Process control methods and apparatus for intrusion detection, protection and network hardening

• US 20060053491A1
• Filed: 03/11/2005
• Published: 03/09/2006
• Est. Priority Date: 03/01/2004
• Status: Active Grant

• Current Assignee: Schneider Electric Systems USA, Inc. (Schneider Electric SE)
• Original Assignee: Invensys Systems Incorporated (Invensys PLC)
• Inventors: Simpson, George, Khuti, Bharat, Rath, David, Rakaczky, Ernest, Leslie, Jim, Peralta, Juan, Coleman, Clayton
• Granted Patent: US 7,614,083 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

The invention provides an improved network and methods of operation thereof for use in or with process control systems, computer-based manufacturing or production control systems, environmental control systems, industrial control system, and the like (collectively, “control systems”). Those networks utilize a unique combination of firewalls, intrusion detection systems, intrusion protection devices and/or other devices for hardening (e.g., security against hacking, intrusion or other mischievous conduct) and/or intrusion detection. The networks and methods have application, by way of example, in plants, sites and other facilities in which networks that support control systems interface with corporate, business or other networks.

Claims

1. A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “

control systems”

), the digital data network comprising;

A. network media that supports digital data communications,

B. an intrusion system that is coupled to the network media and that monitors traffic thereon utilizing signature-based detection in order to identify traffic that is potentially adverse to the control system control or devices therefor in communications coupling with the network media,

C. the intrusion system utilizing one or more signatures specific to a control network (hereinafter, “

control signatures”

) and blocking traffic on the network media matching at least a selected control signature;

2. The digital data network of claim 1, wherein

one more control signatures are indicative of traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media, and wherein

the intrusion system blocks traffic matching that signature.

3. The digital data network of claim 2, wherein one or more control signatures are indicative of one or more of the following:

an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;

traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;

traffic other than from MAC addresses falling within a selected range; and

wherein the intrusion system blocks traffic matching that signature;

4. The digital data network of claim 1, wherein one or more control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of

a password “

gnomes”

;

a username “

fox” and

a password “

gnomes”

; and

wherein the intrusion system blocks traffic matching that signature.

5. The digital data network of claim 1, wherein one or more control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of

a username “

hstorian”

, wherein that username is a misspelled formative of “

historian”

;

a username “

Administrator”

with password “

password”

;

a username “

bpm”

;

a username “

pam”

; and

wherein

the intrusion system blocks traffic matching that signature.

6. The digital data network of claim 1, wherein one or more control signatures are indicative of an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the intrusion system blocks traffic matching that signature.

7. The digital data network of claim 6, wherein one or more control signatures are indicative of an attempt to access, via any of the ftp and the tftp protocol, any of the following:

a password file named “

sam”

on a digital data device executing a Windows operating system;

a password file named “

passwd”

on a digital data device executing a Unix operating system;

a password file named dmpasswd_cfg on a digital data device comprising a display manager; and

wherein

wherein the intrusion system blocks traffic matching that signature.

8. The digital data network of claim 1, wherein the one or more control signatures are indicative of packets with a data payload bearing one or more selected commands.

9. The digital data network of claim 8, wherein the one or more control signatures are indicative of packets with a data payload bearing any of a “

setpars” and

“

omset”

command.

10. A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “

control systems”

), the digital data network comprising;

A. network media that supports digital data communications,

B. an intrusion system that is coupled to the network media and that monitors traffic thereon utilizing signature-based detection in order to identify traffic that is potentially adverse to the control system control or devices therefor in communications coupling with the network media,

C. the intrusion system utilizing one or more signatures specific to a control network (hereinafter, “

control signatures”

) and blocking traffic on the network media matching at least a selected control signature,

D. wherein the control signatures are indicative of the following;

traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media;

an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;

traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;

traffic other than from MAC addresses within a selected range;

an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of

a password “

gnomes”

;

a username “

fox” and

a password “

gnomes”

;

an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of

a username “

hstorian”

, wherein that username is a misspelled formative of “

historian”

;

a username “

Administrator”

with password “

password”

;

a username “

bpm”

;

a username “

pam”

;

an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the intrusion system blocks traffic matching that signature.

