Method and communication control system for influencing communication in a communication network

Description

[0001] The invention relates to a method for controlling or influencing communication within a communications network. Furthermore, the invention relates to a communication control system for controlling or influencing communication of at least one component within a communications network.

[0002] Due to the ongoing development of increasingly complex technical systems, e.g., systems in which IT and / or software components on the one hand interact or are interlinked with mechanical and / or electronic components on the other, communication between the components or between people and the components and the handling of such communication are playing an increasingly important role, not least for security reasons. Communication between the components essentially forms the backbone of such systems. For example, an accidental disruption or intentional manipulation of this communication itself, or an accidental disruption or intentional manipulation of components of a system, can lead to undesirable or unforeseeable effects within the system.

[0003] Existing solutions provide for communication between two or more components or participants in a communication network to be either permitted or suppressed. This is regularly achieved using firewall systems. Such solutions are known, for example, from the published patent specifications or patent applications EP 1417820 B1, WO 2007038872 A1, US 2018115517 A1, WO 00 / 72171 A1, CA 2594020 C, US 6574666 B1, US 6154775 A. The published patent application WO 2005 / 072170 A2 describes dynamic switching of communication. In such systems, communication rules are defined that are based on network parameters or communication parameters or specific services / protocols (e.g. http, ftp, webdav, ssh, or similar) of the network participants connected via the network. Network parameters or communication parameters of this type are, for example, E.g. certificates, MAC addresses, IP addresses, network ports, host-client configurations, etc.The replacement or replacement of network participants requires that such communication rules be adapted. In complex technical systems, adapting communication rules is therefore very complex and error-prone.

[0004] For these reasons, reconfiguration of conventional communication structures or communication rules is generally not possible by laypersons and requires expert knowledge from administrators or IT specialists who are specifically called upon for this purpose and who must also have the necessary permission / approval for reconfiguration.

[0005] US 2017 / 295031 A1 discloses techniques or mechanisms for automatically filtering network messages in an avionics network for an aircraft based on a current system context. A method is provided that includes receiving a network message transmitted from a source avionics device to a destination avionics device via one or more network packets within the avionics network. A current system context indicating an overall status of avionics devices within the avionics network is determined based on monitoring the avionics devices. The network message is analyzed by identifying a plurality of attributes corresponding to the header and data fields of the one or more network packets corresponding to the network message.The acceptability of the network message within the current system context is determined based on one or more filter rules that specify which attributes are allowed within a particular system context.

[0006] It is an object of the present invention to describe a method and a communication control system for controlling or influencing communication in a communication network, which enable a control or influencing of the communication of one or more components in a communication network that is easier to handle, more situation-appropriate, more comprehensive and more flexible than conventional approaches.

[0007] This object is achieved in a first aspect by a method according to claim 1. Further implementations are disclosed below and in the associated subclaims.

[0008] The method is designed to influence the communication of at least one component within a communications network depending on the situation. The communications network has one, two, or more components. The communications network is configured, for example, as a private or public communications network or a mixture thereof. Communication between the component(s) within the communications network is routed via a communications control system. The communications control system distinguishes between several, for example preconfigured, communication scenarios and selects one of the communication scenarios depending on the situation. The communication of the component(s) is controlled depending on the selected communication scenario.

[0009] In particular, the communication of the component(s) is influenced depending on the respective selected communication scenario in such a way that the communication content is changed or completely replaced depending on the situation. The communication content refers, for example, to semantics or a semantic meaning of the communication, in particular of a message, a command, an instruction or user data. For example, the communication control system intervenes in a generated (already existing) communication from outside or to outside the component, i.e. in a generated communication / a generated communication flow from outside into the component or from the component to outside. The communication content of the generated (already existing) communication is thereby influenced in a targeted manner by the communication control system depending on the respective selected communication scenario, i.e.modified (restricting, adding, or partially replacing), suppressed, or completely replaced. Alternatively or additionally, the communication control system generates / initiates a (not yet existing) communication and thus creates new communication content.

[0010] The communication scenarios include, for example, different specifications, parameters or settings regarding one or more parameters from the communication connection, communication direction, communication scope or communication content of the communication of the component(s) and / or a communication between one or more of the components and the communication control system itself. A communication scenario, for example, makes specifications for at least one, but normally several, communication connections or communication topics.

[0011] The communication control system monitors the occurrence of a (situation-dependent) condition. The (situation-dependent) condition differs, for example, but not necessarily, from network parameters of the component(s) and / or communication parameters of the component(s) and / or payload data traffic of the component(s) within the communication network. The communication control system switches from a selected communication scenario to another communication scenario when the situation-dependent condition occurs.

