Patent ID: 9467297
Filing Date: 2016-10-11
CPC Classification: G06F,H04L

Claim Text:
1. A secure industrial control system, comprising: one or more industrial elements, the one or more industrial elements including at least one input/output module operable to receive industrial sensor information or send control information to an industrial actuator or motor; and a set of redundant communications/control modules that drive the one or more industrial elements, each of the redundant communications/control modules including at least one respective processor coupled to a respective non-transitory medium that stores instructions executable by the at least one respective processor; the set of redundant communications/control modules including a first communications/control module and a second communications/control module, the first and second communications/control modules both being communicatively coupled with the at least one input/output module and configured to monitor and control the at least one input/output module, the first and second communications/control modules being further configured to perform an authentication sequence, the authentication sequence including: transmitting a request datagram from the first communications/control module to the second communications/control module, the request datagram including a first nonce, a first device authentication key certificate, and a first identity attribute certificate; transmitting a response datagram from the second communications/control module to the first communications/control module, the response datagram including a second nonce, a first signature associated with the first and second nonces, a second device authentication key certificate, and a second identity attribute certificate; transmitting an authentication datagram from the first communications/control module to the second communications/control module when the response datagram is valid, the authentication datagram including a second signature associated with the first and second nonces; and transmitting a failed authentication datagram from the first communications/control module to the second communications/control module when the response datagram is invalid, the failed authentication datagram including a signature associated with the second nonce and an error message generated by the first communications/control module.