A mac address management method of an MES system

Abstract

The present application relates to the technical field of industrial control system security, and specifically to a MAC address management method of MES system. The method comprises: receiving context data related to manufacturing process from a manufacturing execution system in real time, such as work order status, equipment operation mode, bill of materials and operator assignment; discovering devices connected to the OT network and their corresponding MAC addresses through passive monitoring and active querying of network switches; in a central data repository, associating the discovered MAC addresses with the context data obtained from the MES, and establishing a dynamic and context-rich identity profile for each device; based on the association, dynamically generating a network access policy for the device with timeliness and minimum authority principle; finally, sending instructions to the network switch to enforce the policy. The present application binds the network security policy with the actual production plan, significantly improving the security of the industrial network while ensuring the continuity of production.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security technology, specifically a MAC address management method for a MES system. Background Technology

[0002] In modern manufacturing, MES (Manufacturing Execution System) is responsible for real-time scheduling and allocation of production resources (including equipment, personnel, and materials), tracking the status of work-in-process, monitoring quality parameters during production, and recording a complete product lineage for traceability. Therefore, the MES database contains authoritative, high-precision real-time information about factory operations, such as which equipment is executing which work order, the planned start and end times, the current operator, and whether the equipment is in production, standby, or maintenance status.

[0003] This gives MES capabilities that surpass those of traditional network security systems. Traditional network security devices (such as firewalls or switches) can only see basic information like source / destination IP addresses and MAC addresses in network traffic, but cannot obtain the contextual information corresponding to this network traffic. This information, however, is stored in the MES system, allowing the MES system to not only know the existence of a network request, but also whether that request conforms to the currently approved production plan. For example, a traditional switch can only see data packets sent from a single MAC address, while MES can interpret this information as "This is the MAC address of the PLC belonging to CNC machine tool number 5, which is currently assigned to work order number 789, with a planned operating time from 2 PM to 10 PM."

[0004] To protect manufacturing execution system networks from unauthorized access, the industry has adopted various network access control technologies. However, these existing technologies all have certain limitations in their application.

[0005] The most basic network access control method is to configure static MAC address filtering on the ports of industrial switches. This technology allows network administrators to manually create a "whitelist," binding the MAC addresses of authorized devices to specific switch ports. The switch then discards all packets from MAC addresses not on the list. While conceptually simple, this method introduces significant management overhead and inflexibility in practice. Firstly, its maintenance costs are extremely high. Whenever a new device comes online, an existing device has its network card replaced, or external technicians (such as equipment maintenance engineers) need temporary network access, the administrator must manually modify the switch configuration. This is not only time-consuming and labor-intensive but also highly susceptible to production interruptions due to human error.

[0006] Secondly, static MAC filtering is extremely vulnerable. MAC addresses can be easily "spoofed" or "cloned." Attackers can capture the MAC addresses of legitimate devices by simply sniffing network traffic briefly, then modify their own device's MAC address to impersonate it, thus easily bypassing MAC address-based access control.

[0007] To overcome the problems of static MAC filtering, the enterprise IT field has developed more advanced Network Access Control (NAC) solutions. However, applying these NAC solutions designed for IT environments to manufacturing execution system networks presents the following issues: First, IT NAC solutions typically employ a "default denial" security stance. When an unknown or non-compliant device is detected, the standard procedure is to isolate or directly block its network connection. While this behavior is acceptable in IT networks, it can lead to unexpected production line downtime in manufacturing execution system networks, resulting in significant economic losses and potential security incidents.

[0008] Secondly, IT NAC solutions rely on standard IT protocols and agent software installed on end devices to discover and identify information such as device type and operating system. However, most industrial equipment uses proprietary industrial communication protocols, and their embedded or outdated operating systems simply cannot install any third-party agent software. This prevents IT NAC from effectively identifying and profiling the vast majority of critical assets in manufacturing execution system networks.

[0009] In summary, existing technologies, whether simple static MAC filtering or complex IT NAC solutions, cannot effectively solve the network access control problem in manufacturing execution system environments. They are either too costly to manage and lack sufficient security, or they conflict with the core requirements of manufacturing execution system environments, posing a significant risk of introducing production disruptions. Summary of the Invention

[0010] To address the problems in the prior art, this invention provides a MAC address management method for a MES system. This method is deeply coupled with the operating status of the Manufacturing Execution System (MES), thereby solving the various shortcomings of the prior art.

