Patent Application
20110167477
The subject matter disclosed herein relates generally to controlling access to a computer system/network-implemented equipment monitoring and diagnostic facility. More specifically, technology disclosed herein relates to a method and apparatus for providing secure user access and controlled connectivity to a globally accessible proprietary online computerized information storage and management facility used to monitor and diagnose steam turbine power generator equipment. In particular, the technology disclosed herein relates to a hardware-software user interface connectivity method and apparatus for providing a controlled and secure access environment that enables only authorized users to obtain direct and/or remote access to proprietary data/information and processes of an online computer system/facility resource.
During the use and operation of steam turbine power generating equipment, the operating condition of numerous pieces of equipment and various operational processes must be monitored continually so as to obtain early indications of equipment malfunctions or to predict potential equipment failures well in advance so that appropriate corrective measures may be implemented in sufficient time to preclude possible injury to personnel and financial loss due to equipment down time. Conventionally, processes such as the generation of electricity in a steam turbine power generator plant employ typically hundreds of sensors throughout the plant to provide real-time status of equipment operational parameters. The turbine equipment is often monitored remotely and the acquired sensor data/information sent across either dedicated or public communications lines to a specialized equipment monitoring/diagnostics facility that maintains a proprietary computer system/network specifically for providing such services. Moreover, the monitoring/diagnostics facility may provide such services to multiple clients for a multitude of plants geographically situated in diverse locations across the globe. In addition, real time access to the monitored equipment information as well as some degree of control over the diagnostics process and analysis of the acquired sensor data must be made available and accessible both locally at the monitoring/diagnostics computer facility as well as remotely from a diverse variety of global locations where various plants and engineers may be situated.
For example, continuous onsite observation and interpretation of steam turbine equipment sensor data may be needed by operators at a specific power generating plant so that any appropriate action, which might be deemed desirable from an economic or safety consideration, can be immediately instigated. Additionally, plant engineers and repair technicians often need access to various software tools/applications, historical operational fleet data and proprietary knowledge base information which may only be available from the remote monitoring/diagnostics computer facility. In addition, it is often desirable to be able to perform such diagnostics, tuning or repairs from a location that is remote from the specific plant/equipment and/or remote from the monitoring/diagnostics computer facility. However, it is highly desirable that any local or remote access to the monitoring/diagnostic computer facility/network and as well as the proprietary applications and data contained therein must be made secure and accessible only to authorized persons or entities. Moreover, it is also important that power generating facilities and electric utilities become and remain compliant with contemporary NERC-CIP (North American Electric Reliability Council Critical Infrastructure Protection) standards regarding cyber security for critical infrastructure protection concerning access to power plant/utilities computer and digital information systems for implementing adequate protection of power plants and electric utilities against any potential electronic threats. For example, among other things, these NERC-CIP standards require that such facilities keep strict track of who is requesting access to data/information, what data/information is being requested and when such access or requests are being made.
In this regard, it is highly desirable to have a controlled and secure access environment that enables only authorized users to obtain access to the proprietary data and operations information provided by the equipment monitoring/diagnostics computer facility. In addition, any such security system/arrangement should also provide some capability for keeping accurate records of who, what, when and how often access attempts are made to the computer facility in accordance with appropriate NERC-CIP standards.
A specific hardware-software user connectivity arrangement/environment and control process is described herein. For the particular hardware-software user connectivity management arrangement contemplated, a non-limiting illustrative exemplary implementation is disclosed that provides controlled access to proprietary computer equipment and/or facilities used for remote monitoring and diagnostics of steam turbine power generating plants/equipment. In particular, the non-limiting example hardware-software implementation described herein provides a user connectivity arrangement/environment and control process that enables both local and remote access to a specialized monitoring/diagnostic computer facility/network and the proprietary applications and data contained therein to be made secure and effectively transparent.
Although the illustrative non-limiting example implementation of the secure hardware-software user-interface connectivity arrangement described herein is generally applicable toward providing security and access control for a multitude of different types of digital computer systems and networks, the particular non-limiting implementation disclosed herein is presented by way of example for use in a computer/server implemented system configured for providing ongoing real-time monitoring services and performing expert system-based diagnostics of steam turbine generator power plant equipment and operations, and for providing secure controlled access to authorized customers/clients requiring such services.
