System and methodology providing automation security analysis, validation, and learning in an industrial controller environment

• US 8,909,926 B2
• Filed: 09/12/2003
• Issued: 12/09/2014
• Est. Priority Date: 10/21/2002
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Brandt, David D., Hall, Kenwood, Anderson, Mark Burton, Anderson, Craig D., Collins, George Bradford
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US10/661,696
• Publication Number:
  US 20040117624A1
• Time in Patent Office: 4,106 Days
• Field of Search: 713/166
• US Class Current: 713/166
• CPC Class Codes: G05B 15/02 electric
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

The present invention relates to a system and methodology facilitating automation security in a networked-based industrial controller environment. Various components, systems and methodologies are provided to facilitate varying levels of automation security in accordance with security analysis tools, security validation tools and/or security learning systems. The security analysis tool receives abstract factory models or descriptions for input and generates an output that can include security guidelines, components, topologies, procedures, rules, policies, and the like for deployment in an automation security network. The validation tools are operative in the automation security network, wherein the tools perform security checking and/or auditing functions, for example, to determine if security components are in place and/or in suitable working order. The security learning system monitors/learns network traffic patterns during a learning phase, fires alarms or events based upon detected deviations from the learned patterns, and/or causes other automated actions to occur.

Claims

1. A security analysis tool, comprising:

a processor; and

a memory communicatively coupled to the processor and having stored thereon computer-executable components configured to implement the security analysis tool, the computer-executable components comprising;

a learning component that monitors communication of data associated with an I/O table of an industrial controller of an automation system during a training period and generates a learned pattern of communication, wherein the I/O table stores input data received by the industrial controller from a controlled device via an I/O device and output data provided by the industrial controller to the controlled device via the I/O device; and

an analyzer component that monitors data traffic subsequent to the training period and generates one or more security outputs in response to a determination that a current pattern of the data traffic deviates from the learned pattern in excess of an acceptable deviation, the one or more security outputs comprising at least one output that alters the data traffic between the industrial controller and the I/O device.

2. The security analysis tool of claim 1, wherein the computer-executable components further comprising an interface component that generates a description of one or more industrial controllers in the automation system.

3. The security analysis tool of claim 2, wherein at least one of the interface component or the analyzer component operate on a computer and receive one or more factory inputs that provide the description, and wherein the one or more factory inputs comprise at least one of user input, a model input, a schema, a formula, an equation, a file, a map, or a code.

4. The security analysis tool of claim 3, wherein the one or more factory inputs are processed by the analyzer component to generate the one or more security outputs, the security outputs comprising at least one of a manual, a document, a schema, an executable, a code, a file, an e-mail, a recommendation, a topology, a configuration, an application procedure, a parameter, a policy, a rule, a user procedure, or a user practice employed to facilitate a security measure in the automation system.

5. The security analysis tool of claim 2, wherein the interface component is configured to render a display output having associated display objects and receive at least one input to facilitate operations with the analyzer component, and wherein the interface component is associated with at least one of an engine, an application, an editor tool, a web browser, or a web service.

6. The security analysis tool of claim 5, wherein the display objects comprise at least one of a configurable icon, a button, a slider, an input box, a selection option, a menu, or a tab, and the display objects are associated with multiple configurable dimensions, shapes, colors, text, data, and sounds.

7. The security analysis tool of claim 5, wherein the at least one input comprises a user command from at least one of a mouse, a keyboard, speech input, a web site, a remote web service, a camera, or video input analyzer component.

8. The security analysis tool of claim 2, wherein the description comprises a model of one or more industrial automation assets to be protected and one or more associated network pathways to access the one or more industrial automation assets.

9. The security analysis tool of claim 2, wherein the description comprises at least one of risk data or cost data that is employed by the analyzer component to determine a security measure.

10. The security analysis tool of claim 1, further comprising a validation component that periodically monitors the industrial controller following deployment of the one or more security outputs to determine one or more vulnerabilities related to the industrial controller.

11. The security analysis tool of claim 10, wherein the validation component automatically installs one or more security components in response to the one or more vulnerabilities.

12. The security analysis tool of claim 1, wherein the analyzer component is adapted for partitioned security specification entry and sign-off from one or more groups.

13. The security analysis tool of claim 1, wherein the analyzer component further performs an automated action that disables network requests from at least one outside network in response to detecting that the current pattern of the data traffic deviates from the learned pattern in excess of the acceptable deviation.

14. The security analysis tool of claim 1, wherein the one or more security outputs alter the data traffic between the industrial controller and the I/O device to restore the learned pattern.

15. A method for analyzing security in an industrial automation system, comprising:

monitoring, by a system comprising at least one processor, communication of data associated with an I/O table of an industrial controller for a predetermined training period to learn at least one learned pattern of communication, wherein the I/O table stores input data received by the controller from a controlled device via an I/O device and output data sent by the controller to the controlled device via the I/O device;

defining, by the system, a pattern threshold specifying an acceptable deviation from the at least one learned pattern;

monitoring, by the system, data traffic subsequent to the training period; and

performing, by the system, at least one automated security event in response to a determination that a current pattern of the data traffic deviates from the at least one learned pattern in excess of the acceptable deviation after the training period,

wherein the performing the at least one automated security event comprises at least altering a network traffic pattern between the industrial controller and the I/O device.

