung.

The present invention is explained in detail below using exemplary embodiments with reference to the attached figures. Show it:

• 1 two state-of-the-art field devices,
• 2 an embodiment according to the present application,
• 3 a third embodiment of a field device according to the present application with a retrofit module and
• 4 an embodiment of a method according to the present application.

The exemplary embodiments of field devices shown below show exemplary implementations for the implementation of IT security levels SL based on the definitions of the standard IEC 62443. The examples are intended to be purely exemplary in nature to illustrate the basic structures and processes, and basically include the transfer to other existing or future standards with comparable concepts for the standardized definition of security levels according to the understanding of the present invention. In particular, provision may be made to combine existing IT security levels SL in future standards, for example in order to redefine IT security levels SL according to the BASIC (corresponding to SL0 + SL1), SUBSTANTIAL (corresponding to SL2 + SL3) and HIGH (corresponding to SL4) scheme. The application of the present invention in the context of newly defined security levels can be implemented in an obvious manner by a person skilled in the art, which is why future redefinitions of security levels in the context of the present invention should also be covered.

1 shows in the 1a) and 1b) two field devices 101, 102 according to the prior art.

1a) shows a wired field device 101, which is designed as a radar level gauge. The field device 101 obtains the energy it needs for operation via a cable connection 104, usually an analog or digital connection 104. In the present case, the field device 101 is designed as a two-wire field device.

A two-wire field device according to the present invention is understood to mean a field device that is connected to a higher-level unit via two lines, both power supply and measured value transmission taking place via these two lines.

The energy and/or signal transmission between the two-wire field device and the higher-level units takes place according to the known 4 mA to 20 mA standard, in which a 4 mA to 20 mA current loop, i.e. a two-wire line, is formed between the field device and the higher-level unit. In addition to the analogue transmission of signals, there is the possibility that the measuring devices transmit further information to or receive from the higher-level unit according to various other protocols, in particular digital protocols. Examples of this are the HART protocol or the Profibus-PA protocol. The interface can also be an IO-Link interface, for example.

These field devices are also supplied with energy via the 4 mA to 20 mA current signal, so that no additional supply line is required in addition to the two-wire line.

The wired field device 101 thus uses the interface 104 to transmit its measured value to the outside. In the embodiment shown, the field device 101 has a display and operating module 103 for enabling interaction with a user. The display and operating module 103 obtains the energy required for operation via the interface 102. In addition, the retrofit module 103 uses the interface 102 to communicate with field device electronics of the field device 101.

1b) 10 shows an autonomously operating field device 105, which obtains the energy required for the operation of the field device 105 from an integrated battery 106 and provides a determined measured value to the outside via a wireless interface 107.

Autonomously operating field devices 105 are self-sufficient measuring arrangements, in particular self-sufficient level or limit sensors. The self-sufficient filling level or point level sensors are preferably designed as radar sensors and, in order to ensure the self-sufficiency of the sensors, have, in addition to a sensor for acquiring measurement data, a transmission device for preferably wireless transmission of acquired measurement data or measurement values, and their own power supply. The transmission device can preferably be a radio module for narrowband radio technology (LoRa, Sigfox, LTE-M, NB-IOT), which transfers the measurement data or measurement values to a cloud, i. H. transferred to a server on the World Wide Web. The energy supply is preferably designed as a battery or accumulator and can also include an energy harvesting module.

The autonomous field device 105 presented here has a completely hermetically sealed housing 108 . The autonomous field device 105 has a wireless display and operating module 109 to enable display and/or operation. Both the energy required by the display and control module 109 and the required data are exchanged wirelessly between the autonomous field device 105 and the display and control module 109, for example using RFID technology.

These known field devices 101, 105 have been produced in large numbers for years and have become widespread on the market. Previously known field devices 101, 105 have not yet had any technical devices to meet the requirements for obtaining a defined IT security level (SL).

2 shows a first retrofit module 201 according to the invention, which, after installation in a known field device 101 in interaction with this, results in a technical device in order to implement the requirements for achieving a defined IT security level (SL).

For this purpose, the retrofit module 201 has specialized functional units 202 implemented in hardware, which are necessary to achieve the IT security level. In interaction with software-implemented functional units 203 and hardware and software units 110 of the field device electronics 112 of the field device 101, the specifications are implemented that are necessary to achieve one of the IT security levels SL1, SL2, SL3 or SL4 defined above.