[0011] A method for MAC address management in an MES system includes the following steps: Receive context data related to one or more manufacturing processes from a manufacturing execution system; Discover a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address through one or more network switches; In a data repository, the MAC address of the terminal device is associated with the context data; Based on the association, a network access policy is dynamically generated for the terminal device; Send an instruction to at least one of the one or more network switches to enforce the network admission policy on the switch.

[0012] Preferably, the context data includes at least one of the following: a work order identifier, a device operation status, a maintenance plan, a bill of materials, product lineage data, or operator role information.

[0013] Preferably, the step of discovering a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address through one or more network switches specifically includes: Monitor network traffic copied from the mirror port of the network switch, and filter out broadcast and multicast packets containing device identity information. The packets include Address Resolution Protocol (ARP) packets, Dynamic Host Configuration Protocol (DHCP) packets, and Link Layer Discovery Protocol (LINK) packets. Based on the above packets, generate an asset list of MAC addresses and their corresponding IP addresses. The standard network management protocol is used to periodically obtain and parse the media access control address table inside the network switch to obtain a dataset that precisely maps MAC addresses to their connected physical port numbers and the identifiers of their respective virtual LANs. By associating the generated asset list with the obtained mapping dataset, the MAC address corresponding to the terminal device and the network access point corresponding to that MAC address are determined, forming a comprehensive and dynamic list of terminal devices.

[0014] Preferably, associating the MAC address of the terminal device with the context data specifically includes: The context data is parsed to obtain operational metadata, which includes at least a valid work order identifier, an equipment asset number, a predefined equipment operation status, and a planned timestamp associated with the work order or operation status. Query the data repository to see if there is an existing device record corresponding to the MAC address of the terminal device; If a matching existing record is found, the attribute fields in that record are updated using the aforementioned context data; if no matching record is found, a new device record is created in the data repository, and the corresponding fields of that record are populated with the MAC address of the terminal device and the aforementioned metadata.

[0015] Preferably, the step of dynamically generating a network access policy for the terminal device based on the association specifically includes: Retrieve records associated with the MAC address of the terminal device from the data repository; The context data in the above records is matched with a predefined policy rule base, which contains multiple logical rules. Each logical rule defines a mapping relationship between one or more operation contexts and a specific network permission level. Construct a network admission policy based on the matched logical rules.

[0016] Preferably, the logical rules include: a production rule applicable to the equipment in a "production" state; a maintenance rule applicable to the equipment in a "planned maintenance" state; and a standby rule applicable to the equipment in a "standby" state.

[0017] Preferably, the network admission policy has a time limit, and its validity period is associated with a predetermined time parameter in the context data.

[0018] Preferably, the enforcement of the network access control policy includes: Configure a port security feature of the switch to bind the MAC address to a specific port of the switch; Apply an access control list to a port of the switch or assign the port to a specific virtual LAN.

[0019] Preferably, the method further includes: When an unknown MAC address not recorded in the data repository is discovered, the switch port associated with the unknown MAC address is automatically placed in a predefined restricted network area. An alarm notification is sent to an authorized user through a user interface of the MES to initiate a supervised workflow for handling the unknown MAC address.

[0020] Preferably, the supervised workflow includes: Receive user credentials associated with the unknown MAC address and a task identifier through an authentication portal; The MES is used to verify the validity of the user credentials and task identifier; If the verification is successful, the unknown MAC address is associated with the task identifier, and a temporary network access policy is generated for it.

[0021] Compared with the prior art, the advantages of this invention are: This solution deeply integrates network access control with the Manufacturing Execution System (MES), addressing issues that static MAC address filtering and traditional IT NAC solutions struggle with. Compared to traditional static MAC address filtering, this solution replaces costly and error-prone manual management with automated and dynamic strategies. By verifying "operational intent" rather than simple address identification, it effectively defends against attacks such as MAC address spoofing. Furthermore, it solves the network challenge of static lists becoming invalid due to MAC address randomization through a task-based temporary authorization workflow.

[0022] Furthermore, this solution abandons the "default rejection" logic that could disrupt production through IT NAC, and adopts a supervised guided certification process for unknown equipment. At the same time, it leverages the authoritative asset database within the MES to overcome the "visibility blind spot" that exists in IT NAC when identifying proprietary industrial equipment. Attached Figure Description

[0023] Figure 1 This is a flowchart of a MAC address management method for a MES system proposed in this invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0025] The system environment for implementing this invention mainly includes: Manufacturing Execution System Server: A server that runs standard MES applications. The MES integrated MAC address management module of this invention is deployed or integrated on this server.

