Automation network and method for monitoring the security of the transfer of data packets

• US 10,320,747 B2
• Filed: 07/21/2016
• Issued: 06/11/2019
• Est. Priority Date: 07/22/2015
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Palmin, Anna
• Primary Examiner(s): Goodchild, William J.
• Application Number:
  US15/216,394
• Publication Number:
  US 20170026341A1
• Time in Patent Office: 1,055 Days
• Field of Search: None
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

An automation network for monitoring the security of a transfer of data packets includes a first processing device configured to transfer a data packet from an installation component and to the installation component, and a second data processing device which is bidirectionally connected to the first data processing device. The second data processing device generates at least one response packet, when detecting a transmission of the data packet from the first data processing device, and sends the at least one response packet back to the first data processing device. The first data processing device includes a response filter which is configured to execute a check and subsequent rejection/acceptance of the at least one response packet.

Claims

1. An industrial automation network for monitoring the security of a transfer of data packets, comprising:

a first processing device configured to transfer a data packet from an plant component and to the plant component; and

a second data processing device bidirectionally connected to the first data processing device, said second data processing device configured to generate at least one response packet, when detecting a transmission of the data packet from the first data processing device, and to send the at least one response packet back to the first data processing device;

said first data processing device including a response filter which is configured to execute a check and subsequent rejection/acceptance of the at least one response packet;

wherein the industrial automation network is a network selected from a control automation installation network, a production automation installation network, a manufacturing automation installation, and any combination thereof; and

wherein the plant component comprise at least one input and/or output facility which can detect process parameters and/or can output corresponding actuating signals.

2. The automation network of claim 1, wherein the second data processing device comprises a server.

3. The automation network of claim 2, wherein the server is a Syslog server or a Syslog-ng server or a Rsyslog server, or any combination thereof.

4. The automation network of claim 2, wherein the server is a SIEM server.

5. The automation network of claim 1, wherein the first data processing device comprises a TCP-based client.

6. The automation network of claim 5, wherein the TCP-based client comprises a protocol stack, said response filter being provided in the protocol stack.

7. The automation network of claim 1, wherein the response packets comprise at least one of synchronization packets, finish packets, acknowledgment packets, or any combination thereof.

8. The automation network of claim 1, wherein the data packets are security events.

9. The automation network of claim 1, further comprising a service device configured to output a warning signal, when a response packet is rejected.

10. The automation network of claim 1, further comprising a firewall configured to check the data packets at least in the first data processing device.

17. The automation network of claim 1, wherein the plant component is selected from a programmable logic controller (PLC) device, an actuator, or a measuring transducer device.

11. A method for monitoring the security of a transfer of data packets in an industrial automation network, having first and second data processing devices which are bidirectionally connected to one another, the method comprising:

at the first data processing device, communicating of a data packet from a plant component and to the plant component;

at the second data processing device, generating at least one response packet, when detecting a transmission of the data packet from the first data processing device, and sending the at least one response packet back to the first data processing device; and

at the first data processing device, checking and subsequently accepting or rejecting response packets by a response filter;

wherein the Industrial automation network is a network selected from a control automation installation network, production automation installation network, a production automation installation, a manufacturing automation installation, and any combination thereof; and

,

wherein the plant component comprise at least one input and/or output facility which can detect process parameters and/or can output corresponding actuating signals.

12. The method of claim 11, wherein the response filter is constantly active.

13. The method of claim 11, further comprising generating a warning signal for display on a service device in response to a rejection of a response packet.

14. The method of claim 11, wherein responsive to rejection of a response packet, the confirmation of the receipt of the response packet from the first data processing device to the second data processing device is omitted.

15. The method of claim 11, wherein the second data processing device communicates with the first data processing device via a server, the server being at least one of a Syslog server, a Syslog-ng server, a Rsyslog server, a SIEM server, or any combination thereof.

16. The method of claim 11, wherein the first data processing device communicates with the second data processing device via transmission control protocol (TCP).

18. The method of claim 11, wherein the plant component is selected from a programmable logic controller (PLC) device, an actuator, or a measuring transducer device.