Method for securely transmitting time-critical data in communication system, communication system and adapter for terminal

Abstract

The invention relates to the secure transmission of time-critical data within a communication system, the communication system comprising a plurality of local area networks (100), each comprising at least one switch (101) and a plurality of terminal devices (102-105), the communication system comprising a control unit (202), the control unit controlling the functionality of the plurality of switches and terminal devices, and the communication system comprising a control network (200), the control network is assigned to the control unit and is separate from the local area network. Communication within the local area network is implicitly authorized based on the allocation of the respective terminal devices to the same local area network. A zero-trust adapter (121, 131, 141, 151) is assigned to each terminal, the zero-trust adapter acquires status information about the terminal, forwards the status information to the control unit via the control network for evaluation, and authenticates the terminal for the control unit and / or the communication partner. The control unit determines a trust score for each terminal on the basis of the state information and uses a rule dependent on the trust score for the configuration or permissible communication relationship of the terminal.

Description

Technical Field

[0001] The invention relates to a method for securely transmitting time-critical data within a communication system, in particular a communication system for an industrial automation system, a communication system for carrying out the method and an adapter for a terminal device of the communication system. Background Art

[0002] Industrial automation systems usually include a plurality of automation devices that are networked to one another via an industrial communication network and are used to control or regulate facilities, machines or devices within the scope of manufacturing or process automation. Due to the time-critical framework conditions in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, real-time Ethernet or time-sensitive networks (TSN) are mainly used for communication between automation devices. Control services or control applications can be distributed in particular automatically and in a manner dependent on utilization to currently available servers or virtual machines of the industrial automation system.

[0003] EP 3 646 559 B1 discloses a method for checking datagrams transmitted within an industrial automation system having a plurality of automation units, wherein datagrams to be checked from the automation units are transmitted to a firewall system via corresponding firewall interfaces for checking and are checked there based on rules. The firewall system is formed by at least one virtual machine, which is provided in a data processing system comprising a plurality of computing units. For transmitting the datagrams to be checked, a protection layer tunnel is established between each firewall interface and the firewall system. In each protection layer tunnel, not only the datagrams to be checked but also at least the successfully checked datagrams are transmitted.

[0004] Document WO 2020 / 182627 A1 describes a method for monitoring the integrity of an industrial cyber-physical system, wherein measurement data or control data are provided or measured, the measurement data being detected by different sensors of the cyber-physical system and the control data being used for different actuators of the cyber-physical system. In addition, at least one measurement data association parameter is determined between the measurement data detected by different sensors, or at least one control data association parameter is determined between the control data determined for different actuators. At least one measurement data association parameter is compared with a measurement data association reference, or at least one control data association parameter is compared with a control data association reference. Based on the comparison, the integrity of the cyber-physical system to be monitored is determined.

[0005] The prior European patent application with application number 22175490.6 relates to the secure transmission of time-critical data within a communication system, the communication system comprising a plurality of local area networks, in which data are transmitted by means of switching, the communication system comprising at least one network superimposed relative to the local area networks, in which data are transmitted by means of routing, and the communication system comprising a gateway system for connecting the communication system to at least one unprotected external network. Network layer communications via the superimposed network are authorized only between authenticated system components. The switch authenticates the connected terminal devices respectively and assigns these terminal devices to a physical or logical local area network according to the respective terminal device identity. Protected layer communications within the local area network are implicitly authorized based on the assignment of the respective terminal devices to the same local area network. Communications on OSI layers 3-7 between terminal devices of different local area networks or with terminal devices in an unprotected external network are authorized by means of zero trust agents, which are respectively assigned to the local area networks.

[0006] Zero trust solutions provide that users or devices are authenticated with respect to communication partners or when accessing protected resources, independently of their respective location or environment, so that after successful authentication, for example, desired data or applications can be accessed. In industrial automation systems, the problem with the application of zero trust solutions is that not every user or every device is able to perform authentication, especially economically. The application of zero trust solutions usually requires additional cryptographic functions (such as trust anchors) and key materials (such as device certificates) or computing power, which are not always freely available in existing hardware components. In addition, existing security or communication protocols in industrial automation systems cannot be easily adapted or replaced to implement zero trust solutions.

