MAC address management method of MES system

Abstract

The invention relates to the technical field of industrial control system safety, in particular to an MAC address management method of an MES system. Comprising the following steps: receiving contextual data related to a manufacturing process from a manufacturing execution system in real time, such as a work order state, an equipment operation mode, a bill of materials and operator allocation; the method comprises the following steps of: finding equipment connected to an OT network and a corresponding MAC (Media Access Control) address in a mode of passively monitoring and actively querying a network switch; in a central data storage library, the found MAC address is associated with context data obtained from an MES, and a dynamic identity portrait with rich situations is established for each device; dynamically generating a network access strategy with timeliness and a minimum permission principle for the equipment on the basis of the association relationship; finally, an instruction is sent to the network switch to enforce the policy. According to the method, the network security policy is bound with the actual production plan, so that the security of the industrial network is remarkably improved on the premise of ensuring the production continuity.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control system security, and in particular to a MAC address management method for an MES system. Background Art

[0002] In modern manufacturing, MES is responsible for real-time scheduling and allocation of production resources (including equipment, personnel, and materials), tracking the status of work-in-progress, monitoring quality parameters during production, and recording the complete product lineage for traceability. Therefore, the MES database contains authoritative, highly accurate, real-time information about factory operations, such as which equipment is executing which work order, the scheduled start and end times, the current operator, and whether the equipment is in production, standby, or maintenance.

[0003] This gives MES capabilities that surpass traditional network security systems. Traditional network security devices (such as firewalls or switches) only see basic information such as the source / destination IP and MAC addresses in network traffic, but lack the contextual information associated with that traffic. However, this information is stored in the MES, enabling the system to not only understand the existence of a network request but also determine whether that request complies with the currently approved production plan. For example, a traditional switch only sees packets originating from a single MAC address, while the MES can interpret this information as, "This is the MAC address of the PLC belonging to CNC machine number 5. This machine is currently assigned to work order 789 and is scheduled to run from 2 PM to 10 PM."

[0004] To protect the manufacturing execution system network from unauthorized access, the industry has adopted a variety of network access control technologies. However, these existing technologies all have certain limitations in their application.

[0005] The most basic network access control method involves configuring static MAC address filtering on the ports of industrial switches. Using this technology, network administrators manually create a "whitelist" that binds the MAC addresses of authorized devices to specific switch ports. The switch then discards all packets originating from MAC addresses not on the whitelist. While this method is conceptually simple, it introduces significant management overhead and rigidity in practice. First, its maintenance cost is extremely high. Whenever a new device comes online, an existing device's network card is replaced, or external technicians (such as equipment maintenance engineers) require temporary network access, administrators must manually modify the switch configuration. This is not only time-consuming and labor-intensive, but also prone to human error and production interruptions.

[0006] Secondly, the security of static MAC filtering is very fragile. MAC addresses can be easily spoofed or cloned. An attacker can simply sniff traffic briefly on the network to capture the MAC address of a legitimate device, then modify their own device's MAC address to disguise it, easily bypassing MAC address-based access control.

[0007] To overcome the problems of static MAC filtering, the enterprise IT field has developed more advanced network access control (NAC) solutions. However, applying these NAC solutions designed for IT environments to manufacturing execution system networks has the following problems: First, IT NAC solutions typically adopt a "deny by default" security posture. When an unknown or non-compliant device is detected, the standard action is to isolate or directly block its network connection. This behavior is acceptable in IT networks, but in manufacturing execution system networks, it can cause unexpected production line downtime, resulting in huge financial losses and potential security incidents.

[0008] Secondly, IT NAC solutions rely on standard IT protocols and agent software installed on endpoint devices to discover and identify information such as device type and operating system. However, most industrial devices use proprietary industrial communication protocols, and their embedded or outdated operating systems are incapable of installing any third-party agent software. This makes IT NAC unable to effectively identify and profile the vast majority of critical assets in the Manufacturing Execution System network.

[0009] In summary, existing technologies, whether simple static MAC filtering or complex IT NAC solutions, are unable to effectively address network access control in manufacturing execution systems (MESs). These solutions either incur excessive management costs and inadequate security, or conflict with the core requirements of MESs, posing a significant risk of disrupting production. Summary of the Invention

[0010] To solve the problems in the prior art, the present invention provides a MAC address management method for an MES system. The method is deeply coupled with the operating status of a manufacturing execution system (MES), thereby solving various deficiencies in the prior art.