[0012] A method of the type described has the advantage over conventional solutions that communication between one or more components within the communication network can be controlled or influenced depending on the situation or situation-appropriate. The control or influence is carried out via the communication control system, which uses communication scenarios, possibly preconfigured accordingly, and selects a communication scenario to control or influence the communication. The selection is made depending on the occurrence of a specific event (trigger event) or a (situation-dependent) condition. In this way, communication or communication content within the communication network can be influenced easily, quickly, adaptively, and flexibly depending on the occurrence of certain events (trigger events) or conditions.This eliminates the need for complicated and time-consuming reconfiguration of the communications network by specialized personnel under specific conditions or situations. Especially in certain situations, such as safety-critical situations or emergency situations, an explained procedure is advantageous over conventional solutions.

[0013] In optional implementations or further developments of the method, the monitored condition or triggering event for selecting a specific communication scenario, as explained above, differs from network parameters of the component(s) and / or communication parameters of the component(s) and / or payload data traffic of the component(s) within the communication network. In these optional implementations, the monitored condition or triggering event may also differ from a change in network parameters of the component(s) and / or a change in communication parameters of the component(s) and / or payload data traffic of the component(s) within the communication network.In contrast to conventional firewall systems, in which communication is controlled depending on the evaluation of network parameters and / or communication parameters and / or user data traffic of the type explained above, the method according to these optional implementations controls / influences communication depending on the situation-dependent occurrence of an additional event or condition. In these implementations, the method thus enables the control / influence of communication between components within the communication network, possibly independent of network parameters and / or communication parameters and / or user data traffic within the communication network, but rather dependent on the respective situation in which one or more components or the communication network itself find themselves.

[0014] Controlling or influencing communication, as described here, can generally be understood as influencing one or more components of a communication, the entire communication within the communication network, or sub-areas of communication (e.g., a specific communication thread or a communication topic) within the communication network. This influence can consist of limiting or manipulating / modifying existing communication or initiating / creating / executing nonexistent communication.The influence can relate to the duration, the time of communication (date, day of the week, time of day), the amount of data, the transmission speed, the bandwidth, the transmission direction, the possible communication partners, the permissible content of the communication, the number of connection attempts (connection establishment), encryption of the communication (the exchanged information), manipulation (alteration or complete replacement) of the communication content using these criteria, or the initiation, creation, or execution of communication (if applicable, subject to these criteria). These points can be applied, on the one hand, to communication between at least one component or between several components within the communication network, and, on the other hand, alternatively or additionally, to communication between one or more components and the communication control system itself. E.g.The communication control system itself can send signals / communication patterns to one or more components in the communication network depending on the situation. The above points can also be reflected in the various specifications, parameters, or settings of the communication scenarios.

[0015] In this description, communication generally refers to signal and / or data communication. Communication occurs, for example, with a component via a human-machine interface as human-machine communication and / or between multiple components as machine-machine communication.

[0016] In the case of an implementation as a private communications network, the term "private communications network" refers to a communications network with a non-public or non-publicly accessible / addressable communications structure. For example, the private communications network can be configured as a private IP network with a private IP address space, as opposed to a publicly accessible IP network with a public IP address space (such as the Internet or publicly accessible provider networks). This can also be understood as a communications network that is inherently private, i.e., non-public, but is mediated via a public communications network, as is the case, for example, with VPN networks (VPN = virtual private network).

[0017] In the case of implementation as a public communications network, the term "public communications network" here means a publicly accessible IP network with a public IP address space (such as the Internet or publicly accessible provider networks).

[0018] In this description, a component is understood to mean, among other things, an electrical device in general, a sensor, a control system, a programming device, an operating device, a network switching system (e.g., router, switch, hub), an actuator, a machine, a human-machine interface, a security / monitoring system, a computer system, a device function, a device utility function, software, or an application on a computer system. In the case of multiple components, all components can be connected via the communications network to form a system, e.g., a cyber-physical system. The system is, for example, a computerized / digitized machine or production facility, or a computerized / digitized building, computerized laboratory, vehicle, or transport system.

[0019] In various implementations or developments of the method, the communication control system is set up centrally in the communication network. The term of the communication control system set up centrally in the communication network is to be understood in the present description in such a way that the communication of a component or between two or more components within the communication network is routed through the communication control system, which is interposed with respect to these communication paths or is set up between the components. In contrast to decentralised communication controls, where a communication agent (for example, a special software, hardware, etc.) that controls the respective component is configured decentralisedly for each individual component, a central communication control system is set up in the method according to these implementations.This can be configured as the "center of a star connection" of the components within the communication network. However, this does not preclude the communication control system from comprising several individual (sub-)communication control systems. These can, for example, be configured to scale functionality within sub-areas, sub-sections, or sub-networks of an entire communication network. The communication control system can be configured in the form of hardware and / or software, for example, as an embedded system.