Another aspect of the non-limiting illustrative example implementation disclosed herein includes equipping the GMS facility hardware interface ports with proprietary port connectors/plugs and requiring a matching connector/plug device to be used on all user computer/workstation equipment or user USB dongle devices for making local direct communications/connections to the GMS facility computer equipment.
The block and flow diagrams in the figures below do not necessarily represent an actual physical arrangement of the example system, but are primarily intended to illustrate major structural components in convenient functional groupings so that the non-limiting illustrative exemplary implementation presented herein may be more readily understood. The above described features and other aspects and advantages will be better and more completely understood by referring to the following detailed description of exemplary non-limiting illustrative implementations in conjunction with the drawings of which:
In
Although the GMS may provide remote monitoring and diagnostic services directly for one or more clients/customers that are operating turbine power generators and associated equipment, much of the monitoring and at least some diagnostics may be actually performed by one or more wide area networked computer/server centers located remote from the GMS. These monitoring and diagnostic (M&D) centers 190 typically provide local services for specific plants/equipment. In at least one non-limiting example implementation, conventional computer application programs known as knowledge-based expert systems are used for analyzing the sensor and other data acquired from the equipment. Conventionally, such diagnostics programs are typically “expert system-based” systems containing a multitude of situational rules generated as a result of interviewing one or more diagnostic experts relative to a specific piece of equipment. As more and more information is acquired about specific plants or equipment over a period of time, the associated diagnostics program may be easily updated and customized by adding, deleting, or modifying specific diagnostic rules.
In
Referring to GMS functional block diagram 100 of
For example, as illustrated by the nonlimiting general example illustrated in block 100 of
Referring next to
Although a particular preferred structure for such an non-standard proprietary port connector 311 and/or 312 is not explicitly disclosed or specified herein, one of ordinary skill in the art would recognize that such non-standard connector devices could be readily implemented employing a wide variety of different designs and that the choice of any one particular design over another would not affect either the operation or the implementation of the disclosed method and arrangement for providing a controlled and secure access to a proprietary computer system/facility. Moreover, virtually any such matching/mating non-standard proprietary connector/plug arrangement could be used so long as it serves its function as an electrical connector and is fabricated as a non-standard piece of equipment whose source and distribution may be securely controlled. Accordingly, applying this aspect of the disclosed method and arrangement for providing a controlled and secure access to a proprietary computer system/facility, it becomes necessary to first realize a physical connection to the GMS via use of an appropriate proprietary port connector device in addition to having the appropriate ARA software component on the user access system/device. Consequently, gaining local access to the GMS computer/facilities will be nearly impossible, or at least very difficult, unless the local user access system/device is first outfitted with the necessary mating proprietary port interface connector hardware. Requiring use of non-standard local port interface hardware security equipment thus provides an additional level of access control and security on top of the disclosed ACA-ARA software security component at least for the reason that the availability and distribution of such non-standard port interface security connectors may be carefully supervised and controlled.
Referring now to
Beginning with block 402, the authentication challenging application (ACA) software component resident on the GMS computer system/network recognizes that a request or an attempt to connect and access the GMS is being made from an unknown external system or user. For example, a user/customer computer system containing the software authentication response application (ARA) may be making an attempt to connect and log-on to the GMS facility computer system/network via, for example, a conventional WAN/LAN, Internet/Ethernet/RS-232 communications lines or a local RS-232/Ethernet/USB port connection. Next, in block 404, upon receiving such a request for access, the ACA software component in the GMS facility computer system/network is activated to send to the requesting user/customer computer information consisting of a predetermined specific access “challenge” and then to wait to receive a specific appropriate response from the same requesting user/customer computer. Although in this particular non-limiting example, the predetermined access challenge is disclosed as a specific predetermined digital code/number, the predetermined challenge and response information may be any form or type of encrypted or non-encrypted digital information and a particular implementation of the method disclosed herein is not intended to be limited to using any specific type of information or data as form of access challenge or response.