The principle on which the exemplary embodiments are based is explained in more detail below using the example of user authentication.

If an existing field device 101 is to be enabled, for example, to meet the requirements for obtaining security level SL2, then a mechanism for managing a specifiable List of users with associated passwords and individual access rights can be stored in the field device. In this way, unauthorized access to the settings of the field device 101 is to be prevented.

Since the original field device 101 has no hardware and software units 110 for implementing user administration, it is provided with a retrofit module 201, which is designed here as a display and operating module. The retrofit module is designed in such a way that it executes a user login initiated via the keyboard 204 by processing a login routine implemented in software and stored in the functional unit 203 using a previously stored list of authorized users that is persistently stored in the functional unit 202 implemented in the hardware. A registration of the user will only be accepted if the user is known, i. H. is contained in the list stored in the hardware and has entered the valid password assigned to the user. If both have taken place, the interaction of the keyboard 204 and the display 205 enables authorized operation of the field device 101, for which the display and operating module 103, 109 communicates with the field device 101 via the interface 102 in a known manner.

As part of a modular field device concept, further retrofit modules 201 are provided by the manufacturer, with which the requirements of other IT security levels are met. An alternative retrofit module 201 for obtaining security level SL3 can thus have functional units already implemented in hardware and software for realizing multi-factor authentication. In addition to the keyboard 204, this can, for example, be an NFC interface (not shown graphically here) with which the presence of an NFC token can also be verified.

The assembly of the retrofit module 201 according to the exemplary embodiment presented here is designed to be persistent, i. H. that subsequent removal of the retrofit module 201 is permanently prevented.

This prevents the IT security level SL of the updated overall device 101, 201 achieved by means of the retrofit module 201 from being subsequently deactivated again without authorization by unauthorized dismantling of the retrofit module 201. For this purpose, unauthorized dismantling is prevented by mechanical security mechanisms. On the one hand, the retrofit module 201 is connected to the field device electronics 112 of the field device 101 by a circumferential adhesive bond 206 . On the other hand, the desired persistence is electronically ensured. When connecting to the field device electronics 112 of the field device 101 for the first time, the retrofit module 201 modifies a firmware 111 of the field device 101 in such a way that from now on it only exchanges data with precisely this retrofit module 201, and if the retrofit module 201 is not present or if it is replaced with an unauthenticated retrofit module 201, the operation stops in order to signal an error to the outside, for example by outputting a status signal s for an invalid reading.

In a further embodiment, provision can additionally or alternatively be made to replace the cover 207 with a mechanically modified cover which mechanically prevents it from being unscrewed after it has been closed once, so that access to the retrofit module 201 is prevented.

3 shows a further exemplary embodiment of a retrofit module 301 for obtaining a defined IT security level (SL). As can be seen from the graphic, a self-sufficient field device 105 is enabled by a retrofit module 301 to meet extended requirements with regard to achieving an IT security level (SL).

In cooperation with the software units 303, 305, 307, the hardware units 302, 304, 306 implement a defined set of functionalities which are required to obtain a number of different IT security levels (SL). A defined IT security level (SL) can be set by the user via a selector 308 . For example, in a first position of the selector 308, the safety function of the hardware module 302 in interaction with the software units 303 is activated by a selection unit 309, for example a multiplexer. At the same time, the units 304, 305, 306, 307 can be deactivated. The retrofit module 301 is thus enabled, in interaction with the field device 105, to implement the requirements according to a first IT security level (SL). If, on the other hand, the selection unit 309 is activated in a second position, the units 302, 303, 306, 307 can be deactivated and the units 304, 305 can be activated to meet the requirements of a second IT security level (SL). According to this scheme, it is possible to provide a retrofit module, which best Current sensors are expanded in such a way that, in conjunction with the retrofit module, they meet the requirements according to an IT security level SL that can be selected in the retrofit module 301.

It should be noted at this point that the ability to select the IT security level SL described here can be achieved both with wired retrofit modules 201 and with wireless retrofit modules 301 .

4 shows another variant of a retrofit module 401.

A large number of field devices in the process industry are supplied with so-called two-chamber housings 402, which offer the possibility of accommodating components for lightning protection or explosion protection in a second housing chamber 403. Inside the housing, these components are connected to the actual field device electronics 405 via at least one wire connection 404 .