[0011] A MAC address management method for an MES system includes the following steps: receiving contextual data related to one or more manufacturing processes from a manufacturing execution system; Discovering, through one or more network switches, a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address; Associating the MAC address of the terminal device with the context data in a data repository; dynamically generating a network admission policy for the terminal device based on the association; An instruction is sent to at least one of the one or more network switches to enforce the network admission policy on the switch.

[0012] Preferably, the context data includes at least one selected from the following: a work order identifier, an equipment operating status, a maintenance plan, a bill of materials, product pedigree data, or operator role information.

[0013] Preferably, the step of discovering a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address through one or more network switches specifically includes: Monitor network traffic copied from the mirrored port of a network switch and filter out broadcast and multicast messages containing device identity information, including Address Resolution Protocol messages, Dynamic Host Configuration Protocol messages, and Link Layer Discovery Protocol messages. Based on these messages, a list of assets with MAC addresses and their corresponding IP addresses is generated. Using a standard network management protocol, periodically acquiring and parsing the media access control address table within the network switch to obtain a data set that accurately maps the MAC address to the physical port number to which it is connected and the virtual local area network identifier to which it belongs; The asset list generated above is associated with the obtained mapping data set to determine the MAC address corresponding to the terminal device and the network access point corresponding to the MAC address, thereby forming a comprehensive and dynamic terminal device list.

[0014] Preferably, associating the MAC address of the terminal device with the context data specifically includes: Parsing the context data to obtain operational metadata therein, the metadata including at least a valid work order identifier, a device asset number, a predefined device operation state, and a planned timestamp associated with the work order or operation state; Querying the data repository for an existing device record corresponding to the MAC address of the terminal device; If a matching existing record is found, the attribute fields in the record are updated using the above context data; if no matching record is found, a new device record is created in the data repository, and the corresponding fields of the record are filled using the MAC address of the terminal device and the metadata.

[0015] Preferably, dynamically generating a network admission policy for the terminal device based on the association specifically includes: Retrieving a record associated with the MAC address of the terminal device from the data repository; Matching the context data in the record with a predefined policy rule base, wherein the policy rule base contains a plurality of logic rules, each of which defines a mapping between one or more operational contexts and a specific network permission level; Construct a network admission policy based on the matched logical rules.

[0016] Preferably, the logic rules include: a production rule applicable to the equipment in the "in production" state; a maintenance rule applicable to the equipment in the "planned maintenance" state; and a standby rule applicable to the equipment in the "standby" state.

[0017] Preferably, the network admission policy has a time limit, and its validity period is associated with a predetermined time parameter in the context data.

[0018] Preferably, the forcibly executing the network admission policy includes: Configuring a port security feature of the switch to bind the MAC address to a specific port of the switch; Apply an access control list to a port of the switch or assign the port to a specific virtual local area network.

[0019] Preferably, the method further comprises: When an unknown MAC address that is not recorded in the data repository is discovered, automatically placing the switch port associated with the unknown MAC address into a predefined restricted network area; An alert notification is sent to an authorized user via a user interface of the MES to initiate a supervised workflow for handling the unknown MAC address.

[0020] Preferably, the supervised workflow includes: receiving, via an authentication portal, user credentials associated with the unknown MAC address and a task identifier; Verifying the validity of the user credentials and task identifier using the MES; If the verification is successful, the unknown MAC address is associated with the task identifier and a temporary network admission policy is generated for it.

[0021] Compared with the prior art, the advantages of the present invention are: This solution addresses issues that are difficult to address with static MAC address filtering and traditional IT NAC solutions by deeply integrating network access control with the Manufacturing Execution System (MES). Compared to traditional static MAC address filtering, this solution replaces costly and error-prone manual management with automated, dynamic policies. By verifying "operational intent" rather than simple address identification, it effectively protects against attacks such as MAC address spoofing. It also addresses the network challenge of static lists becoming ineffective due to MAC address randomization through a task-based temporary authorization workflow.

[0022] Furthermore, this solution eliminates IT NAC's "default deny" logic, which can disrupt production, and instead employs a supervised, guided authentication process for unknown devices. Furthermore, it leverages the authoritative asset database within the MES to overcome IT NAC's "visibility blind spots" when identifying proprietary industrial equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of the MAC address management method for an MES system proposed by the present invention. DETAILED DESCRIPTION

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0025] The system environment implemented by the present invention mainly includes: Manufacturing Execution System Server: A server that runs a standard MES application program and on which the MES integrated MAC address management module of the present invention is deployed or integrated.

[0026] OT network: The operational technology network on the factory floor connects all production-related industrial equipment. This network is composed of one or more managed network switches. These switches must be programmable, supporting protocols such as SNMP, NETCONF, and RESTful APIs, allowing management modules to programmatically configure them.

