Method for monitoring communication of field device

Abstract

There is described a method for monitoring communications of a field device of a plurality of field devices (112, 114, 116), comprising: providing at least one stored characteristic attribute of power consumption of each of the plurality of field devices (112, 114, 116) caused by a respective query of a plurality of queries for the respective field device (112, 114, 116); determining a respective query requested for each of a respective one of the plurality of field devices (112, 114, 116) during communication with the plurality of field devices (112, 114, 116); measuring a characteristic attribute (200, 211, 212, 213) of power consumption for each of respective ones of the plurality of field devices (112, 114, 116) caused by the query during communication with the plurality of field devices (112, 114, 116); a similarity of a stored characteristic attribute of the power consumption of each of the respective field devices caused by the respective query to a respective measured characteristic attribute (200, 211, 212, 213) for the respective field device and for the power consumption of the respective query is determined for monitoring communications of the field devices (112, 114, 116).

Description

Background Art

[0001] Industrial equipment and systems are increasingly becoming targets of cyberattacks. Therefore, the cybersecurity of such systems is becoming increasingly important. Security Information and Event Management (SIEM) systems are crucial for detecting threats to critical operational technology (OT) systems. These systems aggregate security-related information from both IT and OT systems, but their coverage within the OT domain is limited. More feature-rich and highly networked field devices are emerging, such as the upcoming Ethernet APL advanced physical layer devices using the Open Platform Communications Unified Architecture (OPC UA). While these devices are beginning to resemble IT resources like servers, integration options with SIEM systems remain limited. Summary of the Invention

[0002] Legacy, resource-constrained devices are common and difficult to integrate into SIEM systems. Field devices often have limited resources, lack isolation for internal monitoring, and lack standards for monitoring such devices. They typically do not offer security monitoring or logging functionality, nor do they support the deployment of endpoint monitoring solutions or agents.

[0003] Monitoring communication patterns or network traffic is an alternative, but as encrypted traffic (such as OPC UA secure conversations) becomes more common, the detection capabilities of such methods are limited.

[0004] Another option is to monitor the health of field devices, such as power consumption, via side channels. This allows monitoring to be performed externally to the field device and can be used to detect changes in the state of a field device, such as when a field device is infected with malware and begins executing code different from normal. However, monitoring this behavior relies solely on side channels and cannot detect changes in device communication patterns. It therefore lacks important contextual information needed to distinguish between attacks and harmless differences in field device behavior, which can lead to false positive status messages or limited detection capabilities. While it is possible to monitor the network and side channels separately and merge the results at the SIEM system, this does not fully address their shortcomings and requires rules specific to the field device. In order to easily integrate field devices into SIEM systems, a solution that overcomes these limitations is needed that can monitor the communication and status of a variety of field devices without the need for manual configuration. Such a solution would further enhance the advantages of SIEM deployments in industrial environments and improve overall network security.

[0005] Rather than requiring the upgrade or replacement of all such devices, we propose adding external monitoring functionality based on the communication behavior of the devices and their power consumption. To limit the amount of hardware required, our proposed solution operates based on the combined power traces of all monitored devices and uses contextual information obtained from the observed device communications to associate deviations from the baseline power consumption with specific devices.

[0006] The solution can be deployed as an enhancement to the communication infrastructure, for example as part of an APL field switch, or as a separate monitoring unit placed between such communication equipment (such as an APL field switch) and its upstream connection.

[0007] The present invention therefore relates to a method for monitoring the communication of a field device of a plurality of field devices, a monitoring unit, the use of the monitoring unit for monitoring the secure communication of a field device, a computer program, and a computer-readable storage medium.

[0008] Advantageous modifications of the invention are set forth in the dependent claims. All combinations of at least two of the features disclosed in the description, the claims, and the drawings fall within the scope of the invention. To avoid repetition, features disclosed with respect to the method should also apply to the system described and be claimed with respect to the system described.

