System for Analyzing an Industrial Control Network

• US 20160127207A1
• Filed: 01/08/2016
• Published: 05/05/2016
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Zaccaria, Joseph M., Spangler, Raymond A., Kausalik, Evan J., Medina, Javier, Hermans, Matthew A.
• Granted Patent: US 10,116,488 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/0659 by isolating or reconfiguring faulty entities
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 61/4541 Directories for service discovery

Abstract

A system may be provided in which an industrial control network may be discovered and characterized such that useful networking data may be presented to a user and/or monitored for events. By configuring an interrogator device to send a “generic” message to ranges of network locations, presences of devices at particular locations may be determined. The generic message may direct any of numerous devices types to provide a response including multiple parameters. The interrogator may store such parameters in “data records,” and may advantageously send periodic collections of data records, or “data sets,” to a processing manager. The processing manager, in turn, may communicate with one or more data structures to format, enrich and/or monitor the networking data to more conveniently and reliably capture and maintain networks and connected devices.

Claims

1. A system for analyzing an industrial control network comprising:

an interrogator having a network interface configured to communicate with a plurality of device types, the interrogator being operable to send a message readable by each of the plurality of device types, the message being configured to direct a device to provide a response including a plurality of parameters, the interrogator being further operable to send the message to a plurality of network locations to determine presence of a device; and

a processing manager in communication with the interrogator, the processing manager executing a program stored in a non-transient medium operable to;

(a) receive a plurality of data records from the interrogator, each data record including a plurality of parameters for a device providing a response, the plurality of data records forming a data set; and

(b) format the data set by populating a plurality of predetermined fields for each data record, the plurality of predetermined fields including a first field indicating a parameter for a device of a data record and a second field indicating a network location for the device of the data record.

2. The system of claim 1, further comprising the processing manager being operable to graphically display the predetermined fields.

3. The system of claim 1, wherein the parameter indicated by the first field is a serial number for the device, and the network location indicated by the second field is an Internet Protocol (IP) address for the device.

4. The system of claim 1, further comprising a data structure relating a plurality of predetermined values to the plurality of device types, wherein the processing manager is further operable to communicate with the data structure to identify a device type and a related predetermined value according to a parameter for a device of a data record.

5. The system of claim 4, wherein the plurality of predetermined fields include a third field, and further comprising the processing manager being operable to format the data set by populating the third field indicating the related predetermined value for the device.

6. The system of claim 1, further comprising the processing manager being operable to monitor the data set for a predetermined condition.

7. The system of claim 1, wherein the response provides a Common Industrial Protocol (CIP) identity object, and the plurality of parameters are attributes of the CIP identity object.

8. The system of claim 1, wherein the processing manager communicates with the interrogator through a defined port in a firewall.

9. The system of claim 8, wherein the processing manager communicates with the interrogator at a higher level of communication than the interrogator communicates with a device.

10. The system of claim 1, wherein the interrogator includes a transaction manager operable to send the data set to the processing manager, and wherein the transaction manager assigns a unique identifier to the data set.

11. The system of claim 10, wherein the interrogator periodically generates new data sets, and wherein the transaction manager sends new data sets to the processing manager with unique identifiers.

12. The system of claim 1, wherein the interrogator sends the message to a second device at a second network location by communicating the message through a first device at a first network location.

13. The system of claim 1, wherein the first device is a gateway or a router, and the second device is at least one of:

a processor, a drive, a network card, and an I/O module.

14. A method for analyzing an industrial control network including an interrogator having a network interface configured to communicate with a plurality of device types, the interrogator being operable to send a message readable by each of the plurality of device types, the message being configured to direct a device to provide a response including a plurality of parameters, the interrogator being further operable to send the message to a plurality of network locations to determine presence of a device, and a processing manager in communication with the interrogator, the method comprising:

(a) receiving a plurality of data records from the interrogator, each data record including a plurality of parameters for a device providing a response, the plurality of data records forming a data set; and

(b) formatting the data set by populating a plurality of predetermined fields for each data record, the plurality of predetermined fields including a first field indicating a parameter for a device of a data record and a second field indicating a network location for the device of the data record.

15. The method of claim 14, further comprising graphically displaying the predetermined fields.

16. The method of claim 14, further comprising communicating with a data structure relating a plurality of predetermined values to the plurality of device types to identify a device type and a related predetermined value according to a parameter for a device of a data record.

17. The method of claim 16, wherein the plurality of predetermined fields include a third field, and further comprising formatting the data set by populating a third field indicating the related predetermined value for the device.

18. The method of claim 14, further comprising monitoring the data set for a predetermined condition.

19. The method of claim 14, wherein the interrogator includes a transaction manager operable to send the data set to the processing manager, and further comprising the interrogator periodically generating a new data set, and the transaction manager sending each new data set to the processing manager with a unique identifier.

20. The method of claim 14, further comprising the interrogator sending the message through a first device at a first network location in order to send the message to a second device at a second network location.