16. The method of claim 15, further comprising:

receiving at least one model related to the industrial controllers;

generating one or more security outputs based on the at least one model; and

automatically installing one or more security components based at least in part on the one or more security outputs.

17. The method of claim 16, wherein the generating the one or more security outputs comprises generating at least one of a recommendation of a security component, a code, a parameter, a setting, a related interconnection topology, a connection configuration, an application procedure, a security, policy, a rule, a user procedure, or a user practice.

18. The method of claim 16, further comprising:

automatically deploying the one or more security outputs to the industrial controller, wherein the one or more security outputs are configured to mitigate at least one of unauthorized network access or a network attack.

19. The method of claim 15, wherein the at least one automated security event includes at least disabling network attempts to access the industrial controller.

20. The method of claim 15, wherein the monitoring the communication of the data comprises at least one of monitoring a number of network requests to or from the industrial controller over a time frame or monitoring a type of request to or from the industrial controller during the training period.

21. A non-transitory computer-readable storage medium having stored thereon computer-executable components that, in response to execution, cause a system comprising at least one processor to perform operations, comprising:

monitoring communication of data associated with an I/O table of an industrial controller for a predetermined training period, wherein the I/O table stores input data received by the industrial controller from a controlled device via an I/O device and output data sent by the industrial controller to the controlled device via the I/O device;

learning a learned pattern of communication based on the monitoring;

defining a pattern threshold that specifies an acceptable deviation from the learned pattern;

automatically detecting that a current pattern of communication of the data associated with the I/O table deviates from the learned pattern in excess of the acceptable deviation after the training period; and

performing an automated action that alters the current pattern of communication in response to the detecting.

22. A security validation system for use in an industrial automation environment, comprising:

a processor; and

a memory communicatively coupled to the processor and having stored thereon computer-executable components configured to implement the security validation system, the computer-executable components comprising;

a learning component that monitors communication of data associated with an I/O table with respect to an industrial controller during a training period and establishes a learned pattern of communication, wherein the I/O table comprises a portion of a memory of the industrial controller that maintains input data received by the industrial controller from a controlled device via an I/O device and output data provided by the industrial controller to the controlled device via the I/O device; and

an analyzer component that monitors a current pattern of communication of the data associated with the I/O table subsequent to the training period and automatically performs a security action to bring the current pattern in line with the learned pattern in response to detecting that the current pattern communication has deviated from the learned pattern of communication in excess of a defined pattern threshold.

23. The security validation system of claim 22, wherein the computer-executable components further comprise:

a scanner component that automatically interrogates at least one of the industrial controller, the I/O device, or the controlled device at periodic intervals for security-related data;

a validation component that automatically assesses a security capability of the at least one of the industrial controller, the I/O device, or the controlled device based upon a comparison of the security-related data and one or more predetermined security guidelines; and

a security analysis tool that recommends at least one network interconnection to achieve a specified security goal indicated by the predetermined security guidelines.

24. The security validation system of claim 23, wherein the security guidelines are automatically determined.

25. The security validation system of claim 23, wherein the scanner component and the validation component are at least one of a host-based component or a network-based component.

26. The security validation system of claim 25, wherein the host-based component performs vulnerability scanning and auditing on one or more devices, and the network-based component performs vulnerability scanning and auditing on one or more networks.

27. The security validation system of claim 26, wherein at least one of the host-based component or the network-based component at least one of non-destructively maps a topology of information technology and industrial automation devices, verifies a revision or a configuration, verifies a user attribute, or verifies an access control list.

28. The security validation system of claim 26, wherein at least one of the host-based component or the network-based component at least one of determines susceptibility to a network-based attack, searches for an open Transmission Control Protocol/User Datagram Protocol (TCP/UDP) port, scans for a vulnerable network service, gains identity information about an end device determined to be attempting unauthorized entry, or performs vulnerability scanning and auditing on at least one of a firewall, a router, a security device, or a factory protocol.

29. The security validation system of claim 22, wherein the security action comprises at least one of automatically correcting a security event, automatically adjusting a security parameter, altering a network traffic pattern, adding a security component, removing a security component, triggering an alarm, automatically sending a notification to an entity regarding a detected problem, generating an error file or a log file, generating a schema, generating re-configuration data to re-configure or re-route a network connection, updating a database, or updating a remote site.

30. A method for validating security in an industrial automation environment, comprising:

monitoring communication of data associated with an I/O table with respect to an industrial controller during a training period and establishing a learned pattern of communication, wherein the I/O table stores input data received by the industrial controller from a controlled device via an I/O device and output data sent by the industrial controller to the controlled device via the I/O device;

defining a pattern threshold specifying an allowable deviation from the learned pattern;

monitoring a current pattern of communication of the data associated with the I/O table subsequent to the training period; and

initiating a security procedure that performs a security action to bring the current pattern in line with the learned pattern in response to determining that the monitoring identifies that the current pattern deviates from the learned pattern in excess of the allowable deviation.