Patent Publication Number: US-2021195742-A1

Title: Industrial control system cable

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     The present application claims the benefit under 35 U.S.C. § 119(e) of U.S. Provisional Application Ser. No. 62/021,438, filed Jul. 7, 2014, and titled “INDUSTRIAL CONTROL SYSTEM CABLE.” The present application is also a continuation-in-part of International Application No. PCT/US2013/053721, filed Aug. 6, 2013, and titled, “SECURE INDUSTRIAL CONTROL SYSTEM.” U.S. Provisional Application Ser. No. 62/021,438 and International Application No. PCT/US2013/053721 are herein incorporated by reference in their entireties. 
    
    
     BACKGROUND 
     Industrial and process control systems include various types of control equipment used in industrial production, such as Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control equipment using, for example, Programmable Logic Controllers (PLC). These control systems are typically used in industries including electrical, water, oil, gas, and data. Using information collected from remote stations in the field, automated and/or operator-driven supervisory commands can be transmitted to field control devices. These field devices control local operations, such as opening and closing valves and breakers, collecting data from sensor systems, and monitoring a local environment for alarm conditions. 
     For example, SCADA systems typically use open-loop control with sites that may be widely separated geographically, using potentially unreliable or intermittent low-bandwidth/high-latency links. These systems use Remote Terminal Units (RTUs) to send supervisory data to a control center. The RTUs may have a limited capacity for local controls when the master station is not available. DCS systems are generally used for real time data collection and control with high-bandwidth, low-latency data networks. PLCs typically provide Boolean logic operations, timers, continuous control, and so on. However, as industrial control systems evolve, new technologies are combining aspects of these various types of control systems. For instance, Programmable Automation Controllers (PACs) can include aspects of SCADA, DCS, and PLCs. 
     SCADA systems can be used with industrial processes, including manufacturing, production, power generation, fabrication, and refining. They can also be used with infrastructure processes, including water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, wind farms, large communication systems, and so forth. Further, SCADA systems can be used in facility processes for buildings, airports, ships, space stations, and the like (e.g., to monitor and control Heating, Ventilation, and Air Conditioning (HVAC) equipment and energy consumption). DCS systems are generally used in large campus industrial process plants, such as oil and gas, refining, chemical, pharmaceutical, food and beverage, water and wastewater, pulp and paper, utility power, mining, metals, and so forth. PLCs are typically used in industrial sectors and with critical infrastructures. 
     SUMMARY 
     A cable includes a wiring assembly with a knuckle and wires bundled together by a sleeve. The cable also includes a connector assembly with a connector having connections for the wires, where the connections are arranged along a longitudinal axis. The connector assembly captures an end of the wiring assembly, and the knuckle of the wiring assembly is pivotally connected to the connector assembly so that the wiring assembly can articulate with respect to the connector assembly in a plane defined by the longitudinal axis of the connector and the end of the wiring assembly. In some embodiments, the connector assembly and the knuckle form a decent to arrest movement of the wiring assembly with respect to the connector assembly. In some embodiments, one or more of the connections is a keyed connection. 
     A cable includes a wiring assembly with wires bundled together by a sleeve. The cable also includes a connector assembly with a connector having connections for the wires, where the connector assembly captures an end of the wiring assembly. The cable further includes circuitry configured to authenticate the cable to a device connected to the cable by the connector and/or to authenticate the device connected to the cable by the connector. In some embodiments, the circuitry stores a unique identifier and/or a security credential associated with the cable. The circuitry can be configured to establish and/or prevent connection to the device connected to the cable based upon the authentication. The circuitry can also be configured to encrypt communication between the cable and the device. The cable can also include an indicator (e.g., an indicator light) to indicate the authentication. 
     A control system includes a first control element or subsystem coupled with a backplane, a first cable configured to connect to the first control element or subsystem, a second control element or subsystem coupled with the backplane adjacent to the first control element or subsystem, and a second cable configured to connect to the second control element or subsystem. Each one of the first cable and the second cable includes a wiring assembly with a knuckle and wires bundled together by a sleeve. Each cable also includes a connector assembly with a connector having connections for the wires, where the connections are arranged along a longitudinal axis. The connector assembly captures an end of the wiring assembly, and the knuckle of the wiring assembly is pivotally connected to the connector assembly so that the wiring assembly can articulate with respect to the connector assembly in a plane defined by the longitudinal axis of the connector and the end of the wiring assembly. In this manner, respective connector assemblies of the first cable and the second cable are configured to connect to the first control element or subsystem and the second control element or subsystem so that respective wiring assemblies of the first cable and the second cable can articulate to be parallel to the longitudinal axis of each respective connector. The backplane can be, for instance, a power backplane or a communications backplane. 
     A control system includes a first control element or subsystem coupled with a backplane, a first cable configured to connect to the first control element or subsystem, a second control element or subsystem coupled with the backplane adjacent to the first control element or subsystem, and a second cable configured to connect to the second control element or subsystem. Each one of the first cable and the second cable includes a wiring assembly with wires bundled together by a sleeve and a connector assembly with a connector having connections for the wires, where the connector assembly captures an end of the wiring assembly. Each cable includes circuitry configured to authenticate respective ones of the first cable and the second cable to the first control element or subsystem and the second control element or subsystem and/or to authenticate the first control element or subsystem and the second control element or subsystem to respective ones of the first cable and the second cable. 
