Method and monitoring system for monitoring access to software of a control system

Abstract

The control system (1) comprises at least one cabinet (3) containing hardware components (5) comprising or providing access to software components. The monitoring method comprises the following steps: determining a plurality of physical intrusion modes of the software component which is expected to be monitored; providing tamper-resistant elements (23) at respective defined marking positions on the hardware component (5) and / or the cabinet (3), each tamper-resistant element (23) having a unique identification code, the marking positions being selected such that intrusion by one of the physical intrusion modes causes at least one of the tamper-resistant elements (23) to be damaged; -storing, in a database (35), a reference state comprising the unique identification code of the tamper-resistant element (23) and the corresponding marking position; and-during the monitoring phase, checking at least some of the marker positions and comparing with a reference state.

Description

Technical Field

[0001] The present invention is a means of preventing undetected physical intrusions on a control system. It relates to a method for monitoring access to the software of a control system of an industrial installation. Background Art

[0002] In sensitive facilities such as nuclear facilities, it is necessary to control access to software elements implemented in the control systems. Cyber ​​attacks performed using malware introduced in the software elements must be prevented as they could lead to potentially catastrophic failures in the facility.

[0003] One possibility for controlling access to software elements is to grant physical access only to properly authorized persons. However, even with very strict procedures, there is still the possibility that an unauthorized person could gain physical access to the room housing the hardware components and modify the software elements without being noticed.

[0004] When an intrusion is detected, it may be difficult to understand in this case how the software component was accessed and what was done. Summary of the invention

[0005] The invention therefore proposes a method allowing better monitoring of access to the software of a control system of an industrial installation.

[0006] The approach also provides information to guide analysis so that relevant plans of action can be established in the event of an intrusion.

[0007] According to a first aspect, the invention relates to a method for monitoring access to software of a control system of an industrial installation, the control system comprising at least one cabinet containing hardware components, the hardware components comprising software components or providing access to software components, the monitoring method comprising:

[0008] - Identify various ways of physical intrusion into the software component for which you wish to monitor;

[0009] - providing tamper-proof elements at defined marking locations on the hardware component and / or on the cabinet, each tamper-proof element having a unique identification code, said marking locations being selected such that an intrusion by one of said physical intrusion means results in at least one of the tamper-proof elements being damaged;

[0010] - storing in a database a reference state comprising a unique identification code of the tamper-proof element and a corresponding marking position; and

[0011] - During the monitoring phase, at least some of the marking positions are checked and compared with a reference state.

[0012] Since the marker locations are determined based on a thorough analysis of how the software component can be physically hacked, they are appropriately positioned. Physical hacking of the software component is not possible without removing one of the tamper-resistant elements or damaging one of the tamper-resistant elements.

[0013] A damaged tamper-proof element is immediately visible to the operator. For example, the message "Framatome Opened" appears on the tamper-proof element.

[0014] A missing tamper-proof element can be detected when compared with a reference state.Each tamper-proof element has a unique identification code, and all identification codes are recorded in a database.

[0015] If an intruder replaces the original tamper-proof element with another tamper-proof element with another identification code, this replacement is easily detected when compared with the reference state.

[0016] The method can be applied throughout the life cycle of a control system, from the manufacture of the cabinet containing the hardware components to the commissioning of the control system, and later during the operational life of the control system.

[0017] Furthermore, the method allows companies manufacturing control systems to provide proof of the integrity of software components when the control system is delivered to the client, including during industrial commissioning.

[0018] In the event of an intrusion, the method of the present invention helps understand how the intruder penetrated the software component and the timing of the intrusion.

[0019] The method may exhibit one or more of the following characteristics:

[0020] During the monitoring phase, checking at least some of the marking locations comprises one or more of the following operations:

[0021] * checking the physical integrity of a tamper-proof element arranged at said marking location;

[0022] * checking whether the identification code of the tamper-proof element arranged at the marking position corresponds to the identification code in the reference state;

[0023] * Check if tamper-proof elements are missing compared to the reference state;

[0024] - During the monitoring phase, checking at least some of the marker positions comprises the following operations:

[0025] * Provide new tamper-proof elements at given marking locations;

[0026] * Update reference status in database.

[0027] - the or each cabinet comprises an external body and at least one door mounted on the external body and allowing access to some of the hardware components, one of the tamper-proof elements bridging the external body and the door;

[0028] - the or each cabinet comprises a chassis to which the hardware components are removably mounted, the tamper-proof elements at the marked locations being arranged to:

[0029] *Bridge two hardware components;

[0030] *Bridge a hardware component among hardware components and chassis;

[0031] * Close at least one port of one of the hardware components;

[0032] *Bridging a hardware component having a port and a connector that plugs into the interior of said port;

[0033] - The electronic reader is configured to perform at least one of the following operations:

[0034] * Read the identification code of the tamper-proof element;

[0035] * Provides the marker position associated with the identification code in the reference state;

[0036] * Recording the identification code of the tamper-proof element associated with a given marking position in the reference state.