[0007] In addition to data security, deterministic data transmission and data processing must also be ensured in the communication networks of industrial automation systems. In industrial automation systems, deterministic behavior is required in particular to ensure functional safety. However, the mutual authentication provided by the corresponding zero-trust concepts with respect to the communication partners makes deterministic data transmission and data processing difficult. Summary of the invention

[0008] The basic object of the present invention is therefore to provide a method for the secure transmission of time-critical data which can be easily integrated into existing communication systems, which method ensures data security and determinism at the same time, in particular in industrial automation systems, and to provide a suitable device for technically implementing the method.

[0009] According to the invention, this object is achieved by a method having the features specified in claim 1, a communication system having the features specified in claim 15 and an adapter having the features specified in claim 16. Advantageous developments of the invention are given in the dependent claims.

[0010] According to the method for securely transmitting time-critical data in a communication system, the communication system comprises a plurality of local area networks, a control unit and a control network assigned to the control unit, the control network being separate from the local area networks. The local area networks each comprise at least one switch and a plurality of terminal devices, wherein the control unit controls the functions of the plurality of switches and the terminal devices. Communication within the local area network is implicitly authorized based on the assignment of the respective terminal devices to the same local area network.

[0011] The switches of the local area network are preferably assigned to a software defined network (SDN), which comprises a communication control plane, referred to as a control plane, and a data transmission plane, referred to as a data plane. In this case, the control unit is assigned to the control plane, while the switches are assigned to the data plane. In particular, the control unit can predefine a flow table, from which a routing table or forwarding table for a network infrastructure device assigned to the control unit can be derived. In this case, the network infrastructure device comprises, for example, a router or a switch.

[0012] According to the present invention, a zero-trust adapter is assigned to each terminal device, which obtains status information of the terminal device, forwards the status information of the terminal device to the control unit via the control network for evaluation, and authenticates the terminal device relative to the control unit or the communication partner. The zero-trust adapter can be integrated into the corresponding terminal device as a hardware component and / or a software component, for example. According to an optional embodiment, the zero-trust adapters each include a zero-trust agent for obtaining status information integrated in each terminal device and a zero-trust interface device for authenticating the terminal device, which is separate from each terminal device. In addition, the zero-trust adapters for multiple terminal devices can also be integrated into a common zero-trust agent.

[0013] According to the invention, the control unit determines a trust score (e.g., a trust score) for each terminal device based on the status information and uses rules that depend on the trust score for the configuration of the terminal device or the permitted communication relationships. For example, according to the rules applied by the control unit, the communication relationship of the terminal device with its corresponding communication partner outside the local area network is authorized. In particular, the functions of the terminal device or the switch can be controlled according to the rules applied by the control unit. Preferably, the application of the rules that depend on the trust score is carried out only after a corresponding successful authentication of the terminal device. In the event of a failed authentication of the terminal device, a warning is advantageously issued.

[0014] By means of zero-trust adapters, the present invention enables in particular the cost-effective integration of zero-trust solutions in industrial communication or automation systems. This is particularly advantageous in existing infrastructures, the components of which cannot be easily replaced. If the zero-trust adapters each include a trust anchor for storing adapter-specific or terminal device-specific key material, the integration is further simplified. In addition, by implementing zero-trust control functions within a separate control network, it is ensured that the functions and behavior of existing industrial communication or automation systems are not adversely affected or changed. Preferably, the terminal devices are connected to the zero-trust interface device or the control network respectively via a dedicated port for this purpose.