[0009] Throughout this description, the order of procedural steps is presented in a manner that facilitates understanding of the process. However, those skilled in the art will recognize that many of the procedural steps can be performed in a different order and still lead to the same or corresponding results. In this sense, the order of the procedural steps can be changed accordingly. Some features are provided with counters to improve readability or to clarify designations, but this does not necessarily imply the presence of certain features.

[0010] 1. To achieve these and other advantages and in accordance with the purposes of the present invention, as embodied and broadly described herein, a method for monitoring communications of a field device among a plurality of field devices is provided, wherein in one step of the method, at least one stored characteristic attribute of power consumption of each of the plurality of field devices induced by a corresponding query of a plurality of queries directed to the corresponding field device is provided. In a further step of the method, a corresponding query requested for each of the plurality of field devices during communications with the plurality of field devices is determined. In a further step of the method, a characteristic attribute of power consumption of each of the plurality of field devices induced by the query during communications with the plurality of field devices is measured. In a further step of the method, a similarity between the stored characteristic attribute of power consumption of each of the plurality of field devices induced by the corresponding query and a corresponding measured characteristic attribute of power consumption for the corresponding field device and for the corresponding query is determined for use in monitoring communications of the field device.

[0011] A query can be an incoming request from a control system to a corresponding field device, wherein the corresponding field device can generate an outgoing response to the query. During the period between receiving the query and generating the response, the field device can increase its power consumption, which can be described by a characteristic attribute of the power consumption of the corresponding field device caused by the corresponding query.

[0012] According to one aspect, communication queries and / or responses from each of a plurality of field devices, as well as attributes of power consumption from each of the plurality of field devices, are electrically and / or signal-accessed adjacent to one another. This means that communication electrical signals and power consumption electrical signals from the plurality of field devices are determined, detected, and / or sensed at a station located signally upstream of the plurality of field devices, which station has access to communications from all of the plurality of field devices, as well as a power supply configured to supply power to all of the individual field devices. The station can be a monitoring unit, for example, a field switch and / or an APL field switch configured to connect to all of the plurality of field devices, and wherein the field switch is configured to supply power to each of the plurality of field devices.

[0013] According to one aspect, each of the plurality of field devices may be configured to be electrically powered and to communicate over a shared common line, such as an Ethernet-APL device, particularly such that the plurality of field devices may be accessible adjacent to one another at the same point and / or the same unit (such as a remote I / O or APL field switch).

[0014] At the point and / or unit, a monitoring unit may be used to monitor communications of all connected respective ones of the plurality of field devices, and individual and / or total power consumption of respective ones of the plurality of field devices coupled to the point and / or unit.

[0015] The characteristic attribute of the power consumption of a field device can be a maximum value of the power consumption of the corresponding field device during communication, and / or a duration of the power consumption of the corresponding field device during communication, and / or a power consumption signal of the power consumption of the corresponding field device during communication, and / or a statistical parameter of the power consumption during communication. The power consumption of the corresponding field device during communication can be determined within a time window, and the time window can be defined by a query to the corresponding field device and a response to the query from the field device, thereby triggering the power consumption of the corresponding field device within the time window by the query. Such a query can be provided by a control unit that is at least signal-coupled to each of the plurality of field devices. For example, the control unit can use the query to the corresponding field device to access an APL field switch that is at least signal-coupled to the APL field switch.

[0016] In other words, the method for monitoring field device communications can be a hybrid safety monitoring method for multiple industrial field devices, which simultaneously utilizes field device communications and tracks the power consumption of the monitored field devices to detect abnormal behavior of the field devices. Monitoring field device communications can contextualize the power consumption attributes of the field devices corresponding to the power consumption traces to detect deviations in the behavior of the field devices.

[0017] A method for monitoring communications of field devices may include observing or monitoring deviations between measured characteristic attributes of power consumption associated with communications (including queries and / or responses) of each field device and stored characteristic attributes. Normal behavior of the field device (described by the stored characteristic attributes of the power consumption of the corresponding field device) when performing certain actions (the actions being determined based on the communications of the device) may be based on the measured characteristic attributes of the power consumption of the corresponding field device during normal operation.