[0026] OT network: An operational technology network in a factory floor, connecting all production-related industrial equipment. This network consists of one or more managed network switches. These switches must be programmable, supporting protocols such as SNMP, NETCONF, and RESTful APIs, so that management modules can configure them programmatically.

[0027] Industrial terminal equipment: Various devices connected to the OT network, such as programmable logic controllers (PLCs), human-machine interfaces (HMIs), numerical control machine tools (CNCs), robot controllers, sensors, and laptops or mobile devices for temporary access by technicians.

[0028] The MES integrated MAC address management module, as a software entity, is responsible for executing all the methods described in this invention. This module can be implemented as a plugin for the MES system or as a standalone application that exchanges data with the MES via an API. It mainly consists of the following engines: Device discovery and profiling engine: This engine is responsible for continuously scanning the OT network to discover all connected devices and build their basic profiles. To achieve comprehensive coverage and avoid interfering with vulnerable OT devices, the engine employs a combination of discovery technologies: Passive monitoring: By listening to network broadcasts and communication traffic (such as ARP requests, DHCP requests, and LLDP / CDP broadcast packets) at key network nodes, the MAC addresses of newly connected devices are passively learned without actively sending any probe packets. Specifically, network traffic copied from mirrored ports of network switches is monitored, and broadcast and multicast packets containing device identity information are filtered out. Based on these packets, an asset list of MAC addresses and their corresponding IP addresses is generated.

[0029] Active query: Periodically query the MAC address table of the managed switch via a management protocol (such as SNMP) to obtain the list of MAC addresses currently learned for each port. Specifically, use standard network management protocols to periodically obtain and parse the media access control address table inside the network switch to obtain a dataset that precisely maps MAC addresses to their connected physical port numbers and their associated virtual LAN identifiers.

[0030] MES Asset Database Integration: This feature allows querying the built-in asset inventory database within the MES system. In most established manufacturing enterprises, the MES system itself maintains a highly authoritative and comprehensive inventory of factory equipment. This engine cross-references discovered MAC addresses with the MES asset database, thus associating a network address with a real physical asset, solving the problem of difficult asset identification in OT networks using traditional solutions.

[0031] After detecting a device, the engine creates an initial profile. For example, it identifies the device's manufacturer by parsing the first 24 bits of the MAC address, which is the organization's unique identifier. This information is then compared with the expected manufacturer of the device recorded in the MES asset database as part of the authentication process.

[0032] Contextualization Engine: This engine is responsible for dynamically binding a network entity (identified by its MAC address) to its real-time "operation context". The engine continuously queries the MES database via API or subscribes to events published by the MES system to obtain the following key context information: Work order status: Which work orders are currently active? Which devices or production lines have these work orders been assigned to? Equipment Status: Is the real-time status of the target equipment recorded in the MES "In Production", "Standby", "Planned Shutdown", or "Unplanned Maintenance"? Operator / User Data: Which operator is currently logged into this specific HMI or workstation? Is their role a regular operator, maintenance technician, or production supervisor? Maintenance Plan: Is there a valid maintenance work order for this device? Has the work order authorized access for a maintenance technician? All this contextual information is used to enrich and update a dedicated database: the MES integrated MAC address repository. In this repository, each record uses the MAC address as the primary key or index and is associated with a series of dynamically changing contextual attributes, such as: asset ID, device type, manufacturer OUI, current status, associated work order ID, associated operator ID, trust level, and policy expiration timestamp. In this way, the system builds a dynamic, context-rich identity profile for every device on the network.

[0033] Dynamic strategy generation engine: Based on the device profile built by the context association engine, this engine dynamically generates refined network access control policies that adhere to the principle of least privilege. These policies are not simple "allow / deny" rules, but rather complex logical rules based on state and time. For example: Production policy example: If the MAC address of the device is “AA:BB:CC:11:22:33” and the asset ID of the device is “CNC-05”, the status of CNC-05 in MES is “in production”, and the associated work order of the device is “WO-998”, then all communication of the MAC address is allowed on switch port 5. The policy is valid until the planned end time of WO-998.

[0034] Maintenance policy example: If the device's MAC address is "DD:EE:FF:44:55:66" and the device is a technician's laptop, and there is a valid maintenance work order for asset "PLC-12" in the MES, then only this MAC address is allowed to access the IP address of PLC-12 on switch port 10, and the policy is valid for 4 hours.

[0035] Standby policy example: If the device's MAC address is "AA:BB:CC:11:22:33" and the device's asset ID is "CNC-05" and the device's status is "standby", then only this MAC address is allowed to communicate with the MAC server and monitoring server on switch port 5, blocking all other communications.

