Data are sent from an internal data processing system of an industrial plant to an external data processing system of the industrial plant by generating with an industrial edge device data packets from data related to an industrial machine, and generating therefrom signed data packets signed with a first digital signature. While the signed data packet are read, a user-defined data filter is applied, which lets either pass or rejects the signed data packets. The data packets that passed the user-defined data filter are then sent to the external data processing system.

Process control systems for operating process plants are disclosed herein. The process control systems include control modules that are decoupled from the I/O architecture of the process plants using signal objects or generic shadow blocks. This decoupling is effected by using the signal objects or generic shadow blocks to manage at least part of the communication between the control modules and the field devices. Signal objects may convert between protocols used by control modules and field devices, thus decoupling the control modules from the I/O architecture. Generic shadow blocks may be automatically configured to mimic the operation of field devices within a controller executing the control modules, thus partially decoupling the control modules from the I/O architecture by using the shadow blocks to manage communication between the control modules and the field devices.

A method and edge device for controlling data exchange of an industrial edge device with an industrial automation arrangement and a data cloud, wherein the edge device includes a first communication connection to the industrial automation arrangement and a second communication connection to a network of the data cloud, where the edge device includes applications exchanging data, and where the edge device includes a control device to control the data to be exchanged, wherein whether data exchange of an application is controlled via the first communication connection and the data exchange is implemented directly via the second communication connection or vice versa is defined for each application, where a data flow control device ensures simultaneous direct data exchange by an application via both communication connections does not occur, such that rigorous checking of applications or containers within the applications with respect to data security is not required.

A system for securely disseminating information relating to a process control plant includes a process control node and a controller that is coupled to a plurality of process control devices. The process control node includes a communicator module operable to transmit, via a first network, information of the process plant received from the controller. The system also includes a data services module operable to receive from the communicator module, via the first network, the information of the process plant and to transmit some or all of that information via a second network, and a mobile server, coupled to the second network and to a third network, and operable to receive data from the data services module. The mobile server is operable to communicate with a plurality of mobile computing devices via the third network.

A method for decreasing the risk of unauthorized access to an embedded node in a secure subsystem of a process control system includes receiving a message comprising a message header and a message payload, and determining that the message is an unlock message configured to access one or more protected functions of the embedded node, at least by analyzing a bit sequence of one or more bits in the message header. The method also includes determining whether a manual control mechanism has been placed in a particular state by a human operator, and, based upon those determinations, either causing or not causing the embedded node to enter an unlocked state in which one or more of the protected functions are accessible.

A method of providing process data to a remote computing device includes receiving configuration data describing a configuration of at least part of the process control system. The configuration data includes information associated with a plurality of process control entities, and the information regarding each entity includes at least one tag associated with a level in a hierarchy of the system. The method includes identifying a plurality of levels within the system based upon the tags, including at least a first-level identifier and a plurality of second-level identifiers associated with the first-level identifier. Further, the method includes identifying a plurality of control modules, each associated with a second-level identifier, and each associated with the entities based upon the configuration data. The method includes generating a hierarchical list of available process data, and selecting from the hierarchical list a set of information to include on a watch list or alarm list.

A method and arrangement for providing access of a first computer to at least one application installed on a virtual machine of a second computer via a network connection, wherein at a first step, a Remote Desktop Protocol connection (RDP-C) is established from the first computer to the virtual machine and, at a second step, at least one communication relation of the first computer to an industrial controller is made available to the at least one application as a local communication relation of the application from the virtual machine to the first computer via a virtual channel of the RDP-C connection such that from a user's perspective, only exactly one connection to the virtual machine must be established via the RDP-C, where required back channels can be automatically established and where no security settings must be changed in firewalls or routers.

A system for securely disseminating information relating to a process control plant includes a process control node and a controller that is coupled to a plurality of process control devices. The process control node includes a communicator module operable to transmit, via a first network, information of the process plant received from the controller. The system also includes a data services module operable to receive from the communicator module, via the first network, the information of the process plant and to transmit some or all of that information via a second network, and a mobile server, coupled to the second network and to a third network, and operable to receive data from the data services module. The mobile server is operable to communicate with a plurality of mobile computing devices via the third network.

A method and edge device for controlling data exchange of an industrial edge device with an industrial automation arrangement and a data cloud, wherein the edge device includes a first communication connection to the industrial automation arrangement and a second communication connection to a network of the data cloud, where the edge device includes applications exchanging data, and where the edge device includes a control device to control the data to be exchanged, wherein whether data exchange of an application is controlled via the first communication connection and the data exchange is implemented directly via the second communication connection or vice versa is defined for each application, where a data flow control device ensures simultaneous direct data exchange by an application via both communication connections does not occur, such that rigorous checking of applications or containers within the applications with respect to data security is not required.

To improve the access control in regard to safety and protection of network operation and network data when controlling accesses to networks based on IT systems including embedded systems or distributed systems, it is proposed that observation and evaluation (detection) of the communication in a network (performance of a network communication protocol collation of the observed protocol with a multiplicity of reference protocols, preferably stored in a list, that are usually used in operation- and/or safety-critical networks) be used to independently identify whether an uncritical or critical network is involved in the course of a network access, in particular the setup of a network connectivity, to at least one from at least one network that is uncritical in regard to operation and/or safety, in particular referred to as a standard network, and at least one network that is critical in regard to operation and/or safety.