     This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. 
    
    
     
       DRAWINGS 
       The Detailed Description is described with reference to the accompanying figures. The use of the same reference numbers in different instances in the description and the figures may indicate similar or identical items. 
         FIG. 1  is a partial isometric view illustrating a cable in accordance with example embodiments of the present disclosure. 
         FIG. 2  is a partial exploded isometric view illustrating a cable in accordance with example embodiments of the present disclosure. 
         FIG. 3  is an isometric view illustrating a connector for a cable, such as the cable illustrated in  FIG. 2 , in accordance with example embodiments of the present disclosure. 
         FIG. 4A  is a partial end view of the cable illustrated in  FIG. 2 , where a wiring assembly is articulated with respect to a connector assembly to a first position. 
         FIG. 4B  is a partial end view of the cable illustrated in  FIG. 2 , where a wiring assembly is articulated with respect to a connector assembly to a second position. 
         FIG. 4C  is a partial end view of the cable illustrated in  FIG. 2 , where a wiring assembly is articulated with respect to a connector assembly to a third position. 
         FIG. 5  is a diagrammatic illustration of a cable, such as the cable illustrated in  FIG. 1 , where the cable is connected to a device in accordance with example embodiments of the present disclosure. 
         FIG. 6  is a diagrammatic illustration of cables, such as the cable illustrated in  FIG. 1 , deployed in a control system environment in accordance with example embodiments of the present disclosure. 
         FIG. 7  is a diagrammatic illustration of a process control system, where cables, such as the cable illustrated in  FIG. 1 , are used to connect to devices in accordance with example embodiments of the present disclosure. 
         FIG. 8  is an isometric view illustrating cables, such as the cable illustrated in  FIG. 1 , connected to devices arranged adjacent to one another on a backplane in accordance with example embodiments of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION 
     Overview 
     In industrial and process control systems, many different cable configurations are generally used to interconnect automation equipment, such as controllers, input/output (I/O) modules, and so forth. For example, a cable with heavier gauge wire is used to connect a power supply to a power grid, while a cable with lighter gauge wire is used to connect an I/O module to a field device. Further, each type of device may use different numbers of wires, different pin layouts, and so forth. For this reason, there is typically a separate cable or cable type used for each piece of automation equipment, which can lead. to tracking and inventorying a large number of different cable types. In the event of a cable failure, the proper cable must be identified, located, and properly installed. This can require storing and inventorying an extensive array of different cables, which can increase the expense and/or complexity associated with such equipment. Furthermore, not having an appropriate cable in inventory can lead to production delays, loss of revenue, and so forth. 
     The present disclosure is directed to apparatus, systems, and techniques for providing a cable that can be used with multiple industrial and process control system equipment devices. Furthermore, cables described herein can be positioned so that the cables can be placed in a variety of orientations within the confines of a cabinet, a rack, or another space with limited interior volume. For example, a cable includes a connector assembly having detents that allow the end of the cable proximate to a connector to “click” into various positions (e.g., a horizontal position, a vertical position, an intermediate position, and so forth). In some embodiments, a cable includes a wiring assembly with a symmetrical layout so that the cable can be connected to a device in various orientations. Further, a cable can include one or more keyed connections (e.g., tongue and groove keying, reversed keying, etc.) to ensure that the cable is connected in a desired orientation with respect to a device (e.g., with mating keyed connections). 
     In some embodiments, different devices that connect to a cable each have the same number of channels (e.g., ten (10) channels, twenty (20) channels, and so forth), and each cable is group isolated (e.g., using each conductor and one as a common ground). In this manner, each device (e.g., controllers, input/output (I/O) modules, and so on) can have a common (e.g., universal) input/output count. Further, the wires in a cable can be oversized for one particular application (e.g., a low voltage application) so that the cable can be used for another application (e.g., a high voltage application). For example, each cable can be rated for at least approximately two amperes (2 amps). However, this amperage is provided by way of example and is not meant to limit the present disclosure. In other embodiments, the cables can be rated for more than two amperes (2 amps), less than two amperes (2 amps), and so on. 
     In some embodiments, an electronically active cable (e.g., employing a microprocessor, an embedded state machine, and so on) is provided, which has circuitry (e.g., a printed circuit board (PCB), an integrated circuit (IC) chip, and/or other circuitry) that can perform an authentication of the cable and/or a device connected to the cable. This can prevent or minimize the potential for plugging a cable into a device not intended to be used with that particular cable or type of cable (e.g., preventing or minimizing the possibility that a low voltage cable is plugged into a high voltage device). For example, the cable performs a “handshake” operation with a coupled module to verify that the cable is mated with an appropriate and/or desired device. In some embodiments, an indicator, such as a light emitting diode (LED) indicator light, is used to provide notification of this authentication. For instance, a multi-colored LED and/or a single color LED provides diagnostic information to indicate the status of an authentication (e.g., using a solid glow, no glow, blinking, one color for one state and another color for another state, etc.). 