[0018] The proposed method for monitoring the communication of field devices can be used for secure monitoring of field devices without the need for device upgrades or reconfigurations. It can be deployed as part of the communication infrastructure, such as as an extension of an APL field switch or remote I / O.

[0019] Advantageously, the local analysis performed by the monitoring unit can limit the impact on IT network traffic, while the automatic configuration described below can minimize the manual effort required to set up the method. The proposed method can enable the integration of field devices into the centralized security monitoring system described below.

[0020] When field devices are communicating, the communication may be analyzed to determine corresponding communicating field devices and corresponding queries and / or responses to the communication within a time window, which may be defined by a time interval between an incoming query and an outgoing response.

[0021] The change in power consumption of a field device in an idle state relative to that of a field device in an active state within a communication time window can be correlated to a characteristic attribute of the power consumption of the corresponding field device for a specific communication type. The specific communication type can refer to a specific query and / or a specific response to the query.

[0022] A method for monitoring communications of field devices tracks communications of a plurality of field devices and respective power consumption of respective field devices.

[0023] Advantageously, the method can achieve simultaneous communication monitoring of a large number of field devices and can provide monitoring coverage for the entire plant.

[0024] Advantageously, this method can provide hybrid safety monitoring for a large number of field devices by combining side channel (i.e., power consumption) and communication monitoring (i.e., queries and / or responses). That is, by tracking communications, the power consumption of the corresponding field devices can be contextualized. Specifically, this method can be used for field devices that use the same wiring for both communication and power supply to the corresponding field devices. Thus, the query and / or response of each of the multiple field devices' communications, as well as the power consumption attributes of each of the multiple field devices, can be accessed at the point where the multiple field devices are first coupled upstream to the control system. For example, this point can be an APL field switch.

[0025] Advantageously, the method for monitoring the communication of a field device can be carried out locally, in particular at the aforementioned point.

[0026] Advantageously, the method can enable upgrading existing industrial equipment to provide monitoring, particularly with respect to existing field devices, and integrating the monitoring of field devices into a SIEM system without having to upgrade or reconfigure the field devices.

[0027] Furthermore, advantageously, the similarities determined based on the method and / or the alarms generated and / or the status messages generated (preferably performed by the monitoring unit described below) can be configured to communicate within an IP network and, in particular, for forwarding messages and / or alarms to a SIEM system.

[0028] Alternatively or additionally, the method for monitoring the communication of a field device can be integrated into a SIEM system like a separate sensor in order to use the method via a variety of communication protocols.

[0029] Advantageously, the method enables secure monitoring of industrial field devices using communication behavior and power supply side channels.

[0030] Industrial field devices are monitored and integrated into SIEM systems without requiring modifications to the field devices themselves or manual configuration of the field devices. A single monitoring unit can monitor multiple field devices based on their communication and, in particular, using single and / or combined power consumption traces (i.e., a superposition of the power consumption of multiple field devices), which can be based on measurements of the superimposed power consumption using a single sensor.

[0031] Furthermore, advantageously, the method (i.e., the method for determining the similarity of power consumption of respective field devices characterized by respective communications) can be performed locally, i.e., at a point where a collection of power consumption data is accessible, in order to minimize the additional communication load on the network, in particular upstream of the field switch. Such local execution can be provided, for example, by a field switch and / or an APL field switch comprising or coupled to a monitoring unit, wherein the monitoring unit is configured to perform the method described herein.

[0032] According to one aspect, power consumption of the plurality of field devices is jointly determined as a superposition of the power consumptions of the plurality of field devices, and the measurement of the characteristic attribute of the power consumption of the requested respective query for each respective field device of the plurality of field devices is based on the superposition of the power consumptions.

[0033] Advantageously, this reduces the hardware resources used for determining the power consumption, for example only one current sensor may be used for this purpose.