[0020] In implementations that are alternative or complementary to a purely central implementation, the communication control system is implemented at least partially within a respective component whose communication is to be influenced. Communication from or to outside the component, i.e. communication / communication flow from outside into the component or from the component to the outside, is routed via the communication control system that is at least partially set up in the component. The communication control system is interposed between the communication flow from or to outside the component and a communication flow within the component. The communication control system is configured, for example, in the form of hardware and / or software, for example as a so-called embedded system, within the component.

[0021] In various implementations or further developments of the method, the communication control system within the component operates purely decentrally with respect to the communication network to which the component can be connected. This means that the communication control system is configured separately from any communication control system centrally configured in the communication network. In contrast to a communication control system centrally configured in the communication network, which influences the control of all communication within the communication network, the decentralized communication control system within the component is implemented, for example, in such a way that it only or exclusively influences the communication intended for this component or generated by this component.

[0022] A communications network with multiple components with communication control systems of the type described implemented therein is, for example, constructed in such a way that the respective communication control systems of the components are set up in a decentralized manner. Each communication control system influences the communication intended for its component or generated by its component. Each communication control system therefore functions as a decentralized communication agent that controls the communication of the assigned component. Optionally, a communication control system of the type described above, or a part thereof, is additionally provided within such a communication network and is set up centrally in the communication network, which mediates between the respective components or their communication control systems.analogous to communication control systems in the components, it influences the communication of one or more components or between components in the communication network.

[0023] In various optional implementations or further developments of the method, the communication control system differs from an (operating) state control system in that an (operating) state control system directly controls the operating states or operating modes of the components involved, which can ultimately influence their communication. In contrast, the communication control system, in a reverse causal chain, directly influences the communication of the components involved, which can ultimately influence their operating states or operating modes. In these optional implementations, the communication control system itself therefore does not primarily control the operating states or operating modes of the components involved within the communication network using control and / or regulation parameters or corresponding operating control signals, as one or more (operating) state control systems do.In this case, the communication control system itself does not initiate any (operating) state changes or operating mode changes of components, which might also trigger a change in communication (e.g., switching off / deactivating / standby of components or component functions). Rather, in these implementations, the communication control system controls / influences the communication specified / established by these states / state / mode changes within certain (operating) states or operating modes of the components or triggered by a state change or operating mode change of the components, such that a situation-dependent, created, modified, required / necessary / permitted communication is achieved.This has the advantage that complex and error-prone programming, adaptation, or reconfiguration of the (operating) state control of the components for situation-dependent desired / required communication is not necessary. Rather, communication control in these optional implementations can be carried out flexibly, abstractly, and independently of programming / specifying the (operating) state control of the components based on the communication scenarios. Thus, communication control can modify communication that is generally possible / permitted by a specific (operating) state of a component, the communication network, or the system into situation-dependent communication, which differs from communication that is possible / permitted based on the (operating) state.In this way, the security of all components involved in communication in the communication network can be maintained and ensured. However, communication influenced or modified by the communication control system can causally result in a change in the state of one or more components.

[0024] The term "situation-dependent" in this description means that a situation is taken into account. The situation can be a state or a change in state within the component(s), within the communications network, or within a system or facility in which the communications network is implemented. A state can be, for example, an operating state (e.g., running, activated, stopped, deactivated, power-saving mode, sleep mode, day / night operation), a maintenance mode, or an emergency / problem state. Alternatively or additionally, the situation can also be an environmental condition or a change in an environmental condition outside the communications network or outside a system or facility in which the communications network is implemented.An environmental condition is a condition that is little or not at all dependent on the component(s), the communications network, or the system or facility itself, and is not or cannot be directly influenced by the component(s), the communications network, the system, or the facility. Environmental conditions can be physical or environmental conditions (e.g., temperature, pressure, humidity) or entire weather conditions (e.g., severe weather, storms, floods), social conditions (e.g., terrorist threat, risk situation, protection needs), or technical conditions (e.g., identified vulnerabilities, changed IT attack scenarios). The situation can also be a combination of the above criteria.