     In some embodiments, the cable can be used to authenticate a field device, such as an instrument connected to the cable using a terminal block connection. For instance, cable circuitry can be used to authenticate an instrument, a type of instrument, the manufacturer of an instrument, and so on. In this manner, the use of counterfeit equipment in an industrial automation setting can be prevented or minimized. Further, the cable can be used to authenticate itself to equipment, such as controllers, input/output (I/O) modules, end devices, field devices, and so forth. In some embodiments, the cable facilitates cryptographic communication between the cable and a device connected to the cable. For example, a cable can provide bi-directional cryptographic communications between the cable and end devices, field devices, and so on. Further, in some embodiments, an operator can use a cable connected to a network to obtain authentication information about a field device, such as an instrument. 
     Example Implementations 
     Referring now to  FIGS. 1 through 8 , cables  100  are described. The cables  100  include a wiring assembly  102  with a knuckle  104  and wires  106  bundled together by a sleeve  108 . In some embodiments, the knuckle  104  is disposed about the sleeve  108 . For example, the knuckle  104  is formed in two parts that are captured by a connector housing (e.g., as shown in  FIG. 2 ). In other embodiments, the knuckle  104  is integrally formed with the sleeve  108  (e.g., molded as part of the sleeve  108 , co-molded with the sleeve  108 , and so on). The cable  100  also includes a connector assembly  110  with a connector  112  having connections  114  for the wires  106 . In some embodiments, one or more of the connections  114  is a keyed connection. The connections  114  are arranged along a longitudinal axis  116  (e.g., as shown in  FIG. 3 ). The connector assembly  110  captures an end  118  of the wiring assembly  102 , and the knuckle  104  of the wiring assembly  102  is pivotally connected to the connector assembly  110  so that the wiring assembly  102  can articulate with respect to the connector assembly  110  in a plane defined by the longitudinal axis  116  of the connector  112  and the end  118  of the wiring assembly  102  (e.g., as shown in  FIGS. 4A through 4C ). In some embodiments, the connector assembly  110  comprises a connector housing  120  that captures the wiring assembly  102 . 
     The connector assembly  110  and the knuckle  104  can include one or more detents to arrest movement of the wiring assembly  102  with respect to the connector assembly  110 . For example, the knuckle  104  includes one or more notches  122  configured to interface with one or more corresponding teeth  124  of the connector assembly  110  (e.g., as shown in  FIG. 2 ). However, this configuration is provided by way of example and is not mean to limit the present disclosure. In other embodiments, one or more notches of the connector assembly  110  can be configured to interface with one or more corresponding teeth of the knuckle  104 . Further, other mechanisms for arresting movement of the wiring assembly  102  with respect to the connector assembly  110  can be provided, including, but not necessarily limited to: a gravity-actuated lever, a spring-actuated lever, a spring-loaded ball bearing, a leaf spring (e.g., a piece of spring steel), and so forth. 
     In some embodiments, the cable  100  includes circuitry  126  configured to authenticate the cable  100  to a device  128  connected to the cable  100  by the connector  112  and/or by another connector, such as another connector on the other end of the cable  100 . The circuitry  126  can also be used to authenticate the device  128  connected to the cable  100  by the connector  112  and/or by another connector, such as another connector on the other end of the cable  100 . In some embodiments, the circuitry  126  stores a unique identifier  130  and/or a security credential  132  associated with the cable  100  (e.g., as shown in  FIG. 5 ). The circuitry  126  can be configured to establish and/or prevent connection to the device  128  connected to the cable  100  based upon the authentication. The cable  100  can also include an indicator (e.g., an indicator light  134 ) to indicate the authentication. 
     In some embodiments, the cable  100  includes an alert module. In embodiments of the disclosure, the alert module is configured to provide an alert (e.g., to an operator) when a condition and/or set of conditions is met for the cable  100  and/or a device  128  connected to the cable  100 . For example, an alert is generated by circuitry  126  when authentication of the cable  100  and/or a device  128  connected to the cable is obtained and/or fails. For example, a cable  100  performs a “handshake” operation with a coupled device  128  to verify that the cable  100  is mated with an appropriate and/or desired device. If not, the alert module can be used to alert an operator (e.g., via a network). In some embodiments, an alert is provided to an operator in the form of an email. In other embodiments, an alert is provided to an operator in the form of a text message. However, these alerts are provided by way of example and are not meant to limit the present disclosure. In other embodiments, different alerts are provided to an operator. Further, multiple alerts can be provided to an operator when a condition is met for an authentication procedure (e.g., an email and a text message, and so forth). It should also be noted that alerts can be provided by circuitry  126  for other conditions, including, but not necessarily limited to: cable failure, connected device failure, various error conditions for a cable and/or a connected device, and so forth. 
     The circuitry  126  can also be configured to encrypt communication between the cable  100  and the device  128 . As shown in  FIG. 6 , a cable  100  can include an encryption module  136 . For example, one or more cryptographic protocols are used to transmit information between the cable  100  and a device  128 . Examples of such cryptographic protocols include, but are not necessarily limited to: a transport layer security (TLS) protocol, a secure sockets layer (SSL) protocol, and so forth. For instance, communications between a cable  100  and a device  128  can use HTTP secure (HTTPS) protocol, where HTTP protocol is layered on SSL and/or TLS protocol. 