[0034] According to an aspect, at least one stored characteristic attribute of the power consumption of each field device of the plurality of field devices triggered by a respective query of the plurality of queries for the respective field device is provided by the storage unit.

[0035] The stored characteristic attributes may be provided by the field device manufacturer to facilitate setting.

[0036] According to one aspect, at the start of executing the method for monitoring communication of a field device as described above, at least one stored characteristic attribute of power consumption of each of a plurality of field devices triggered by a corresponding query of a plurality of queries for the corresponding field device is determined based on a first number of corresponding measured characteristic attributes, and the corresponding at least one stored characteristic attribute of power consumption is stored by a storage unit.

[0037] Advantageously, this determination of stored characteristic attributes of the power consumption of each of the plurality of field devices provides a flexible setting for the method, since the method itself will learn the normal behavior of the field devices described by the stored characteristic attributes of the power consumption triggered by the respective queries.

[0038] According to one aspect, at least one stored characteristic attribute of the power consumption of each of a plurality of field devices triggered by a corresponding query of a plurality of queries for the corresponding field devices is determined based on repeatedly storing (in particular in a first-in-first-out manner) a second number of corresponding measured characteristic attributes during the performance of the method for monitoring communication of field devices as described above, and the corresponding at least one stored characteristic attribute of the power consumption is stored by a storage unit.

[0039] The repeated storage of the characteristic attributes of the second number of power consumptions may be performed in such a manner that the new data overwrites the previously stored data.

[0040] In other words, the normal behavior of each of the plurality of field devices can be provided by monitoring the properties of the power consumption of the respective field devices during the communication initiated by the communication query. Preferably, the monitored properties of the power consumption can be stored as a history (preferably a limited history) of the power consumption traces initiated by the respective query of the plurality of queries. The actual measured properties of the power consumption can be compared based on the history of the stored properties of the power consumption of the respective field devices initiated by the respective query (preferably within the time window of the respective communication) to determine a similarity, in particular within the communication time window. If the determined similarity value is below a predetermined threshold, a corresponding status value or an alarm can be generated.

[0041] These attributes of power consumption can be stored as differences from corresponding baselines for corresponding field devices in an idle state. Such differences in power consumption from the baseline can improve accuracy. Thus, the method includes automatically configuring the stored characteristic attributes of power consumption for each of the plurality of field devices.

[0042] Advantageously, the method for monitoring communications of a field device, wherein the stored characteristic attributes are determined by the corresponding steps of the method, does not require specific customization or manual configuration or modification for each field device or each type of field device. Thus, the method is applicable to a wide variety of different field devices without requiring customization. This enables simultaneous monitoring of a large number of field devices and / or achieving comprehensive monitoring coverage of field devices at a limited cost.

[0043] According to one aspect, the method includes the following steps: in one step, determining a baseline for the power consumption of each field device if the corresponding field device is idle; in a further step, determining a similarity between a stored characteristic attribute of the power consumption of each corresponding field device triggered by the corresponding query and a corresponding measured characteristic attribute of the power consumption of the corresponding field device based on the characteristic attribute of the power consumption, wherein the baseline is subtracted from the measured characteristic attribute of the power consumption and the baseline is subtracted from at least one stored characteristic attribute of the power consumption, respectively.

[0044] In other words, if no communication occurs, that is, if the corresponding field devices are in an idle state, a baseline for individual power consumption and / or a combined (i.e., superimposed) baseline power consumption can be obtained for multiple field devices. The respective baselines can be subtracted from the measured values ​​of the power consumption of the respective field devices in order to compare the similarity between the stored characteristic attributes of the power consumption and the measured characteristic attributes of the power consumption based on the deviation from the respective baselines.

[0045] Based on initial observations of field devices in an idle state and during certain communication activities to establish a history of observed behavior, a baseline for the idle state of the respective field devices and a range of normal behavior with respect to power consumption for each respective field device can be automatically established without manual configuration. Changes to connected devices or their configurations require re-establishment of the baseline and normal range.

