Content-Aware Firewalling, Policy Regulation, and Policy Management for Industrial Automation, Machine To Machine Communications, and Embedded Devices

Abstract

In one embodiment, a processor-implemented method for controlling network traffic to and/or from at least one industrial machine, including: (a) receiving, as input, (i) a stored policy object in language form defining at least one desired behavior and/or operational constraint for the at least one industrial machine, and (ii) a stored machine profile defining an association between the language of the stored policy object and at least one control signal or instruction for the at least one industrial machine; (b) detecting, in network traffic to and/or from the at least one industrial machine, a transaction; (c) applying the received policy object and machine profile to the detected transaction to determine whether a desired behavior exists and/or whether an operational constraint is satisfied; and (d) modifying network traffic to and/or from the at least one industrial machine based on the determination in step (c). This permits expression and enforcement of constraints on actual industrial machine behaviors by filtering, modifying or blocking network communications (e.g., control signals and telemetry) that violate constraints or could cause unsafe or inefficient operation.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application claims priority to co-pending U.S. Provisional Patent Application Ser. No. 62 / 051,291, filed Sep. 16, 2014, the disclosure of which is incorporated herein by reference in its entirety.BACKGROUND[0002]1. Technical Field[0003]The disclosure relates, generally, to industrial automation, and more particularly, to policy regulation and firewalling for purposes of controlling industrial machines.[0004]2. Description of Related Art[0005]It is possible for industrial machines to communicate with each other using Ethernet-based networks. These are the same networks that are generally used to link computers together. Traditional practice uses network types other than Ethernets to network industrial machines together, for example DeviceNet and CAN, most notably for the purpose of ensuring that reliability and latency characteristics inherent in Ethernets do not compromise the more stringent safety and efficiency requirements of indus...

AI Technical Summary

Benefits of technology

[0016]Embodiments of the disclosure provide solutions to the foregoing problems and additional benefits, by employing a communications language designed to permit the expression of the desired behavior of machines and processes in an abstract and general form that, in turn, can be automatically and dynamically converted to control signals pertaining to specific machines and processes, by a communications device or devices resident on a converged network. At the same time, the same communications devices can enforce conditions and thresholds (for example, speeds, temperatures, pressures, and flow rates) beyond which machines and processes may not be allowed to operate for safety and efficiency reasons.

[0017]Embodiments of the disclosure provide languages and devices that permit the expression and enforcement of constraints on actual machine behaviors by filtering, modifying or blocking network communications (e.g., control signals and telemetry) that violate the constraints or may otherwise cause machines to operate unsafely or inefficiently. This is completely different from the filtration performed by network firewalls, even the so-called industrial firewalls. Existing devices focus on permitting or denying communications based on the identity of the endpoints, their position within the network, and even through analysis of the communications protocols (for example, enforcing that protocols such as Modbus or Ethernet/IP are in use and syntactically correct).

[0018]In one embodiment, the present disclosure provides a processor-implemented method for controlling network traffic to and/or from at least one industrial machine. The method includes: (a) the processor receiving, as input, (i) a stored policy object in language form de

Problems solved by technology

At the same time, tremendous vulnerabilities arise, because the computers and the network infrastructure devices such as switches and routers themselves are often quite easy for attackers to compromise, and those devices are subject to malfunctions of hardware and software.

Such attacks and malfunctions can create rogue control signals that can render unsafe or inefficient the functioning of industrial machines; and they can expose telemetry to unauthorized or malicious parties.

In addition, however, the electrical and functional characteristics of industrial machines are fundamentally different from those of general-purpose computers used for traditional data processing applications.

Although, strictly speaking, some industrial machines might include a computer, industrial machines are not general-purpose computers that would typically be used by a human operator for applications including such as data processing, information retrieval, email, and the like.

A problem very different from those of preventing undesired access to industrial machines through Ethernets by unauthorized users or by other machines through Ethernets, is that of inhibiting network traffic that arrives through Ethernets and is quite normal, typical and innocuous for traditional computers but is disruptive and even dangerous when encountered by industrial machines.

Conventional

Images