[0037] The method comprises dividing the control system into a number of zones and each zone into a number of sub-zones, each zone comprising at least one cabinet, each sub-zone comprising a tag location accessible through a given door of a given cabinet, an electronic reader being used to perform the following operations:

[0038] * Read the identification codes of all tamper-proof elements arranged in the sub-areas;

[0039] * Compares with a reference state and indicates if the tamper-proof element is missing;

[0040] - The monitoring phase includes one or more of the following periods:

[0041] * a storage period at a manufacturing location where at least one cabinet is manufactured;

[0042] * a delivery period during which at least one cabinet 3 is transported from a manufacturing location to an industrial installation;

[0043] * the period of storage at the industrial plant prior to installation in the industrial plant;

[0044] * Installation period for installing at least one cabinet in an industrial installation;

[0045] * The operating period during which at least one cabinet is in operation;

[0046] - In the reference state, each marked position is recorded as either in service or out of service, during the monitoring phase only the marked positions recorded as in service are checked.

[0047] According to a second aspect, the invention relates to a monitoring system for monitoring access to software of a control system of an industrial installation, the monitoring system comprising at least one cabinet containing hardware components, the hardware components comprising software components or providing access to software components, the monitoring system comprising:

[0048] - a database recording the locations of markings on hardware components and / or on cabinets;

[0049] - tamper-proof elements, each tamper-proof element being arranged at one of the marking locations, each tamper-proof element having a unique identification code;

[0050] The marking position is selected so that intrusion into the software component by a plurality of physical intrusion methods results in damage to at least one of the tamper-resistant elements;

[0051] The database stores a reference state including a unique identification code of the tamper-proof element and a corresponding marking position.

[0052] A monitoring system may exhibit one or more of the following characteristics:

[0053] The monitoring system includes an electronic reader configured to perform at least one of the following operations:

[0054] * Read the identification code of the tamper-proof element;

[0055] * Provides the marker position associated with the identification code in the reference state;

[0056] * Record the identification code of the tamper-proof element associated with a given marking position in the reference state.

[0057] the cabinet or each cabinet comprises an external body and at least one door mounted on the external body and allowing access to some of the hardware components, the control system being divided into a number of areas and each area being divided into a number of sub-areas, each area comprising at least one cabinet, each sub-area comprising a marked location accessible through a given door of a given cabinet, the electronic reader being adapted to perform the following operations:

[0058] * Read the identification codes of all tamper-proof elements arranged in the sub-areas;

[0059] *Compares to a reference state and indicates if the tamper-proof element is missing.

[0060] -When performing an inspection of a given area / sub-area, the monitoring system is programmed to record the following information:

[0061] * all operations performed at any given marked location, including: checking the marked location and comparing with a reference state, removing the tamper-proof element associated with the marked location and placing a new tamper-proof element at the marked location;

[0062] * the area, sub-area, cabinet, tamper-resistant element associated with said given marked location;

[0063] * an indication of whether the given marking position is non-compliant, the given marking position being considered non-compliant if the associated tamper-resistant element is missing or damaged, or if the identification code of the tamper-resistant element at the marking position does not correspond to the identification code recorded in the reference state;

[0064] * The date and time each action was performed;

[0065] * The identity of the operator who performed each operation.

[0066] -The monitoring system is programmed to:

[0067] * Extract data from database;

[0068] * Extract reference status from database;

[0069] * Generate detailed reports containing all information recorded during a given inspection;

[0070] * Generates a collection related to the control system with a detailed report of the tag location that mentions at least one non-compliance.

[0071] - In the reference state, each marked position is recorded as either in service or out of service. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Other characteristics and advantages of the invention will become apparent from the following detailed description of an embodiment given as a non-limiting example with reference to the accompanying drawings:

[0073] - Figure 1 A view of a portion of a control system to be monitored;

[0074] - Figure 2 and Figure 3 shows an undamaged and damaged tamper-resistant element, respectively;

[0075] - Figure 4 Depicted arranged in Figure 1a plurality of tamper-resistant elements at marked locations on one of the cabinets shown above; and

[0076] Figure 5 Schematic diagram of the monitoring system of the present invention. DETAILED DESCRIPTION

[0077] The method described below is used to monitor access to software of a control system of an industrial installation.

[0078] The industrial installation is, for example, a nuclear facility such as a nuclear reactor, a nuclear fuel manufacturing plant, a nuclear fuel reprocessing plant, and the like.

[0079] Alternatively, the installation is a non-nuclear facility, where penetration of the control system could lead to potential danger to humans, the environment, or could be detrimental to the economic interests of the installation owner. The installation may belong to the chemical industry, agrochemical industry, pharmaceutical industry, petrochemical industry, etc.

[0080] A control system is a system of an industrial plant that controls the operation of process equipment or safety equipment or any other equipment that is critical to the safe operation of the industrial plant.

[0081] In a nuclear reactor, the method is particularly suitable for monitoring access to the software of a control system that controls the operation of the core of the nuclear reactor. The control system controls at least the control rods driven into the core to regulate the reactivity of the nuclear fuel and to shut down the nuclear reactor in an emergency.

[0082] like Figure 1 As shown, the control system 1 comprises at least one cabinet 3 containing hardware components 5. The hardware components 5 include software components or provide access to software components.

[0083] In industries with critical processes, the control system consists of several control subsystems. The subsystems are redundant and independent of each other. They are located in separate electrical rooms.

[0084] Each system 1 or subsystem usually includes several cabinets 3, such as Figure 1 The cabinets 3 are located in the same room or accommodated in different rooms.