[0046] According to one aspect, the characteristic attribute of the power consumption is a maximum value of the power consumption of the corresponding field device caused by the corresponding query, and / or a duration of the power consumption of the corresponding field device caused by the corresponding query, and / or a power consumption in the form of a signal of the power consumption of the corresponding field device caused by the corresponding query, and / or a statistical parameter of the power consumption of the corresponding field device caused by the corresponding query.

[0047] The associated time window for a corresponding communication may include a time span from receiving the query to responding to the query.

[0048] According to one aspect, a query or response of a communication by each of the plurality of field devices and a characteristic attribute of power consumption by each of the plurality of field devices are provided by a two-wire cable.

[0049] According to one aspect, the query or response of the communication of each of the plurality of field devices and the characteristic attribute of the power consumption of each of the plurality of field devices conform to an Ethernet-APL standard.

[0050] According to one aspect, a security alert is generated if the value of the determined similarity of the stored characteristic attributes of the power consumption compared with the corresponding measured characteristic attributes of the power consumption of the corresponding field device triggered by the corresponding query is below a predetermined threshold, and preferably the security alert is reported to the SIEM system.

[0051] In other words, anomalies indicated by differences in device behavior related to power consumption can be reported to a security system (such as a SIEM system) by generating security alerts and / or status messages. If such anomalies in the power consumption of the corresponding field device occur, the security alerts and / or status messages can be forwarded to the signal-coupled SIEM system.

[0052] An event where the power consumption of a corresponding field device deviates from a normal range (i.e., a stored characteristic attribute of power consumption) can indicate a change in the behavior of the field device and can be reported to the SIEM system using the same upstream communication link used for field device communication. The monitoring unit can observe and / or monitor the communication of all connected field devices and can track their individual power consumption and / or combined power consumption.

[0053] According to one aspect, a monitoring unit is provided, comprising:

[0054] A storage unit, at least one measurement unit, a communication monitoring unit, and a processing unit are provided. The storage unit is configured to store stored characteristic attributes of power consumption of each of a plurality of field devices triggered by a corresponding query in a plurality of queries directed to the corresponding field devices. The at least one measurement unit is configured to be electrically coupled to the plurality of field devices for measuring the corresponding characteristic attributes of power consumption. The communication monitoring unit is configured to monitor and identify queries and / or responses from each of the plurality of field devices. The monitoring unit is configured to perform any one of the above methods.

[0055] The monitoring unit may be supported by the processing unit to perform any of the aforementioned methods for monitoring a field device.

[0056] The method for monitoring field devices can enhance the functionality of communication devices used in industrial systems, such as APL field switches, by providing safety monitoring capabilities for multiple field devices based on their communication behavior and their individual and / or combined power consumption. The method can be implemented as a separate hardware module, such as a monitoring unit, or as a feature of such communication devices.

[0057] According to one aspect, a communication monitoring unit is configured to be coupled to each of a plurality of field devices. Furthermore, the communication monitoring unit is configured to be coupled to a control unit that generates a request for the field device. Furthermore, the communication monitoring unit is configured to determine a corresponding query and / or response requested for each of the plurality of field devices during communication between the control unit and the respective field device.

[0058] A use of a monitoring unit as described above is proposed for monitoring a secure communication of a field device of a plurality of field devices according to any of the methods for monitoring communication of a field device as described above.

[0059] A computer program is proposed comprising instructions which, when executed by a computer, cause the computer to perform any of the above-described methods for monitoring communication of a field device.

