Control device, network and data transmission from control device to network
By introducing monitoring and resilience units into the control device, the integrity of the device is monitored and data is transmitted through a resilience tunnel when damaged, thus solving the problem of the control device being vulnerable to attack proliferation and realizing effective attack prevention and remote recovery functions.
Patent Information
- Application Number
- CN202580024706.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2024-03-28
- Filing Date
- 2025-02-17
- Publication Date
- 2026-11-03
AI Technical Summary
Control devices are vulnerable to attacks that could lead to the execution of unwanted and harmful functions, and the attacks could spread to other devices in the network. Furthermore, existing technologies make it difficult to reliably limit or recover from attacked control devices.
Introducing monitoring and resilience units into the control equipment monitors equipment integrity and encapsulates and transmits data through resilience tunnels when integrity is compromised, restricting communication and restoring equipment integrity.
It effectively prevents the spread of attacks, reduces damage to other devices, and supports remote recovery of attacked control devices, reducing workload and impact.
Smart Images
Figure CN123036802A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to control devices, networks, and methods for transmitting data from control devices to networks. Background Technology
[0002] The term "control device" as used herein primarily refers to equipment configured for the automatic control and / or regulation of machines, facilities, and technical processes. Control devices include, for example, automation equipment, Industrial Internet of Things (IoT) devices, and Programmable Logic Controllers (PLCs). The term "control device" is interpreted broadly to also include mobile terminal devices such as mobile operating devices, smartphones, and tablets.
[0003] Typically, control devices may contain vulnerabilities that attackers can actively exploit. As a result, the control device can be manipulated to perform unintended and harmful functions. Control devices are usually connected to a network, through which they can communicate with each other and / or with higher-level systems. Because control devices are connected to a network, attacks on that control device can spread through the network, thereby attacking other devices in the network or causing overload during a DoS attack (DDoS: Denial of Service), or potentially causing real-world damage through actuators connected to the control device.
[0004] Therefore, it is necessary to reliably limit control devices identified as being attacked or manipulated so that they do not cause harm or cause only minor harm. Furthermore, it may be advantageous, to the extent possible, to support the restoration of control devices identified as being attacked or manipulated to a complete state from a remote location via a communication connection, enabling remote access to the control devices with minimal effort. This may be advantageous, for example, for control devices used in power plants, water treatment facilities, or wind power generation facilities where there are no on-site operators. Summary of the Invention
[0005] The object of the present invention is to provide a control device and a method for transmitting data from the control device to a network, wherein the control device and method are improved in responding to attacks or manipulations against the control device.
[0006] The above-mentioned objective of the present invention is achieved by a control device having the features of claim 1, a network having the features of claim 9, and a method having the features of claim 10.
[0007] Advantageous embodiments of the present invention form the subject matter of the dependent claims.
[0008] The control device according to the present invention includes: - Network interface, which is configured to enable network communication between the control device and the network; - A monitoring unit, configured to monitor the integrity of the control equipment; and - A resilience unit is configured to encapsulate at least a portion of the data to be transmitted from the control device to the network via the network interface in accordance with a tunneling protocol for transmission via a resilience tunnel, before transmitting the encapsulated data to the network via the network interface, in the event that the monitoring unit detects that the integrity of the control device has been compromised.
[0009] In other words, when the monitoring unit of the control device detects that the integrity of the control device has been compromised, the control device according to the invention is placed into a resilient operating mode by its resilience unit. In the resilient operating mode, communication between the control device and the network is restricted by transmitting at least a portion of the communication between the control device and the network via a resilient tunnel. This prevents or at least increases the difficulty of so-called "lateral movement," in which an attack against the control device spreads across the network to other devices in the network. In particular, it prevents or at least increases the difficulty of software executed on the control device and potentially manipulated accessing other devices in the network. However, at the same time, since communication with the control device via the resilient tunnel is still possible, measures to restore the integrity of the control device can be taken remotely.
[0010] One embodiment of the control device according to the invention has a main processor, and the data encapsulated by the resilient unit includes at least all data generated by software executed by the main processor and to be transmitted to the network via a network interface. The main processor typically refers to the most powerful processor in the control device that primarily controls the functions of the control device. The main processor may have subprocessors, particularly multiple processor cores. In addition to the main processor, the control device may also have other processors, particularly coprocessors. Encapsulating network communications generated by the software executed by the main processor within a resilient tunnel takes into account the fact that attackers typically prioritize attacking the main processor of the control device or the software executed by the main processor.