[0036] This strategy generation approach enables a fundamental shift from static access control to dynamic, state-based authorization.

[0037] Strategy execution and monitoring engine: This engine is responsible for translating the logical policy generated in the previous step into specific instructions that the network switch can understand and execute, and then distributing these instructions to the switch via the management protocol. Policy execution can be achieved in the following ways: Configure port security: Dynamically update the port security configuration of the switch ports programmatically. For example, use the "sticky MAC" or "static MAC" function to bind authorized MAC addresses to specific ports. When the policy expires or the context changes, unbind the MAC address using a command.

[0038] Apply dynamic ACLs or VLANs: Dynamically apply access control lists (ACLs) to switch ports based on policies, or dynamically assign ports to specific virtual LANs (VLANs). For example, a device that needs maintenance and its corresponding technician's laptop can be temporarily assigned to an isolated "maintenance VLAN," or an unknown device can be assigned to an "isolated VLAN."

[0039] All policy generation, distribution, execution, and device connection / disconnection events are recorded in detail in the log, along with the timestamp and context snapshot, for subsequent auditing and troubleshooting.

[0040] Example 1: This embodiment describes the debugging workflow for the initial device connection, specifically including: When a new, permanent piece of industrial equipment (such as a new PLC) is installed, the administrator first registers the equipment in the MES asset management module, entering its asset number, model, production line, and other information. Then, the equipment is powered on and connected to the OT network. At this point, the system of this invention will detect an unknown MAC address. The system marks it as "pending debugging" and places it in a restricted network environment that can only communicate with the MES server. Simultaneously, the system sends a notification to the production supervisor or IT administrator through the MES user interface. After the supervisor confirms on the interface that the equipment is indeed the newly registered asset, a "binding" operation is performed, formally associating this new MAC address with the asset record in the MES. Once the binding is complete, the system will generate and apply the corresponding network policy based on the equipment's default state (such as "standby").

[0041] Example 2: This embodiment describes the workflow for handling temporary access to devices (such as device maintenance) in the MES, specifically: When a maintenance technician needs to maintain a machine: Context preparation: First, create or activate a maintenance work order for the machine in the MES system.

[0042] Device Connection and Discovery: The technician connects their laptop to the designated network port. The system immediately detects an unknown MAC address.

[0043] Automatic Isolation and Guidance: When the system detects that the MAC address is no longer in the known repository, it immediately and automatically assigns the switch port to an isolated "Guest VLAN" or "Authentication VLAN". Within this VLAN, the device can only access a specific authentication portal.

[0044] Task-based authentication: Technicians open the authentication portal in their laptop's browser. The portal requires them to enter valid credentials from the MES system and the maintenance work order number being executed.

[0045] Context verification and policy generation: The system verifies the information submitted by the technician against the MES database. If the credentials are valid and the maintenance work order does exist and is active, the system considers the access legitimate. At this point, the system associates the technician's device and its MAC address with the maintenance task and dynamically generates a minimum-privilege, time-limited temporary network policy (e.g., only allowing access to the IP address of the device being maintained, valid for the estimated duration of the work order).

[0046] Policy Enforcement and Access Authorization: The system distributes the newly generated policy to the switch, removes the port from the isolated VLAN, and applies the new ACL. The technician then obtains the network access permissions required to perform the task.

[0047] Automatic policy revocation: When a maintenance work order is closed in MES, or when the set policy expires, the system will automatically revoke the temporary policy and restore the port to the default isolation state.

[0048] This solution addresses the issue of MAC address randomization while ensuring security by binding authentication to specific, time-limited "tasks" (i.e., maintenance work orders) rather than to unstable "device identifiers" (i.e., MAC addresses).

[0049] Example 3: This embodiment illustrates the anomaly detection capability of the method using a MAC address spoofing scenario, specifically: Suppose an attacker successfully clones the MAC address of a critical PLC (named "PLC-A") through network sniffing.

[0050] In a traditional static filtering scenario, an attacker could access all other devices on the network because their MAC address was on the whitelist.

[0051] In this solution, it is assumed that the MES system records show that the production line to which "PLC-A" belongs is currently in a "planned shutdown" state. At this time, an attacker uses a forged MAC address to attempt to send control commands to other devices. The system of this invention detects traffic from the MAC address of "PLC-A," but by querying the MES context, it finds that its state should be "shutdown," and there should be no active control communication. Due to the contradiction between the aforementioned "network behavior" and "operational context," the system identifies this as a high-risk security anomaly. An alarm is triggered, the characteristics of the abnormal traffic are recorded in detail, and the system can be configured to automatically execute response actions, such as isolating the switch port without affecting other parts of the network, thereby thwarting the attack.