11. A method of operating a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “

control systems”

), the method comprising;

A. transmitting digital data traffic on digital data network media,

B. monitoring that traffic with an intrusion system that is coupled to the network media and that utilizes signature-based detection in order to identify traffic that is potentially adverse to the control system control or devices therefor in communications coupling with the network media,

C. blocking, with the intrusion system, traffic on the network media matching at least a selected signature specific to a control network (hereinafter, “

control signature”

).

12. The method of claim 11, wherein

one more more control signatures are indicative of traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media, and wherein

the blocking step includes blocking traffic matching that signature.

13. The method of claim 12, wherein one or more control signatures are indicative of one or more of the following:

an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;

traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;

traffic other than from MAC addresses falling within a selected range; and

wherein

the blocking step includes blocking traffic matching that signature;

14. The method of claim 11, wherein one or more control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of

a password “

gnomes”

;

a usemame “

fox” and

a password “

gnomes”

; and

wherein

the blocking step includes blocking traffic matching that signature.

15. The method of claim 11, wherein one or more control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of

a username “

hstorian”

, wherein that username is a misspelled formative of “

historian”

;

a username “

Administrator”

with password “

password”

;

a username “

bpm”

;

a username “

pam”

; and

wherein

the blocking step includes blocking traffic matching that signature.

16. The method of claim 11, wherein one or more control signatures are indicative of an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the blocking step includes blocking traffic matching that signature.

17. The method of claim 16, wherein one or more control signatures are indicative of an attempt to access, via any of the ftp and the tftp protocol, any of the following:

a password file named “

sam”

on a digital data device executing a Windows operating system;

a password file named “

passwd”

on a digital data device executing a Unix operating system;

a password file named dmpasswd_cfg on a digital data device comprising a display manager; and

wherein

wherein the blocking step includes blocking traffic matching that signature.

18. The method of claim 11, wherein the one or more control signatures are indicative of packets with a data payload bearing one or more selected commands.

19. The method of claim 18, wherein the one or more control signatures are indicative of packets with a data payload bearing any of a “

setpars” and

“

omset”

command.

20. A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “

control systems”

), the digital data network comprising;

A. network media that is coupled to control devices to support digital data communications therewith,

B. an intrusion system that monitors traffic on the network media utilizing signature-based detection in order to identify traffic that is potentially adverse to the control devices or control system,

C. the intrusion system utilizing one or more signatures specific to a control network (hereinafter, “

control signatures”

) and blocking traffic on the network media matching at least a selected control signature,

D. wherein the control signatures are indicative of the following;

traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media;

an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;

an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;

traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;

traffic other than from MAC addresses within a selected range;

an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of

a password “

gnomes”

;

a username “

fox” and

a password “

gnomes”

;

an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of

a username “

hstorian”

, wherein that username is a misspelled formative of “

historian”

;

a username “

Administrator”

with password “

password”

;

a username “

bpm”

;

a username “

pam”

;

an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the blocking step includes blocking traffic matching that signature.

21. A method of hardening a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “

control systems”

), the method comprising;

A. selectively deactivating any of an operating system service and other service on one or more digital data processors on the digital data network;

B. backing up the one or more digital data processors to preserve at least current system status;

C. testing, following deactivation, to determine whether such deactivation affects normal and/or expected operation of any of the control system, the digital data network and the one or more digital data processors;

D. responding to testing revealing that the deactivation resulted in any of abnormal and unexpected operation by re-activiating the deactivated service, and repeating steps (A)-(C) with other services;

E. following deactivation of services believed non-essential to said normal and/or expected operation, testing any of said digital data network and said one or more digital data processors for any of hacking, intrusion and mischievous action (collectively, “

penetration”

);

F. responding to testing revealing that such penetration occurs by repeating steps (A)-(D) with additional services.

22. The method of claim 21, wherein the backing up step includes performing an incremental backup.

23. The method of claim 21, wherein the deactivating step includes deactivating a plurality of services.