Systems and methods for controlling file execution for industrial control systems

• US 8,964,973 B2
• Filed: 04/30/2012
• Issued: 02/24/2015
• Est. Priority Date: 04/30/2012
• Status: Active Grant

• Current Assignee: GE Infrastructure Technology, LLC (General Electric Company)
• Original Assignee: General Electric Company
• Inventors: Chong, Justin Brandon, Socky, David Richard, Sahoo, Manas Ranjan
• Primary Examiner(s): BROWN, ANTHONY D
• Application Number:
  US13/460,801
• Publication Number:
  US 20130287208A1
• Time in Patent Office: 1,030 Days
• Field of Search: 380/44, 726 22- 25
• US Class Current: 380/44
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A system includes a build system processor configured to generate a private encryption key and configured to add the private encryption key to at least one of a plurality of source files. Each of the plurality of source files includes instructions configured to be executed by an industrial controller processor. The processor is also configured to generate a plurality of binary files from the plurality of source files. The processor is further configured to construct a whitelist file including first hash key values determined for the plurality of binary files and configured to encrypt the whitelist file using the private key to provide an encrypted whitelist file.

Claims

1. A system, comprising:

a build system processor configured to;

generate a private encryption key;

embed the private encryption key in at least one of a plurality of source files, wherein each of the plurality of source files comprises instructions configured to be executed by an industrial controller processor of an industrial controller;

generate a plurality of binary files from the plurality of source files, wherein at least one of the plurality of binary files includes the private encryption key;

construct a whitelist file comprising a plurality of hash key values respectively determined for the plurality of binary files; and

encrypt the whitelist file using the private key to provide an encrypted whitelist file.

2. The system of claim 1, wherein the build system processor is configured to provide the plurality of binary files and the encrypted whitelist file to the industrial controller.

3. The system of claim 1, comprising the industrial controller having the industrial controller processor configured to:

execute a binary startup executable file of the plurality of binary files acquired from the build system processor to determine the private encryption key;

decrypt the encrypted whitelist file using the determined private encryption key to provide the whitelist file;

determine a particular hash key value for a particular binary file of the plurality of binary files, wherein the particular binary file is attempting execution; and

allow the particular binary file to execute when the particular hash key value matches one of the plurality of hash key values located in the whitelist file.

4. The system of claim 3, wherein the industrial controller processor is configured to download the plurality of binary files and the encrypted whitelist file from the build system processor via a network connection or from a data storage medium.

5. The system of claim 3, wherein the industrial controller processor is configured to block the particular binary file from executing on the industrial controller when the particular hash key value determined for the particular binary file does not match one of the plurality of hash key values located in the whitelist file.

6. The system of claim 1, wherein the whitelist file has an extensible markup language (XML) format.

7. The system of claim 1, wherein the industrial controller is configured to control an industrial system comprising a gasification system, a gas treatment system, a turbine system, a power generation system, a heat recovery steam generation (HRSG) system, or a combination thereof.

19. The system of claim 1, wherein the build system processor is configured to package the encrypted whitelist file and the plurality of binary files together in a package before the package is provided to the industrial controller.

20. The system of claim 19, wherein the build system processor is configured to compress the package before the package is provided to the industrial controller.

8. A method, comprising:

generating a plurality of executable files from a plurality of source files, wherein the plurality of executable files comprise instructions to be executed by an industrial controller, and wherein the plurality of executable files include a private key that is embedded in at least one of the plurality of source files;

determining a respective hash key value for each of the plurality of executable files;

generating a whitelist file comprising the hash key values for each of the plurality of executable files; and

encrypting the whitelist file using the private key to provide an encrypted whitelist file.

9. The method of claim 8, comprising packaging the plurality of executable files together with the encrypted whitelist file to provide a package.

10. The method of claim 9, comprising encrypting the package before providing the package to the industrial controller.

11. The method of claim 8, comprising:

receiving the encrypted whitelist file and the plurality of executable files at the industrial controller;

execute one of the plurality of executable files received to determine the private encryption key;

decrypting the received encrypted whitelist file using the private key to provide the whitelist file;

determining a particular hash key value for a particular executable file of the plurality of executable files; and

allowing the particular executable file to execute on the industrial controller when the particular hash key value determined for the particular executable matches one of the hash key values in the whitelist file.

12. The method of claim 11, comprising:

blocking the particular executable file from executing on the industrial controller when the particular hash key value determined for the particular executable does not match one of the hash key values in the decrypted whitelist file; and

logging information relating to the particular executable file blocked from executing on the industrial controller.

13. The method of claim 8, wherein the industrial controller comprises an industrial controller of a gasification system, a gas treatment system, a turbine system, a power generation system, a heat recovery steam generation (HRSG) system, or a combination thereof.

14. A tangible, non-transitory, computer-readable medium comprising instructions configured to be executed by a processor of an industrial controller, the instructions comprising:

instructions to determine an encryption key value via execution of a first binary file of a plurality of binary files, wherein the first binary file was generated from a source file having the encryption key value embedded within;

instructions to use the determined encryption key value to decrypt a whitelist file, wherein the whitelist file comprises a plurality of whitelisted hash key values that respectively correspond to the plurality of binary files;

instructions to determine a hash key value for a second binary file of the plurality of binary files; and

instructions to block execution of the second binary file when the determined hash key value is not located among the plurality of whitelisted hash key values.

15. The medium of claim 14, wherein the instructions comprise instructions to log information relating to the particular binary file blocked from executing on the industrial controller.

16. The medium of claim 14, wherein the instructions comprise instructions to allow execution of the second binary file when the determined hash key value is located among the plurality of whitelisted hash key values.

17. The medium of claim 14, wherein the instructions comprise instructions to determine the hash key value for the particular binary file using a Cyclic Redundancy Check (CRC) hash function, a Message-Digest Algorithm (MD) hash function, or a Secure Hash Algorithm (SHA) hash function.

18. The medium of claim 14, wherein the instructions comprise instructions to unpackage a package generated by a build system processor, wherein the package comprises the plurality of binary files and the whitelist file.