[0015] According to a preferred embodiment of the present invention, the state information is preprocessed by the respective zero-trust adapters for the control unit. Advantageously, only the preprocessed state information or the meta-information extracted from the state information is forwarded to the control unit for evaluation. The state information may include log files, which are collected, preprocessed and forwarded to the control unit by the respective zero-trust adapters. In this way, the terminal device can be evaluated again more accurately with respect to its security state or possible security risks.

[0016] Preferably, the rules applied by the control unit according to the trust score are predefined by the security policy. These security policies define which terminal devices or users need to access which data and / or resources. This allows selective and efficient access control. Advantageously, the state information is evaluated based on the security policy by a policy decision point (PDP) assigned to the control device. Preferably, the security policy is implemented by the control device as a policy execution point.

[0017] The communication system according to the present invention is configured to execute the method according to the aforementioned embodiment and comprises a plurality of local area networks, a control unit and a control network assigned to the control unit, wherein each local area network comprises at least one switch and a plurality of terminal devices, the control unit controls the functions of the plurality of switches and the terminal devices, and the control network is separated from the local area network. Here, each local area network is implemented and configured to implicitly authorize communication within the local area network based on the assignment of the corresponding terminal device to the same local area network.

[0018] A zero-trust adapter is assigned to each terminal device of the communication system according to the invention, which is designed and configured to acquire status information of the terminal device, forward the status information of the terminal device to the control unit via the control network for evaluation, and authenticate the terminal device to the control unit or the communication partner. In contrast, the control unit is designed and configured to determine a trust score for each terminal device based on the status information and to apply rules that depend on the trust score to the configuration of the terminal device or the permitted communication relationship. Preferably, the communication system is designed and configured to authorize a communication relationship of the terminal device with a communication partner outside its corresponding local area network according to the rules applied by the control unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention will be described in more detail below with reference to the accompanying drawings.

[0020] Figure 1 A communication system is shown, the communication system having a local area network including a switch and a plurality of terminal devices, a control network, a control unit, and a zero-trust adapter integrated into the terminal device,

[0021] Figure 2 Show according to Figure 1 An optional embodiment of a communication system having a zero-trust adapter that is not fully integrated into a terminal device,

[0022] Figure 3 Show Figure 2 A detailed diagram of a terminal device of a communication system and an associated zero-trust interface device shown in FIG.

[0023] Figure 4 shows an exemplary illustration of determining a trust score for a plurality of end devices using status information,

[0024] Figure 5 Exemplary trust score-related rules applied by the control unit are shown. DETAILED DESCRIPTION

[0025] exist Figure 1 The communication system shown in FIG. 1 has, in principle, a plurality of local area networks 100, a control unit 202, and a control network 200 assigned to the control unit 202. The local area networks each include a switch 101 and a plurality of terminal devices 102-105 connected to the switch. In the present embodiment, communication within the local area network 100 is implicitly authorized based on the assignment of the corresponding terminal devices 102-105 to the same local area network. For greater clarity, in FIG. Figure 1 Only one local area network 100 is shown by way of example.

[0026] The control network 200 is advantageously completely separated from the local area network 100. To this end, the terminal devices 102-105 are connected to the control network 200 via dedicated ports 122, 132, 142, 152. Similarly, the switches 101 of the local area network 100 are connected to the control unit 202 included in the control network 200 via dedicated ports.

[0027] Terminal devices 102-105 are in particular physical or virtual hosts, which can respectively provide data and resources to other hosts. Data or resources can be allocated, for example, to services or control and monitoring applications of industrial automation systems, which are exemplary for time-critical services or applications.

[0028] In this embodiment, the terminal devices 102-105 implement the functions of a control device of an industrial automation system, such as a programmable logic controller or a field device, such as a sensor or an actuator. Here, the terminal devices 102-105 are used to exchange control and measurement variables with a machine or device controlled by the control device. The control device is particularly configured to determine a suitable control variable from the detected measurement variable.

[0029] Alternatively or additionally, the terminal devices 102-105 can each implement an operating and monitoring station and be used to visualize process data or measurement and control variables that are processed or detected by the control device or other automation device. The operating and monitoring station can be used in particular to display the values ​​of the control loop and to change the control parameters or programs.