     The cables  100  can be used with a process control system  200 . In embodiments of the disclosure, the process control system  200  uses a communications control architecture to implement a distributed control system that includes control elements or subsystems  202 , where the subsystems are controlled by one or more controllers distributed throughout the system. For example, one or more I/O modules  204  are connected to one or more control modules  206 . The process control system  200  is configured to transmit data to and from the I/O modules  204 . The I/O modules  204  can comprise input modules, output modules, and/or input and output modules. For instance, input modules can be used to receive information from input instruments in the process or the field, while output modules can be used to transmit instructions to output instruments in the field. For example, an I/O module  204  can be connected to a process sensor, such as a sensor for measuring pressure in piping for a gas plant, a refinery, and so forth. 
     In implementations, the I/O modules  204  can be used to control systems and collect data in applications including, but not necessarily limited to: industrial processes, such as manufacturing, production, power generation, fabrication, and refining; infrastructure processes, such as water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, wind farms, and large communication systems; facility processes for buildings, airports, ships, and space stations (e.g., to monitor and control Heating, Ventilation, and Air Conditioning (HVAC) equipment and energy consumption); large campus industrial process plants, such as oil and gas, refining, chemical, pharmaceutical, food and beverage, water and wastewater, pulp and paper, utility power, mining, metals; and/or critical infrastructures. 
     In implementations, an I/O module  204  can be configured to convert analog data received from the sensor to digital data (e.g., using Analog-to-Digital Converter (ADC) circuitry, and so forth). An I/O module  204  can also be connected to a motor and configured to control one or more operating characteristics of the motor, such as motor speed, motor torque, and so forth, Further, the I/O module  204  can be configured to convert digital data to analog data for transmission to the motor (e.g., using Digital-to-Analog (DAC) circuitry, and so forth). In implementations, one or more of the I/O modules  204  can comprise a communications module configured for communicating via a communications sub-bus, such as an Ethernet bus, an H 1  field bus, a Process Field Bus (PROFIBUS), a Highway Addressable Remote Transducer (HART) bus, a Modbus, and so forth. Further, two or more I/O modules  204  can be used to provide fault tolerant and redundant connections for a communications sub-bus. 
     Each I/O module  204  can be provided with a unique identifier (ID) for distinguishing one I/O module  204  from another I/O module  204 . In implementations, an I/O module  204  is identified by its ID when it is connected to the process control system  200 . Multiple I/O modules  204  can be used with the process control system  200  to provide redundancy. For example, two or more I/O modules  204  can be connected to the sensor and/or the motor. Each I/O module  204  can include one or more ports that furnish a physical connection to hardware and circuitry included with the I/O module  204 , such as a printed circuit board (PCB), and so forth. For example, each I/O module  204  includes a connection for a cable  100  that connects the cable  100  to a printed wiring board (PWB) in the I/O module  204 . 
     One or more of the I/O modules  204  can include an interface for connecting to other networks including, but not necessarily limited to: a wide-area cellular telephone network, such as a 3G cellular network, a 4G cellular network, or a Global System for Mobile communications (GSM) network; a wireless computer communications network, such as a Wi-Fi network (e.g., a Wireless LAN (WLAN) operated using IEEE 802.11 network standards); a Personal Area Network (PAN) (e.g., a Wireless PAN (WPAN) operated using IEEE 802.15 network standards); a Wide Area Network (WAN); an intranet; an extranet; an internet; the Internet; and so on. Further, one or more of the I/O modules  204  can include a connection for connecting an I/O module  204  to a computer bus, and so forth. 
     The control modules  206  can be used to monitor and control the I/O modules  204 , and to connect two or more I/O modules  204  together. In embodiments of the disclosure, a control module  206  can update a routing table when an I/O module  204  is connected to the process control system  200  based upon a unique ID for the I/O module  204 . Further, when multiple redundant I/O modules  204  are used, each control module  206  can implement mirroring of informational databases regarding the I/O modules  204  and update them as data is received from and/or transmitted to the I/O modules  204 . In some implementations, two or more control modules  206  are used to provide redundancy. 
     Data transmitted by the process control system  200  can be packetized, i.e., discrete portions of the data can be converted into data packets comprising the data portions along with network control information, and so forth. The process control system  200  can use one or more protocols for data transmission, including a bit-oriented synchronous data link layer protocol such as High-Level Data Link Control (HDLC). In some embodiments, the process control system  200  implements HDLC according to an International Organization for Standardization (ISO) 13239 standard, or the like. Further, two or more control modules  206  can be used to implement redundant HDLC. However, it should be noted that HDLC is provided by way of example only and is not meant to be restrictive of the present disclosure. Thus, the process control system  200  can use other various communications protocols in accordance with the present disclosure. 