[0027] Industrial terminal devices: Various devices connected to the OT network, such as programmable logic controllers (PLCs), human-machine interfaces (HMIs), numerical control machines (CNCs), robot controllers, sensors, and laptops or mobile devices temporarily connected by technicians.

[0028] The MES integrated MAC address management module is a software entity responsible for executing the entire method described in this invention. This module can be implemented as a plug-in for the MES system or as a standalone application that exchanges data with the MES via an API. It primarily consists of the following engines: Device discovery and profiling engine: The engine is responsible for continuously scanning the OT network to discover all connected devices and build a basic profile of them. To achieve comprehensive coverage and avoid interfering with vulnerable OT devices, the engine uses a combination of discovery technologies: Passive monitoring: By monitoring network broadcasts and communication traffic (such as ARP requests, DHCP requests, and LLDP / CDP broadcast packets) at key network nodes, the system passively learns the MAC addresses of newly online devices without actively sending any probe packets. Specifically, it monitors network traffic copied from the mirrored port of the network switch, filters out broadcast and multicast messages containing device identity information, and generates an asset list based on these messages, linking MAC addresses to their corresponding IP addresses.

[0029] Active query: Periodically query the managed switch's MAC address table via a management protocol (such as SNMP) to obtain a list of currently learned MAC addresses for each port. Specifically, using standard network management protocols, the switch's internal media access control address table is periodically retrieved and parsed, yielding a dataset that accurately maps MAC addresses to the physical port numbers and virtual local area network (VLAN) identifiers to which they are connected.

[0030] MES asset database integration: Query the MES's built-in asset inventory database. In most mature manufacturing companies, the MES system itself maintains the most authoritative and comprehensive inventory of factory equipment. This engine cross-references discovered MAC addresses with the MES asset database, linking a network address to a real physical asset. This solves the difficulty of traditional asset identification solutions in OT networks.

[0031] After discovering a device, the engine creates a preliminary profile. For example, it identifies the device's manufacturer by parsing the first 24 bits of the MAC address, known as the Organizationally Unique Identifier (OUID). This information is then compared with the device's expected manufacturer as part of the authentication process in the MES asset database.

[0032] Contextual Association Engine: The engine is responsible for dynamically binding a network entity (identified by its MAC address) to its real-time "operational context." The engine continuously queries the MES database through the API or subscribes to events published by the MES system to obtain the following key context information: Work Order Status: Which work orders are currently active? Which equipment or production lines are these work orders assigned to? Equipment status: Is the real-time status of the target equipment recorded in the MES "in production", "standby", "planned downtime", or "unplanned maintenance"? Operator / User Data: Which operator is currently logged into a specific HMI or workstation? Is their role a general operator, maintenance technician, or production supervisor? Maintenance plan: Is there an active maintenance work order for a particular piece of equipment? Does the work order authorize access by a maintenance technician? All of this contextual information is used to enrich and update a specialized database, the MES-integrated MAC address repository. In this repository, each record is keyed or indexed by the MAC address and associated with a series of dynamically changing contextual attributes, such as asset ID, device type, manufacturer OUI, current status, associated work order ID, associated operator ID, trust level, and policy expiration timestamp. In this way, the system builds a dynamic, context-rich identity profile for every device on the network.

[0033] Dynamic Policy Generation Engine: Based on the device profile created by the contextual correlation engine, the engine dynamically generates refined network access policies that adhere to the principle of least privilege. These policies are not simple "allow / deny" policies, but complex logical rules based on state and time. For example: Production policy example: If the device's MAC address is "AA:BB:CC:11:22:33", the device's asset ID is "CNC-05", the status of CNC-05 in the MES is "In Production", and the device's associated work order is "WO-998", then all communications with this MAC address are allowed on switch port 5. The policy is effective until the scheduled end time of WO-998.

[0034] Maintenance policy example: If the device's MAC address is "DD:EE:FF:44:55:66" and the device is a technician's laptop and there is an active maintenance work order for asset "PLC-12" in the MES, then only this MAC address is allowed to access the IP address of PLC-12 on switch port 10, and the policy is valid for 4 hours.

[0035] Standby policy example: If the device's MAC address is "AA:BB:CC:11:22:33," the device's asset ID is "CNC-05," and the device's status is "Standby," only this MAC address is allowed to communicate with the MAC server and monitoring server on switch port 5, blocking all other communications.

[0036] This approach to policy generation enables a fundamental shift from static admission to dynamic, state-based authorization.

