Process control methods and apparatus for intrusion detection, protection and network hardening

• US 20060294579A1
• Filed: 03/01/2005
• Published: 12/28/2006
• Est. Priority Date: 03/01/2004
• Status: Active Grant

• Current Assignee: Schneider Electric Systems USA, Inc. (Schneider Electric SE)
• Original Assignee: Invensys Systems Incorporated (Invensys PLC)
• Inventors: Rahaczky, Ernest, Simpson, George, Khuti, Bharat, Rath, David, Leslie, Jim, Peralta, Juan, Coleman, Clayton
• Granted Patent: US 7,761,923 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

The invention provides an improved network and methods of operation thereof for use in or with process control systems, computer-based manufacturing or production control systems, environmental control systems, industrial control system, and the like (collectively, “control systems”). Those networks utilize a unique combination of firewalls, intrusion detection systems, intrusion protection devices and/or other devices for hardening (e.g., security against hacking, intrusion or other mischievous conduct) and/or intrusion detection. The networks and methods have application, by way of example, in plants, sites and other facilities in which networks that support control systems interface with corporate, business or other networks.

Claims

1. A digital data network for use with process control systems, computer-based manufacturing/production control systems, environmental control systems, and/or industrial control system (collectively, “

control systems”

), the digital data network comprising;

A. a plurality of digital data devices,

B. network media that is coupled to digital data devices to support communications therewith,

C. the digital data network comprising a first zone and a second zone, each zone including one or more of the digital data devices and the network media that is coupled thereto, the first zone comprising digital data devices executing business applications, the second zone comprising devices that monitor and control a control system,

D. the network media of the first zone being coupled for at least selected communications to an external network by a first firewall, and

E. the network media of the second zone being coupled for selected communications to the first zone by a second firewall and any of an intrusion protection system and an intrusion detection system.

2. The digital data network of claim 1, wherein one or more of the digital data devices of the second zone comprise control devices.

3. The digital data network of claim 2, wherein one or more of the control devices being any of (i) coupled to any of actuators and sensors for the control system and (ii) comprising any of actuators and sensors for the control system.

4. The digital data network of claim 3, wherein the external network comprises a public network

5. The digital data network of claim 3, wherein the external network comprises an Internet.

6. The digital data network of claim 5, wherein one or more digital data devices of the first zone execute any of an Internet browser and a messaging application.

7. The digital data network of claim 1, comprising a third zone including one or more control devices coupled for communication with one or more digital data devices of the second zone.

8. The digital data network of claim 7, wherein one or more of the control devices are coupled to any of actuators and sensors that make up at least a portion of the control system and/or a system controlled thereby.

9. The digital data network of claim 7, wherein the one or more control devices of the third zone that are coupled to the one or more digital data devices of the second zone via any of media and devices supporting a control network protocol.

10. The digital data network of claim 9, wherein the control network protocol comprises any of a FieldBus protocol, a ProfiBus protocol, a ModBus protocol, a Nodebus protocol, and an OPC protocol.

11. The digital data network of claim 9, comprising any of a control station and a interface providing communications coupling between one or more control devices of the third zone and one or more digital data devices of the second zone.

12. The digital data network of claim 10, wherein the network media of the first and second zones include any of local area networks and wide area networks.

13. A digital data network for use with process control systems, computer-based manufacturing/production control systems, environmental control systems, and/or industrial control system (collectively, “

control systems”

), the digital data network comprising;

A. a first network zone comprising one or more digital data processors that are coupled for communications via network media and that execute applications to provide any of a monitoring and control interface to control devices of the control system,

B. a second network zone comprising one or more digital data processors that are coupled for communication via network media and that execute any of business, engineering and scientific applications and functions (collectively, “

business applications”

) connected with a manufacturing, environmental control, industrial or other operation in which control systems are employed,

C. a third network zone comprising one or more digital data processors that are coupled for communication via network media and that execute business applications,

D. the network media of the third network zone being coupled to a public network by a first firewall and any of a first intrusion protection system and a first intrusion detection system,

E. the network media of the second network zone being coupled to the network media of the third network zone by a second firewall,

F. the network media of the first network zone being coupled to the network media of the second network zone by a firewall and any of a second intrusion protection system and a second intrusion detection system.

14. The digital data network of claim 13, a field I/O network zone comprising one or more of said control devices, the control devices being any of (i) coupled to any of actuators and sensors for the control system and (ii) comprising any of actuators and sensors for the control system.

15. The digital data network of claim 14, wherein one or more control devices of the field I/O network zone are coupled to the one or more digital data processors of the first network zone via any of media and devices supporting a control network protocol.

16. The digital data network of claim 15, wherein the control network protocol comprises any of a FieldBus protocol, a ProfiBus protocol, a ModBus protocol, a Nodebus protocol, and an OPC protocol.

17. The digital data network of claim 16, comprising any of a control station and a interface providing communications coupling between one or more control devices of the field I/O zone and one or more digital data devices of the first network zone.

18. The digital data network of claim 13, wherein the network media of each of the first business network zone and the second business network zone comprise any of a local area network (LAN) and a wide area network (WAN).

19. The digital data network of claim 13, wherein any of the first intrusion detection system, first intrusion protection system, second intrusion detection system, and second intrusion protection system utilize signature-based detection.

20. The digital data network of claim 19, wherein the signatures used by any of the second intrusion detection system and second intrusion prevention system are specific to control networks.

21. The digital data network of claim 20, wherein the signatures used by any of the first intrusion detection system and first intrusion prevention system employ signatures that are not specific to business networks.

22. A method of operating a digital data network for use with process control systems, computer-based manufacturing/production control systems, environmental control systems, and/or industrial control system (collectively, “

control systems”

), the method comprising;

A. executing business applications on or more digital data processors that are interconnected in a first zone on the network,

B. controlling the control system with one or more digital data processors that are interconnected in a second zone on the network,

C. filtering with a first firewall digital data traffic between an external network and the first zone,

D. filtering with a second firewall digital data traffic between the first zone and the second zone, and

E. monitoring with any of an intrusion detection system and an intrusion detection system digital data traffic traveling between the first zone and the second zone.

23. The method of claim 22, comprising signaling an alert when traffic monitored in step (E) is indicative of an intrusion.

24. The method of claim 22, comprising blocking traffic identified in step (E) as an intrusion.

25. The method of claim 22, wherein one or more of the digital data devices of the second zone comprise control devices.

26. The method of claim 22, wherein one or more of the control devices being any of (i) coupled to any of actuators and sensors for the control system and (ii) comprising any of actuators and sensors for the control system.

27. The method of claim 22, comprising executing any of an Internet browser and a messaging application with a digital data device in the first zone.

28. The method of claim 22, communicating between one or more of the digital data devices in the second zone and one or more control devices in a third zone of the network.

29. The method of claim 28, wherein one or more of the control devices are coupled to any of actuators and sensors that comprise and/or form at least a part of a system being controlled.

30. The method of claim 28, comprising communicating between the one or more control devices of the third zone and the one or more digital data devices of the second zone via any of media and devices supporting a control network protocol.

31. The method of claim 30, wherein the control network protocol comprises any of a FieldBus protocol, a ProfiBus protocol, a ModBus protocol, a Nodebus protocol, and an OPC protocol.