[0052] In summary, compared to existing static MAC filtering methods, this invention, through integration with MES, achieves automated generation, application, and revocation of network access policies, eliminating tedious, time-consuming, and error-prone manual configuration work. Furthermore, this invention deeply binds network access with real-time production contexts (such as work orders, equipment status, and maintenance plans), enabling security policies to reflect and serve production needs. In addition, by continuously verifying the consistency between network behavior and MES context, it can identify devices that use legitimate MAC addresses but exhibit abnormal behavior, thereby providing a deeper level of security.

[0053] Compared to the IT NAC solution, this invention adopts a supervised guided authentication process for unknown devices instead of directly blocking them. This ensures security while minimizing the impact on production continuity. Furthermore, by directly integrating with the authoritative asset database in the MES and combining it with non-intrusive network discovery technology, it achieves accurate identification and profiling of OT assets, solving the asset visibility problem in the OT environment.

[0054] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0055] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A MAC address management method for a MES system, characterized in that, Includes the following steps: Receive context data related to one or more manufacturing processes from a manufacturing execution system; The system discovers a terminal device connected to the network where the manufacturing execution system is located and its corresponding MAC address through one or more network switches. Specifically: Monitor network traffic copied from the mirror port of the network switch, and filter out broadcast and multicast packets containing device identity information. The packets include Address Resolution Protocol (ARP) packets, Dynamic Host Configuration Protocol (DHCP) packets, and Link Layer Discovery Protocol (LINK) packets. Based on the above packets, generate an asset list of MAC addresses and their corresponding IP addresses. The standard network management protocol is used to periodically obtain and parse the media access control address table inside the network switch to obtain a dataset that precisely maps MAC addresses to their connected physical port numbers and the identifiers of their respective virtual LANs. By associating the generated asset list with the obtained mapping dataset, the MAC address corresponding to the terminal device and the network access point corresponding to the MAC address are determined, forming a comprehensive and dynamic list of terminal devices. In a data repository, the MAC address of the terminal device is associated with the context data; Based on the aforementioned association, a network access policy is dynamically generated for the terminal device, specifically: Retrieve records associated with the MAC address of the terminal device from the data repository; The context data in the above records is matched with a predefined policy rule base, which contains multiple logical rules. Each logical rule defines a mapping relationship between one or more operation contexts and a specific network permission level. Construct a network admission policy based on the matched logical rules; The logical rules include: a production rule applicable when the equipment is in "production" state; a maintenance rule applicable when the equipment is in "planned maintenance" state; and a standby rule applicable when the equipment is in "standby" state. The network access policy has a time limit, and its validity period is associated with a predetermined time parameter in the context data. Send an instruction to at least one of the one or more network switches to enforce the network admission policy on the switch; The enforcement of the network access policy includes: Configure a port security feature of the switch to bind the MAC address to a specific port of the switch; Apply an access control list to a port of the switch or assign the port to a specific virtual LAN; The method further includes: When an unknown MAC address not recorded in the data repository is discovered, the switch port associated with the unknown MAC address is automatically placed in a predefined restricted network area. Through a user interface of the MES, an alarm notification is sent to an authorized user to initiate a supervised workflow for handling the unknown MAC address, specifically: Receive user credentials associated with the unknown MAC address and a task identifier through an authentication portal; The MES is used to verify the validity of the user credentials and task identifier; If the verification is successful, the unknown MAC address is associated with the task identifier, and a temporary network access policy is generated for it.

2. The MAC address management method for a MES system according to claim 1, characterized in that, The context data includes at least one of the following: a work order identifier, an equipment operation status, a maintenance plan, a bill of materials, product lineage data, or operator role information.

3. The MAC address management method for a MES system according to claim 1, characterized in that, Associating the MAC address of the terminal device with the context data specifically includes: The context data is parsed to obtain operational metadata, which includes at least a valid work order identifier, an equipment asset number, a predefined equipment operation status, and a planned timestamp associated with the work order or operation status. Query the data repository to see if there is an existing device record corresponding to the MAC address of the terminal device; If a matching existing record is found, the attribute fields in that record are updated using the aforementioned context data; if no matching record is found, a new device record is created in the data repository, and the corresponding fields of that record are populated with the MAC address of the terminal device and the aforementioned metadata.

Images