APPARATUS AND METHOD SUPPORTING WIRELESS ACCESS TO MULTIPLE SECURITY LAYERS IN AN INDUSTRIAL CONTROL AND AUTOMATION SYSTEM OR OTHER SYSTEM

• US 20090086692A1
• Filed: 09/05/2008
• Published: 04/02/2009
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Chen, Yu-Gene T.
• Granted Patent: US 8,413,227 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

A method includes receiving a message at a first wireless node. The first wireless node is associated with a first wired network, and the first wired network is associated with a first security layer. The method also includes transmitting the message over the first wired network when at least one destination of the message is located in the first security layer. The method further includes wirelessly transmitting the message for delivery to a second wireless node when at least one destination of the message is located in a second security layer. The second wireless node is associated with a second wired network, and the second wired network is associated with the second security layer. The first and second security layers may be associated with different security paradigms and/or different security domains. Also, the message could be associated with destinations in the first and second security layers.

Claims

1. A method comprising:

receiving a message at a first wireless node, the first wireless node associated with a first wired network, the first wired network associated with a first security layer;

transmitting the message over the first wired network when at least one destination of the message is located in the first security layer; and

wirelessly transmitting the message for delivery to a second wireless node when at least one destination of the message is located in a second security layer, the second wireless node associated with a second wired network, the second wired network associated with the second security layer.

2. The method of claim 1, wherein at least one of:

the first and second security layers are associated with different security paradigms; and

the first and second security layers are associated with different security domains.

3. The method of claim 1, wherein the message is associated with at least one destination located in the first security layer and at least one destination located in the second security layer.

4. The method of claim 1, further comprising:

using a tag in the message to identify one or more security layers associated with the message;

wherein the transmitting and wirelessly transmitting are based on the one or more identified security layers.

5. The method of claim 1, further comprising:

using contents of the message to identify one or more security layers associated with the message;

wherein the transmitting and wirelessly transmitting are based on the one or more identified security layers.

6. The method of claim 5, wherein using the contents of the message to identify the one or more security layers comprises:

determining that the message is associated with a lower security layer in a process control network when the message comprises process variable data; and

determining that the message is associated with a higher security layer in a business network when the message comprises diagnostic data.

8. The method of claim 1, further comprising:

determining whether to filter the message; and

discarding the message if the message is to be filtered;

wherein wirelessly transmitting the message comprises wirelessly transmitting the message if the message is not to be filtered.

9. The method of claim 8, wherein determining whether to filter the message comprises blocking one or more specified types of messages.

10. The method of claim 9, wherein:

the first wired network comprises a redundant pair of wired networks; and

the one or more specified types of messages comprise heartbeat traffic associated with the redundant pair of wired networks.

11. The method of claim 8, wherein:

the first and second wired networks are coupled by a wired router; and

determining whether to filter the message comprises filtering the message to avoid creation of a network loop.

12. An apparatus comprising:

a wired network interface configured to communicate over a first wired network, the first wired network associated with a first security layer;

a wireless network interface configured to communicate over a wireless network; and

a controller configured to;

determine whether a message received through one of the network interfaces has at least one destination located in the first security layer;

initiate transmission of the message by the wired network interface over the first wired network when at least one destination is located in the first security layer; and

initiate transmission of the message by the wireless network interface over the wireless network when at least one destination of the message is located in a second security layer.

13. The apparatus of claim 12, wherein the wireless network interface is configured to transmit the message to a second apparatus associated with a second wired network, the second wired network associated with the second security layer.

14. The apparatus of claim 12, wherein the controller is configured to determine whether the message has at least one destination located in the first security layer using at least one of:

a tag in the message, the at least one destination of the message, and contents of the message.

15. The apparatus of claim 12, wherein the controller is further configured to:

determine whether to filter the message; and

discard the message if the message is to be filtered;

wherein the controller is configured to initiate transmission of the message by the wireless network interface if the message is not to be filtered.

16. The apparatus of claim 12, wherein:

the wired network interface comprises two Ethernet interfaces configured to communicate over a redundant pair of wired Ethernet networks; and

the wireless network interface comprises multiple wireless transceivers, each of the wireless transceivers configured to communicate with different types of wireless devices.

17. A system comprising:

multiple security layers, the security layers associated with multiple wired networks; and

multiple gateway nodes, each gateway node coupled to one of the wired networks and associated with one of the security layers, wherein each of the gateway nodes is configured to;

receive a message;

transmit the message over its associated wired network when at least one destination of the message is located in its associated security layer; and

wirelessly transmit the message for delivery to another of the wireless nodes when at least one destination of the message is located in a different one of the security layers.

7. The method of claim 17 wherein wirelessly transmitting the message for delivery to the second wireless node comprises one of:

wirelessly transmitting the message directly to the second wireless node; and

wirelessly transmitting the message indirectly to the second wireless node through one or more intermediate wireless nodes.

18. The system of claim 17, wherein at least one of:

at least some of the security layers are associated with different security paradigms; and

at least some of the security layers are associated with different security domains.

19. The system of claim 17, further comprising:

wireless leaf nodes configured to provide the messages to the gateway nodes.

20. The system of claim 19, wherein:

at least one of the gateway nodes and the leaf nodes is configured to identify one or more security layers associated with each message; and

the gateway nodes are configured to route the messages based on the one or more identified security layers for each message.

21. The system of claim 17, wherein at least two of the gateway nodes are coupled to a common one of the wired networks and are configured to be active at a common time.

22. A computer readable medium embodying a computer program, the computer program comprising:

computer readable program code for receiving a message at a first wireless node, the first wireless node associated with a first wired network, the first wired network associated with a first security layer;

computer readable program code for initiating transmission of the message over the first wired network when at least one destination of the message is located in the first security layer; and

computer readable program code for initiating wireless transmission of the message for delivery to a second wireless node when at least one destination of the message is located in a second security layer, the second wireless node associated with a second wired network, the second wired network associated with the second security layer.