Honeypot for connections between edge devices and cloud-based service platforms

Abstract

The invention relates to a system in automation technology, comprising: - a first facility part (AT1) which consists of a plurality of field devices (FG); - an edge device (ED) which is part of a communication network, wherein the edge device (ED) is designed to listen to at least a part of the data transmitted by the field devices (FG) and superordinate units and / or to query further data from the field devices (FG) and / or superordinate units, wherein the edge device (ED) is designed to generate a real-time list which contains the identification of each field device (FG) or control unit and the current respectively queried or listened data, wherein the edge device (ED) is designed to simulate a plurality of virtual field devices (FG'), to generate data for the virtual field devices (FG'), to input the identification of the virtual field devices (FG') and the generated data into the real-time list and to provide the real-time list via a first interface (API1), in particular an interface for application programming; - a cloud-based service platform (SP), wherein the edge device (ED) is designed to transmit the real-time list with the current respectively queried or listened data to the cloud-based service platform (SP) at regular time intervals, and wherein the cloud-based service platform (SP) is designed to collate and / or present the real-time list, wherein the data of the virtual field devices (FG') are not taken into account.

Description

TECHNICAL FIELD

[0001] The present invention relates to a system of automation technology. BACKGROUND

[0002] Field devices for use in industrial plants are known from the prior art. Field devices are widely used in process automation technology and in manufacturing automation technology. All devices which are used in a process-oriented manner and which provide or process data or information related to a process are in principle referred to as field devices. Thus, field devices are used for detecting and / or influencing process variables. For detecting process variables, measuring devices or sensors are used. These measuring devices or sensors are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, level measurement, etc., and detect corresponding process variables, such as pressure, temperature, conductivity, pH value, level, flow, etc. For influencing process variables, actuators are used. These actuators are, for example, pumps or valves which can influence the flow of a liquid in a pipe or the level in a container. In addition to the above-mentioned measuring devices and actuators, field devices are also understood to be remote I / Os, radio adapters or generally devices which are arranged on the field level.

[0003] The Endress+Hauser Group produces and sells a large number of such field devices.

[0004] In modern industrial plants, field devices are usually connected to superordinate units via a communication network, for example a fieldbus (PROFIBUS, HART, FF, etc.). Fieldbus, etc.).

[0005] In addition to process values, field devices of the automation industry also provide analysis and status data which are of great importance for the maintenance and care of assets and for the assessment of the status of the components of a plant in which these assets are installed.

[0006] For the best and comprehensive analysis of the data obtained from the field devices, it is necessary to collect these data centrally and to provide the data differently to a group of persons and to evaluation systems that can contribute their expertise for the assessment of the condition of the facility part and its assets. Service providers such as the company "Endress + Hauser" with the "Netilion" platform offer the required functions of data management, data security and data processing in this respect.

[0007] In order to be able to transmit these data from the field devices to a so-called cloud (a cloud-capable service platform that can be contacted via the Internet) within the scope of the digital services described above, so-called edge devices are used, which listen to or retrieve the data of the field devices and upload them to the cloud via the Internet.

[0008] These data are sometimes sensitive information, which is not allowed to fall into the hands of third parties. For this purpose, the data are transmitted between the edge device and the cloud via a connection that is secured, for example, cryptographically, symmetrically or asymmetrically. If this encryption is broken, or if a third party obtains access data to the edge device or to the cloud, then facility knowledge can fall into the hands of unauthorized persons, since the communication between the edge device and the cloud can be intercepted. SUMMARY

[0009] It is therefore the task of the present application to improve the security of the data transmission between the edge device and the cloud-based service platform.

[0010] This task is solved by a system of automation technology, which comprises

[0011] a first facility part, which consists of a plurality of field devices and a superordinate unit, which field devices are designed to detect measurement values of at least one physical variable of a method-technical process and / or to influence at least one physical variable of a method-technical process,

[0012] wherein the field devices are in communication connection with one another and with the superordinate unit via a communication network, wherein the field devices are designed to transmit data, in particular measurement values, status values and / or diagnostic data, to the superordinate unit, and wherein the superordinate unit is designed to transmit data, in particular adjustment values and / or operating telegrams, to the field devices;