[0011] In another embodiment of the control device according to the invention, a resilience unit is configured to encode the encapsulated data using a different encoding scheme than the data transmitted by the control device to the network via the network interface when the monitoring unit does not detect any breach in the integrity of the control device. In other words, in the resilient operating mode of the control device, the data transmitted via the resilient tunnel is encoded using a different encoding scheme than the data transmitted to the network in the normal operating mode of the control device. The advantage is that data transmitted via the resilient tunnel will not be accepted as valid data by other devices in the network that are not designed to handle this specific data encoding scheme. Therefore, even if this data accidentally reaches other devices besides the intended device, the harm caused by this data is minimized.
[0012] In another embodiment of the control device according to the invention, a resilience unit is configured to give the encapsulated data a different checksum than the data transmitted by the control device to the network via the network interface when the monitoring unit does not detect any breach in the integrity of the control device. Alternatively or additionally, the resilience unit is configured to give the encapsulated data a checksum encoded using a different encoding scheme than the checksum of the data transmitted by the control device to the network via the network interface when the monitoring unit does not detect any breach in the integrity of the control device. These embodiments of the control device according to the invention also aim to ensure that data transmitted via a resilience tunnel is not accepted as valid data by other devices in the network, thereby minimizing the harm caused by the data even if it accidentally reaches devices other than the intended ones.
[0013] In another embodiment of the control device according to the invention, a resilience unit is configured to generate a password-protected message when the monitoring unit detects that the integrity of the control device has been compromised. This message is sent to the network via a network interface and indicates that data was sent from the control device to the network in an encapsulated manner via a resilience tunnel. Thus, reliable information can be obtained and verified both within the network and remotely, namely that the control device is currently unable to communicate directly with other devices in the network, or can only communicate directly with other devices in the network in a restricted manner.
[0014] In another embodiment of the control device according to the invention, a resilience unit is configured to cryptographically encrypt the encapsulated data. This further enhances the transmission protection of data transmitted via a resilience tunnel.
[0015] In another embodiment of the control device according to the invention, the resilience unit has a tunnel configuration component, by which the encapsulation and / or encryption of data to be transmitted via the resilience tunnel and / or the destination address can be configured. The destination address refers to the endpoint of the resilience tunnel, through which data is sent. The tunnel configuration component can determine and / or change the configuration of the resilience tunnel. The configuration of the resilience tunnel may include the destination address, which can be configured, for example, in the form of an IP address, DNS address, Uniform Resource Locator (URL), or Uniform Resource Identifier (URI). The configuration of the resilience tunnel may also include a digital certificate, a certificate whitelist, or one or more cryptographic keys.
[0016] The network according to the present invention includes: - Multiple control devices designed according to the present invention; - Resilient tunnel endpoint services; and - Device recovery service, among which... - Each control device is configured to send data encapsulated by the resilience unit to the resilience tunnel endpoint service via the resilience tunnel if the monitoring unit of the control device detects that the integrity of the control device has been compromised. - The resilient tunnel endpoint service is configured to decapsulate encapsulated data received by the resilient tunnel endpoint service and check for permission. When the decapsulated data is permitted, the device recovery service communicates via the resilient tunnel with the control device that sent the encapsulated data. - The device recovery service is configured to restore the integrity of the control device.
