FIELD DEVICE HAVING TAMPER ATTEMPT REPORTING

• US 20140101771A1
• Filed: 10/10/2012
• Published: 04/10/2014
• Est. Priority Date: 10/10/2012
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: TANDON, VIBHOR, PANE, JOSEPH
• Granted Patent: US 8,984,641 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2135 Metering

Abstract

A method of tamper attempt reporting includes receiving a write attempt to configuration data stored within a field device in an industrial plant configured to run a process involving a plurality of physical process parameters including a network server, a plurality of processing units, and a plurality of field devices. The plurality of field devices include (i) a sensor for measuring at least one of the plurality of physical process parameters or (ii) an instrument for performing control output actions for at least one of the plurality of processing units. The plurality of field devices are in communication with at least one remote host system or device. The write attempt is automatically detected. An alert of the write attempt is automatically sent to at least the remote host system or device.

Claims

1. A method of tamper attempt reporting, comprising:

receiving a write attempt to configuration data stored within a field device in an industrial plant configured to run a process involving a plurality of physical process parameters including a network server, a plurality of processing units, and a plurality of said field devices, said plurality of field devices including (i) a sensor for measuring at least one of said plurality of physical process parameters or (ii) an instrument for performing control output actions for at least one of said plurality of processing units, said plurality of field devices each being in communication with at least one remote host system or device;

said field device automatically detecting said write attempt, and

said field device automatically sending an alert of said write attempt to at least said remote host system or device.

2. The method of claim 1, wherein said remote host system or device includes said network server.

3. The method of claim 1, wherein said plurality of field devices further include a write protect hardware jumper, and wherein said write attempt includes both attempts to bypass write protection software protecting said configuration data and movement of said write protect hardware jumper.

4. The method of claim 1, further comprising incrementing a counter for each said write attempt, and delaying said automatically sending said alert until said counter reaches a predetermined number>

1, wherein said predetermined number is at least one of programmable and user configurable.

5. The method of claim 1, wherein said automatically sending said alert persists for a predetermined time, and wherein said predetermined time is at least one of programmable and user configurable.

6. The method of claim 1, wherein said plurality of field devices further include a memory and wherein an Automatic Tamper Attempt Reporting (ATAR) algorithm having executable code for said automatically detecting said write attempt and said automatically sending said alert is stored in said memory.

7. The method of claim 6, wherein said method further includes enabling and disabling of said ATAR algorithm.

8. The method of claim 7, wherein said disabling of said ATAR algorithm results in said automatically sending said alert.

9. The method of claim 1, wherein a local alert of said write attempt is indicated on said plurality of field devices by at least one of an audio signal and a visual signal.

10. A field device, comprising:

(i) a sensor for measuring at least one of a plurality of physical process parameters associated with a process involving said plurality of physical process parameters run by an industrial plant having a plurality of processing units configured to run said process, or (ii) an instrument for performing control output actions for said plurality of processing units, wherein said field device is in communication with at least one remote host system or device;

a memory for storing configuration data and an Automatic Tamper Attempt Reporting (ATAR) algorithm;

a processor operatively coupled to said sensor or said instrument, and to said memory to implement said ATAR;

a transceiver coupled to said processor for enabling communications over a network used by said industrial plant, and

wherein said ATAR algorithm has executable code for;

automatically detecting a write attempt to said configuration data, and

automatically sending an alert of said write attempt to at least said remote host system or device.

11. The field device of claim 10, wherein said field device includes a write protect hardware jumper, and wherein said write attempt includes both attempts to bypass write protection software protecting said configuration data and movement of said write protect hardware jumper.

12. The field device of claim 10, wherein said ATAR algorithm has executable code for incrementing a counter for each said write attempt, and delaying said automatically sending said alert until said counter reaches a predetermined number>

1, wherein said predetermined number is at least one of programmable and user configurable.

13. The field device of claim 10, wherein said automatically sending said alert persists for a predetermined time, and wherein said predetermined time is at least one of programmable and user configurable.

14. The field device of claim 10, wherein said ATAR algorithm is programmable for enabling and disabling.

15. The field device of claim 14, wherein said disabling of said ATAR algorithm results in said automatically sending said alert.

18. The machine readable storage of claim 15, further comprising code for incrementing a counter for each said write attempt, and delaying said automatically sending said alert until said counter reaches a predetermined number>

1, wherein said predetermined number is at least one of programmable and user configurable.

16. Machine readable storage for tamper attempt reporting at industrial plants, comprising:

a non-transitory machine readable storage media having code stored therein for implementing a tamper attempt tracking/reporting (ATAR) algorithm at a field device, said code including;

code for said field device automatically detecting a received write attempt to configuration data stored within a field device in an industrial plant configured to run a process involving a plurality of physical process parameters including a network server, a plurality of processing units, and a plurality of said field devices, said plurality of field devices including (i) a sensor for measuring at least one of said plurality of physical process parameters or (ii) an instrument for performing control output actions for at least one of said plurality of processing units, said plurality of field devices each being in communication with at least one remote host system or device, and

code for said field device automatically sending an alert of said write attempt to at least said remote host system or device.

17. The machine readable storage of claim 16, wherein said plurality of field devices include a write protect hardware jumper, and wherein said write attempt includes both attempts to bypass write protection software protecting said configuration data and movement of said write protect hardware jumper.

19. The machine readable storage of claim 16, wherein said automatically sending said alert persists for a predetermined time, and wherein said predetermined time is at least one of programmable and user configurable.

20. The machine readable storage of claim 16, further comprising code for enabling and disabling of said ATAR algorithm.

21. The machine readable storage of claim 20, wherein said disabling of said ATAR algorithm results in said automatically sending said alert.