     One or more of the control modules  206  can be configured for exchanging information with components used for monitoring and/or controlling the instrumentation connected to the process control system  200  via the I/O modules  204 , such as one or more control loop feedback mechanisms/controllers. In implementations, a controller can be configured as a microcontroller/Programmable Logic Controller (PLC), a Proportional-Integral-Derivative (PID) controller, and so forth. In embodiments of the disclosure, the I/O modules  204  and the control modules  206  include network interfaces, e.g., for connecting one or more I/O modules  204  to one or more controllers via a network. In implementations, a network interface can be configured as a Gigabit Ethernet interface for connecting the I/O modules  204  to a Local Area Network (LAN). Further, two or more control modules  206  can be used to implement redundant Gigabit Ethernet. 
     However, it should be noted that Gigabit Ethernet is provided by way of example only and is not meant to be restrictive of the present disclosure. Thus, a network interface can be configured for connecting the control modules  206  to other various networks including, but not necessarily limited to: a wide-area cellular telephone network, such as a 3G cellular network, a 4G cellular network, or a GSM network; a wireless computer communications network, such as a Wi-Fi network (e.g., a WLAN operated using IEEE 802.11 network standards); a PAN (e.g., a WPAN operated using IEEE 802.15 network standards); a WAN; an intranet; an extranet; an internet; the Internet; and so on. Additionally, a network interface can be implemented using a computer bus. For example, a network interface can include a Peripheral Component Interconnect (PCI) card interface, such as a Mini PCI interface, and so forth. Further, the network can be configured to include a single network or multiple networks across different access points. 
     The process control system  200  can receive electrical power from multiple sources. For example, AC power is supplied from a power grid  208  (e.g., using high voltage power from AC mains). AC power can also be supplied using local power generation (e.g., an on-site turbine or diesel local power generator  210 ). A power supply  212  is used to distribute electrical power from the power grid  208  to automation equipment of the process control system  200 , such as controllers, I/O modules, and so forth. A power supply  212  can also be used to distribute electrical power from the local power generator  210  to the automation equipment. The process control system  200  can also include additional (backup) power supplies configured to store and return DC power using multiple battery modules. For example, a power supply  212  functions as a UPS. In embodiments of the disclosure, multiple power supplies  212  can be distributed (e.g., physically decentralized) within the process control system  200 . 
     In embodiments of the disclosure, the control elements or subsystems  202  (e.g., the I/O modules  204 , the control modules  206 , the power supplies  212 , and so forth) are connected together by one or more backplanes  214 . For example, as shown in  FIG. 7 , control modules  206  can be connected to  110  modules  204  by a communications backplane  216 . Further, power supplies  212  can be connected to I/O modules  204  and/or to control modules  206  by a power backplane  218 . In embodiments of the disclosure, cables  100  are used to connect to the I/O modules  204 , the control modules  206 , the power supplies  212 , and possibly other process control system equipment. For example, a cable  100  is used to connect a control module  206  to a network  220 , another cable  100  is used to connect a power supply  212  to a power grid  208 , another cable  100  is used to connect a power supply  212  to a local power generator  210 , and so forth. 
     In some embodiments, the I/O modules  204 , the control modules  206 , and/or the power supplies  212  can be positioned adjacent to one another (e.g., immediately adjacent to one another as shown in  FIG. 8 ). As shown, connector assemblies  110  of the first cables  100  are connected to the control elements or subsystem  204 ,  206 , and  212  so that respective wiring assemblies  102  of the cables  100  can articulate to be parallel to the longitudinal axis of each respective connector  112 . Further, as previously described, each cable  100  can include circuitry configured to authenticate the cables  100  to the first control elements or subsystem  204 ,  206 , and  212  and/or to authenticate the control elements or subsystem  204 ,  206 , and  212  to respective cables  100 . 
     Referring now to  FIG. 5 , a cable  100 , including some or all of its components, can operate under computer control. For example, a processor can be included with or in a cable  100  to control the components and functions of cables  100  described herein using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or a combination thereof. The terms “controller,” “functionality,” “service,” and “logic” as used herein generally represent software, firmware, hardware, or a combination of software, firmware, or hardware in conjunction with controlling the cables  100 . In the case of a software implementation, the module, functionality, or logic represents program code that performs specified tasks when executed on a processor (e.g., central processing unit (CPU) or CPUs). The program code can be stored in one or more computer-readable memory devices (e.g., internal memory and/or one or more tangible media), and so on. The structures, functions, approaches, and techniques described herein can be implemented on a variety of commercial computing platforms having a variety of processors. 
     The cable  100  can include a controller  150  for controlling authentication operations, encryption, cryptographic communications, and so forth. The controller  150  can include a processor  152 , a memory  154 , and a communications interface  156 . The processor  152  provides processing functionality for the controller  150  and can include any number of processors, micro-controllers, or other processing systems, and resident or external memory for storing data and other information accessed or generated by the controller  150 . The processor  152  can execute one or more software programs that implement techniques described herein. The processor  152  is not limited by the materials from which it is formed or the processing mechanisms employed therein and, as such, can be implemented via semiconductor(s) and/or transistors (e.g., using electronic integrated circuit (IC) components), and so forth. 