[0060] A computer-readable storage medium for storing the above-mentioned computer program is proposed. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings are included to provide a further understanding of the present invention and are incorporated in and constitute a part of this application. The accompanying drawings illustrate embodiments of the present invention and together with the description serve to explain the principles of the present invention. The accompanying drawings show:

[0062] Figure 1 : Factory communication systems including field devices;

[0063] Figure 2 : Schematic diagram of power consumption of field devices;

[0064] Figure 3 : A schematic diagram of the superimposed power consumption of multiple field devices; and

[0065] Figure 4 : Schematic diagram of the characteristic properties of power consumption of field devices. DETAILED DESCRIPTION

[0066] Figure 1A plant communication system is schematically depicted, wherein a plurality of field devices 112, 114, 116 are coupled to an APL field switch 110, and wherein the APL field switch is coupled to an APL power switch 120. The APL power switch 120 is coupled to a control system 140 and a SIEM system 130, and the SIEM system 130 is coupled to the control system 140. The APL field switch includes a monitoring unit 100, which includes a storage unit for storing stored characteristic attributes of power consumption of each of the plurality of field devices 112, 114, 116, triggered by a respective query of a plurality of queries for the respective field devices 112, 114, 116. The respective queries may be generated by the control system 140. Furthermore, the monitoring unit 100 includes at least one measuring unit configured to be electrically coupled to the plurality of field devices 112, 114, 116 for measuring respective characteristic attributes of power consumption of respective field devices of the plurality of field devices 112, 114, 116. The monitoring unit 100 includes a communication monitoring unit configured to monitor and identify queries and / or responses with each of the plurality of field devices 112, 114, 116, and a processing unit. The monitoring unit 100 is configured to perform any of the above methods.

[0067] Figure 2 Power consumption graphs 211 , 212 , 213 of a plurality of field devices 112 , 114 , 116 are schematically depicted. Figure 2The vertical component current i in FIG indicates the power consumption of the respective field device 112, 114, 116, while the horizontal component time t indicates the duration of the power consumption. Graph 200 plots an overlay of power consumption graphs 211, 212, and 213 for a plurality of field devices 112, 114, and 116. Within time window 210, a baseline for the respective field device 112, 114, and 116 and an overlay of the baselines for the field devices 112, 114, and 116 are depicted. Time windows 211a, 213a, and 212a indicate the normal behavior of the power consumption of the respective field devices, triggered by specific signals associated with the respective field devices and corresponding power consumption signals for the overlay of the power consumption of the plurality of field devices 112, 114, and 116. By comparing time window 213a' with time window 213a (where the characteristic attributes of the field device are indicated by the characteristic pattern of graph 213 within the aforementioned time window), the measured characteristic attributes of the field device and the power consumption graph 213 indicate deviations between the two time windows 213a and 213a'. If the stored characteristic attributes of the field device's power consumption 213 are similar to the characteristic attributes shown in time window 213a, the behavior of the power consumption within time window 213a' indicates faulty behavior of the corresponding field device. If the similarity is below a predetermined threshold, a security alert and / or status message can be reported to the SIEM system. As can be seen by comparing the characteristic attributes of the field device with graph 213, the deviations within the superimposed signal of graph 200 indicate the same deviations. The monitoring unit is configured to perform a method for monitoring the communication of multiple field devices and can be deployed as an extension of a communication device, such as an APL field switch, and can observe the communication behavior of the multiple monitored field devices and access their combined or superimposed power consumption. The communication behavior is used to determine a period of communication activity for each field device, which is then used to analyze the combined and / or individual power traces to determine attributes of the power consumption of each of the plurality of field devices.

[0068] Figure 3 A combined or overlaid power consumption graph 200 and a combined or overlaid power consumption graph 300 of the plurality of field devices 112, 114, 116 are schematically depicted, with a baseline for the plurality of field devices 112, 114, 116 subtracted, wherein the baseline is generated by an idle state of the plurality of field devices 112, 114, 116. The results show that even with the baseline subtracted, characteristic attributes of the power consumption of each of the plurality of field devices induced by a corresponding query in the plurality of queries directed to the corresponding field device can still be identified. Advantageously, by subtracting the baseline, a sense of the overlaid power consumption of the plurality of field devices 112, 114, 116 can be more accurately measured.

