Process installation network intrusion detection and prevention

• US 9,270,642 B2
• Filed: 10/13/2011
• Issued: 02/23/2016
• Est. Priority Date: 10/13/2011
• Status: Active Grant

• Current Assignee: Rosemount Incorporated (Emerson Electric Company)
• Original Assignee: Rosemount Incorporated (Emerson Electric Company)
• Inventors: Rotvold, Eric D., Potter, Jeff D.
• Primary Examiner(s): Khajuria, Shripal
• Assistant Examiner(s): Choudhury, Faisal
• Application Number:
  US13/272,394
• Publication Number:
  US 20130094500A1
• Time in Patent Office: 1,594 Days
• Field of Search: 370/389
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A process communication device includes a process communication interface for communicating on a process communication loop in accordance with a process communication protocol. A controller is coupled to the process communication interface. A rules store is coupled to the controller, and has at least one process communication packet rule that is based on the process communication protocol. The controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule.

Claims

1. A process communication device comprising:

a process communication interface configured to communicate with at least one field device on a process communication loop in accordance with a process communication protocol;

a controller coupled to the process communication interface;

a rules store coupled to the controller, the rules store having at least one process communication packet rule that is based on the process communication protocol

a device description store coupled to the controller, the device description store having at least one device description related to a process variable measured by the at least one field device and wherein the at least one field device is described by the at least one device description stored in the device description store; and

wherein the controller applies the at least one process communication packet rule and the at least one device description to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails the at least one process communication packet rule or if the at least one communication packet is not in accordance with the at least one device description for the at least one field device; and

a network interface coupled to the controller, wherein the controller is configured to forward the process communication packet through the network interface if the process communication packet passes all process communication packet rules.

2. The process communication device of claim 1, wherein the process communication protocol is the HART®

(Highway Addressable Remote Transducer) protocol.

3. The process communication device of claim 1, wherein the protocol imposes a digital signal on a 4-20 mA analog current signal.

4. The process communication device of claim 1, wherein the process communication interface is a wired process communication interface.

5. The process communication device of claim 1, wherein the process communication interface is a wireless process communication interface.

6. The process communication device of claim 5, wherein the process communication interface is also a wired process communication interface.

7. The process communication device of claim 1, wherein the controller is configured to decrypt the at least one process communication packet before applying the at least one process communication packet rule.

8. The process communication device of claim 7, wherein the process communication device is embodied within a process communication gateway.

9. The process communication device of claim 1, wherein at least one process communication packet rule relates an allowable number of packet bytes to a process communication protocol command contained in the packet.

10. The process communication device of claim 1, wherein the at least one process communication packet rule includes an allowable command range.

11. The process communication device of claim 1, wherein the process communication device is embodied within an access point.

12. A method of providing process communication protection, the method comprising;

obtaining at least one process communication packet sent from a field device in accordance with a process communication protocol;

applying at least one rule against the process communication packet, wherein the at least one rule is based on the process communication protocol;

applying at least a second rule against the process communication packet, wherein the at least a second rule is based upon a device description for the field device related to a process variable measured by the at least one field device; and

determining an event based on whether the at least one process communication packet passed each of the at least one rule and at least a second rule; and

selectively forwarding the at least one process communication packet based on whether the at least one process communication packet passed each of the at least one rule.

13. The method of claim 12, and further comprising logging the event.

14. A process communication device comprising:

a process communication interface configured to communicate with at least one process device on a process communication loop in accordance with a process communication protocol;

a controller coupled to the process communication interface;

a device description store coupled to the controller, the device description store having at least one process communication packet rule that is based on a device description related to a process variable measured by the at least one field device for the at least one process device; and

wherein the controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule; and

a network interface coupled to the controller, wherein the controller is configured to forward the process communication packet through the network interface if the process communication packet passes all process communication packet rules.

15. A method of providing process communication protection, the method comprising;

obtaining at least one process communication packet in accordance with a process communication protocol, wherein the at least one process communication packet carries communication to or from at least one field device;

retrieving a device description from a device description store in a process communication security device which describes the at least one field device related to a process variable measured by the at least one field device;

applying at least one rule against the process communication packet, wherein the at least one rule is based the retrieved device description;

determining an event based on whether the at least one process communication packet passed each of the at least one rule; and

selectively forwarding the at least one process communication packet based on whether the at least one process communication packet passed each of the at least one rule.

16. The method of claim 15, and further comprising logging the event.