     The memory  154  is an example of tangible, computer-readable storage medium that provides storage functionality to store various data associated with operation of the controller  150 , such as software programs and/or code segments, or other data to instruct the processor  152 , and possibly other components of the controller  150 , to perform the functionality described herein. Thus, the memory  154  can store data, such as a program of instructions for operating the cable  100  (including its components), and so forth. In embodiments of the disclosure, the memory  154  can store a unique identifier  130  and/or a security credential  132  for the cable  100 . It should be noted that while a single memory  154  is described, a wide variety of types and combinations of memory (e.g., tangible, non-transitory memory) can be employed. The memory  154  can be integral with the processor  152 , can comprise stand-alone memory, or can be a combination of both. 
     The memory  154  can include, but is not necessarily limited to: removable and non-removable memory components, such as random-access memory (RAM), read-only memory (ROM), flash memory (e.g., a secure digital (SD) memory card, a mini-SD memory card, and/or a micro-SD memory card), magnetic memory, optical memory, universal serial bus (USB) memory devices, hard disk memory, external memory, and so forth. In implementations, the cable  100  and/or the memory  154  can include removable integrated circuit card (ICC) memory, such as memory provided by a subscriber identity module (SIM) card, a universal subscriber identity module (USIM) card, a universal integrated circuit card (UICC), and so on. 
     The communications interface  156  is operatively configured to communicate with components of the cable  100 . For example, the communications interface  156  can be configured to transmit data for storage in the cable  100 , retrieve data from storage in the cable  100 , and so forth. The communications interface  156  is also communicatively coupled with the processor  152  to facilitate data transfer between components of the cable  100  and the processor  152  (e.g., for communicating inputs to the processor  152  received from a device communicatively coupled with the controller  150 ). It should be noted that while the communications interface  156  is described as a component of a controller  150 , one or more components of the communications interface  156  can be implemented as external components communicatively coupled to the cable  100  via a wired and/or wireless connection. The cable  100  can also comprise and/or connect to one or more input/output (I/O) devices (e.g., via the communications interface  156 ), including, but not necessarily limited to: a display, a mouse, a touchpad, a keyboard, and so on. 
     The communications interface  156  and/or the processor  152  can be configured to communicate with a variety of different networks, including, but not necessarily limited to: a wide-area cellular telephone network, such as a 3G cellular network, a 4G cellular network, or a global system for mobile communications (GSM) network; a wireless computer communications network, such as a WiFi network (e.g., a wireless local area network (WLAN) operated using IEEE 802.11 network standards); an internet; the Internet; a wide area network (WAN); a local area network (LAN); a personal area network (PAN) (e.g., a wireless personal area network (WPAN) operated using IEEE 802.15 network standards); a public telephone network; an extranet; an intranet; and so on. However, this list is provided by way of example only and is not meant to limit the present disclosure. Further, the communications interface  156  can be configured to communicate with a single network or multiple networks across different access points. 
     With reference to  FIG. 7 , the process control system  200  implements a secure control system. For example, the process control system  200  includes a security credential source (e.g., a factory  222 ) and a security credential implementer (e.g., a key management entity  224 ). The security credential source is configured to generate a unique security credential (e.g., a key, a certificate, etc., such as the unique identifier  130 , and/or the security credential  132 ). The security credential implementer is configured to provision the cables  100 , the devices  128 , the control elements or subsystems  202 , e.g., the I/O modules  204 , the control modules  206 , the power supplies  212 , and so forth, with a unique security credential generated by the security credential source. For instance, a cable  100  and a device  128  can each be provisioned with unique security credentials. 
     An authentication process for authenticating the cables  100 , the devices  128 , and/or the control elements or subsystems  202  connected to the cables  100  is performed. based upon the unique security credentials. For example, in embodiments, a cable  100  and a device  128  are operable to bi-directionally communicate with one another based on the unique security credentials (e.g., based upon the authentication process). Further, in the secure process control system  200  disclosed herein, multiple (e.g., every) cable  100 , device  128 , control element or subsystem  202  (e.g., I/O modules, power supplies, physical interconnect devices, etc.) of the process control system  200  is provisioned with security credentials for providing security at multiple (e.g., all) levels of the process control system  200 . Still further, the elements can be provisioned with the unique security credentials (e.g., keys, certificates, etc.) during manufacture (e.g., at birth), and can be managed from birth by a key management entity  224  of the process control system  200  for promoting security of the process control system  200 . 
     In embodiments of the disclosure, communications between elements and/or physical interconnect devices (e.g., cables  100 ) of the process control system  200  includes an authentication process. The authentication process can be performed for authenticating an element and/or physical interconnect device implemented in the process control system  200 . In implementations, the authentication process can utilize security credentials associated with the element and/or physical interconnect device for authenticating that element and/or physical interconnect device. For example, the security credentials can include encryption keys, certificates (e.g., public key certificates, digital certificates, identity certificates, security certificates, asymmetric certificates, standard certificates, non-standard certificates) and/or identification numbers. In embodiments, controllers  150  (e.g., secure microcontrollers) that are included in and/or connected to the cables  100  of the process control system  200  can be configured for performing the authentication process. 