[0017] This network can restore the integrity of control devices through a device recovery service. To this end, in addition to the device recovery service, the network also has a resilient tunnel endpoint service, through which control devices in resilient operation mode establish a communication connection with the resilient tunnel endpoint service. Subsequently, if data sent by the control device to the resilient tunnel endpoint service via the resilient tunnel is deemed permissible by the resilient tunnel endpoint service, the resilient tunnel endpoint service enables the device recovery service to communicate with the control device via the resilient tunnel. The control device can access the resilient tunnel endpoint service and the device recovery service, for example, via the Internet. For instance, the resilient tunnel endpoint service and the device recovery service can be hosted on a publicly accessible cloud platform; alternatively, they can be located locally, such as in a factory network or enterprise network, or in an edge computing execution environment. Restoring the integrity of the control device by the device recovery service may include, for example, resetting the control device's configuration to its initial configuration (factory reset), restarting the device (reboot), preferably reading program code from a read-only storage device, such as flash memory, installing firmware updates, installing software patches, or setting configuration parameters during reboot. The device recovery service can be configured to transmit firmware, program code, configuration data, or recovery instructions to the device via a resilient tunnel. Furthermore, the control device can be configured to transmit diagnostic data to the device recovery service via a resilient tunnel. The device recovery service can be configured to determine, based on the received diagnostic data, the recovery measures to be taken to restore the integrity of the control device, or to check the success of initiated recovery measures, i.e., to determine whether the control device has returned to an intact state; and, if the device recovery service identifies that the control device has returned to an intact state, to provide the control device with a resilient tunnel delicacy message, preferably protected by cryptographic verification. The resilient unit of the control device can be configured to verify the validity of the received resilient tunnel delicacy message using cryptographic verification, and to disable or remove the resilient tunnel based on the verification result.
[0018] In the method according to the invention for transmitting data from a control device to a network, - The integrity of the control equipment is monitored by the monitoring unit of the control equipment; - If the monitoring unit detects that the integrity of the control device has been compromised, the resilience unit of the control device encapsulates at least a portion of the data to be transmitted by the control device through the control device's network interface into the network according to a tunneling protocol for transmission via a resilience tunnel; and - Send the encapsulated data to the network via a resilient tunnel.
[0019] In one embodiment of the method according to the invention, the encapsulated data is encoded using a different encoding scheme than the data sent by the control device to the network via the network interface when the monitoring unit does not detect any damage to the integrity of the control device.
[0020] In another embodiment of the method according to the invention, the encapsulated data is made to have a different checksum than the data sent to the network by the control device via the network interface when the monitoring unit does not detect that the integrity of the control device is compromised, and / or the encapsulated data is made to have a checksum encoded using a different encoding scheme than the checksum of the data sent to the network by the control device via the network interface when the monitoring unit does not detect that the integrity of the control device is compromised.
[0021] In another embodiment of the method according to the invention, when the monitoring unit detects that the integrity of the control device has been compromised, the resilience unit generates a password-protected message, which is sent to the network via the network interface, indicating that data is sent from the control device to the network via a resilience tunnel in an encapsulated manner.
[0022] In another embodiment of the method according to the invention, the encapsulated data is cryptographically encrypted.
[0023] The features of the method according to the present invention and its above-described embodiments correspond to the features of the control device and its embodiments according to the present invention described above. Therefore, the advantages of the method according to the present invention and its above-described embodiments also correspond to the advantages of the corresponding features of the control device and its embodiments according to the present invention.
[0024] In another embodiment of the method according to the invention, when the monitoring unit detects that the integrity of the control device has been compromised, data traffic transmitted via the resilient tunnel is filtered, limiting the bandwidth and / or data transmission rate of data sent to the network via the network interface, and / or preventing the main processor of the control device from accessing at least one hardware component and / or at least one storage area of the control device. These measures further limit the impact of attacks against the control device. For example, limiting the bandwidth and / or data transmission rate of data sent to the network via the network interface prevents overload of the network or individual devices within the network due to DoS attacks. Attached Figure Description
[0025] The above-described features, characteristics, and advantages of the present invention, as well as the ways in which these features, characteristics, and advantages are realized, will become more apparent from the following description of embodiments, which are described in more detail with reference to the accompanying drawings. Wherein: Figure 1 A block diagram of one embodiment of the control device is shown; Figure 2 A block diagram of one embodiment of a network having multiple control devices is shown.
[0026] In the accompanying drawings, corresponding components are indicated by the same reference numerals. Detailed Implementation
[0027] Figure 1 A block diagram of an embodiment of a control device 1 according to the present invention is shown. The control device 1 includes a main processor 3, a program and configuration memory 5, a working memory 7, a safety element 9, an input / output interface 11 for connecting sensors and actuators to the control device 1, a network interface 13, a monitoring unit 15, and a resilience unit 17.
[0028] Network interface 13 is configured to control device 1 and network 33 (see...) Figure 2 Network communication between [interfaces]. For example, network interface 13 includes an Ethernet interface, a WLAN (Wireless Local Area Network) interface, a mobile communication interface, and / or an ultra-wideband interface. Typically, network interface 13 can be implemented as a wired interface, an optical interface, a radio interface, or a wireless communication interface.