[0085] Hardware component 5 is:

[0086] - a component comprising a memory loaded with a software program, such as a central unit or an EPROM (Erasable Programmable Read Only Memory);

[0087] - components comprising integrated circuits, such as ASICs (application specific integrated circuits);

[0088] -Having a connector or communication port 7 providing access to software components Figure 4 )

[0089] -Computer; etc.

[0090] Each cabinet 3 comprises an external body 9 and at least one door 11 mounted on the external body 9 and allowing access to some of the hardware components 5 .

[0091] The outer body 9 and the at least one door 11 completely surround the hardware component 5. In other words, the hardware component 5 can be accessed only when the door 11 is open.

[0092] The door 11 is, for example, a front door hinged to the outer body 9 .

[0093] The door 11 is alternatively hinged or removably mounted to a side panel or a rear panel of the outer body 9 .

[0094] Each cabinet 3 comprises a single door 11 , or alternatively several doors 11 , each door allowing access to several hardware components 5 .

[0095] like Figure 4 As shown, the cabinet 3 includes a chassis 12 disposed inside an outer body 9. The hardware component 5 is removably mounted to the chassis 12.

[0096] In the example shown, the chassis 12 includes several racks 13. The hardware components 5 are distributed on the several racks 13.

[0097] In addition to the hardware components 5 which comprise software components or provide access to software components, the cabinet 3 also accommodates other hardware components 14 which comprise no software components and do not provide access to software components.

[0098] The control system 1 further comprises a cabinet 3 housing a test device 15. The cabinet 3 is mobile, since the test setup 15 is used to test all subsystems and has to be transported between several rooms.

[0099] The test device 15 comprises a computer 17. The test device 15 has a front door (not shown) for accessing a screen 19 and a keyboard 21 of the computer 17, and a rear door (not shown) for accessing connectors of the computer 17.

[0100] The purpose of the monitoring method is to detect physical intrusions into the software components of the control system 1 .

[0101] Physical intrusion can be, for example:

[0102] - an intruder accesses the hardware component 5 and modifies or replaces the software components included in the hardware component 5;

[0103] - an intruder accesses the hardware component 5 and replaces the original hardware component 5 with another hardware component including a software component with malware;

[0104] An intruder accesses a connector or a communication port 7 of a hardware component 5 and modifies or replaces a software component comprised in another hardware component 5 .

[0105] The monitoring method comprises a first stage of determining a plurality of ways of physical intrusion into a software component for which monitoring is desired.

[0106] This phase is often referred to as the engineering phase.

[0107] Said phases are usually performed during the design of the control system 1, before the control system is manufactured.

[0108] A physical intrusion method is a method in which an intruder can physically access a hardware component containing a software component, or can physically access a connector or communication port that provides access to a software component. The physical intrusion method includes a series of operations that an intruder must perform to access a hardware component, communication port, or connector, given the physical design of the cabinet 3.

[0109] The first stage also includes defining marked locations on the hardware component 5 and / or cabinet 3 where the tamper-proof elements 23 are to be placed. The marked locations are selected so that an intrusion by one of the physical intrusion methods causes at least one tamper-proof element 23 to be damaged.

[0110] The first stage advantageously consists in dividing the control system 1 into several areas and in dividing each area into several sub-areas, each area comprising at least one cabinet 3 .

[0111] Advantageously, each sub-area comprises a marking location accessible through a given door 11 of a given cabinet 3 .

[0112] Thus, each marked position belongs to an identified sub-region and each sub-region belongs to an identified region.

[0113] The first stage also includes creating a database 35, which includes all marked positions, as well as the corresponding sub-regions to which the marked positions belong and the corresponding regions to which the sub-regions belong.

[0114] like Figure 5 As shown, the database 35 is stored in a central server 37 .

[0115] The central server 37 is located, for example, in an engineering center 39 where the first phase takes place. Alternatively, the central server 37 is located at an industrial installation 41 .

[0116] The monitoring method further comprises providing tamper-proof elements 23 at previously determined respective defined marking positions on the hardware component 5 and / or the cabinet 3 .

[0117] Each tamper-proof element 23 has a unique identification code. The identification code is usually an alphanumeric sequence.

[0118] Figure 2 An example of a tamper-proof element 23 is shown in FIG.

[0119] The tamper-evident element is embedded in the label printed on paper or plastic.

[0120] It carries a unique identification code 25 on its visible face.

[0121] It carries a QR code 27 encoding a unique identification number.

[0122] It carries a hologram 29, making the element tamper-proof. The element cannot be reproduced on a color printer.

[0123] The name of the company that manufactured the control system may also be indicated.

[0124] The tamper-proof element 23 is affixed to the hardware component 5 and / or the cabinet 3. When the tamper-proof element 23 is removed from the surface to which it is affixed, the bottom layer of the tamper-proof element 23 deteriorates and an inscription appears.

[0125] After removal, the tamper-proof element 23 has Figure 3 The appearance shown. Due to the absence of the bottom layer, the text 31 appears through the visible surface of the tamper-proof element 23.

[0126] In the example shown, the words "XXXXXXXXXX" appear on the visible surface.

[0127] This allows detection that the tamper-proof element has been removed from the marked position where it was originally arranged.

[0128] The tamper-proof element 23 is first arranged at the marked position after the manufacture of the corresponding cabinet 3 is completed. The corresponding cabinet 3 is a cabinet in which the tamper-proof element 23 is arranged, or a cabinet that accommodates the hardware component 5 in which the tamper-proof element 23 is arranged.