[0037] Policy execution and monitoring engine: The engine is responsible for converting the logical policy generated in the previous step into specific instructions that the network switch can understand and execute, and then sending them to the switch through the management protocol. The policy can be executed in the following ways: Configure port security: Dynamically update the port security configuration of a switch port programmatically. For example, use the "sticky MAC" or "static MAC" features to bind authorized MAC addresses to a specific port. When the policy expires or the context changes, the binding can be removed through command.

[0038] Apply dynamic ACLs or VLANs: Dynamically apply access control lists (ACLs) to switch ports based on policy, or dynamically assign ports to specific virtual local area networks (VLANs). For example, a device requiring maintenance and its corresponding technician laptop can be temporarily assigned to an isolated "maintenance VLAN," or an unknown device can be assigned to a "quarantine VLAN."

[0039] All policy generation, issuance, execution, and device connection / disconnection events are logged in detail with a timestamp and context snapshot for subsequent auditing and troubleshooting.

[0040] Example 1: This embodiment describes the debugging workflow for the first access of a device, which specifically includes: When a new, permanent industrial device (such as a new PLC) is installed, the administrator first registers the device in the MES asset management module, entering its asset number, model, production line, and other information. The device is then powered on and connected to the OT network. At this point, the system detects an unknown MAC address. It marks the device as "pending commissioning" and places it in a restricted network environment, enabling communication only with the MES server. Simultaneously, the system sends a notification to the production supervisor or IT administrator through the MES user interface. After the supervisor confirms the device as a newly registered asset, they perform a "bind" operation, formally associating the new MAC address with the MES asset record. Once the binding is complete, the system generates and applies a network policy based on the device's default state (e.g., "Standby").

[0041] Example 2: This embodiment describes the workflow for processing temporary access to equipment (such as equipment maintenance) in MES, specifically: When a maintenance technician needs to perform maintenance on a machine: Context preparation: First, create or activate a maintenance work order for the machine in the MES system.

[0042] Device connection and discovery: The technician connects his laptop to the designated network port. The system immediately discovers an unknown MAC address.

[0043] Automatic Isolation and Booting: When the system detects that the MAC address is no longer in the known repository, it automatically and immediately assigns the switch port to an isolated "Guest VLAN" or "Authentication VLAN." In this VLAN, the device can only access a specific authentication portal.

[0044] Task-based authentication: The technician opens the authentication portal in a browser on their laptop. The portal requires them to enter valid credentials from the MES system and the maintenance work order number they are performing.

[0045] Context Verification and Policy Generation: The system verifies the technician's submitted information against the MES database. If the credentials are valid and the maintenance work order exists and is active, the system deems the access legitimate. The technician's device and its MAC address are then associated with the maintenance task, and a temporary, time-limited, and least-privileged network policy is dynamically generated for the technician (for example, limiting access to only the IP address of the device being maintained, valid for the expected duration of the work order).

[0046] Policy enforcement and access authorization: The system sends the newly generated policy to the switch, removes the port from the isolated VLAN, and applies the new ACL. The technician then gains the network access rights necessary to perform the task.

[0047] Automatic revocation of policy: When a maintenance work order is closed in MES, or the set policy validity period expires, the system will automatically revoke the temporary policy and restore the port to the default isolation state.

[0048] This solution solves the problem of MAC address randomization while ensuring security by binding authentication to a specific, time-limited "task" (i.e., a maintenance work order) rather than to an unstable "device identity" (i.e., a MAC address).

[0049] Example 3: In this embodiment, the anomaly detection capability of the method is illustrated by using a MAC address spoofing scenario, specifically: Assume that an attacker successfully clones the MAC address of a critical PLC (named "PLC-A") through network sniffing.

[0050] In a traditional static filtering scenario, the attacker can now access all other devices on the network because their MAC addresses are on the whitelist.

[0051] In this solution, it is assumed that the records in the MES system show that the production line to which "PLC-A" belongs is currently in a "planned shutdown" state. At this time, the attacker uses a forged MAC address to try to send control instructions to other devices. The system of the present invention detects traffic from the MAC address of "PLC-A", but by querying the MES context, it is found that its status should be "shutdown" and there should be no active control-type communication. Due to the contradiction between the above-mentioned "network behavior" and "operation context", the system identifies it as a high-risk security anomaly, which will trigger an alarm, record the characteristics of the abnormal traffic in detail, and can be configured to automatically execute response actions, such as isolating the switch port alone without affecting other parts of the network, thereby thwarting the attack.

