Content-Aware Firewalling, Policy Regulation, and Policy Management for Industrial Automation, Machine To Machine Communications, and Embedded Devices

Abstract

In one embodiment, a processor-implemented method for controlling network traffic to and / or from at least one industrial machine, including: (a) receiving, as input, (i) a stored policy object in language form defining at least one desired behavior and / or operational constraint for the at least one industrial machine, and (ii) a stored machine profile defining an association between the language of the stored policy object and at least one control signal or instruction for the at least one industrial machine; (b) detecting, in network traffic to and / or from the at least one industrial machine, a transaction; (c) applying the received policy object and machine profile to the detected transaction to determine whether a desired behavior exists and / or whether an operational constraint is satisfied; and (d) modifying network traffic to and / or from the at least one industrial machine based on the determination in step (c). This permits expression and enforcement of constraints on actual industrial machine behaviors by filtering, modifying or blocking network communications (e.g., control signals and telemetry) that violate constraints or could cause unsafe or inefficient operation.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application claims priority to co-pending U.S. Provisional Patent Application Ser. No. 62 / 051,291, filed Sep. 16, 2014, the disclosure of which is incorporated herein by reference in its entirety.BACKGROUND[0002]1. Technical Field[0003]The disclosure relates, generally, to industrial automation, and more particularly, to policy regulation and firewalling for purposes of controlling industrial machines.[0004]2. Description of Related Art[0005]It is possible for industrial machines to communicate with each other using Ethernet-based networks. These are the same networks that are generally used to link computers together. Traditional practice uses network types other than Ethernets to network industrial machines together, for example DeviceNet and CAN, most notably for the purpose of ensuring that reliability and latency characteristics inherent in Ethernets do not compromise the more stringent safety and efficiency requirements of indus...

AI Technical Summary

Benefits of technology

The patent text describes a solution for controlling the behavior of machines and processes in an industrial setting. It uses a communications language that allows for the expression of desired behaviors and the enforcement of operational constraints. The system detects transactions in network traffic and applies a stored policy object and machine profile to determine if a desired behavior is being performed or if an operational constraint is being met. The system can then modify network traffic to prevent unsafe or inefficient behavior. Overall, the solution ensures safety and efficiency in industrial settings by controlling network traffic and monitoring machine behavior.

Problems solved by technology

At the same time, tremendous vulnerabilities arise, because the computers and the network infrastructure devices such as switches and routers themselves are often quite easy for attackers to compromise, and those devices are subject to malfunctions of hardware and software.

Such attacks and malfunctions can create rogue control signals that can render unsafe or inefficient the functioning of industrial machines; and they can expose telemetry to unauthorized or malicious parties.

In addition, however, the electrical and functional characteristics of industrial machines are fundamentally different from those of general-purpose computers used for traditional data processing applications.

Although, strictly speaking, some industrial machines might include a computer, industrial machines are not general-purpose computers that would typically be used by a human operator for applications including such as data processing, information retrieval, email, and the like.

A problem very different from those of preventing undesired access to industrial machines through Ethernets by unauthorized users or by other machines through Ethernets, is that of inhibiting network traffic that arrives through Ethernets and is quite normal, typical and innocuous for traditional computers but is disruptive and even dangerous when encountered by industrial machines.

Conventionally, such a mode of traffic recognition and filtration is not available.

In general, such prior art has focused on the problem of recognizing which specific machines are being targeted with control signals and from which telemetry is being requested or monitored.

But many problems can be created by accesses that are not prohibited by access-control rules.

Among the distinctive issues that arise specifically in Ethernets, which include both traditional computer equipment and industrial machines, are problems of policy regulation; problems arising from the different electrical and functional characteristics of computers and typical industrial machines; and problems arising as machines acquire a broader ability to communicate with one another, thus affecting the functioning of other machines.

None of these problem areas has been addressed by current practice or prior art.

The problem of policy regulation in converged networks arises from the goals of controlling the behavior and function of industrial machines from distant control points, and of dispatching telemetry from machines to distant analysis points.

At the same time, the same communications devices can enforce conditions and thresholds (for example, speeds, temperatures, pressures, and flow rates) beyond which machines and processes may not be allowed to operate for safety and efficiency reasons.

Images