[0029] Monitoring unit 15 is configured to monitor the integrity of control device 1. Figure 1 In the illustrated embodiment, for this purpose, the monitoring unit 15 includes a runtime health check component 21 and an authenticated watchdog 23 with a cryptographically protected reset mechanism. The runtime health check component 21 is configured to monitor the integrity of the control device 1 during runtime. The authenticated watchdog 23 can be reset externally in a cryptographically protected manner and issues an integrity breach signal if it is not reset in a timely manner. Furthermore, the monitoring unit 15 may also have device management functions, through which the device management system can issue integrity breach signals externally.
[0030] The resilience unit 17 includes a resilience mode activation component 25, an encapsulation component 27, and a tunnel configuration component 29. The resilience mode activation component 25 is configured to activate the resilience operation mode of the control device 1 when the monitoring unit 15 detects that the integrity of the control device 1 has been compromised. To activate the resilience operation mode, the resilience mode activation component 25 sends a control signal 31 to the encapsulation component 27. Furthermore, the resilience mode activation component 25 can also be configured to generate a password-protected message when activating the resilience operation mode. This message is sent to the network 33 via the network interface 13, indicating that the resilience operation mode of the control device 1 has been activated. Optionally, the resilience mode activation component 25 may also initiate other measures when activating the resilience operation mode, such as disabling the input / output interface 11, stopping the main processor 3, or generating an interrupt signal, and / or loading a recovery image into the program and configuration memory 5.
[0031] Encapsulation component 27 is configured to, in resilient operation mode, after receiving control signal 31, encapsulate at least a portion of the data to be transmitted by control device 1 to network 33 via network interface 13 according to a tunneling protocol before transmitting the encapsulated data to network 33 via resilient tunnel 43. The tunneling protocol is used to encapsulate the data via resilient tunnel 43 (see [link to relevant documentation]). Figure 2 The encapsulated data includes at least all data generated by the software executed by the main processor 3 and to be sent to the network 33 via the network interface 13, but may also include other or all data to be sent from the control device 1 to the network 33. By transmitting the encapsulated data via the resilient tunnel 43, the control device 1 itself is no longer able to perform regular communication via the network interface 13.
[0032] In addition to the measures described above, other measures can be taken on control device 1 in resilient operation mode. For example, in resilient operation mode, the encapsulated data is encoded using a different encoding scheme than the data that control device 1 normally sends to network 33 via network interface 13. Here, for example, the data to be sent via resilient tunnel 43 is re-encoded using an XOR operation with a specific positioning mode, such as 1111 1111, 0101 0101, 1010 1010, or 1001 0110. As an alternative or additional scheme, the encapsulated data may have a checksum different from the data that control device 1 normally sends to network 33 via network interface 13, or the encapsulated data may have a checksum encoded using a different encoding scheme than the checksum of the data that control device 1 normally sends to network 33 via network interface 13. As an alternative or additional scheme, the encapsulated data may be cryptographically encrypted.
[0033] As an alternative or additional solution, in resilient operation mode, for example, filtering data traffic transmitted via resilient tunnel 43, limiting the bandwidth or data transmission rate of data transmitted from network interface 13 to network 33 (to avoid DoS attacks), and / or preventing the main processor 3 from accessing specific hardware components and / or specific storage areas of the control device 1.
[0034] Tunnel configuration component 29 is configured to configure resilient tunnel 43. The configuration of resilient tunnel 43 includes, for example, the tunneling protocol to be used, the endpoints of resilient tunnel 43 (e.g., in the form of the destination address of data to be sent via resilient tunnel 43), and / or the cryptographic key used to encrypt this data. The cryptographic key can be a symmetric key (pre-shared key), or it can be a private key with its own certificate and the certificates of the endpoints of resilient tunnel 43. Tunnel configuration component 29 can either fix the default configuration of resilient tunnel 43 or provide options for configuring resilient tunnel 43.
[0035] Figure 2 A block diagram of one embodiment of a network 33 according to the present invention is shown. The network 33 includes a plurality of control devices 1, a resilient tunnel endpoint service 35, and a device recovery service 37.