[0013] - an edge device, which is part of the communication network, wherein the edge device is designed to listen to at least a part of the data transmitted by the field devices and the superordinate units and / or to query further data from the field devices and / or the superordinate units, wherein the edge device is designed to generate a real-time list, which contains the identification of each field device or control unit and the data currently queried or listened to, respectively, wherein the edge device is designed to simulate a plurality of virtual field devices, to generate data for the virtual field devices, to input the identification of the virtual field devices and the generated data into the real-time list and to provide the real-time list via a first interface, in particular an interface for application programming, to the application;

[0014] - a cloud-based service platform, wherein the edge device is in a communication connection with the service platform via a first communication channel over the internet, wherein the edge device is designed to transmit the real-time list with the data currently queried or listened to, respectively, to the service platform at regular time intervals, and wherein the cloud-based service platform is designed to collate and / or present the real-time list, wherein the data of the virtual field devices is not taken into account.

[0015] The system according to the invention makes it possible to securely transmit the data of the field devices between the edge device and the cloud-based service platform. The main aspect of the invention is that the edge device simulates further field devices which are not present in the first plant part at all. The edge device writes these so-called virtual field devices into the real-time list which is to be transmitted to the cloud-based service platform. The real-time list shows the totality of all field devices in operation in the first plant part. In addition, the edge device simulates data for each virtual field device which is to be transmitted to the cloud-based service platform. If an attacker succeeds in hacking the connection between the edge device and the cloud-based service platform or accesses the edge device via the first interface, he obtains a plurality of field devices and displays the data of these field devices, of which only a small part are indeed field devices installed in the first plant part. Here, the attacker cannot distinguish which data actually comes from real field devices. The attacker is thereby confused and obtains time to resist the attack, or the attacker thereby interrupts the attack, since he cannot gain from the data.

[0016] However, the actual user of the cloud-based service platform is presented only with the field devices actually contained in the first plant part and their data. The field devices mentioned in connection with the system according to the invention have been listed exemplarily in the introductory part of the specification.

[0017] According to an advantageous design of the system according to the application, the edge device is designed to encrypt the identifications of the field devices and virtual field devices in the real-time list by means of a public key located on the edge device, wherein the service platform is designed to decrypt the encrypted identifications with a public key located on the service platform, and wherein the identification of the virtual field devices is not decryptable. In this form and in this manner, it is recognizable for the cloud-based service platform, which field devices are actually contained in the first plant part and which field devices are simulated by the edge device.

[0018] According to an advantageous design of the system according to the application, the service platform is designed to simulate at least one second plant part with a plurality of further virtual field devices, to generate data for the further virtual field devices, to input the identifications of the further virtual field devices and the generated data into the real-time list and to provide the real-time list via a second interface, in particular an interface for application programming. Thereby, the attacker is further confused. If the attacker succeeds in accessing the cloud-based service platform via the second interface, he will be overwhelmed by the more further field devices and data. It is not recognizable for the attacker even which plant parts the plant actually consists of. However, even in this case, only the field devices actually contained in the first plant part and their data are presented to the actual user of the cloud-based service platform, without any virtual or further virtual field devices being presented.

[0019] According to an advantageous design of the system according to the application, the edge device or the service platform comprises an algorithm, in particular a KI algorithm, which is designed to analyze historical data of the field devices and to generate data of the virtual field devices based on the analysis. Thus, the data of the virtual field devices are simulated similarly to the actually used field devices, for example following similar value ranges or similar trends. Thereby, the security level is increased, since the data of the virtual field devices thus become very credible and in practice cannot be distinguished from the actually used field devices any more.

[0020] According to an advantageous alternative design of the system according to the application, the edge device or the service platform comprises an algorithm, in particular a KI algorithm, and at least one model of the field device type, wherein the model has at least one property specific to the respective field device type, and wherein the algorithm is designed to generate data of the virtual field device using the model. The KI algorithm learns in advance from different field device types and their specific properties by means of training data. Here, advantageously, the configuration and parameterization of the field devices actually used in the first facility part with the same or similar field device types can be taken into account in order to increase the reliability. The specific properties are, for example, value ranges, units of measurement, specific attenuation or start-up behavior, etc.

