Protection of control networks using a one-way link

• US 7,649,452 B2
• Filed: 06/29/2007
• Issued: 01/19/2010
• Est. Priority Date: 06/29/2007
• Status: Active Grant

• Current Assignee: Waterfall Security Solutions Ltd.
• Original Assignee: Waterfall Solutions Ltd. (Thruvision Group Plc)
• Inventors: Frenkel, Lior, Zilberstein, Amir
• Primary Examiner(s): Tweel, Jr.; John A
• Application Number:
  US11/823,950
• Publication Number:
  US 20090002150A1
• Time in Patent Office: 935 Days
• Field of Search: 340/531, 370/487, 702/188, 709238-240, 709/245, 726/3
• US Class Current: 340/531
• CPC Class Codes: G05B 2223/06 Remote monitoring
• CPC Class Codes: G05B 23/0208 characterized by the configuration of the monitoring system
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04Q 9/00 Arrangements in telecontrol or telemetry systems for selectively calling a substation from a main station, in which substation desired apparatus is selected for applying a control signal thereto or for obtaining measured values therefrom

Abstract

A method for monitoring a process includes receiving a signal from a sensor that is indicative of a physical attribute associated with the process and transmitting data indicative of the received signal over a one-way link. The transmitted data received from the one way link are used in monitoring the process.

Claims

1. A method for monitoring a process, comprising:

receiving a signal from a sensor that is indicative of a physical attribute associated with the process;

transmitting data indicative of the received signal over a one-way link; and

receiving and processing the transmitted data from the one way link in order to monitor the process.

2. The method according to claim 1, and comprising outputting a report indicative of the monitored process.

3. The method according to claim 1, wherein transmitting the data comprises sending the data from a facility in which the process occurs over the one-way link to a location at which the process is monitored, which is remote from the facility.

4. The method according to claim 1, wherein receiving the signal comprises collecting signals from a plurality of sensors at a transmit proxy, which transmits the data corresponding to the collected signals over the one-way link.

5. The method according to claim 4, wherein receiving the transmitted data comprises mirroring the data corresponding to the collected signals at a receive proxy, and providing the mirrored data to a computer for the processing.

6. The method according to claim 5, wherein collecting the signals comprises communicating between the transmit proxy and the sensors using a predetermined monitoring protocol, and wherein providing the mirrored data comprises emulating the monitoring protocol at the receive proxy in communication with the computer.

7. The method according to claim 1, wherein receiving the signal comprises collecting the signal from the sensor over a local network in a facility, wherein the local network has an exit for transmission of the data via the one-way link but has no entrance from outside the facility.

8. The method according to claim 6, wherein processing the transmitted data comprises generating an instruction to adjust the process, and comprising transmitting the instruction to an operator of the process over an auxiliary link that is not connected to the local network.

9. Apparatus for monitoring a process, comprising:

a plurality of sensors, which are configured to generate respective signals that are indicative of physical attributes associated with the process;

a one-way link; and

a transmission controller, which is coupled to receive the signals from the sensors and to transmit data indicative of the signals over the one-way link.

10. The apparatus according to claim 9, and comprising a computer, which is coupled to receive and process the transmitted data from the one-way link so as to monitor the process.

11. The apparatus according to claim 10, and comprising a local network connecting the sensors with the transmission controller, wherein the local network, sensors and transmission controller are located in a facility, and wherein the one-way link serves as an exit from the local network for transmission of the data to the computer outside the facility, but the local network has no entrance from outside the facility.

12. The apparatus according to claim 11, wherein the computer is configured to generate an instruction to adjust the process, and comprising an auxiliary link that is not connected to the local network for transmission of the instruction to an operator in the facility.

13. The apparatus according to claim 9, wherein the one-way link is configured to connect a facility in which the sensors are deployed with a location at which the process is monitored, which is remote from the facility.

14. The apparatus according to claim 9, wherein the transmission controller comprises a transmit proxy, which is configured to hold the data that is indicative of the signals received from the sensor, and wherein the apparatus comprises a receive proxy, which is coupled to receive the data transmitted over the one-way link and is configured to mirror the data held by the transmit proxy so as to provide the mirrored data to a computer for processing.

15. The apparatus according to claim 14, wherein the transmit proxy is configured to communicate with the sensors using a predetermined monitoring protocol, and wherein the receive proxy is configured to emulate the monitoring protocol in communication with the computer.

16. Apparatus for monitoring a process, comprising:

a one-way link;

a transmit proxy, which is configured to collect data indicative of physical attributes associated with the process from a plurality of sensors, and to transmit the collected data over the one-way link; and

a receive proxy, which is coupled to the one-way link so as to receive and mirror the data collected by the transmit proxy so as to provide the mirrored data to a computer for processing.

17. The apparatus according to claim 16, wherein the transmit proxy is configured to communicate with the sensors using a predetermined monitoring protocol, and wherein the receive proxy is configured to emulate the monitoring protocol in communication with the computer.

18. The apparatus according to claim 16, wherein the one-way link is configured to connect a facility in which the sensors are deployed with a location at which the process is monitored, which is remote from the facility.

19. Apparatus for communication in a facility, the apparatus comprising:

a local network, which is configured to communicate with a plurality of data sources that are deployed in the facility, so as to collect data from the data sources; and

a one-way link, for conveying the collected data out of the local network to a computer outside the facility,

wherein the one-way link serves as an exit from the local network for transmission of the collected data to the computer, but the local network has no entrance from outside the facility.

20. The apparatus according to claim 19, and comprising:

a transmit proxy, which is coupled between the local network and the one-way link so as to hold and transmit the collected data over the one-way link; and

a receive proxy, which is coupled to receive the data transmitted over the one-way link and is configured to mirror the data held by the transmit proxy so as to provide the mirrored data to the computer for processing.

21. The apparatus according to claim 19, wherein the data sources comprise sensors, which are configured to generate respective signals that are indicative of physical attributes associated with a process carried out in the facility.

22. The apparatus according to claim 19, and comprising an auxiliary link that is not connected to the local network for transmission of an instruction from the computer to an operator within the facility.