[0036] Each control device 1 is constructed as a reference. Figure 1 The control device 1, in its normal operating mode, is capable of communicating with each other via subnetwork 34 of network 33. Resilient tunnel endpoint service 35 and device recovery service 37 can be accessed from subnetwork 34 via communication medium 39, which is connected to subnetwork 34 via gateway 41. Communication medium 39 is, for example, the Internet, and the resilient tunnel endpoint service 35 and device recovery service 37 can be accessed via the Internet, for example, in the form of services hosted on a publicly accessible cloud platform. Alternatively, the resilient tunnel endpoint service 35 and device recovery service 37 can be located locally, for example, in a factory network or enterprise network, or in an edge computing execution environment.
[0037] Each control device 1 is configured to send data encapsulated by its resilience unit 17 to the resilience tunnel endpoint service 35 via the resilience tunnel 43 in resilience operation mode. Figure 2 An example is illustrated where one of the control devices 1 is in a resilient operating mode. When all data to be sent by control device 1 to network 33 is transmitted via resilient tunnel 43, control device 1 is technically only able to communicate with the resilient tunnel endpoint service 35 via resilient tunnel 43, and cannot communicate with other control devices 1 in subnetwork 34, nor can it eavesdrop on communications on subnetwork 34. Resilient tunnel 43 extends between control device 1 and resilient tunnel endpoint service 35 via gateway 41 and communication medium 39.
[0038] The resilient tunnel endpoint service 35 decapsulates data transmitted via the resilient tunnel 43. If the data is cryptographically encrypted, decapsulation also includes decryption. For this purpose, the resilient tunnel endpoint service 35 has a tunnel endpoint unit 45 and a tunnel endpoint configuration component 47 for the tunnel endpoint unit 45. A network traffic filter 49 of the resilient tunnel endpoint service 35 checks whether the decapsulated data is allowed to pass. If communication is permitted, the resilient tunnel endpoint service 35 enables the device recovery service 37 to communicate with the control device 1 that sent the encapsulated data via the resilient tunnel 43. The device recovery service 37 is configured to restore the integrity of the control device 1 to the extent possible and is performed, for example, by the device management system.
[0039] Although the present invention has been illustrated and described in detail with reference to preferred embodiments, the present invention is not limited to the disclosed embodiments, and those skilled in the art can derive other variations therefrom without departing from the scope of protection of the present invention.
[0040] Regardless of the grammar of the term, terms include masculine, feminine, and other parts of speech.
[0041] Reference number list
[0042] 1. Control equipment
[0043] 3 Main Processors
[0044] 5. Program and Configuration Memory
[0045] 7 Working Memory
[0046] 9 Safety Components
[0047] 11 Input / Output Interfaces
[0048] 13 Network Interface
[0049] 15 Monitoring Units
[0050] 17 Toughness Units
[0051] 21. Runtime Health Check Component
[0052] 23 Certified Watchdogs
[0053] 25 Resilience Mode Activation Components
[0054] 27. Encapsulated Components
[0055] 29 Tunnel Configuration Components
[0056] 31 Control Signals
[0057] 33 Network
[0058] 34 subnetworks
[0059] 35 Resilient Tunnel Endpoint Services
[0060] 37 Equipment Recovery Service
[0061] 39 Communication Media
[0062] 41 Gateway
[0063] 43 Resilient Tunnels
[0064] 45 Tunnel Endpoint Unit
[0065] 47 Tunnel Endpoint Configuration Component
[0066] 49. Network traffic filter.
Claims
1. A control device (1), comprising: - Network interface (13), which is configured to implement network communication between the control device (1) and the network (33); - Monitoring unit (15), the monitoring unit is configured to monitor the integrity of the control device (1); as well as - A resilience unit (17) is configured to encapsulate at least a portion of the data to be transmitted from the control device (1) to the network (33) via the network interface (13) in accordance with a tunneling protocol for transmission via the resilience tunnel (43) before transmitting the encapsulated data to the network (33) via the resilience tunnel (43) if the monitoring unit (15) detects that the integrity of the control device (1) has been compromised.
2. The control device (1) according to claim 1, comprising a main processor (3), wherein, The data encapsulated by the resilience unit (17) includes at least all data generated by the software executed by the main processor (3) to be sent to the network (33) via the network interface (13).