[0021] According to an advantageous refinement of the system according to the application, the edge device has a first monitoring mechanism which is designed to detect an access or a request to at least one of the virtual field devices from the outside via the first interface and to create a first report. Thereby it can be determined that an unauthorized person has accessed the edge device: the actual user of the cloud-based service platform cannot access the virtual field devices since these are not presented to him and thus cannot make requests to them.

[0022] According to an advantageous design of the system according to the application, the service platform has a second monitoring mechanism which is designed to detect an access or a request to at least one further virtual field device from the outside via the second interface and to create a second report. Analogously to the description in the preceding paragraph, therefrom an unauthorized access to the cloud-based service platform can be detected.

[0023] According to an advantageous design of the system according to the application, the first report and / or the second report contains an identification of the virtual field device or the further virtual field device, a timestamp of the access or the request, and / or a type of the access or the request. Thereby an attack can be analyzed and the possible scale can be understood.

[0024] According to an advantageous design of the system according to the application, the first monitoring mechanism and / or the second monitoring mechanism is designed to detect a further access or a further request to the further virtual field device after the detection and to add it to the first report or the second report or a further report. Thereby, the behavior of the attacker can be analyzed and in addition also his strategy and / or his origin.

[0025] According to a first alternative of the system according to the application, the first monitoring mechanism and / or the second monitoring mechanism is designed to transmit the first report or the second report and / or the further report to a superior unit via a second communication channel.

[0026] According to an advantageous design of the first alternative of the system according to the application, the superior unit is designed to evaluate the first report or the second report and / or the further report and to execute at least one measure on the basis of the evaluation. In this form and in this manner, an attack can be reacted to directly on the site level.

[0027] According to a further alternative of the system according to the application, the system, in particular based on the cloud, comprises an evaluation unit, wherein the first monitoring authority and / or the second monitoring authority is designed to transmit the first report or the second report and / or the further report to the evaluation unit via a third communication channel.

[0028] According to an advantageous design of the second alternative of the system according to the application, the evaluation unit is designed to evaluate the first report or the second report and / or the further report and to propose at least one execution measure on the basis of the evaluation of the superior unit.

[0029] In all cases, it is important that the report is transmitted via a communication channel that is different from the first communication channel. It is not clear to an attacker who believes to be safe that his attack has been detected and analyzed or that a measure is prepared. It can also be provided that the attack is thus intentionally prolonged in order to obtain data of the attacker or the identity and the location of the attacker or his IP address.

[0030] According to an advantageous design of the system according to the application, the measure is at least one of the following measures:

[0031] - switching off at least one component of the communication network;

[0032] - changing or limiting the access rights to the edge device and / or to the service platform;

[0033] - limiting the communication of the edge device;

[0034] - informing the service personnel of the device.

[0035] Overall, it can be determined effectively that an attack is taking place and measures can be taken in the case where the attacker cannot obtain actual data from the site device of the first facility part. BRIEF DESCRIPTION OF DRAWINGS

[0036] The application is explained in detail with the aid of the following drawings. In which:

[0037] Figure 1 An embodiment of the system according to the application is shown; DETAILED DESCRIPTION

[0038] Figure 1A facility part AT1 of a facility of automation technology is shown in the middle. The facility can have further facility parts in addition to the first facility part AT1. In the first facility part AT1 a plurality of field devices FG is used, which serve to detect or influence physical variables of a process technology process. In Figure 1 The physically present field devices in the first facility part AT1 are shown in the middle in black filled circles.

[0039] The field devices FG are in communication connection with one another and via a communication network with superordinate units Especially control units, such as SPS, or gateways are in communication connection. Figure 1 All superordinate units shown in the middle are presented by white circles. The communication network is a wired communication network, for example a fieldbus of automation technology, for example based on the protocols HART, Profibus PA / DP, Foundation Fieldbus, etc. or an Ethernet-based communication network. Alternatively, the communication network is a wireless communication network, for example an industrial wireless network, such as WirelessHART, or an IT wireless network, such as WiFi. It can also be provided that the communication network is a hybrid communication network, wherein a first part of the network segment is designed to be wireless and wherein a second part of the network segment is designed to be wired.

[0040] In order to also monitor, record and further process the data of the field devices FG outside the facility environment, the data are transmitted to a cloud-based service platform SP. On the cloud-based service platform SP one or more applications or apps are implemented with which the monitoring and further processing of the data can be realized. A user can connect via the Internet with the cloud-based service platform by means of a PC or mobile terminal device and, after successful authentication, access the applications / apps and data of the field devices.