[0069] The monitoring unit may measure a combined or superimposed characteristic attribute of power consumption of a plurality of field devices. Within each communication window, when a field device responds to a request, a deviation of the power consumption from the baseline power consumption may be associated with the attribute of the power consumption of the corresponding field device and the corresponding query type or request type.

[0070] Figure 4 a schematically depicts a plurality of graphs 211a of characteristic attributes of power consumption of a first field device among the plurality of field devices 112, 114, 116 triggered by corresponding queries, wherein one graph 211a' of the characteristic attributes of power consumption of the first field device triggered by the corresponding query deviates from the other graphs, which may indicate that the first field device may be threatened.

[0071] Figure 4 b schematically illustrates multiple graphs 212a of characteristic attributes of power consumption of a second field device among the plurality of field devices 112, 114, and 116, triggered by a corresponding query. One graph 212a′ of the characteristic attributes of power consumption of the second field device triggered by the corresponding query deviates from the other graphs, which may indicate that the second field device may be compromised. Similar characteristic attributes of power consumption of the first and second field devices within a specific range may be used to define stored characteristic attributes of power consumption of the corresponding field device triggered by the corresponding query.

[0072] In other words, a higher 212a' or lower 211a' deviation compared to the superimposed baseline power consumption may constitute abnormal behavior, which may cause the monitoring unit to generate an event.

[0073] Because minor variations in the characteristic attributes of the power consumption of the respective field devices are to be expected, the monitoring unit can establish a normal behavior range for each of the plurality of field devices. To this end, the monitoring unit can store a history of previously measured characteristic attributes of the power consumption of each of the plurality of field devices, along with the corresponding query or request type, as differences from a baseline for the power consumption of the plurality of field devices. Storing these per-device historical records as deviations from the baseline can provide the advantage that if the baseline power consumption changes (e.g., if field devices are added or removed), the monitoring unit can continue to use it as the stored characteristic attribute.

Claims

1. A method for monitoring communications of a field device in a plurality of field devices (112, 114, 116), comprising: providing at least one stored characteristic attribute of power consumption of each of the plurality of field devices (112, 114, 116) resulting from a respective query of a plurality of queries for the respective field devices (112, 114, 116); determining a respective query requested for each of the respective ones of the plurality of field devices (112, 114, 116) during communication with the plurality of field devices (112, 114, 116); measuring a characteristic attribute (200, 211, 212, 213) of the power consumption for each of the respective ones of the plurality of field devices (112, 114, 116) triggered by a query during communication with the plurality of field devices (112, 114, 116); as well as Determining a similarity between stored characteristic attributes of the power consumption of each of the respective field devices triggered by the respective query and the corresponding measured characteristic attributes (200, 211, 212, 213) of the power consumption for the respective field device and for the respective query for monitoring the communication of the field devices (112, 114, 116).

2. The method of claim 1 , wherein the power consumption of the plurality of field devices (112, 114, 116) is jointly determined as a superposition of the power consumptions (200, 300) of the plurality of field devices (112, 114, 116); and The measurement of the characteristic attribute of the power consumption for the requested respective query for each of the respective field devices of the plurality of field devices (112, 114, 116) is based on the superimposed power consumption (200, 300).

3. The method according to claim 1 or 2, wherein at least one stored characteristic attribute of the power consumption of each of the plurality of field devices (112, 114, 116) triggered by a corresponding query of the plurality of queries for the corresponding field device (112, 114, 116) is provided by a storage unit.

4. The method according to claim 3, wherein at the beginning of the execution of the method for monitoring the communication of the field devices (112, 114, 116) according to claim 1, the at least one stored characteristic attribute of the power consumption of each of the plurality of field devices (112, 114, 116) triggered by a corresponding query of the plurality of queries for the corresponding field devices is determined based on a first number of corresponding measured characteristic attributes (200, 211, 212, 213), and the corresponding at least one stored characteristic attribute of the power consumption is stored by the storage unit.