3. The control device (1) according to claim 1 or 2, wherein, The resilience unit (17) is configured to encode the encapsulated data in a different manner compared to the data sent from the control device (1) to the network (33) via the network interface (13) when the monitoring unit (15) does not detect any breach in the integrity of the control device (1).
4. The control device (1) according to any one of the preceding claims, wherein, The resilience unit (17) is configured to provide a different checksum for the encapsulated data compared to the data sent from the control device (1) to the network (33) via the network interface (13) when the monitoring unit (15) does not detect any breach in the integrity of the control device (1).
5. The control device (1) according to any one of the preceding claims, wherein, The resilience unit (17) is configured to provide a checksum encoded differently for the encapsulated data, compared to the checksum provided with the data sent from the control device (1) to the network (33) via the network interface (13) when the monitoring unit (15) does not detect any breach in the integrity of the control device (1).
6. The control device (1) according to any one of the preceding claims, wherein, The resilience unit (17) is configured to generate a password-protected message when the monitoring unit (15) detects that the integrity of the control device (1) has been compromised. The message is sent to the network (33) via the network interface (13) and indicates that data is sent from the control device (1) to the network (33) in an encapsulated manner via the resilience tunnel (43).
7. The control device (1) according to any one of the preceding claims, wherein, The resilience unit (17) is configured to cryptographically encrypt the encapsulated data.
8. The control device (1) according to any one of the preceding claims, wherein, The resilience unit (17) has a tunnel configuration component (29) which can configure the encapsulation and / or encryption and / or destination address of data to be sent via the resilience tunnel (43).
9. A network (33), comprising: - A plurality of control devices (1), each of which is designed as a control device according to any one of the preceding claims; - Resilient tunnel endpoint service (35); and - Device recovery service (37); among which... - Each control device (1) is configured to send data encapsulated by the resilience unit (17) to the resilience tunnel endpoint service (35) via the resilience tunnel (43) if the monitoring unit (15) of the control device (1) detects that the integrity of the control device (1) has been compromised. - The resilient tunnel endpoint service (35) is configured to decapsulate encapsulated data received by the resilient tunnel endpoint service and check for permission; when the decapsulated data is permitted, to enable the device recovery service (37) to communicate via the resilient tunnel (43) with the control device (1) that sent the encapsulated data; and - The device recovery service (37) is configured to restore the integrity of the control device (1).
10. A method for transmitting data from a control device (1) to a network (33), wherein, - The integrity of the control device (1) is monitored by the monitoring unit (15) of the control device (1); as well as - If the monitoring unit (15) detects that the integrity of the control device (1) has been compromised, before sending the encapsulated data to the network (33) via the resilient tunnel (43), the resilient unit (17) of the control device (1) encapsulates at least a portion of the data to be sent from the control device (1) to the network (33) via the network interface (13) of the control device (1) in accordance with a tunneling protocol for transmission via the resilient tunnel (43).
11. The method according to claim 10, wherein, The encapsulated data is encoded in a different way compared to the data sent from the control device (1) to the network (33) via the network interface (13) when the monitoring unit (15) does not detect that the integrity of the control device (1) is compromised.
12. The method according to claim 10 or 11, wherein, The encapsulated data is provided with a different checksum compared to the data sent from the control device (1) to the network (33) via the network interface (13) when the monitoring unit (15) does not detect any damage to the integrity of the control device (1), and / or the encapsulated data is provided with a checksum encoded in a different manner compared to the checksum provided with the data sent from the control device (1) to the network (33) via the network interface (13) when the monitoring unit (15) does not detect any damage to the integrity of the control device (1).
13. The method according to any one of claims 10 to 12, wherein, If the monitoring unit (15) detects that the integrity of the control device (1) has been compromised, the resilience unit (17) generates a password-protected message that is sent to the network (33) via the network interface (13) and indicates that data is sent from the control device (1) to the network (33) in an encapsulated manner via the resilience tunnel (43).
14. The method according to any one of claims 10 to 13, wherein, Encrypt the encapsulated data with a password.
15. The method according to any one of claims 10 to 14, wherein, If the monitoring unit (15) detects that the integrity of the control device (1) has been compromised, it filters the data traffic transmitted via the resilient tunnel (43), limits the bandwidth and / or data transmission rate of data transmitted to the network (33) via the network interface (13), and / or prohibits the main processor (3) of the control device (1) from accessing at least one hardware component and / or at least one storage area of the control device (1).