[0041] In order to transmit the data of the field devices FG, an edge device ED is provided, which is arranged on the field level in the first facility part AT1. The edge device is either connected with the superordinate units or with the network segment of the communication network. The edge device ED is designed to extract and thus listen to the data of the field devices from the data traffic of the communication network or actively query data from the field devices FG and / or the superordinate units . For this purpose, there are profiles or so-called microservices on the edge device ED, which preset to the edge device ED which data of which field devices FG are to be listened to or queried at which frequency and how they are to be processed before transmission to the cloud-based service platform SP.

[0042] The transfer of the data of the field devices FG is effected via the first communication channel KK1 over the Internet. Specifically, data is exchanged between the first interface API1 of the edge device ED and the second interface API2 of the cloud-based service platform SP. To this end, the data of the field devices FG are incorporated in a so-called real-time list before the transfer. The real-time list contains all field devices FG that are currently in the active or defined in the edge device ED and their current data.

[0043] The data communication via the first communication channel KK1 between the edge device ED and the cloud-based service platform SP is encrypted. To this end, the edge device ED has a private key KY for the encryption. The cloud-based service platform SP has a public key KY' corresponding to the private key KY for the decryption.

[0044] For an attacker AG, there are several potential points of attack in this system in order to obtain the data of the field devices FG:

[0045] - The attacker can eavesdrop on the data communication between the edge devices and vice versa and gain knowledge of the public key KY or otherwise decrypt the encrypted data.

[0046] - The attacker can access the edge device ED via the first interface API1 and read the data directly therefrom.

[0047] - The attacker can access the edge device ED via the second interface API2 and read the data stored there.

[0048] The concept according to the application is explained below in order to reduce the risk of attacks from the outside. The concept is less concerned with making unauthorized access difficult than with confusing the attacker in the event that the attacker has already gained unauthorized access, so that the attacker does not know what to do with the data obtained.

[0049] To this end, the edge device ED creates a plurality of further field devices FG' (in Figure 1These further field devices are designed to be virtual and are not actually present in the first plant part AT1 (indicated as shaded circles). For each virtual field device FG, the edge device ED simulates data and transmits these data in real time lists to the cloud-based service platform SP. The identification of the field devices FG is here specially encrypted with the private key KY or another private key. The identification of the virtual field devices FG' is not, however, encrypted in this form and in this way. In this form and in this way, the cloud-based service platform SP can identify which field devices FG are actually contained in the plant and which field devices are virtual field devices FG' by decrypting the identification with the associated public key KY'. The users of the application / app on the cloud-based service platform are only shown the field devices FG which are actually present. However, it is not clear to an attacker who accesses the data in one of the three ways described above that most of the data is simulated data.

[0050] In order to make the degree of confusion as high as possible, the following two aspects are of particular importance:

[0051] 1.) The ratio of virtual field devices FG' to actually real field devices FG must be as high as possible. Usually, an attacker does not only need the data read from the edge device. Therefore, the attacker will try to access the sensitive data of the field devices FG, in particular the parameter settings of the field devices, via the edge device ED by means of the identification information in the real time lists. The higher the ratio (for example from a factor of 10), the less likely it is that the attacker reads data of field devices FG which are actually used in the plant.

[0052] 2.) The data of the virtual field devices FG' should not be distinguishable at first glance from the data of the real field devices FG. Therefore, the data of the virtual field devices FG' should be as trustworthy as possible. For this purpose, the software of the edge device ED accesses historical data of field devices FG which are similar to the type of the virtual field device or accesses a KI algorithm which learns with training data of the field devices. Furthermore, the type of the virtual field device must also be trustworthy and adapted to the type of the plant.

[0053] In order to further confuse and thus to increase the security, the cloud-based service platform creates a plurality of further virtual plant parts AT2', AT3', AT4'. Each of these plant parts AT2', AT3', AT4' in turn has a plurality of virtual field devices FG" and virtual superordinate units for which data are also simulated. It is not clear to an attacker which plant part AT1 is actually really present in the plant.