Next, in block 406, the ARA software component in the user/customer computer requesting access generates and sends a specific “response” code/number back to the GMS in response. The ARA may use a specific predetermined code/number or a particular predetermined algorithm or proprietary algorithm to generate the specific response code/number, so long as the ACA software component in the GMS is able to independently determine or duplicate the same specific response code for that particular user/customer. In block 408, after receiving a response code/number from the user/customer computer requesting access, the ACA software component in the GMS checks or verifies that the received code/number is correct and corresponds to a response code/number expected to be received from that particular user/customer. Next, as shown in diamond 410, if the received code/number is not valid, the ACA disables the communications port and terminates the connection/communication session with the access requesting party/computer as indicated in block 412. Alternatively, if the received code/number is verified as being valid, the ACA sends a second challenge message to the ARA which requires a particular second response by the ARA consisting of a series of codes/numbers which, as indicated in block 414, is preferably a predetermined sequence of codes/numbers that are known or verifiable by the ACA.
Next, as indicated in block 416, the ARA of the computer requesting access preferably responds with a sequence of code/numbers and then, as indicated in diamond 418, the ACA in the GMS checks to verify that the received sequence corresponds to a predetermined expected sequence. If the response or received sequence of code/numbers from the ARA was incorrect or not the expected response sequence, the ACA then determines whether any recent unsuccessful access attempts from the same user/computer have been made. As indicated in diamond 420, if less than three recent unsuccessful access attempts have been made by a particular user/computer, the ACA again requests the ARA in that computer to respond by sending a the appropriate series of codes/numbers. On the other hand, if more than three recent unsuccessful access attempts have been made by a particular user/computer, the ACA disables the communications port and terminates the connection/communication session with the access requesting party/computer as indicated in block 412.
Alternatively, in diamond 418, if the received sequence of code/numbers from the ARA was verifiable by the ACA as being the correct and expected sequence then, as indicated in diamond 422, the ACA determines whether the current communication with that particular user/computer is a new uninitiated communication session or part of an ongoing previously established communication session. If the ACA determines that the current communication is a new uninitiated communication session, it then proceeds to allow access and initiate the session with the requesting user/computer, as indicated in block 426. If the ACA determines that the current communication is part of a previously established ongoing communication session, it allows the session to continue for a random or predetermined time-out period, as indicated in block 424, before again sending a further request to the ARA of the connected computer to ask it to respond again by sending a another series of codes/numbers, as indicated by block 414. The ACA continues to interrogate the ARA software component of a connected user/customer computer in this fashion at the end of every time-out period until the session is terminated by the user/customer computer or the session is terminated by receiving three or more incorrect code/number sequences after a further response request as shown in blocks 420 and 412.
As described above, an implementation of the method and apparatus disclosed herein may be in the form of computer-implemented processes and apparatuses for practicing those processes. An implementation may also be practiced or embodied in the form of computer program code containing instructions embodied in tangible media, such as floppy diskettes, CD ROMs, hard drives, or any other computer-readable storage medium, wherein when the computer program code is read and executed by a computer, the computer becomes an apparatus for practicing the disclosed process or method. An implementation may also be embodied in the form of computer program code, for example, whether stored in a storage medium, loaded into and/or executed by a computer, or transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, or via electromagnetic radiation, wherein when the computer program code is read and/or executed by a computer, the computer becomes an apparatus for practicing the disclosed process or method. When implemented on a general-purpose programmable microprocessor or computer, the computer program code configures the programmable microprocessor or computer to create specific logic circuits (i.e., programmed logic circuitry).
While disclosed method and apparatus is described with reference to one or more exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalence may be substituted for elements thereof without departing from the scope of the claims. In addition, many modifications may be made to the teachings herein to adapt to a particular situation without departing from the scope thereof. Therefore, it is intended that the claims not be limited to the specific embodiments disclosed, but rather include all embodiments falling within the scope of the intended claims. Moreover, the use of the terms first, second, etc. does not denote any order of importance, but rather such terms are used solely to distinguish one claim element from another.
This written description uses various examples to disclose exemplary implementations of the invention, including the best mode, and also to enable any person skilled in the art to practice the invention, including making and using any devices or systems and performing any incorporated methods. The patentable scope of the invention is defined by the claims, and may include other examples that occur to those skilled in the art. Such other examples are intended to be within the scope of the claims if they have structural elements that do not differ from the literal language of the claims, or if they include equivalent structural elements with insubstantial differences from the literal languages of the claims.