[0129] They are preferably provided in the facility where the cabinets 3 are manufactured and then transported to the industrial installation.

[0130] Typically, for each cabinet 3, one of the tamper-proof elements 23 bridges the gap between the outer body 9 and the door 11 (eg, Figure 1 The tamper-proof element is referred to as the door tamper-proof element, and the corresponding marking position is referred to as the door marking position.

[0131] More precisely, when the cabinet 3 comprises several doors 11 , the anti-tampering element 23 bridges the external body 9 and each door 11 .

[0132] Bridging here means that a portion of the tamper-proof element 23 is attached to the outer body 9 and another portion is attached to the door 11. In order to open the door 11 and access the hardware components within the cabinet 3, an intruder must remove the tamper-proof element from the door or from the outer body 9.

[0133] Inside the cabinet 3, an anti-tamper element 23 is arranged at a marked position, such as Figure 4 As shown:

[0134] - bridges two hardware components 5;

[0135] - bridge a hardware component 5 and a hardware component 14;

[0136] - bridge a hardware component 5 and a chassis 12;

[0137] - Closing at least one port 7 of one of the hardware components 5 .

[0138] Here, bridging has the same meaning as before.

[0139] When an intruder wants to remove a hardware component 5 from the chassis 12 , he has to remove at least one tamper-proof element 23 from said hardware component 5 or from an adjacent hardware component 5 , 14 or from the chassis 12 .

[0140] When an intruder wants to access the communication port 7 , he must first at least partially remove the tamper-proof element 23 .

[0141] When the marking position corresponds to a communication port in which the connector is engaged (a situation not shown in the figure), the tamper-proof element 23 is arranged so that it bridges the connector and the hardware component 5 on which the communication port is arranged.

[0142] When an intruder wants to remove the connector from the communication port in order to access the communication port or the connector, he has to remove the tamper-proof element 23 from the connector or from the hardware component 5 .

[0143] The monitoring method further comprises storing a reference state in a database, the reference state comprising the unique identification codes of all tamper-resistant elements placed on the cabinet 23 and the corresponding marking positions.

[0144] This operation is performed by an operator when the tamper-proof element 23 is arranged at the corresponding marking position.

[0145] The reference state is recorded immediately after the tamper-proof element is initially placed at the marked location. The reference state is later updated when the tamper-proof element is removed or replaced.

[0146] This operation is advantageously performed using an electronic reader 33 as will be described further below.

[0147] The electronic reader 33 is a mobile electronic device, usually a tablet device, a mobile phone, a mobile computer, etc.

[0148] The operator must perform at least the following operations:

[0149] - reading the identification code of the tamper-proof element 23;

[0150] - Recording of the identification code of the tamper-proof element 23 and the associated marking position in the reference state.

[0151] The operation is repeated for all tamper-resistant elements 23 .

[0152] The reading is performed using the electronic reader 33 , by scanning the QR code, or by recognizing an identification code written on the visible face of the tamper-proof element 23 , or by manually entering the identification code using a keyboard, or by any other means.

[0153] The recording is done automatically by transmitting the data to a central server 37 and implementing routines designed specifically for said recording.

[0154] After recording, the reference status includes:

[0155] - a list of areas controlling the system 1;

[0156] - for each region, a list of sub-regions belonging to that region;

[0157] - for each sub-region, a list of marker locations belonging to that sub-region;

[0158] - For each marking position, the identification code of the corresponding tamper-proof element 23 .

[0159] Furthermore, in the reference state, each marked position is recorded as being in service or out of service. The state of each marked position (in service or out of service) is initially selected, for example, by an administrator of the database, who is typically a network security officer of the industrial installation. It can be updated later by an operator reading the identification code for the reference state. This allows the reference state to be configured when the control system is gradually commissioned on site.

[0160] For example, if the marked location is extended on a non-existent hardware component 5, or when the hardware component has no software component loaded, etc., the marked location is recorded as out of service.

[0161] The marked position recorded as out of service has no tamper-proof element 23 and does not belong to the reference state.

[0162] The monitoring method further comprises a monitoring phase comprising checking at least some of the marking positions and comparing them with a reference state.

[0163] This check is performed by an operator, advantageously using an electronic reader 33 .

[0164] This check is repeated periodically.

[0165] The monitoring phase includes one or more of the following periods:

[0166] - a storage period at a manufacturing site where at least one cabinet 3 is manufactured;

[0167] - a delivery period during which at least one cabinet 3 is transported from a manufacturing location to an industrial installation;

[0168] - the storage period at the industrial plant before installation in the industrial plant;

[0169] - an installation period for installing at least one cabinet 3 in an industrial installation;

[0170] - An operating period during which at least one cabinet 3 is operated.

[0171] Preferably, the monitoring phase includes all the above time periods.

[0172] Checking at least some of the marker locations includes one or more of the following operations:

[0173] - Checking the physical integrity of the tamper-proof element 23 arranged at the marking location;

[0174] - checking whether the identification code of the tamper-proof element 23 arranged at the marking position corresponds to the identification code of the reference state;

[0175] - Check whether the tamper-proof element 23 is missing compared to a reference state.

[0176] Only the marked locations that are logged as being in service are checked during the monitoring phase.

