Watermarking for data integrity

• US 10,277,396 B2
• Filed: 06/16/2016
• Issued: 04/30/2019
• Est. Priority Date: 06/16/2016
• Status: Active Grant

• Current Assignee: GE Digital Holdings LLC (GE Aerospace)
• Original Assignee: General Electric Company
• Inventors: Ramos, Luis, Sivasubramanian, Venkatesh, Yelisetti, Sriramakrishna
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US15/184,739
• Publication Number:
  US 20170366356A1
• Time in Patent Office: 1,048 Days
• Field of Search: 713176
• CPC Class Codes: H04L 2209/608 Watermarking
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Methods, systems, and apparatus for ensuring data integrity are disclosed. A data container structure is obtained, the data container structure containing data and a source identifier of a first hardware component. The data container structure is modified, using a header processing device, to include a component signature and an identifier of a second hardware component.

Claims

1. A method comprising:

receiving, at an intermediate hardware component, a data container structure comprising a payload including time-series data acquired by a source hardware component from an operation performed by an industrial asset, and a header that includes a source identifier of the source hardware component that uniquely identifies the source hardware component, and an asset identifier that uniquely identifies the industrial asset;

generating, by the intermediate hardware component, a hash of the payload including the time-series data acquired from the operation performed by the industrial asset;

watermarking, by the intermediate hardware component, the data container structure by inserting a signature of the intermediate hardware component based on the hash of the payload generated by the intermediate hardware component, and an identifier of the intermediate hardware component that uniquely identifies the intermediate hardware component into the header, wherein the asset identifier, the source identifier, and the identifier of the intermediate hardware component combine to provide an indication of an Industrial Internet of Things (IIoT) network path traveled by the data container structure; and

transmitting, at the intermediate hardware component, the modified data container structure to a next hardware component within the IIoT network.

2. The method of claim 1, wherein the data container structure further includes a source signature based on the data and a source key.

3. The method of claim 1, further comprising modifying the data container structure to include a timestamp generated by the intermediate hardware component.

4. The method of claim 1, further comprising modifying the data in the data container structure.

5. The method of claim 4, wherein the inserted signature is based on the modified data and a component key.

6. The method of claim 1, wherein the inserted signature is based on a component key and the data contained in the data container structure.

7. The method of claim 1, further comprising:

obtaining an identification of an expected path of the data container structure through the IIoT network, the expected path being defined by one or more component identifiers;

parsing a header of the data container structure to extract a list of one or more component identifiers;

comparing the list of one or more component identifiers and the expected path of the data container structure; and

issuing a notification based on a result of the comparison.

20. The method of claim 1, wherein the source hardware component comprises a sensor which senses time series data generated by operation of the industrial asset, the source identifier comprises a unique identifier of the sensor within the IIoT network, and the asset identifier comprises a unique identifier of the industrial asset within the IIoT network.

8. An apparatus comprising:

a processor;

memory to store instructions that, when executed by the processor cause the processor to perform operations comprising;

receiving, at an intermediate hardware component, a data container structure comprising a payload including time-series data acquired by a source hardware component from an operation performed by an industrial asset, and a header that includes a source identifier of the source hardware component that uniquely identifies the source hardware component, and an asset identifier that uniquely identifies the industrial asset;

generating, by the intermediate hardware component, a hash of the payload including the time-series data acquired from the operation performed by the industrial asset;

watermarking, by the intermediate hardware component, the data container structure by inserting a signature of the intermediate hardware component based on the hash of the payload generated by the intermediate hardware component, and an identifier of the intermediate hardware component that uniquely identifies the intermediate hardware component into the header, wherein the asset identifier, the source identifier, and the identifier of the intermediate hardware component combine to provide an indication of an Industrial Internet of Things (IIoT) network path traveled by the data container structure; and

transmitting, at the intermediate hardware component, the modified data container structure to a next hardware component within the IIoT network.

9. The apparatus of claim 8, wherein the data container structure further includes a source signature based on the data and a source key.

10. The apparatus of claim 8, wherein the operations further comprise modifying the data container structure to include a timestamp generated by the intermediate hardware component.

11. The apparatus of claim 8, wherein the operations further comprise modifying the data in the data container structure.

12. The apparatus of claim 11, wherein the inserted signature is based on the modified data and a component key.

13. The apparatus of claim 8, wherein the inserted signature is based on a component key and the data contained in the obtained data container structure.

14. A non-transitory machine-readable storage medium comprising instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

receiving, at an intermediate hardware component, a data container structure comprising a payload including time-series data acquired by a source hardware component from an operation performed by an industrial asset, and a header that includes a source identifier of the source hardware component that uniquely identifies the source hardware component, and an asset identifier that uniquely identifies the industrial asset;

generating, by the intermediate hardware component, a hash of the payload including the time-series data acquired from the operation performed by the industrial asset;

watermarking, by the intermediate hardware component, the data container structure by inserting a signature of the intermediate hardware component based on the hash of the payload generated by the intermediate hardware component, and an identifier of the intermediate hardware component that uniquely identifies the intermediate hardware component into the header, wherein the asset identifier, the source identifier, and the identifier of the intermediate hardware component combine to provide an indication of an Industrial Internet of Things (IIoT) network path traveled by the data container structure; and

transmitting, at the intermediate hardware component, the modified data container structure to a next hardware component within the IIoT network.

15. The non-transitory machine-readable storage medium of claim 14, wherein the data container structure further includes a source signature based on the data and a source key.

16. The non-transitory machine-readable storage medium of claim 14, wherein the operations further comprise modifying the data container structure to include a timestamp generated by the intermediate hardware component.

17. The non-transitory machine-readable storage medium of claim 14, wherein the operations further comprise modifying the data in the data container structure.

18. The non-transitory machine-readable storage medium of claim 17, wherein the inserted signature is based on the modified data and a component key.

19. The non-transitory machine-readable storage medium of claim 14, wherein the inserted signature is based on a component key and the data contained in the obtained data container structure.