[0025] In various implementations or further developments of the procedure, the occurrence of the situation-dependent condition includes one or more of the following events: an occurrence of an external condition (environmental condition) or a change in an external condition (environmental condition) outside the communication network, the facility or the system, a change in the state of one or more components within the communication network, the communication network itself, the facility or the system, an exceeding of a specified time of day, an exceeding of a specified period of time for the existence of a selected communication scenario, an exceeding of a specified time (e.g.Date, day of the week, month, year), an exceeding of a certain data volume of the communication of the component(s) or between the components or an exceeding of a certain data volume used by one or more components within the communication network, the installation or the system, a recognition of a defined communication pattern in the communication of the component(s) or between the components within the communication network, the installation or the system, an actuation of a switching device (e.g. emergency switching device, emergency switch, emergency stop switch, etc.) which differs from an activation or deactivation of the communication control system (or alternatively from an activation or deactivation of one or more components, the system or the installation), a signal from another communication control system, e.g. an occurrence of a communication scenario in the other communication control system.

[0026] In various implementations or developments of the method, at least one component is configured as a device, with the communication controller influencing communication between a device utility function within the device and a communication network outside the device depending on the selected communication scenario. This has the technical effect that the content of the communication of the device utility function within the device can differ from the content of the communication outside the device depending on the communication scenario. This has the advantage that the content of the communication from or to outside the device can be flexibly adapted to the current situation as needed and appropriate to the situation, without the device utility function itself having to be changed depending on the situation.

[0027] According to the method described here, the communication content is divided into various communication topics. Each communication topic is influenced individually depending on the selected communication scenario. This has the advantage that the influence on communication from or to outside the component can be controlled selectively for individual communication topics, according to the method described here for communication of a specific software application in the component, without influencing other communication content depending on it. This allows for a very finely structured influence on communication. Alternatively or additionally, according to the method described here, the creation of communication rules or communication scenarios for influencing communication is carried out in a device-independent manner (abstract) and accordingly simplified through the use of communication topics, i.e.using communication topics in an abstract grammar / high-level language that differs from a device-dependent, more concrete grammar / low-level language.

[0028] In various implementations or further developments of the method, the communication control system creates or limits the communication of the component(s) to a restricted communication scope or content and / or modifies the communication or content and / or sends one or more communication signals generated in the communication control system to one or more components when the situation-dependent condition occurs. Such measures can be particularly useful in safety-critical situations in order to maintain and ensure the safety of the component(s), the communication network, the system, or the facility, or their safe operation.

[0029] In various implementations or further developments of the method, a self-diagnosis of the communication control system is performed, whereby a switch is made from a selected communication scenario to a specifically predefined safety communication scenario if the self-diagnosis of the communication control system reveals an error or a risk situation in the communication control system. Such measures ensure a so-called fail-safe scenario if the self-diagnosis detects or identifies a situation that suggests an error or a risk situation in the communication control system. In such a case, a special safety communication scenario is triggered, which is configured for a specific communication mode in this case.For example, in such a case, communication within the communication network is restricted to the pure exchange of safety (control) signals between participating components. Alternatively, communication within a component or between two or more components within the communication network is generally prevented, or the communication control system is deactivated. Alternatively or additionally, further options for influencing communication are provided in accordance with the method explained above. For example, communication of safety or emergency signals is initiated. Self-diagnosis is carried out, for example, by a self-diagnosis system within the communication network.

[0030] In optional implementations or further developments of the method, a monitoring system monitors data traffic and / or a (communication) state of the respective components within the communication network and generates monitoring signals. The monitoring signals are passed to the communication control system, whereby the communication control system monitors the occurrence of the situation-dependent condition based on the monitoring signals. The monitoring system is a safety instance that monitors the state of the components or the entire communication network and / or their data traffic. Deviations from a target state or other monitoring signals are transmitted to the communication control system. The communication control system can use the monitoring signals to monitor the occurrence of the situation-dependent condition. In this case, the situation-dependent condition can be a specific data traffic (e.g.a specific communication pattern) and / or (communication) state of one or more components or of the entire communication network, which is detected via the monitoring signals.