[0177] If the tamper-proof element 23 is damaged or missing, or if the identification code of the tamper-proof element 23 does not correspond to the identification code recorded in the reference state, the marking position and the corresponding tamper-proof element are considered "non-compliant". The network security event is declared and recorded by the operator. At least the following information is recorded: the marking position of the non-compliant tamper-proof element 23, the non-compliant type, and the identification code of the non-compliant tamper-proof element 23.

[0178] This check is performed by an operator and is aided by a monitoring system. The monitoring system is a traceability tool. The electronic reader 33 is part of the traceability tool. The monitoring system is described below.

[0179] More precisely, during the checking operation, the operator first checks the integrity of the door anti-tampering element 23 of one or several sub-areas.

[0180] If a door tamper-proof element 23 of a sub-area is "non-compliant", it is necessary to check the integrity of all tamper-proof elements 23 placed in the sub-areas accessible through this door.

[0181] As a reminder, non-compliant tamper-proof elements 23 may be:

[0182] Lost;

[0183] ·damage;

[0184] Replaced by another tamper-proof element 23 (identification code inconsistent with reference state).

[0185] Checking the integrity of all tamper-resistant elements 23 placed in a sub-area comprises the following initial actions:

[0186] · Use traceability tools to record the location of the mark where the non-compliant door tamper-proof element 23 was detected;

[0187] If the door tamper-proof element 23 is still present, use the electronic reader 33 to scan and record the identification code of the non-compliant door tamper-proof element 23;

[0188] Use the traceability tool’s drop-down menu to record the type of non-compliance;

[0189] Declare and record cybersecurity incidents to the organization;

[0190] · Information release of the event file number declared in the traceability tool.

[0191] All tamper-proof elements 23 present in the sub-area are then checked. If the operator forgets to check a marking position, the traceability tool notifies the operator of the oversight. The operator checks the forgotten tamper-proof element 23. The information listed above is recorded for all non-compliant marking positions.

[0192] At the end of the inspection, all marked locations that were declared non-compliant were obtained.

[0193] A new tamper-proof element 23 is placed at the non-compliant marked location and the database is updated with the identification code of the new tamper-proof element 23 .

[0194] To this end, the operator performs the following processing:

[0195] Specifying marking locations on traceability tools;

[0196] · Placing the new tamper-proof element 23 at the designated marked position;

[0197] • Scan the identification code of the new tamper-proof element 23 using the electronic reader 33 .

[0198] In other words, during the monitoring phase, checking at least some of the marker locations involves the following operations:

[0199] - removing the tamper-proof element 23 at a given marked position;

[0200] - Updating the reference status in the database 35.

[0201] The tamper-proof element 23 is removed because it is damaged or because a physical intervention is required on the corresponding hardware component 5 .

[0202] During the monitoring phase, checking at least some of the marker locations also includes the following operations:

[0203] - providing a new tamper-proof element 23 at a given marking location;

[0204] - Updating the reference status in the database 35.

[0205] For example, when the marking position is changed from the "out of service" state to the "in service" state, or when a damaged tamper-proof element 23 is replaced, a new tamper-proof element 23 is provided.

[0206] After each inspection operation, the traceability tool generates a control report. The following elements are present in the report:

[0207] - the name of the control system checked during the inspection operation;

[0208] - Check summary status: normal (OK) or abnormal (NOK)

[0209] - The date and time the inspection started, and the time the inspection ended

[0210] - Name of the operator who performed the inspection

[0211] -For all marker positions checked:

[0212] oIdentification of the marking position

[0213] oThe identification code of the tamper-proof element present at the marking location

[0214] - In case of non-compliance detected:

[0215] oMarked positions detected as non-compliant

[0216] oReasons for non-compliance

[0217] oIdentification code of the non-compliant tamper-proof element

[0218] oIdentification code of the new tamper-proof element placed to protect the location.

[0219] For each marking position in a sub-area, the control report comprises a note about the marking position and / or the condition of the tamper-proof element 23 arranged at said marking position.

[0220] If the conditions at all marked positions are the same as those recorded in the reference state, the inspection result is normal (OK). If the conditions at at least one marked position are different from those recorded in the reference state, the inspection result is abnormal.

[0221] If the tamper-proof element is missing, damaged, has an identification code that is different from the identification code recorded in the reference state, the situation at a given marking position is different.

[0222] The annotation for each marked position indicates the state at the marked position compared to a reference state.

[0223] The annotation may indicate that a new tamper-resistant element has been provided but is not referenced in the reference state, or that an existing tamper-resistant element was removed.

[0224] An annotation indicates whether the marked location is out of service.

[0225] Periodically, the history of the control system 1 may be emitted by a traceability tool.

[0226] History is a chronological list of the following events:

[0227] - placing or removing a tamper-proof element at the marked location;

[0228] - all operations performed by the operator during the inspection;

[0229] - Detected issues: tamper-proof element missing, damaged, inconsistent with the reference state;

[0230] - The status of the marked position that transitions between in-service and out-of-service.

[0231] The monitoring system 43 will now be described.

[0232] Monitoring systems are traceability tools.

[0233] The monitoring system 43 is used to monitor access to the software of the control system 1 of the industrial device.

[0234] The control system 1 comprises at least one cabinet 3 containing hardware components 5 which comprise software components or provide access to software components.

[0235] The control system 1 is as described above.

[0236] The monitoring system 43 is specially designed to implement the above monitoring method. In other words, the above monitoring method is particularly suitable for being executed by the monitoring system 43.

