INDUSTRIAL ASSET CYBER-ATTACK DETECTION ALGORITHM VERIFICATION USING SECURE, DISTRIBUTED LEDGER

• US 20200137090A1
• Filed: 10/31/2018
• Published: 04/30/2020
• Est. Priority Date: 10/31/2018
• Status: Active Grant

• Current Assignee: GE Infrastructure Technology, LLC (General Electric Company)
• Original Assignee: General Electric Company
• Inventors: HOLZHAUER, Daniel Francis, MESTHA, Lalit, JOHN, Justin
• Granted Patent: US 11,627,151 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/009 specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A verification platform may include a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data. The verification platform may store the subset into a data store (the subset of industrial asset cyber-attack detection algorithm data being marked as invalid) and record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger. The verification platform may then receive a transaction identifier from the secure, distributed ledger and mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

Claims

1. A system to facilitate industrial asset cyber-attack detection algorithm verification, comprising:

a verification platform, including;

a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data, and

at least one verification platform computer processor coupled to the data connection and adapted to;

store the subset of industrial asset cyber-attack detection algorithm data into a data store, the subset of industrial asset cyber-attack detection algorithm data being marked as invalid,

record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger,

receive a transaction identifier from the secure, distributed ledger, and

mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

2. The system of claim 1, wherein the industrial asset cyber-attack detection algorithm data includes at least one feature-based classification boundary.

3. The system of claim 1, wherein the data connection is further to receive a stream of industrial asset data, including a subset of the industrial asset data, from industrial asset sensors, and

the verification platform computer is further adapted to:

store the subset of industrial asset data into the data store, the subset of industrial asset data being marked as invalid,

record a hash value associated with a compressed representation of the subset of industrial asset data combined with metadata in the secure, distributed ledger,

receive a transaction identifier from the secure, distributed ledger, and

mark the subset of industrial asset data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset data combined with metadata.

4. The system of claim 3, wherein the industrial asset sensors are associated with at least one of:

(i) an engine, (ii) an aircraft, (iii) a locomotive, (iv) power generation, and (v) a wind turbine.

5. The system of claim 1, further comprising:

the data store, wherein the data store is adapted to provide information marked as being valid to a consuming platform.

6. The system of claim 1, wherein the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata comprises a trie.

7. The system of claim 6, wherein the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata comprises a Patricia-Merkle trie.

8. The system of claim 1, wherein the metadata includes at least one of:

(i) a pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

9. The system of claim 1, wherein the verification platform is associated with at least one of:

(i) a single network cloud-hosted topology, (ii) a multiple network cloud-hosted topology, and (iii) a participant hosted intranet environment.

10. The system of claim 1, wherein the secure, distributed ledger comprises blockchain technology.

11. A method associated with industrial asset cyber-attack detection algorithm verification, comprising:

receiving, at a computer processor of a verification platform, a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data;

storing, by the verification platform, the subset of industrial asset cyber-attack detection algorithm data into a data store, the subset of industrial asset cyber-attack detection algorithm data being marked as invalid;

recording, by the verification platform, a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger;

receiving, at the verification platform, a transaction identifier from the secure, distributed ledger; and

marking the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify, at the verification platform, that the recorded hash value matches a hash value associated with an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

12. The method of claim 11, wherein the compressed representation of the subset of industrial data combined with metadata comprises a Patricia-Merkle trie.

13. The method of claim 11, wherein the metadata comprises at least one of:

(i) a pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

14. The method of claim 11, wherein the secure, distributed ledger comprises blockchain technology.

15. A system to facilitate industrial asset cyber-attack detection algorithm verification, comprising:

a verification client, including;

a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data, and

a verification client computer processor coupled to the data connection and adapted to;

create a Patricia-Merkle trie from the subset of the industrial asset cyber-attack detection algorithm data and metadata,

determine a hash trie value associated with the Patricia-Merkle trie,

receive a pseudo identifier from a verification engine, and

transmit raw Patricia-Merkle trie data to a verification server along with metadata,

the verification engine, including;

a verification engine computer processor adapted to;

receive the hash value from the verification client,

transmit a pseudo identifier to the verification client,

record the received hash trie value in a secure, distributed ledger,

receive a transaction identifier from the secure, distributed ledger, and

transmit the pseudo identifier and transaction identifier to the verification server, and

the verification server, including;

a verification server computer processor adapted to;

receive the subset of the industrial asset cyber-attack detection algorithm data and metadata from the verification client,

receive the pseudo identifier and transaction identifier from the verification engine,

store the subset of the industrial asset cyber-attack detection algorithm data into a data store, the subset of the industrial asset cyber-attack detection algorithm data being marked as being invalid,

independently create a Patricia-Merkle trie from the received subset of the industrial asset cyber-attack detection algorithm data and metadata,

retrieve the recorded hash value from the secure, distributed ledger, and

mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after verifying that the recorded hash value matches a hash value associated with the independently created Patricia-Merkle trie.

16. The system of claim 15, wherein the metadata includes at least one of:

(i) the pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

17. The system of claim 15, wherein the verification platform is associated with at least one of:

(i) a single network cloud-hosted topology, (ii) a multiple network cloud-hosted topology, and (iii) a participant hosted intranet environment.

18. The system of claim 15, wherein the secure, distributed ledger comprises blockchain technology.

19. The system of claim 15, further comprising:

the data store, wherein the data store is adapted to provide information marked as being valid to a consuming platform.

20. The system of claim 19, further comprising:

the consuming platform adapted to utilze information marked as being valid in the data store.