[0031] In various implementations or further developments of the method, the communication network is implemented within a cyber-physical system. An automation system generates process signals of the cyber-physical system. The process signals include hazard parameters and / or status parameters of the cyber-physical system. The process signals are transferred to the communication control system, which monitors the occurrence of the situation-dependent condition based on the process signals. The cyber-physical system can be configured as described above. The automation system may be configured separately from the monitoring system described above. In alternative implementations, the automation system is part of the monitoring system or implemented together with the monitoring system in a safety system.In contrast to the monitoring system, the automation system controls processes of the cyber-physical system that go beyond simply monitoring the communication network or its components. For example, the automation system is a control and / or regulation system of the cyber-physical system. The automation system generates process signals from processes of the cyber-physical system that influence the control of communication via the communication scenarios by the communication control system. The process signals of the cyber-physical system generated by the automation system are transferred to the communication control system to monitor the occurrence of situation-dependent conditions. These include, for example, hazard parameters (e.g., high pressure, high temperature) and / or status parameters (system running, system stopped).In this case, the situation-dependent condition can be a state of the cyber-physical system or one of its components (inside or outside the communications network) or the aforementioned hazard parameters. The automation system is an entity that monitors and / or controls the state and / or sequence of processes of the cyber-physical system.

[0032] In various implementations or further developments of the procedure, a risk assessment system, e.g., an operational risk assessment system, performs an operational and / or cross-operational risk assessment of the cyber-physical system and determines a hazard level. The determined hazard level is transferred to the communications control system, which monitors the occurrence of the situation-dependent condition based on the determined hazard level. The risk assessment system is a security instance that monitors, among other things, product or component vulnerabilities in the component inventory or the overall process status of the system and derives a hazard level from this, which is then processed in the communications control system.

[0033] In optional implementations or further developments of the procedure, a cross-company risk assessment system performs a cross-company risk assessment of the cyber-physical system's environment and determines a cross-company hazard level. The determined cross-company hazard level is transferred to the communication control system, which monitors the occurrence of the situation-dependent condition based on the determined cross-company hazard level. The cross-company risk assessment system is configured, for example, to monitor a factory site on which the cyber-physical system is installed. For this purpose, the cross-company risk assessment system is connected to a monitoring sensor system. The sensor system includes, for example, imaging sensors (cameras), heat sensors, radiation sensors, chemical sensors, smoke detectors, microphones, etc.The inter-company risk assessment system can also be connected to online services, such as weather services, rain radar, CERT services, etc., for monitoring and assessing environmental conditions. The inter-company risk assessment system maintains, for example, an event control (emergency control). The event control provides information about the inter-company hazard level and can, for example, generate an emergency stop command. This emergency stop command can be identified by the communication control system as the occurrence of the situation-dependent condition.

[0034] In various implementations or further developments of the method, a configuration, ie parameterization, programming, setting, and / or operation / use of the communication scenarios is independent and / or separate from the technical structure of the component and / or from the type of communication and / or from a configuration of network parameters of the component(s) and / or communication parameters of the component(s).

[0035] Separating the communication scenarios and their configuration from the technical structure, the type of communication, and / or the technical network parameters of the component(s) or the communication parameters of the component(s) makes it possible to change the technical infrastructure of the component(s) (devices, MAC addresses, IP addresses, network ports, registers, protocols, certificates, encryption, etc.) without having to change or adapt the communication scenarios themselves. Conversely, under certain circumstances, the communication scenarios can be changed or adapted without having to reconfigure or know the technical structure, the type of communication, and / or the specific network parameters or communication parameters of the component(s). This allows for a flexible, adaptable, and scalable configuration.

[0036] The configuration and / or operation / use of the communication scenarios, for example, is performed at a different user level / by different users and possibly with different tools, devices, or instruments than the configuration / management of the network parameters of the components and / or the communication parameters of the components. For example, the configuration of the communication scenarios can be performed at a so-called governance level, while the configuration of the network parameters and / or the communication parameters is performed at a so-called IT planning level.

[0037] The above object is achieved in a second aspect by a communication control system according to claim 6. Detailed or further developing embodiments are disclosed in the associated subclaims.

[0038] The communication control system is designed for situation-dependent control or influencing of communication of at least one component within a communication network. The communication control system distinguishes between several, for example preconfigured,

[0039] Communication scenarios that can be selected or are selected depending on the situation. For example, the communication control system is configured to automatically select a communication scenario depending on the situation. The communication control system is set up to control the communication of the component(s) depending on the respectively selected communication scenario. In particular, the communication control system is set up to influence the communication of the component(s) depending on the respectively selected communication scenario in such a way that a communication content is changed or completely replaced depending on the situation. The communication content refers, for example, to semantics or a semantic meaning of the communication, in particular of a message, a command, an instruction or payload data.For example, the communication control system is configured to intervene in a generated (already existing) communication from outside or to outside the component, i.e. in a generated communication / a generated communication flow from outside into the component or from the component to outside. The communication control system is, for example, configured to change (limit, add, or partially replace), suppress, or completely replace the communication content of the generated (already existing) communication depending on the selected communication scenario. Alternatively or additionally, the communication control system is, for example, configured to generate / initiate a (not yet existing) communication and thus create new communication content.