[0237] The monitoring system 43 comprises:

[0238] - a database 35 which records the locations of markings on the hardware components 5 and / or the cabinet 3;

[0239] - Tamper-proof elements 23, each of which is arranged at one of the marking locations, each having a unique identification code.

[0240] The marking positions are selected such that an intrusion into the software component by various physical intrusion methods results in at least one of the tamper-proof elements 23 being damaged.

[0241] The tamper-proof element 23 is as described above.

[0242] The marking positions are as described above.

[0243] The database 35 stores reference states including the unique identification code of the tamper-proof element 23 and the corresponding marking position.

[0244] In the reference state, each marked position is recorded as either in service or out of service.

[0245] The database 35 is as described above.

[0246] The monitoring system 43 includes an electronic reader 33 configured to perform at least one of the following operations:

[0247] - reading the identification code of the tamper-proof element 23;

[0248] - providing a marking position associated with an identification code in a reference state;

[0249] - Recording the identification code of the tamper-proof element 23 associated with a given marking position in the reference state.

[0250] The electronic reader 33 is also used to perform the following operations:

[0251] - reading the identification code of the tamper-proof element 23 removed from a given marking location;

[0252] - Updating the reference state in the database 35 with the indication that the tamper-proof element 23 is removed and no tamper-proof element is arranged in the marked position.

[0253] The electronic reader 33 is also used to perform the following operations:

[0254] - reading the identification code of the new tamper-proof element 23 provided at a given marking position;

[0255] - Updating the reference state in the database 35 by associating the identification code with the marked position.

[0256] The electronic reader 33 is also used to perform the following operations:

[0257] - reading the identification codes of all tamper-proof elements 23 arranged in a sub-area;

[0258] - Compares with a reference state and indicates if the tamper-proof element 23 is missing.

[0259] The monitoring system 43 generally comprises several electronic readers 33, making it possible to perform several operations simultaneously in the device.

[0260] As mentioned above, each electronic reader 33 is a mobile electronic device, usually a tablet device, or a mobile phone, or a mobile computer, etc.

[0261] The electronic reader 33 communicates via Wifi or any other suitable means with a server 45 located in the industrial installation 41. The server 45 communicates via Wifi or by any other suitable means with a central server 37 hosting the database 35.

[0262] When an operator has to perform an operation using the electronic reader 33 , the network security officer of the industrial installation first gives the operator the right to perform an inspection in one or several defined areas / sub-areas.

[0263] Each sub-region has an identification code depicted on a label affixed adjacent to the sub-region.

[0264] When a sub-area corresponds to a marked location accessible through a given door 11 of a given cabinet 3 , the identification code is arranged on the door 11 .

[0265] The electronic reader 33 provides the operator with several routines:

[0266] - Routine "Zone"

[0267] - Routine "Deploy anti-tampering element"

[0268] - Routine "Removing the tamper-proof element"

[0269] - Routine "check".

[0270] When the operator selects the “Zones” routine, the electronic reader 33 offers him a tree of the zones of the control system 1 .

[0271] The operator selects a given area and first has to check that he is allowed to operate in the selected area.

[0272] To this end, the operator reads the identification code of the sub-area, for example on the door 11, using the electronic reader 33, and the electronic reader 33 indicates whether the operator is given the right to carry out operations in the sub-area.

[0273] The operator can then read the tree with the sub-areas and the marked positions of each sub-area on the electronic reader. For each marked position, the electronic reader 33 provides the identification code of the tamper-proof element 23 arranged at the marked position (if any) and the status of the marked position (in service, out of service).

[0274] When the operator selects the “Deploy anti-tampering element” routine, the electronic reader 33 offers him a tree of the areas of the control system 1 .

[0275] The operator selects a given zone and checks in the same way as for the routine "Zone" that he is allowed to operate in the selected zone.

[0276] The electronic reader 33 then displays a tree of sub-regions and a list of marked locations belonging to each sub-region.

[0277] For each marking position, the operator can activate a button for reading the identification code of the tamper-proof element 23 arranged at the marking position. This reading is performed before or after the tamper-proof element is arranged at the marking position.

[0278] The electronic reader 33 will then scan the QR code on the tamper-proof element 23 and write the code into the database.

[0279] For each marked location, the operator may also activate a button for changing the status of the marked area between in use and out of service.

[0280] For example, if there is no tamper-resistant element at the tagged location, the operator transitions the state to Out of Service.

[0281] When the operator selects the routine “Remove tamper-proof element”, the electronic reader 33 offers him a tree of the areas of the control system 1 .

[0282] The operator selects a given zone and checks in the same way as for the routine "Zone" that he is allowed to operate in the selected zone.

[0283] The electronic reader 33 then displays a tree of the sub-areas and a list of the marked locations belonging to the sub-areas.

[0284] For each marking position, the operator can activate a button for reading the identification code of the tamper-proof element 23 to be removed.

[0285] The electronic reader 33 then scans the QR code on the tamper-proof element 23 and displays the code for inspection by the operator.

[0286] If the information regarding the tamper-proof element is correct, the operator confirms that the tamper-proof element 23 is to be removed and the electronic reader 33 updates the database by writing that the tamper-proof element 23 has been removed and the marked location no longer has a tamper-proof element 23 .

[0287] For each marking position, the operator can also activate a button for declaring non-compliance. The electronic reader 33 then displays a new screen with a list of anomalies: tamper-proof element 23 missing, damaged, not attached, identification code not consistent with the reference state.