[0030] The switch 101 and the terminal devices 102-105 of the local area network 100 are preferably assigned to a software defined network (SDN), which includes a communication control plane called a control plane and a data transmission plane called a data plane. In this case, the control unit 202 includes an SDN controller 221 and is assigned to the control plane, while the switch 101 and the terminal device 102 are assigned to the data plane. In principle, other network infrastructure devices such as routers as switches can also be assigned to the data plane. The control unit 202 can preset a flow table, especially for a router or a switch, from which a routing table or a forwarding table for the network infrastructure devices assigned to the control unit is derived.

[0031] Typically, the control unit 202 controls the functions of the plurality of switches 101, 201 and the terminal devices 102-105. Figure 1In the embodiment shown in , the control unit 202 is connected to the terminal devices 102-105 or to the zero trust adapters 121, 131, 141, 151 via the switch 201 assigned to the control network 200 and via the dedicated ports 122, 132, 142, 152, and the zero trust adapters are respectively configured for the respective terminal devices 102-105. Here, the zero trust adapters 121, 131, 141, 151 are integrated into the corresponding terminal devices 102-105 as hardware components or software components, in particular as combined hardware components and software components. Optionally, the zero trust adapters 102-105 for multiple terminal devices are combined in a common zero trust agent 110. This is in Figure 1 This is represented by the dashed line connection between the zero trust agent 110 and the dedicated ports 122, 132, 142, 152 of the terminal devices 102-105.

[0032] The zero trust adapters 121, 131, 141, 151 respectively obtain the status information of the assigned terminal devices 102-105, forward the status information to the control unit 202 via the control network 200 for evaluation, and authenticate the corresponding terminal devices 102-105 on behalf of the control unit 202 or the communication partner. The status information may in particular include log files collected by the corresponding zero trust adapter 121, 131, 141, 151 and forwarded to the control unit 202. Preferably, the status information is pre-processed by the corresponding zero trust adapter 121, 131, 141, 151 for the control unit 202. In this case, only the pre-processed status information or the meta-information extracted from the status information is forwarded to the control unit 202 for evaluation.

[0033] The control unit 202 determines a trust score (trust score) for each terminal device 102-105 based on the status information and uses rules that depend on the trust score for the configuration of the terminal device or the communication relationship allowed. In particular, according to the rules applied by the control unit 202, the communication relationship between the terminal device 102-105 and the communication partner outside the corresponding local area network 100 of the terminal device is authorized. In addition, the function of the switch 101 of the local area network 100 or the terminal device 102-105 is also controlled according to the rules applied by the control unit 202. Preferably, the application of the rules that depend on the trust score is performed only after the corresponding successful terminal device authentication. In the case of a failure in the terminal device authentication, for example, a warning can be issued separately. Optionally, when the terminal device authentication fails, the SDN controller 221 can interrupt the communication of the corresponding terminal device via the data plane, that is, actively intervene in the communication.

[0034] The rules applied by the control unit 202 are in particular preset by security policies. In the present embodiment, these security policies manage and define which terminal devices or users need to access which data or resources by means of a policy administration point (PAP) 223 integrated in the control unit 202. Here, the state information is evaluated based on the security policy by a policy decision point (PDP) 222 included by the control unit 202. The security policy is implemented by the SDN controller 221 as a policy enforcement point (PEP).

[0035] according to Figure 2 In the optional embodiment shown in , the control unit 202 is connected to the dedicated ports 122, 132, 142, 152 of the terminal devices 102-105 via the switch 201 of the control network 200 and via the zero-trust interface devices 121b, 131b, 141b, 151b. In this embodiment, the zero-trust adapters each include a zero-trust agent 121a, 131a, 141a, 151a integrated into the corresponding terminal device 102-105 to obtain state information and a zero-trust interface device 121b, 131b, 141b, 151b separated from the corresponding terminal device 102-105, and the zero-trust interface device authenticates the terminal device 102-105.