[0054] The system according to the application is furthermore provided to detect attacks by unauthorized persons. For this purpose, the edge device ED has a first monitoring unit IN1 and the cloud-based service platform SP has a second monitoring unit IN2. The first monitoring unit IN1 checks which field devices FG, FG' are accessed from the outside. The second monitoring unit IN2 checks which data of which field devices FG, FG', FG" are accessed on the cloud-based service platform SP. If an access or an access request to a virtual field device FG' or a further virtual field device FG" is detected by one of the two monitoring units IN1, IN2, the respective monitoring unit IN1, IN2 which detects the process creates a first or a second report RP1, RP2; the first monitoring unit IN1 creates a first report RP1 and the second monitoring unit IN2 correspondingly creates a second report RP2. The report RP1, RP2 contains information about the identity of the virtual field device FG' or the further virtual field device FG" which was accessed and the date and clock time of the access.

[0055] The respective report RP1, RP2 is transmitted from the edge device ED or the cloud-based service platform SP via a second communication channel KK2 which is different from the first communication channel KK1 to a superior unit of the first facility part AT1

[0056] Alternatively, the respective report RP1, RP2 is transmitted from the edge device ED or the cloud-based service platform SP via a third communication channel KK3 which is different from the first communication channel KK1 to an evaluation unit AE. This evaluation unit AE can in particular be established as an application program on the cloud-based service platform.

[0057] By means of the communication channel KK2, KK3 which is different from the first communication channel KK1, the attacker AE does not learn that his unauthorized access has been detected. It is thus possible to further analyze the attacker AE or to start a counterattack without the attacker AE noticing this. For example, its location and / or IP address can be detected.

[0058] The superior unit and / or the evaluation unit AE evaluates the respective report RP1, RP2 and learns measures in order to further protect the facility part AT1 or its field devices FG. For example, depending on the type of access to the virtual field device FG', FG", it can be provided that the facility personnel is informed, the respective facility part is shut down and / or the access rights to the edge device ED and / or the cloud-based service platform SP are changed or restricted.

[0059] By means of the system according to the application which implements a honeypot mechanism for a facility, it is possible to effectively prevent an attacker from reading data related to the facility or to propose and implement respective measures for further prevention.

[0060] List of reference signs

[0061] API1, API2 first and second interface

[0062] AT1, AT1', AT2', AT3', AT4' facility part

[0063] ED edge device

[0064] FG field device

[0065] FG' virtual field device FG" further virtual field device IN1 first monitoring authority IN2 second monitoring authority KK1, KK2, KK3 communication channel KY private key of the edge device KY' public key of the cloud-based service platform RP1, RP2 first and second report SP cloud-based service platform superordinate unit

Claims

1. System of automation technology, comprising: - a first facility part (AT1) composed of a plurality of field devices (FG) and superordinate units designed for detecting a measured value of at least one physical variable of a method-technical process and / or influencing at least one physical variable of a method-technical process, wherein the field devices (FG) are in communication connection with one another and with the superordinate unit via a communication network are in communication connection, wherein the field devices (FG) are designed to transmit data to the superordinate unit and wherein the superordinate unit is designed to transmit data to the field devices (FG); - an edge device (ED) which is part of a communication network, wherein the edge device (ED) is designed to listen to at least a part of the data transmitted by the field devices (FG) and by the superordinate units and / or to query further data from the field devices (FG) and / or the superordinate units , wherein the edge device (ED) is designed to generate a real-time list which contains the identification of each field device (FG) or control unit and the data currently queried or listened to, respectively, wherein the edge device (ED) is designed to simulate a plurality of virtual field devices (FG'), to generate data for the virtual field devices (FG'), to input the identification of the virtual field devices (FG') and the generated data into the real-time list and to provide the real-time list via a first interface (API1). - a cloud-based service platform (SP), wherein the edge device (ED) is in communication connection with the cloud-based service platform (SP) via a first communication channel (KK1) over the internet, wherein the edge device (ED) is designed to transfer a real-time list with current data of respectively queried or listened to data at regular time intervals to the cloud-based service platform (SP), wherein, if an attacker succeeds in hacking the connection between the edge device (ED) and the cloud-based service platform (SP), he gets a plurality of field devices (FG) and the data of these field devices are displayed, wherein only a small part of the field devices are actually installed in the first plant part (AT1) and wherein the cloud-based service platform (SP) is designed to sort and / or present the real-time list, so that the data of the virtual field devices (FG') are not considered and the user of the cloud-based service platform (SP) is only presented with the field devices (FG) actually contained in the first plant part (AT1) and their data.

