METHODS AND APPARATUS FOR PREVENTING NETWORK INTRUSION

• US 20120198541A1
• Filed: 02/02/2011
• Published: 08/02/2012
• Est. Priority Date: 02/02/2011
• Status: Abandoned Application

• Current Assignee: Randall E. Reeves
• Original Assignee: Randall E. Reeves
• Inventors: Reeves, Randall E.
• Application Number:
  US13/019,618
• Publication Number:
  US 20120198541A1
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

In one configuration, a non-volatile memory is provided having computer readable instructions configured to instruct a computer or controller to run a setup wizard to obtain setup and filtering module configuration rules from a user; reload the computer or controller with the settings obtained by the setup wizard; configure filtering module rules including rules for an industrial protocol filter; and filter received and/or transmitted packets in accordance with the filtering module rules. The configuration may also include instructions to further parse and analyze packets containing industrial protocols to determine whether to allow or deny ingress and/or egress of such packets.

Claims

1. A non-volatile memory having computer readable instructions configured to instruct a computer or controller to:

run a setup wizard to obtain setup and filtering module configuration rules from a user;

reload the computer or controller with the settings obtained by the setup wizard;

configure filtering module rules including rules for an industrial protocol filter; and

filter received packets in accordance with the filtering module rules.

2. A memory in accordance with claim 1 wherein to filter received packets in accordance with the filtering module rules further comprises said computer readable instructions including instructions to:

receive a packet at an interface;

drop the packet when either;

the packet is not part of an existing permitted filtering module connection and the packet is not allowed by the configured filtering module rules, or

the packet is an industrial protocol filter connection, and the connection does not match a “

pass”

rule of the industrial protocol rules.

3. A memory in accordance with claim 2 further having computer readable instructions configured to instruct the computer or controller to analyze objects embedded in industrial protocol filter connections to determine whether or not to drop the packet.

4. A memory in accordance with claim 3 further having computer readable instructions to instruct the computer or controller to request instructions from the user relating to whether or not to selectively log packets and to instruct the computer or controller to selectively log packets in accordance with the instructions obtained from the user.

5. A memory in accordance with claim 4 further having computer readable instructions to instruct the computer or controller to reserve a user-selectable amount of computer or controller memory for at least one of a ruleset of filtering module rules, a ruleset of industrial protocol filter rules, or both.

6. A memory in accordance with claim 2 further having computer readable instructions to instruct the computer or controller to request instructions from the user relating to whether or not to selectively log packets and to instruct the computer or controller to selectively log packets in accordance with the instructions obtained from the user.

7. A memory in accordance with claim 6 further having computer readable instructions to instruct the computer or controller to reserve a user-selectable amount of computer or controller memory for at least one of a ruleset of filtering module rules, a ruleset of industrial protocol filter rules, or both.

8. A method of operating an industrial plant that includes a plurality of industrial controllers on a local area network (LAN), said method comprising:

providing an anti-intrusion and security apparatus (AISA) having two or more Ethernet ports, at least a first of which is configured to communicate through a wide area network (WAN), and the other of which is configured to communicate with the LAN;

electrically connecting the first Ethernet port to the WAN and the other Ethernet port to the LAN;

utilizing the AISA to filter packets of data received for ingress at the first Ethernet port in accordance with one or more rules; and

utilizing the AISA to filter packets of data received for egress at the other Ethernet port in accordance with a one or more rules;

wherein said at least one of filtering packets of data received for ingress, filtering packets of data received for egress, or both, further comprise utilizing the AISA to analyze objects embedded in industrial protocol filter connections to determine whether or not to drop the packet.

9. A method in accordance with claim 8 further comprising:

utilizing the AISA to run a setup wizard to obtain setup and filtering module configuration rules from a user;

utilizing the AISA to reload the computer or controller with the settings obtained by the setup wizard;

configuring filtering module rules in the AISA, including rules for an industrial protocol filter; and

utilizing the AISA to filter received packets in accordance with the filtering module rules.

10. A method in accordance with claim 9 wherein to filter received packets in accordance with the filtering module rules further comprises utilizing the AISA to:

receive a packet at an interface, wherein the interface is either the LAN or the WAN port;

drop the packet when either;

the packet is not part of an existing permitted filtering module connection and the packet is not allowed by the configured filtering module rules, or

the packet is an industrial protocol filter connection, and the connection does not match a “

pass”

rule of the industrial protocol rules.

11. A method in accordance with claim 10 wherein the AISA is further utilized to request instructions from the user relating to whether or not to selectively log packets and to selectively log packets in accordance with the instructions obtained from the user.

12. A method in accordance with claim 10 further comprising instructing the AISA to reserve a user-selectable amount of computer or controller memory for at least one of a ruleset of filtering module rules, a ruleset of industrial protocol filter rules, or both.

13. A method in accordance with claim 8 wherein the AISA is further utilized to request instructions from the user relating to whether or not to selectively log packets and to selectively log packets in accordance with the instructions obtained from the user.

14. An anti-intrusion and security apparatus (AISA) comprising:

a microprocessor or controller (hereinafter, “

microprocessor”

);

memory communicatively associated with the microprocessor;

one or more filtering modules, not necessarily separate from the memory and the microprocessor;

at least one WAN port interface and a LAN port interface having communication therebetween controlled by the filtering module;

the AISA configured to;

run a setup wizard to obtain setup and filtering module configuration rules from a user;

reload the memory with the settings obtained by the setup wizard;

configure filtering module rules in the memory including rules for an industrial protocol filter; and

filter received packets for communication ingress and egress in accordance with the filtering module rules.

15. An apparatus in accordance with claim 14 wherein said apparatus being configured to filter received packets in accordance with the filtering module rules further comprises the AISA configured to:

receive a packet at least one interface;

drop the received packet when either;

the received packet is not part of an existing permitted filtering module connection and the received packet is not allowed by the configured filtering module rules, or

the received packet is an industrial protocol filter connection, and the connection does not match a “

pass”

rule of the industrial protocol rules.

16. An apparatus in accordance with claim 15 further configured to analyze objects embedded in industrial protocol filter connections to determine whether or not to drop the packet.

17. An apparatus in accordance with claim 16 further configured to request instructions from the user relating to whether or not to selectively log packets and to instruct the computer or controller to selectively log packets in accordance with the instructions obtained from the user.

18. An apparatus in accordance with claim 17 further configured to reserve a user-selectable amount of the memory for at least one of a ruleset of filtering module rules, a ruleset of industrial protocol filter rules, or both.

19. An apparatus in accordance with claim 15 further configured to request instructions from the user relating to whether or not to selectively log packets and to instruct the computer or controller to selectively log packets in accordance with the instructions obtained from the user.

20. An apparatus in accordance with claim 19 further configured to reserve a user-selectable amount of the memory for at least one of a ruleset of filtering module rules, a ruleset of industrial protocol filter rules, or both.