That in the 4 The retrofit module 401 shown has, like the retrofit modules 201, 301, hardware and software units 202, 203 which, in combination with the field device electronics 405, are suitable for implementing the requirements for achieving a defined IT security level SL. For this purpose, the retrofit module 401 has at least two wired interfaces, and in this way can be installed in the supply line between the communication line 406 and the field device electronics 405 .

Potential IT-relevant security attacks can essentially only take place in a large number of devices via a wired interface. It is therefore an effective approach to split the communication line 406 and install an upgrade module 401 in the second sensor chamber. In the exemplary embodiment shown, the retrofit module 401 has a wired output line 404 with a predefined length, which is designed in such a way that the original contacting interface 407 of an existing device can be connected. In addition or as an alternative, it can be provided that the retrofit module 401 is fixed to the field device 402 in such a way that it cannot be removed again (mechanically persistent). In the present exemplary embodiment, the retrofit module 401 is fastened in the housing 402 of the field device by means of safety screw connectors that can be fixed with adhesive.

Provision can also be made to replace the original housing cover (not shown) with a self-adhesive housing cover 408 that cannot be removed again.

Depending on the required IT security level SL, the retrofit module 401 assumes a variety of security functions for the field device 301, for example user management, authentication, encryption or other functions that can be required by the respective standard according to the desired IT security level SL. In particular, it can also be provided that the retrofit module 401 acts as a firewall and continuously monitors and, if necessary, rejects the incoming data packets.

According to the present application, provision can be made for various retrofit modules 401 to be provided for retrofitting at the customer or in the factory, depending on the desired IT security level SL. Additionally or alternatively, a security module can be designed in such a way that it can be adjusted according to the above exemplary embodiments, and thus implements different IT security levels SL.

A sensor that has been retrofitted in this way can then only be reached from the outside via the communication line 406 via the retrofit module 401 and the functional modules 203 contained therein, which are designed here as additional software. Unauthorized access and manipulation at the installation site can be reliably prevented by gluing the housing cover 408 together.

Furthermore, in order to implement higher IT security levels (SL), it may be necessary, for example, to authenticate oneself via multi-factor authentication before accessing the field device 402 . In multifactor authentication, it may be necessary to combine two or more security features from the groups of knowledge, possession or presence in order to ensure a particularly reliable authentication. For example, it may be necessary to transmit a security feature "knowledge" in the form of a secret password by wire via an interface to a first retrofit module 401, and also to prove ownership of a user-specific token (e.g. RFID chip, password safe, U2F module) on the sensor by plugging in a second security module 409, which contains the token or at least one interface for reading a token. In this way, by fictional appropriate combination of a first retrofit module 401 and a second security module 409 a higher IT security level SL can be achieved. In addition or as an alternative, the field device electronics 405 can also be modified using installed software in such a way that it enables direct communication between the first retrofit module 401 and the second security module 409 in order to implement specific requirements of a security level.

• - das Logging und Monitoring von Sensorereignissen und Anmeldeversuchen
• - die Authentifizierung von externen Geräten und Benutzern durch Kenntnis, beispielsweise mit Hilfe der Eingabe einer Geheimzahl, eines Passwortes oder einer PIN
• - die Authentifizierung von externen Geräten und Benutzern durch Besitz, beispielsweise mit mechanischen Schlüsseln und/oder elektronisch auslesbaren Token (RFID, NFC, U2F)
• - die Authentifizierung von externen Geräten und Benutzern durch Gegenwart, beispielsweise mit Hilfe eines Touchpanels und einer Handschriftenerkennungssoftware, eines Mikrofons und einer Stimmerkennungssoftware, eines Scanners und einer Fingerabdruckerkennungssoftware
• - die Nutzerverwaltung und die Verwaltung der Rechte der jeweiligen Nutzer
• - die mechanische Integrität des Sensors, beispielsweise durch Versiegelungs- oder Verklebevorrichtungen
• - die Sicherstellung der mechanischen und/oder elektronischen Persistenz von Nachrüstmodulen
• - den funktionalen Ablauf des ursprünglichen Sensors, beispielsweise durch das Vorhalten von spezifischen Softwareupdates