     In implementations, multiple control elements or subsystems  202  (e.g., elements and/or physical interconnect devices) of the process control system  200  are provisioned with their own unique security credentials. For example, each element of the process control system  200  is provisioned with its own unique set(s) of certificates, encryption keys and/or identification numbers when the element is manufactured (e.g., the individual sets of keys and certificates are defined at the birth of the element). The sets of certificates, encryption keys and/or identification numbers are configured for providing/supporting strong encryption. The encryption keys can be implemented with standard (e.g., commercial off-the-shelf (COTS)) encryption algorithms, such as National Security Agency (NSA) algorithms, National institute of Standards and Technology (NIST) algorithms, or the like. 
     Based upon the results of the authentication process, the element being authenticated can be activated, partial functionality of the element can be enabled or disabled within the process control system  200 , complete functionality of the element can be enabled within the process control system  200 , and/or functionality of the element within the process control system  200  can be completely disabled (e.g., no communication facilitated between that element and other elements of the process control system  200 ). 
     In embodiments, the keys, certificates and/or identification numbers associated with an element of the process control system  200  can specify the original equipment manufacturer (OEM) of that element. As used herein, the term “original equipment manufacturer” or “OEM” can be defined as an entity that physically manufactures the device (e.g., element) and/or a supplier of the device such as an entity that purchases the device from a physical manufacturer and sells the device. Thus, in embodiments, a device can be manufactured and distributed (sold) by an OEM that is both the physical manufacturer and the supplier of the device. However, in other embodiments, a device can be distributed by an OEM that is a supplier, but is not the physical manufacturer. In such embodiments, the OEM can cause the device to be manufactured by a physical manufacturer (e.g., the OEM can purchase, contract, order, etc. the device from the physical manufacturer). 
     Additionally, where the OEM comprises a supplier that is not the physical manufacturer of the device, the device can bear the brand of the supplier instead of brand of the physical manufacturer. For example, in embodiments where an element (e.g., a cable  100 ) is associated with a particular OEM that is a supplier but not the physical manufacturer, the element&#39;s keys, certificates and/or identification numbers can specify that origin. During authentication of an element of the process control system  200 , when a determination is made that an element being authenticated was manufactured or supplied by an entity that is different than the OEM of one or more other elements of the process control system  200 , then the functionality of that element can he at least partially disabled within the process control system  200 . For example, limitations can be placed upon communication (e.g., data transfer) between that element and other elements of the process control system  200 , such that the element can not work/function within the process control system  200 . When one of the elements of the process control system  200  requires replacement, this feature can prevent a user of the process control system  200  from unknowingly replacing the element with a non-homogenous element (e.g., an element having a different origin (a different OEM) than the remaining elements of the process control system  200 ) and implementing the element in the process control system  200 . In this manner, the techniques described herein can prevent the substitution of elements (which can furnish similar functionality) of other OEM&#39;s into a secure process control system  200  manufactured and/or supplied by the originating OEM (the OEM that originally supplied the process control system  200  to the user) in place of elements manufactured and/or supplied by the originating OEM without the approval of the originating OEM. 
     In another instance, a user can attempt to implement an incorrectly designated (e.g., mismarked) element within the process control system  200 . For example, the mismarked element can have a physical indicia marked upon it which falsely indicates that the element is associated with the same OEM as the OEM of the other elements of the process control system  200 . In such instances, the authentication process implemented by the process control system  200  can cause the user to be alerted that the element is counterfeit. This process can also promote improved security for the process control system  200 , since counterfeit elements are often a vehicle by which malicious software can be introduced into the process control system  200 . In embodiments, the authentication process provides a secure air gap for the process control system  200 , ensuring that the secure industrial control system is physically isolated from insecure networks. 
     In implementations, the secure process control system  200  includes a key management entity  224 . The key management entity  224  can be configured for managing cryptographic keys (e.g., encryption keys) in a cryptosystem. This managing of cryptographic keys (e.g., key management) can include the generation, exchange, storage, use, and/or replacement of the keys. For example, the key management entity  224  is configured to serve as a security credentials source, generating unique security credentials (e.g., public security credentials, secret security credentials) for the elements of the process control system  200 . Key management pertains to keys at the user and/or system level (e.g., either between users or systems) 
     In embodiments, the key management entity  224  comprises a secure entity such as an entity located in a secure facility. The key management entity  224  can be remotely located from the I/O modules  204 , the control modules  206 , and the network  220 . For example, a firewall  226  can separate the key management entity  224  from the control elements or subsystems  202  and the network  220  (e.g., a corporate network). In implementations, the firewall  226  can be a software and/or hardware-based network security system that controls ingoing and outgoing network traffic by analyzing data packets and determining whether the data packets should be allowed through or not, based on a rule set. The firewall  226  thus establishes a barrier between a trusted, secure internal network (e.g., the network  220 ) and another network  228  that is not assumed to be secure and trusted (e.g., a cloud and/or the Internet). In embodiments, the firewall  226  allows for selective (e.g., secure) communication between the key management entity  224  and one or more of the control elements or subsystems  202  and/or the network  220 . In examples, one or more firewalls can be implemented at various locations within the process control system  200 . For example, firewalls can be integrated into switches and/or workstations of the network  220 . 