2. The system of claim 1, wherein, The edge device (ED) is designed to encrypt the identification of the field devices (FG) and the virtual field devices (FG') in the real-time list by means of a public key (KY') located on the edge device (ED), wherein the cloud-based service platform (SP) is designed to decrypt the encrypted identification with a public key (KY') located on the cloud-based service platform (SP) and wherein the identification of the virtual field devices (FG') is not decryptable.

3. The system of claim 1, wherein, The cloud-based service platform (SP) is designed to simulate at least one second plant part (AT2', AT3', AT4') with a plurality of further virtual field devices (FG"), to generate data for the further virtual field devices (FG"), to input the identification of the further virtual field devices (FG") and the generated data into the real-time list and to provide the real-time list via a second interface (API2).

4. The system of any one of claims 1 to 3, wherein, The edge device (ED) or the cloud-based service platform (SP) comprises an algorithm which is designed to analyze historical data of the field devices (FG) and to generate data of the virtual field devices (FG') based on the analysis.

5. The system of any one of claims 1 to 3, wherein, The edge device (ED) or the cloud-based service platform (SP) comprises an algorithm and at least one model of a field device type, wherein the model has at least one property specific to the respective field device type and wherein the algorithm is designed to generate data of the virtual field devices (FG') using the model.

6. The system of claim 3, wherein, The edge device (ED) has a first monitoring mechanism (IN1) which is designed to detect an access or a request to at least one virtual field device (FG') from the outside via the first interface (API1) and to create a first report (RP1).

7. The system of claim 6, wherein, The cloud-based service platform (SP) has a second monitoring mechanism (IN2) which is designed to detect an access or request to at least one further virtual field device (FG") from outside via the second interface (API2) and to create a second report (RP2).

8. The system of claim 7, wherein, The first report (RP1) and / or the second report (RP2) contains an identification of the virtual field device (FG') or the further virtual field device (FG"), a timestamp of the access or request, and / or a type of the access or request.

9. The system of claim 8, wherein, The first monitoring mechanism (IN1) and / or the second monitoring mechanism (IN2) is designed to detect a further access or request to the further virtual field device (FG") after the detection and to add it to the first report (RP1) or the second report (RP2) or a further report.

10. The system of claim 9, wherein, The first monitoring means (IN1) and / or the second monitoring means (IN2) are designed to transmit the first report (RP1) or the second report (RP2) and / or the further report to the superordinate unit via a second communication channel (KK2) .

11. The system of claim 10, wherein, the superior unit is designed to evaluate the first report (RP1) or the second report (RP2) and / or the further report and to perform at least one measure based on the evaluation.

12. The system of claim 9, further comprising an evaluation unit, wherein, The first monitoring mechanism (IN1) and / or the second monitoring mechanism (IN2) is designed to transmit the first report (RP1) or the second report (RP2) and / or the further report to the evaluation unit via a third communication channel (KK3).

13. The system of claim 12, wherein, The evaluation unit is designed to evaluate the first report (RP1) or the second report (RP2) and / or the further report and to propose at least one execution measure on the basis of the evaluation of the superior unit .

14. The system of claim 11 or claim 13, wherein, The measures are at least one of the following: - switching off at least one component of the communication network; - changing or limiting access rights to the edge device (ED) and / or the cloud-based service platform (SP); - limiting communication of the edge device (ED); - informing a service person of the facility.

15. The system of claim 1, wherein, The field device (FG) is designed to transmit measured values, status values and / or diagnostic data to the superordinate unit .

16. The system of claim 1, wherein, The superior unit is designed to transmit the regulation values and / or the operating telegram to the field device (FG).

17. The system of claim 1, wherein, The first interface (API1) is an interface for application programming.

18. The system of claim 3, wherein, The second interface (API2) is an interface for application programming.

19. The system of claim 4, wherein, The algorithm is a KI algorithm.

20. The system of claim 5, wherein, The algorithm is a KI algorithm.

21. The system of claim 12, wherein, The system comprises an evaluation unit based in the cloud.

Images