[0040] The communication scenarios include, for example, different specifications regarding one or more parameters from the communication connection, communication direction, communication scope or communication content of the communication of the component(s) and / or a communication between one or more of the components and the communication control system itself.

[0041] The communication control system is configured to monitor the occurrence of a situation-dependent condition. The situation-dependent condition differs, for example, but not necessarily, from network parameters of the component(s) and / or communication parameters of the component(s) and / or payload data traffic of the component(s) within the communication network. The communication control system is configured to switch from a selected communication scenario to another communication scenario when the situation-dependent condition occurs.

[0042] Such a communication control system achieves the same advantages and effects as explained above in connection with a communication control system of the method according to the first aspect. All implementations or further developments presented in connection with the above method can also be applied here.

[0043] In various embodiments or developments, the communication control system comprises a control logic and a communication execution module. The control logic is configured to determine a communication scenario to be selected depending on the existing situation-dependent condition (according to a preconfigured communication logic). The communication execution module is configured to implement the communication scenario determined in the control logic. The communication control system is e.g.an embedded system with a microprocessor that contains the control logic and with a so-called FPGA (Field Programmable Gate Array) that is set up as a communication execution module.

[0044] In various embodiments or further developments, several communication control systems are configured to derive the communication scenario from one or more higher-level central control logic(s).

[0045] According to this application, the communication control system is configured to divide the communication content into various communication topics and to influence each communication topic individually depending on the selected communication scenario. This achieves the same advantages and effects as explained above in this context for the method according to the first aspect.

[0046] In various application cases, a communications network is implemented with one, two, or more components configured for communication within the communications network, as well as with a communications control system of the type described. The communications network is configured, for example, as a private or public communications network, or a mixture thereof. The communications network achieves the same advantages and effects as explained above in connection with a communications network of the method according to the first aspect. All implementations or further developments presented in connection with the above method can also be applied here.

[0047] In various application cases, a cyber-physical system is configured with a communications network of the described type and with an automation system. The cyber-physical system achieves the same advantages and effects as explained above in connection with a cyber-physical system of the method according to the first aspect. All implementations or further developments presented in connection with the above method can also be applied here.

[0048] In various application cases, a control system is implemented with a cyber-physical system of the type described and with a (cross-company) risk assessment system. The control system allows for a (cross-company) risk assessment and achieves the same advantages and effects as explained above in connection with a (cross-company) risk assessment of the procedure according to the first aspect. All implementations or further developments presented in connection with the above procedure can also be applied here.

[0049] All implementations, features, advantages and effects explained in connection with the above method according to the first aspect can be reflected in structural designs, features, advantages and effects explained in connection with the communication control system, the communication network, the cyber-physical system or the control system according to the second aspect and vice versa.

[0050] The invention is explained in more detail below using several exemplary embodiments and implementations with the aid of several drawings.

[0051] They show: Figure 1 shows a schematic representation of an exemplary embodiment of a communication network, Figures 2A...2C show schematic representations of influences on communication within the communication network according to Figure 1, Figure 3 is a schematic representation of an exemplary embodiment of a device connected to a communication network, Figures 4A...4H are schematic representations of various exemplary states of influencing communication to and from outside the device according to Figure 3 or within a communication network according to Figure 1 , Figures 5 and 6 are combinations of influencing different communication topics to and from outside the device according to Figure 3 or within a communication network according to Figure 1 Figure 7 is a schematic representation of an exemplary embodiment of a system with multiple devices according to Figure 3 , Figure 8 is a schematic representation of an exemplary configuration of components of a communication network, Figure 9 is a schematic overview diagram of exemplary communication scenarios of the configuration according to Figure 8, Figure 10 a schematic control diagram for controlling exemplary communication scenarios according to Figure 9 , Figure 11A a schematic representation of an exemplary configuration of instances of an overall system with a centrally integrated communication control system, Figure 11B a schematic representation of an exemplary configuration of instances of a device with an integrated communication control system in an overall system, Figure 12A a schematic representation of an exemplary configuration of interfaces of the configuration according to Figure 11A , Figure 12B shows a schematic representation of an exemplary configuration of interfaces of the configuration according to Figure 11B , Figure 13 a schematic representation of an exemplary configuration of another embodiment of a system.