     The secure process control system  200  can further include one or more manufacturing entities (e.g., factories  222 ). The manufacturing entities can be associated with original equipment manufacturers (OEMs) for the elements of the process control system  200 . The key management entity  224  can be communicatively coupled with the manufacturing entity via a network (e.g., a cloud). In implementations, when the elements of the process control system  200  are being manufactured at one or more manufacturing entities, the key management entity  224  can be communicatively coupled with (e.g., can have an encrypted communications pipeline to) the elements. The key management entity  224  can utilize the communications pipeline for provisioning the elements with security credentials (e.g., inserting keys, certificates and/or identification numbers into the elements) at the point of manufacture. 
     Further, when the elements are placed into use (e.g., activated), the key management entity  224  can be communicatively coupled (e.g., via an encrypted communications pipeline) to each individual element worldwide and can confirm and sign the use of specific code, revoke (e.g., remove) the use of any particular code, and/or enable the use of any particular code. Thus, the key management entity  224  can communicate with each element at the factory where the element is originally manufactured (e.g., born), such that the element is born with managed keys. A master database and/or table including all encryption keys, certificates and/or identification numbers for each element of the process control system  200  can be maintained by the key management entity  224 . The key management entity  224 , through its communication with the elements, is configured for revoking keys, thereby promoting the ability of the authentication mechanism to counter theft and re-use of components. 
     In implementations, the key management entity  224  can be communicatively coupled with one or more of the control elements or subsystems  202  and/or the network  220  via another network (e.g., a cloud and/or the Internet) and firewall. For example, in embodiments, the key management entity  224  can be a centralized system or a distributed system. Moreover, in embodiments, the key management entity  224  can be managed locally or remotely. In some implementations, the key management entity  224  can be located within (e.g., integrated into) the network  220  and/or the control elements or subsystems  202 . The key management entity  224  can provide management and/or can be managed in a variety of ways. For example, the key management entity  224  can be implemented/managed: by a customer at a central location, by the customer at individual factory locations, by an external third party management company and/or by the customer at different layers of the process control system  200 , and at different locations, depending on the layer. 
     Varying levels of security (e.g., scalable, user-configured amounts of security) can be provided by the authentication process. For example, a base level of security can be provided which authenticates the elements and protects code within the elements. Other layers of security can be added as well. For example, security can be implemented to such a degree that a component, such as the cable  100 , cannot power up without proper authentication occurring. In implementations, encryption in the code is implemented in the elements, security credentials (e.g., keys and certificates) are implemented on the elements. Security can be distributed (e.g., flows) through the process control system  200 . For example, security can flow through the process control system  200  all the way to an end user, who knows what a module is designed to control in that instance. In embodiments, the authentication process provides encryption, identification of devices for secure communication and authentication of system hardware or software components (e.g., via digital signature). 
     In implementations, the authentication process can be implemented to provide for and/or enable interoperability within the secure process control system  200  of elements manufactured and/or supplied by different manufacturers/vendors/suppliers (e.g., OEMs). For example, selective (e.g., some) interoperability between elements manufactured and/or supplied by different manufacturers/vendors/suppliers can be enabled. In embodiments, unique security credentials (e.g., keys) implemented during authentication can form a hierarchy, thereby allowing for different functions to be performed by different elements of the process control system  200 . 
     The communication links connecting the components of the process control system  200  can further employ data packets, such as runt packets packets (e.g., packets smaller than sixty-four (64) bytes), placed (e.g., injected and/or stuffed) therein, providing an added level of security. The use of runt packets increases the level of difficulty with which outside information (e.g., malicious content such as false messages, malware (viruses), data mining applications, etc.) can be injected onto the communications links. For example, runt packets can be injected onto a communication link within gaps between data packets transmitted between a control module  206  and a cable  100  to hinder an external entity&#39;s ability to inject malicious content onto the communication link. 
     Generally, any of the functions described herein can be implemented using hardware (e.g., fixed logic circuitry such as integrated circuits), software, firmware, manual processing, or a combination thereof. Thus, the blocks discussed in the above disclosure generally represent hardware (e.g., fixed logic circuitry such as integrated circuits), software, firmware, or a combination thereof. In the instance of a hardware configuration, the various blocks discussed in the above disclosure may be implemented as integrated circuits along with other functionality. Such integrated circuits may include all of the functions of a given block, system, or circuit, or a portion of the functions of the block, system, or circuit. Further, elements of the blocks, systems, or circuits may be implemented across multiple integrated circuits. Such integrated circuits may comprise various integrated circuits, including, but not necessarily limited to: a monolithic integrated circuit, a flip chip integrated circuit, a multichip module integrated circuit, and/or a mixed signal integrated circuit. In the instance of a software implementation, the various blocks discussed in the above disclosure represent executable instructions (e.g., program code) that perform specified tasks when executed on a processor. These executable instructions can be stored in one or more tangible computer readable media. In some such instances, the entire system, block, or circuit may be implemented using its software or firmware equivalent. In other instances, one part of a given system, block, or circuit may be implemented in software or firmware, while other parts are implemented in hardware. 
     Although the subject matter has been described in language specific to structural features and/or process operations, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.