[0288] Then, the operator must indicate whether the tamper-proof element can be read. If the tamper-proof element can be read, the electronic reader 33 displays a new screen for reading the identification code of the tamper-proof element. If the tamper-proof element cannot be read, the electronic reader 33 requires the operator to manually indicate the position of the mark associated with the tamper-proof element 23.

[0289] When the operator selects the “Check” routine, the electronic reader 33 offers him a tree of the areas of the control system 1 .

[0290] The operator selects a given zone and checks in the same way as for the routine "Zone" that he is allowed to operate in the selected zone.

[0291] The electronic reader 33 then displays a screen with two possibilities: a single inspection sub-area or a sequential inspection of the sub-areas.

[0292] If a single check is selected, a list of sub-areas is displayed. The operator selects a sub-area and the electronic reader 33 displays a new screen for reading the identification code of the tamper-proof element 23 arranged on the door 11 providing access to said sub-area. The electronic reader then indicates whether the read identification code corresponds to the identification code recorded in the reference state.

[0293] Before reading the identification code, the operator checks the integrity of the tamper-proof element 23 and declares non-compliance if the tamper-proof element 23 is damaged or missing. The operator proceeds as described above.

[0294] After completing one sub-region, the operator selects another sub-region, and continues until all sub-regions have been examined.

[0295] If sequential checking is selected, the electronic reader 33 displays a new screen for reading the identification code. The operator reads one by one the tamper-proof elements 23 arranged on the door 11 providing access to all sub-areas. The electronic reader indicates whether the read identification code corresponds to the identification code recorded in the reference state.

[0296] The operator checks the integrity of the tamper-proof element 23 before the subsequent inspection and declares non-compliance if necessary.

[0297] If the anti-tamper element 23 arranged on the door 11 providing access to all sub-areas is OK (no anomalies, identification code identical to the reference state), it is indicated in the database that all sub-areas are OK and the operator presses the button "Check End".

[0298] If the tamper-proof element 23 arranged on one of the doors 11 is not OK (non-compliant, identification code is not identical to the reference state), it is necessary to check the marked positions in the sub-areas accessible via said door 11. The sub-areas are marked as not OK in the database.

[0299] The operator then removes the anti-tampering element 23 arranged on the door and selects the corresponding sub-area on the screen of the electronic reader 33 .

[0300] The electronic reader 33 then displays a list of the marked positions belonging to the selected sub-area and a button “Check” associated with each marked position.

[0301] The electronic reader 33 also displays a button "Check Next".

[0302] The inspection can be single.

[0303] The operator presses the "check" button associated with the marked position and the electronic reader 33 displays a new screen for reading the identification code of the tamper-proof element 23 arranged at the marked position. The electronic reader then indicates whether the read identification code corresponds to the identification code recorded in the reference state.

[0304] Before reading the identification code, the operator checks the integrity of the tamper-proof element 23 and declares non-compliance if the tamper-proof element 23 is damaged or missing. The operator proceeds as described above.

[0305] After completing one marking location, the operator presses the "check" button associated with another marking location, and continues until all marking locations have been checked.

[0306] If the button "Check in sequence" is selected, the electronic reader 33 displays a new screen for reading the identification code. The operator reads the tamper-proof elements 23 arranged on all marking positions one by one. The electronic reader indicates whether the read identification code corresponds to the identification code recorded in the reference state.

[0307] The electronic reader also indicates if a check is missing in a sub-area compared to the checks listed in the reference state. If the tamper-proof element 23 is damaged or missing, the operator looks for the missing checks and reports non-compliance.

[0308] The operator checks the integrity of the tamper-proof element 23 before checking it in turn.

[0309] Once the marked positions of all sub-areas marked as "not OK" have been checked, the operator presses the button "check end".

[0310] The central network security officer has access to the database of all industrial installations related to all control systems of each industrial installation. He has access to all control reports and history of all control systems.

[0311] Access to all of this information is critical when central network security officers must analyze an intrusion and decide what to do after it.

[0312] Local security personnel and operators of a given industrial installation can only access information related to the control system of that given industrial site.

[0313] Due to the design of the tamper-proof element and because Framatome works directly with the manufacturer of the tamper-proof element, reproduction of the tamper-proof element by unauthorized persons is more difficult. Only Framatome can order tamper-proof elements with a specific design for use in Framatome's industrial devices.

Claims

1. A method for monitoring access to software of a control system (1) of an industrial installation, the control system (1) comprising at least one cabinet (3), the at least one cabinet (3) containing hardware components (5), the hardware components (5) comprising software components or providing access to software components, the monitoring method comprising: - Identify various ways of physical intrusion into the software component for which you wish to monitor; - providing tamper-proof elements (23) at respective defined marking positions on the hardware component (5) and / or the cabinet (3), each tamper-proof element (23) having a unique identification code, the marking positions being selected so that an intrusion by one of the physical intrusion means results in at least one of the tamper-proof elements (23) being damaged; - storing in a database (35) a reference state including a unique identification code of the tamper-proof element (23) and a corresponding marking position; as well as - During a monitoring phase, at least some of said marking positions are checked and compared with said reference states.