[0052] Figure 1shows a schematic representation of an exemplary embodiment of a communication network 4. In this embodiment, the communication network 4 comprises a plurality of components 1, 2 and 3 as well as a communication control system 5. In this embodiment, the communication control system 5 is connected centrally between the various components 1, 2 and 3, so that communication between the components 1, 2 and 3 is each routed via the communication control system 5. The communication control system 5 is configured such that communication between the components 1, 2 and 3 can be controlled, influenced, modified or changed in a situation-dependent manner based on predefined communication scenarios depending on the occurrence of an event or a condition 6. This means that the communication control system 5 influences the type, scope or content of the communication between the components 1, 2 and 3.In particular, the communication control system 5 influences the communication between the components 1, 2 and 3 in such a way that the existing communication content (content generated or to be received by the components) is changed, suppressed or completely replaced depending on the situation or a new (not yet existing) communication content is created.

[0053] The communication control system 5 differs in particular from a conventional firewall system in that the communication or the communication content between the components 1, 2, and 3 is influenced, for example, independently of network parameters or communication parameters of the components 1, 2, and 3 or of the communication network 4. Such network parameters or communication parameters are, for example, certificates, MAC addresses, IP addresses, network ports, or the like. In particular, the situation-dependent condition 6 differs, for example, from such network parameters of the components or such communication parameters of the components within the communication network.

[0054] In contrast to firewall systems, which either allow or block communication between components 1, 2 and 3 on a rule-based basis depending on network parameters or communication parameters, the communication control system 5 of the type described here allows a situation-dependent modification of the communication between components 1, 2 and 3 depending on the occurrence of a condition 6 which describes an external environmental condition, a state of the overall system, a state of the communication network 4 or a state of one or more components 1, 2 or 3.

[0055] The communication control system 5, for example, filters (restricts) the communication or communication content between the components 1, 2, and 3 from a communication or communication content possible in a specific situation or state of the communication network 4 into a filtered (restricted) communication or communication content. Alternatively or additionally, the communication control system 5 can expand a communication or communication content within the communication network 4 depending on the state or situation, or supplement it with a specific communication or communication content. The communication control system 5 can also initiate a new communication or communication content on its own and, for example, send specific communication signals to one or more of the components 1, 2, and 3.

[0056] The Figures 2A and 2Bshow schematic representations of possible influences on communication within the communication network 4 according to Figure 1 . The communication control system 5 is omitted in these examples for the sake of simplicity and is quasi-transparent. According to Figure 2A a modification of the communication is carried out by the communication control system 5 such that, due to an event or a condition 6 that has been detected by the communication control system 5, only communication is permitted between component 1 and component 2 or between component 1 and component 3. However, communication or its communication content between component 2 and component 3, which would be possible due to the states of components 2 and 3, is suppressed by the communication control system 5. According to Figure 2BIn contrast, the communication or its communication content is modified by the communication control system 5 in such a way that, due to an event or a condition 6 that has been detected by the communication control system 5, only communication or its communication content is permitted between the components 2 and 3. However, communication or its communication content with the component 1, which would be possible due to the state of the component 1, is suppressed by the communication control system 5.

[0057] Figure 2C shows a schematic representation of a further influence on communication within the communication network according to Figure 1 . According to Figure 2Cthe communication or its communication content is modified by the communication control system 5 in such a way that, due to an event or a condition 6 that has been detected by the communication control system 5, only communication or its communication content is permitted between components 1 and 2. However, communication or its communication content with component 3, which would be possible due to the state of component 3, is suppressed by the communication control system 5. This case can occur, for example, if the communication control system 5 has detected or suspects, via condition 6, that an error or a safety-critical problem (doubtful integrity of component 3) exists in component 3.In this scenario, the communication control system 5 can, for example, send a communication signal to component 1 to indicate to component 1 that communication with component 3 is prohibited and suppressed. Component 1 can continue its communication with component 2.

[0058] Figure 3 shows a schematic representation of an exemplary embodiment of a component 1 in the form of a device 1 that is integrated into a communication network 4. The device 1 has a device utility function 7 and a communication control system 5.

[0059] The device utility function 7 describes a function or the main function of the device 1, which is realized, for example, by a software application, a hardware functionality such as one or more sensors, actuators, transmitting / receiving devices, communication interfaces or a combination of one or more of these components.

[0060] The communication control system 5 is configured such that communication from or to outside the device 1, ie from the other communication network 4 towards inside the device 1 or from inside the device 1 towards the other communication network 4, can be initiated, controlled, influenced, modified or changed. In particular, the communication control system 5 is according to Figure 3configured in the device 1 such that a communication (or communication content) of the device utility function 7 is converted into an influenced, changed, or modified communication (or communication content) within the communication network 4, or a communication (or communication content) within the communication network 4 is converted into an influenced, changed, or modified communication (or communication content) of the device utility function 7. The communication control system 5 is thus interposed between a communication of the communication network 4 and a communication of the device utility function 7 in the device 1.