5. A method according to claim 3 or 4, wherein the at least one stored characteristic attribute of the power consumption of each of the plurality of field devices (112, 114, 116) triggered by a corresponding query in a plurality of queries for the corresponding field devices is determined based on repeatedly storing, in particular repeatedly storing in a first-in-first-out manner, a second number of corresponding measured characteristic attributes (200, 211, 212, 213) during the execution of the method for monitoring the communication of the field devices according to claim 1, and the corresponding at least one stored characteristic attribute of the power consumption is stored by the storage unit.

6. The method according to any one of the preceding claims, comprising: determining a baseline (210) of the power consumption of each field device (112, 114, 116) if the corresponding field device (112, 114, 116) is idle; as well as Based on the characteristic attributes for the power consumption, a similarity of the stored characteristic attributes for the power consumption of each of the respective field devices triggered by the respective query and the respective measured characteristic attributes (200, 211, 212, 213) for the power consumption of the respective field devices is determined, wherein the baseline (210) is subtracted from the measured characteristic attributes (200, 211, 212, 213) of the power consumption and the baseline (210) is subtracted from the at least one stored characteristic attribute of the power consumption, respectively.

7. A method according to any one of the preceding claims, wherein the characteristic attribute (200, 211, 212, 213) of the power consumption is a maximum value of the power consumption of the corresponding field device (112, 114, 116) triggered by the corresponding query, and / or a duration of the power consumption of the corresponding field device (112, 114, 116) triggered by the corresponding query, and / or the power consumption in signal form of the power consumption of the corresponding field device (112, 114, 116) triggered by the corresponding query, and / or a statistical parameter of the power consumption of the corresponding field device (112, 114, 116) triggered by the corresponding query.

8. The method of any one of the preceding claims, wherein the query or response of the communication of each of the plurality of field devices (112, 114, 116) and the characteristic attribute of the power consumption of each of the plurality of field devices (112, 114, 116) are provided by a two-wire cable.

9. The method according to any one of the preceding claims, wherein the query or response of the communication of each of the plurality of field devices (112, 114, 116) and the characteristic attribute of the power consumption of each of the plurality of field devices (112, 114, 116) comply with the Ethernet-APL standard.

10. A method according to any one of the preceding claims, wherein a security alert is generated if the value of the similarity determined when comparing the stored characteristic attribute of the power consumption with the corresponding measured characteristic attribute of the power consumption of the corresponding field device triggered by the corresponding query is lower than a predetermined threshold; and preferably the security alert is reported to a SIEM system (130).

11. A monitoring unit (100), comprising: a storage unit configured to store stored characteristic attributes of power consumption of each of the plurality of field devices (112, 114, 116) triggered by a corresponding query of a plurality of queries for the corresponding field device (112, 114, 116); at least one measurement unit configured to be electrically coupled to the plurality of field devices (112, 114, 116) for measuring respective characteristic attributes of the power consumption; a communication monitoring unit configured to monitor and identify inquiries and / or responses with each of the plurality of field devices (112, 114, 116); and processing unit; and The monitoring unit (100) is configured to perform the method according to any one of claims 1 to 10.

12. The monitoring unit (100) according to claim 11, wherein the communication monitoring unit (100) is configured to: coupled to each of the field devices in the plurality of field devices (112, 114, 116); coupled to a control unit (140) that generates requests for the plurality of field devices (112, 114, 116); and During communication between the control unit (140) and the respective one of the plurality of field devices (112, 114, 116), respective queries and / or responses requested for each of the respective one of the plurality of field devices (112, 114, 116) are determined.

13. Use of a monitoring unit (100) according to claim 11 or 12 for monitoring secure communication of a field device of a plurality of field devices (112, 114, 116) according to any one of claims 1 to 10.

14. A computer program comprising instructions for causing a computer to perform the method according to any one of claims 1 to 10 when the program is executed by the computer.

15. A computer-readable storage medium for storing the computer program according to claim 14.

Images