2. The method according to claim 1, wherein: During the monitoring phase, checking at least some of the marked locations comprises one or more of the following operations: - checking the physical integrity of an anti-tampering element (23) arranged at said marking location; - checking whether the identification code of the tamper-proof element (23) arranged at the marking position corresponds to the identification code in the reference state; - Checking whether the tamper-proof element (23) is missing compared to the reference state.

3. The method according to claim 1 or 2, wherein: During the monitoring phase, checking at least some of the marked locations comprises the following operations: - providing a new tamper-proof element (23) at a given marking location; - Updating the reference status in said database.

4. The method according to any one of claims 1 to 3, wherein: The cabinet (3) or each cabinet (3) comprises an external body (9) and at least one door (11), the at least one door (11) being mounted on the external body (9) and allowing access to some of the hardware components (5), one of the tamper-proof elements (23) bridging the external body (9) and the door (11).

5. The method according to any one of claims 1 to 4, wherein: The cabinet (3) or each cabinet (3) comprises a chassis (12) to which the hardware component (5) is removably mounted, the tamper-proof element (23) at the marked position being arranged such that: - bridging two hardware components (5, 14); - bridging one of the hardware components (5) and the chassis (12); - closing at least one port (7) of one of the hardware components (5); - Bridging a hardware component (5) having a port (7) and a connector plugged into the interior of said port (7).

6. The method according to any one of claims 1 to 5, wherein: The electronic reader (33) is configured to perform at least one of the following operations: - reading the identification code of the tamper-proof element (23); - providing a marking position associated with said identification code in said reference state; - recording in said reference state an identification code of the tamper-proof element (23) associated with a given marking position.

7. The method according to claim 4 in combination with claim 6, wherein: The method comprises dividing the control system (1) into a number of areas and dividing each area into a number of sub-areas, each area comprising at least one cabinet (3), each sub-area comprising a marked location accessible through a given door (11) of a given cabinet (3), the electronic reader (33) being used to perform the following operations: - reading the identification codes of all tamper-proof elements (23) arranged in the sub-area; - compares with said reference state and indicates if the tamper-proof element (23) is missing.

8. The method according to any one of claims 1 to 7, wherein: The monitoring phase includes one or more of the following periods: - a storage period at a manufacturing site where the at least one cabinet (3) has been manufactured; - a delivery period during which the at least one cabinet (3) is transported from the manufacturing location to an industrial installation; - a period of storage at said industrial installation prior to installation in said industrial installation; - an installation period for installing the at least one cabinet (3) in the industrial installation; - an operating period during which the at least one cabinet (3) is operated.

9. The method according to any one of claims 1 to 8, wherein: In the reference state, each marked position is recorded as either in-service or out-of-service, and only marked positions recorded as in-service are checked during the monitoring phase.

10. A monitoring system (43) for monitoring access to software of a control system (1) of an industrial installation (41), the control system (1) comprising at least one cabinet (3), the at least one cabinet (3) containing hardware components (5), the hardware components (5) comprising software components or providing access to software components, the monitoring system (43) comprising: - a database (35) which records the locations of markings on the hardware components (5) and / or the cabinet (3); - tamper-proof elements (23), each tamper-proof element (23) being arranged at one of the marking positions, each tamper-proof element (23) having a unique identification code; The marking position is selected so that an intrusion into the software component by a plurality of physical intrusion methods results in at least one of the tamper-proof elements (23) being damaged; The database (35) stores reference states including the unique identification code of the tamper-proof element (23) and the corresponding marking position.

11. The monitoring system according to claim 10, wherein: The monitoring system (43) includes an electronic reader (33) configured to perform at least one of the following operations: - reading the identification code of the tamper-proof element (23); - providing a marking position associated with said identification code in said reference state; - recording in said reference state an identification code of the tamper-proof element (23) associated with a given marking position.

12. A monitoring system according to claim 11, wherein the cabinet (3) or each cabinet (3) comprises an external body (9) and at least one door (11), the at least one door (11) being mounted on the external body (9) and allowing access to some of the hardware components (5), the control system (1) being divided into a number of areas and each area being divided into a number of sub-areas, each area comprising at least one cabinet (1), each sub-area comprising the marked positions accessible through a given door (11) of a given cabinet (3), the electronic reader (33) being arranged to perform the following operations: - reading the identification codes of all tamper-proof elements (23) arranged in the sub-area; - compares with said reference state and indicates if the tamper-proof element is missing.

13. The monitoring system according to claim 12, wherein: When performing an inspection of a given area / sub-area, the monitoring system is programmed to record the following information: - all operations performed at any given marked position, said operations comprising: checking said marked position and comparing with said reference state, removing the tamper-proof element (23) associated with said marked position and placing a new tamper-proof element (23) at said marked position; - an area, a sub-area, a cabinet (3), an anti-tampering element (23) associated with said given marking position; - an indication of whether the given marking position is non-compliant, if the associated tamper-proof element (23) is missing or damaged, or if the identification code of the tamper-proof element (23) at the marking position does not correspond to the identification code recorded in the reference state; - Date and time each action was performed; - The identification of the operator who performed each operation.

14. The monitoring system according to claim 13, wherein: The monitoring system is programmed to: - extracting data from said database; - extracting said reference state from said database; - Generate detailed reports containing all information recorded during a given inspection; - generating a collection associated with the control system having all detailed reports in which at least one non-compliant marking position is mentioned.

15. A monitoring system according to any one of claims 10 to 14, wherein: In the reference state, each marked position is recorded as being in service or out of service.

Images