In addition, it should be pointed out that the security modules 201, 301, 401 and 409 according to the invention can contain a large number of hardware and software units for implementing specific security functions. Hardware and software units for the implementation of requirements should be mentioned explicitly at this point

• - logging and monitoring of sensor events and login attempts
• - the authentication of external devices and users by knowledge, for example by entering a secret number, a password or a PIN
• - the authentication of external devices and users through possession, e.g. with mechanical keys and/or electronically readable tokens (RFID, NFC, U2F)
• - the authentication of external devices and users by presence, for example using a touch panel and handwriting recognition software, a microphone and voice recognition software, a scanner and fingerprint recognition software
• - User administration and administration of the rights of the respective users
• - the mechanical integrity of the sensor, for example by means of sealing or bonding devices
• - Ensuring the mechanical and/or electronic persistence of retrofit modules
• - the functional process of the original sensor, for example by providing specific software updates

Reference List

101, 105, 108, 402

field device

102

interface

103, 109

Display and adjustment module

104

cable connection

106

battery

107

wireless interface

108

Housing

110

hardware and software units

111

firmware

112, 405

field device electronics

201, 301, 401

retrofit module

202

functional unit

203

functional unit

204

Keyboard

205

Advertisement

206

bonding

207

Lid

302, 304, 306

hardware units

303, 305, 307

software units

308

selector

309

selection unit

402

two-chamber housing

403

housing chamber

404

wire connection

405

sensor electronics

406

communication line

407

contacting interface

408

housing cover

409

second security module

SL

IT security level

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Non-patent Literature Cited

• ISO 27001 [0010]

Claims (16)

Retrofit module (201, 301, 401) for a field device (101, 105, 108, 402) in process automation technology with field device electronics (112, 405) with at least one communication interface, characterized in that the retrofit module (201, 301, 401) has a security module, the security module (401, 409) having the field device electronics (112, 405) works together in such a way that a specified IT security level (SL) is achieved. Retrofit module (201, 301, 401) according to claim 1 , characterized in that the retrofit module (201, 301, 401) has a first electrical interface (102) for connecting the field device electronics (112, 405) of the fill level measuring device and a communication module for connection to a higher-level unit. Retrofit module (201, 301, 401) according to claim 2 , characterized in that the first interface (102) for connection to the communication interface of the field device (101, 105, 108, 402) is designed. Retrofit module (201, 301, 401) according to claim 2 or 3 , characterized in that one connection of the first interface (102) to the communication interface is designed to be mechanically irreversible. Retrofit module (201, 301, 401) according to one of claims 2 until 4 , characterized in that a connection between the first interface (102) and the communication interface irreversibly interrupts a connection between the field device electronics (112, 405) and the superordinate unit. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the retrofit module (201, 301, 401) has a mechanical interface (102) for irreversible connection to the field device (101, 105, 108, 402). Retrofit module (201, 301, 401) according to claim 6 , characterized in that the retrofit module (201, 301, 401) comprises an irreversible locking connection and/or an irreversible screw connection and/or an irreversible adhesive connection and/or an irreversible barrier. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the retrofit module (201, 301, 401) has a crypto module for signing and/or encrypting data. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the retrofit module (201, 301, 401) has an authentication module. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the retrofit module (201, 301, 401) has an authentication interface for an external, second authentication module. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the retrofit module (201, 301, 401) has a firewall, in particular a packet filter. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the retrofit module (201, 301, 401) is designed as a display and/or operating module (103, 109). Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the security module has a plurality of functional units for implementing a plurality of predetermined IT security levels (SL) of different levels, wherein the security module has a selection element for selecting an IT security level (SL), the functional units necessary for implementing the selected IT security level (SL) being activated and/or functional units which are not necessary being deactivated on the basis of the selection. Retrofit module (201, 301, 401) according to Claim 13 , characterized in that the security module is designed in such a way that a one-time selection of the IT security level (SL) is possible. Retrofit module (201, 301, 401) according to one of the preceding claims, characterized in that the security module is designed in such a way that the IT security level (SL) can be selected when the retrofit module (201, 301, 401) is put into operation. Modular field device for process automation technology with field device electronics (112, 405) with at least one communication interface, characterized in that the field device (101, 105, 108, 402) has a retrofit module (201, 301, 401) according to one of the preceding claims, which is connected to the communication interface of the field device electronics (112).

Images