[0036] Figure 3 The following is shown in detail by way of example Figure 2 In addition to the dedicated port 1211 for the assigned terminal device 102, the dedicated port 1212 for controlling the network 200, and the control module 1213, the zero trust interface device 121b also includes a trust anchor 1214 for storing adapter-specific key materials or terminal device-specific key materials. Such a trust anchor can also be integrated into Figure 1 In the zero trust adapter 121, 131, 141, 151 of the communication system shown in FIG. In summary, the key material for authenticating the terminal device 102-105 does not need to be stored there, but can be reliably managed by the correspondingly assigned zero trust adapter 121, 131, 141, 151 or the corresponding zero trust interface device 121b, 131b, 141b, 151b.

[0037] In order to determine a trust score (trust score) based on the status information of a plurality of example terminal devices, according to Figure 4On the one hand, network configuration data, such as network adapter ID (identification) 401 and IP (Internet Protocol) address 402, can be evaluated, and on the other hand, software installation data, such as operating system 403, operating system version 404, software version 405 of each zero trust adapter or zero trust agent, installed virus scanner 406 and the last scan result 407, can be evaluated. Based on these data, a trust score 408 of each terminal device is calculated. In this embodiment, a relatively low trust score of 50 is calculated for the first terminal device based on an older operating system version, while a higher trust score of 85 is determined for the second terminal device with a newer operating system version. For a third terminal device with an older operating system version but with an installed virus scanner and a positive last scan result, a higher trust score of 85 can also be calculated. The way of calculating the trust score can in principle be adapted to the individual application requirements.

[0038] Figure 5 Four trust score-dependent rules are shown by way of example, which are applied by the control unit. Here, the rule ID 501, the source IP address 502, the destination IP address 503, the destination port 504, the communication protocols 505 permitted by the respective rule, and the trust score threshold 506 are of interest. According to rule 1, a terminal device with a determined trust score of at least 80 is permitted to communicate with a terminal device with IP address 10.10.1.20 via the communication protocol OPC UA and the destination port 4840. In contrast, according to rule 2, a terminal device with a determined trust score of at least 65 is permitted to communicate with a terminal device with IP address 10.10.1.20 only via the communication protocol DCOM and the destination port 135.

[0039] According to rule 3, a terminal device with a determined trust score of at least 70 is allowed to communicate with a terminal device with IP address 10.10.1.25 via the communication protocol OPC UA and the target port 4840. Furthermore, rule 4 stipulates, for example, that if the trust score calculated for the terminal device with IP address 10.10.1.25 is at least 85, communication is allowed between the terminal device with IP address 10.10.1.25 and the terminal device with IP address 10.10.1.30 via the communication protocol OPC UA and the target port 4840.

[0040] According to the above rules, communication is in principle blocked for terminal devices with a calculated trust score lower than the corresponding trust score threshold. In order to avoid conflicts between rules, their application is advantageously prioritized according to the rule ID. The rules applied by the control unit can in principle also be adapted to the individual application requirements.

Claims

1. A method for securely transmitting time-critical data within a communication system, wherein: - the communication system comprises a plurality of local area networks (100), each of the local area networks comprising at least one switch (101) and a plurality of terminal devices (102-105), the communication system further comprises a control unit (202), the control unit controls the functions of the plurality of switches and the terminal devices, and the communication system comprises a control network (200), the control network being assigned to the control unit and being separate from the local area networks, - implicit authorization of communication within said local area network based on the assignment of the respective said terminal device to the same local area network, - assigning a zero-trust adapter (121, 131, 141, 151) to each terminal device, said zero-trust adapter acquiring status information about said terminal device, forwarding said status information via said control network to said control unit for evaluation, and authenticating said terminal device to said control unit and / or a communication partner, The control units each determine a trust score for the terminal based on the status information and apply rules that depend on the trust score for the configuration of the terminal and / or the permitted communication relationships.

