Remote control of secure installations

• US 9,635,037 B2
• Filed: 09/06/2012
• Issued: 04/25/2017
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Waterfall Security Solutions Ltd.
• Original Assignee: Waterfall Security Solutions Ltd.
• Inventors: Frenkel, Lior, Ginter, Andrew, Maor, Tomer
• Primary Examiner(s): Rashid, Harunur
• Assistant Examiner(s): PHAM, QUY C
• Application Number:
  US13/604,677
• Publication Number:
  US 20140068712A1
• Time in Patent Office: 1,692 Days
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Communication apparatus includes a one-way, hardware-actuated data relay, which includes a first hardware interface configured to receive a command from a communications network and a second hardware interface configured to convey the received command to a protected destination when the relay is actuated. A decoder includes a third hardware interface configured to receive a digital signature for the command from the communications network and hardware decoding logic coupled to verify the digital signature and to actuate the relay upon verifying the digital signature, whereby the command is conveyed via the second hardware interface to the protected destination.

Claims

1. Communication apparatus, comprising:

a transmission station, which comprises;

a processor running software which generates commands in a predetermined command format, responsive to input from a user;

hardware encoding logic configured to receive commands in the predetermined command format from the software running on the processor, to convert the received commands into a predefined converted data format of permitted commands including only a limited subset of the commands in the predetermined command format and to cryptographically sign the converted commands in the predefined converted data format; and

a communications processor configured to transmit the cryptographically signed converted commands over a communications network, and an uplink controller, comprising;

a first hardware interface configured to receive commands from the transmission station over the communications network;

a second hardware interface configured to convey the received commands to a protected destination;

hardware logic, which is coupled between the first and second interfaces so as to receive commands from the first interface, to authenticate that the received commands were cryptographically signed by the transmission station, to compare the received commands to a set of hardware masks corresponding to the permitted commands to check the commands are in the predefined converted data format, and to pass to the second interface only received commands that were authenticated as received from the transmission station and match one of the masks, while rejecting commands in the predetermined command format;

a first one-way link connecting the first hardware interface to the hardware logic, allowing data from the first hardware interface to the hardware logic, but incapable of carrying data from the hardware logic to the first hardware interface; and

a second one-way link separate from and independent of the hardware logic, connecting the protected destination to the communication network in a manner allowing information to flow freely out of the protected destination to the communication network, without passing through the hardware logic, wherein the one-way link is incapable of carrying data from the communication network to the protected destination,

wherein the hardware encoding logic comprises dedicated hardware logic not containing a CPU and is designed to perform a task which cannot be changed remotely,

wherein the hardware logic of the uplink controller comprises dedicated hardware logic not containing a CPU and is designed to perform a task which cannot be changed remotely,

wherein the protected destination is an industrial control system, and wherein the permitted commands are configured to control an operating configuration of the industrial control system, and

wherein the hardware encoding logic of the transmission station is configured to encrypt the commands it receives and the hardware logic of the uplink controller is configured to decrypt the received commands.

2. The apparatus according to claim 1, wherein the hardware encoding logic is contained in a user authentication unit, which is configured to authenticate an identity of a user of the transmission station before converting the commands into the predefined data format.

3. The communication apparatus according to claim 1, wherein the permitted commands of the predefined converted data format are defined by stating a name of the command and defining permitted and non-permitted values associated with the name.

4. The communication apparatus according to claim 1, wherein the permitted commands have a predefined converted data format, and wherein the protected destination is a utility control station, and wherein the apparatus comprises a monitor, which is coupled to receive the received command from the second interface and to decode the received command from the predefined converted data format to an inter-control center communications protocol for input to the utility control station.

5. The communication apparatus according to claim 4, wherein the transmission station is configured to receive an input in accordance with the inter-control center communications protocol from a command source and to encode the input in accordance with the predefined converted data format for transmission over the network to the first interface.

6. The communication apparatus according to claim 1, wherein the hardware encoding logic of the transmission station and the hardware logic of the uplink controller comprise hardware logic not driven by software.

7. A method for communication, comprising:

receiving an instruction to generate a command directed to a protected destination, from a user, by a transmission station;

generating a command in a predetermined command format, responsive to the instruction from the user, by software running on a processor;

converting the generated command into a predefined converted data format of permitted commands including only a limited subset of the commands in the predetermined command format, by hardware encoding logic containing no CPU, designed in dedicated hardware logic to perform a task which cannot be changed remotely, wherein converting the generated command into a predefined converted data format comprises encrypting the command;

cryptographically signing the converted commands in the predefined converted data format;

transmitting the cryptographically signed converted command over a communications network to an uplink controller;

receiving the converted command by the uplink controller;

transferring the received converted command to a hardware logic of the uplink controller through a first one-way link incapable of carrying data back from the hardware logic;

decrypting the received converted command by the hardware logic of the uplink controller, wherein the hardware logic of the uplink controller comprises dedicated hardware logic not containing a CPU and is designed to perform a task which cannot be changed remotely;

authenticating that the received commands were cryptographically signed by the transmission station;

comparing the received command to a set of hardware masks corresponding to the permitted commands, by the hardware logic of the uplink controller;

passing the received command to the protected destination only when the received command matches one of the hardware masks and was authenticated as received from the transmission station, while rejecting commands in the predetermined command format; and

conveying output data from the protected destination to the communications network over a second one-way link, which is separate from and independent of the hardware logic and is physically incapable of conveying input data from the communications network to the protected destination,

wherein the protected destination is an industrial control system,

wherein the permitted commands are configured to control an operating configuration of the industrial control system.

8. The method according to claim 7, wherein comparing the received command to a set of hardware masks corresponding to permitted commands comprises comparing the received command to a set of masks which have a predefined converted data format such that each permitted command in the set is defined by a name of the command and permitted values associated with the name.

9. The method according to claim 7 wherein the protected destination is a utility control station, and wherein the method comprises decoding the received command from the predefined converted data format to an inter-control center communications protocol for input to the utility control station.

10. The method according to claim 9, wherein receiving the command comprises receiving a command in accordance with the inter-control center communications protocol.