[0052] In summary, compared to existing static MAC filtering methods, this invention, through integration with MES, automates the generation, application, and revocation of network access policies, eliminating tedious, time-consuming, and error-prone manual configuration. Furthermore, this invention deeply binds network access to real-time production context (such as work orders, equipment status, and maintenance plans), enabling security policies to reflect and serve production needs. Furthermore, by continuously verifying the consistency of network behavior with MES context, it can identify devices with abnormal behavior even with legitimate MAC addresses, thereby providing a deeper level of security.

[0053] Compared with IT NAC solutions, this invention adopts a supervised guided authentication process for unknown devices instead of direct blocking, thereby minimizing the impact on production continuity while ensuring security. In addition, by directly integrating with the authoritative asset database in MES and combining non-invasive network discovery technology, it achieves accurate identification and profiling of OT assets, solving the asset visibility problem in the OT environment.

[0054] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0055] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A MAC address management method for an MES system, characterized in that: The following steps are involved: receiving contextual data related to one or more manufacturing processes from a manufacturing execution system; Discovering, through one or more network switches, a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address; Associating the MAC address of the terminal device with the context data in a data repository; dynamically generating a network admission policy for the terminal device based on the association; sending an instruction to at least one of the one or more network switches to enforce the network admission policy on the switch; The forcible execution of the network admission policy includes: Configuring a port security feature of the switch to bind the MAC address to a specific port of the switch; Apply an access control list to a port of the switch or assign the port to a specific virtual local area network.

2. The MAC address management method of an MES system according to claim 1, characterized in that: The context data includes at least one selected from the group consisting of: a work order identifier, a device operating status, a maintenance plan, a bill of materials, product pedigree data, or operator role information.

3. The MAC address management method of an MES system according to claim 1, characterized in that: The step of discovering a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address through one or more network switches specifically includes: Monitor network traffic copied from the mirrored port of a network switch and filter out broadcast and multicast messages containing device identity information, including Address Resolution Protocol messages, Dynamic Host Configuration Protocol messages, and Link Layer Discovery Protocol messages. Based on these messages, a list of assets with MAC addresses and their corresponding IP addresses is generated. Using a standard network management protocol, periodically acquiring and parsing the media access control address table within the network switch to obtain a data set that accurately maps the MAC address to the physical port number to which it is connected and the virtual local area network identifier to which it belongs; The asset list generated above is associated with the obtained mapping data set to determine the MAC address corresponding to the terminal device and the network access point corresponding to the MAC address, thereby forming a comprehensive and dynamic terminal device list.

4. The MAC address management method of an MES system according to claim 1, characterized in that: The associating the MAC address of the terminal device with the context data specifically includes: Parsing the context data to obtain operational metadata therein, the metadata including at least a valid work order identifier, a device asset number, a predefined device operation state, and a planned timestamp associated with the work order or operation state; Querying the data repository for an existing device record corresponding to the MAC address of the terminal device; If a matching existing record is found, the attribute fields in the record are updated using the above context data; if no matching record is found, a new device record is created in the data repository, and the corresponding fields of the record are filled using the MAC address of the terminal device and the metadata.

5. The MAC address management method of an MES system according to claim 1, characterized in that: The dynamically generating a network admission policy for the terminal device based on the association specifically includes: Retrieving a record associated with the MAC address of the terminal device from the data repository; Matching the context data in the record with a predefined policy rule base, wherein the policy rule base contains a plurality of logic rules, each of which defines a mapping between one or more operational contexts and a specific network permission level; Construct a network admission policy based on the matched logical rules.

6. The MAC address management method of an MES system according to claim 5, characterized in that: The logic rules include: a production rule, which is applicable when the equipment is in a "production" state; a maintenance rule, which is applicable when the equipment is in a "planned maintenance" state; and a standby rule, which is applicable when the equipment is in a "standby" state.

7. The MAC address management method of an MES system according to claim 5, characterized in that: The network admission policy has a time limit, and its validity period is associated with a predetermined time parameter in the context data.

8. The MAC address management method of an MES system according to claim 1, characterized in that: The method further comprises: When an unknown MAC address that is not recorded in the data repository is discovered, automatically placing the switch port associated with the unknown MAC address into a predefined restricted network area; An alert notification is sent to an authorized user via a user interface of the MES to initiate a supervised workflow for handling the unknown MAC address.

9. The MAC address management method of an MES system according to claim 7, characterized in that: The supervised workflow includes: receiving, via an authentication portal, user credentials associated with the unknown MAC address and a task identifier; Verifying the validity of the user credentials and task identifier using the MES; If the verification is successful, the unknown MAC address is associated with the task identifier and a temporary network admission policy is generated for it.

Images