2. The method according to claim 1, wherein: According to the rules applied by the control unit (202), a communication relationship between the terminal (102-105) and a communication partner outside the corresponding local area network (100) of the terminal is authorized.

3. The method according to any one of claims 1 or 2, wherein: The state information is preprocessed (202) by the respective zero trust adapter (121, 131, 141, 151) for the control unit, and only the preprocessed state information and / or meta-information extracted from the state information is forwarded to the control unit for evaluation.

4. The method according to any one of claims 1 to 3, wherein: The terminal devices (102-105) are each connected to a zero-trust interface device (121b, 131b, 141b, 151b) and / or the control network (200) via a dedicated port (122, 132, 142, 152).

5. The method according to any one of claims 1 to 4, wherein: The zero trust adapters (121, 131, 141, 151) are each integrated into the corresponding terminal devices (102-105) as a hardware component and / or a software component.

6. The method according to any one of claims 1 to 4, wherein: The zero trust adapters each include a zero trust agent (121a, 131a, 141a, 151a) integrated into the corresponding terminal device (102-105) for acquiring the status information and a zero trust interface device (121b, 131b, 141b, 151b) separated from the corresponding terminal device for authenticating the terminal device.

7. The method according to any one of claims 1 to 4, wherein: The zero trust adapters for multiple end devices (102-105) are combined in a common zero trust agent (110).

8. The method according to any one of claims 1 to 7, wherein: The zero trust adapters each include a trust anchor for storing adapter-specific and / or end-device-specific key material.

9. The method according to any one of claims 1 to 8, wherein: The rules are preset by a security policy, which defines which terminal devices and / or users need to access which data and / or resources.

10. The method according to claim 9, wherein: The status information is evaluated based on the security policy by a policy decision point assigned to the control device, and the security policy is executed by the control device as a policy execution point.

11. The method according to any one of claims 1 to 10, wherein: Functions of the terminal and / or the switch are controlled in accordance with the rules applied by the control unit.

12. The method according to any one of claims 1 to 11, wherein: The rules depending on the trust score are applied only after a respective successful authentication of the end device, and a warning is issued in each case in the event of an erroneous authentication of the end device.

13. The method according to any one of claims 1 to 12, wherein: The switch (101) of the local area network (100) is assigned to a software-defined network, which comprises a communication control plane called control plane and a data transmission plane called data plane, wherein the control unit (202) is assigned to the control plane and wherein the switch (101) is assigned to the data plane.

14. The method according to claim 13, wherein: The control unit (202) is capable of presetting a flow table, from which a routing table and / or a forwarding table for a network infrastructure device (101) assigned to the control unit is derived, wherein the network infrastructure device comprises a router and / or a switch.

15. A communication system for securely transmitting time-critical data, comprising: - a plurality of local area networks (100) each comprising at least one switch (101) and a plurality of terminal devices (102-105), a control unit (202) for controlling the functions of the plurality of switches and the terminal devices, and a control network (200) assigned to the control unit and separate from the local area networks, - in, said local area networks are each implemented and arranged to ensure that communication within the respective said local area network is implicitly authorized based on the assignment of the respective said terminal device to the same local area network, - wherein the terminal devices are each assigned to a zero trust adapter (121, 131, 141, 151), which is implemented and configured to obtain status information about the terminal devices, forward the status information via the control network to the control unit for evaluation, and authenticate the terminal device to the control unit and / or a communication partner, wherein the control units are each designed and configured to determine a trust score for the terminal based on the status information and to apply rules dependent on the trust score to the configuration of the terminal and / or permitted communication relationships.

16. An adapter for a terminal device of a communication system according to claim 15, - in, The adapter is implemented and configured to be assigned to an end device as a zero trust adapter, and - in, The adapter is also designed and configured to acquire status information about the terminal, forward the status information about the terminal via the control network to a control unit for evaluation, and authenticate the terminal to the control unit and / or a communication partner.

Images