[0061] The communication control system 5 is configured such that communication from or to outside the device 1 can be initiated, controlled, influenced, modified, or changed depending on the situation based on predefined communication scenarios, depending on the occurrence of an event or a condition 6. This means that the communication control system 5 influences or changes the type, scope, or content of the communication between the components 1, 2, and 3. In particular, the communication control system 5 influences the communication from and to the device 1 such that the existing communication content (content generated or to be received by the device 1) is changed, suppressed, or completely replaced depending on the situation, or new (not yet existing) communication content is created.

[0062] The communication control system 5 differs in particular from a conventional firewall system, for example, in that communication from or to outside the device 1 is controlled independently of network parameters or communication parameters or of the user data traffic of the device 1 or the other communication network 4. Such network parameters or communication parameters are, for example, certificates, signatures, MAC addresses, IP addresses, network ports, or the like. In particular, the situation-dependent condition 6 differs, for example, from such network parameters of the device 1 or such communication parameters of the device 1 or from user data traffic within the communication network 4.

[0063] In contrast to firewall systems, which either allow or block communication from or to outside the device 1 on a rule-based basis depending on network parameters or communication parameters or on the user data traffic, the communication control system 5 of the type described here allows a situation-dependent initiation or modification of the communication from or to outside the device 1 depending on the occurrence of a condition 6 which describes, for example, an external environmental condition, a state of the device 1 or a state of the communication network 4.

[0064] For example, the communication control system 5 filters (restricts) communication from or to outside the device 1 that is possible in a specific situation or state of the device 1 or the communication network 4 into a filtered (restricted) communication. Alternatively or additionally, the communication control system 5 can initiate, expand, or supplement communication from or to outside the device 1 depending on the state or situation, or at least partially replace the content of the communication with another content.

[0065] The Figures 4A to 4H show schematic representations of various exemplary states of influencing the communication from and to outside the device 1 or between the device function 7 and the communication network 4 according to Figure 3 Alternatively, the Figures 4A to 4Hschematic representations of various exemplary states of influencing the communication of a component or a device 1 within a communication network according to Figure 1 .

[0066] According to Figure 4AA modification of the communication from within device 1, e.g., initiated by device usage function 7, occurs to outside of device 1 into communication network 4 by means of communication control system 5. The communication control system 5 influences the communication content such that due to an event or a condition 6, which has been recognized by the communication control system 5, an internal device communication 8 (for example, a communication of the device usage function 7) is implemented into a network communication 9 within the communication network 4 that is restricted, limited, or reduced in its content in contrast thereto. For example, certain useful data and / or control commands are filtered out or suppressed by the communication control system 5 in the internal device communication 8.

[0067] According to Figure 4Ba modification of the communication from the communication network 4 (e.g. initiated by another device in the communication network 4) takes place within the device 1 by means of the communication control system 5. The communication control system 5 influences the communication content in such a way that, due to an event or a condition 6 that has been detected by the communication control system 5, a network communication 9 from the communication network 4 is converted into a device-internal communication 8 (e.g. a communication of the device useful function 7) that is restricted, limited, or reduced in its content. For example, certain user data and / or control commands in the network communication 9 are filtered out or suppressed by the communication control system 5, or alternatively, the communication is suppressed completely.

[0068] According to Figure 4Can alternative modification of the communication takes place from within the device 1, e.g. initiated by the device user function 7, to outside the device 1 in the communication network 4 by means of the communication control system 5. The communication control system 5 influences the communication content in such a way that, due to an event or a condition 6 which has been detected by the communication control system 5, a device-internal communication 8 (e.g. a communication of the device user function 7) is converted into a network communication 9 with the same content, wherein a further network communication 10 with additional content has been added by the communication control 5.For example, certain user data and / or control commands are added in the further network communication 10 by the communication control system 5, which, depending on the situation, have a specific influence on the network communication that goes beyond the content of the original device-internal communication 8.

[0069] According to Figure 4Dan alternative modification of the communication takes place from the communication network 4 (e.g. initiated by another device in the communication network 4) within the device 1 by means of the communication control system 5. The communication control system 5 influences the communication content in such a way that, due to an event or a condition 6 which has been detected by the communication control system 5, a network communication 9 is converted into a device-internal communication 8 with the same content (e.g. a communication for the device utility function 7), wherein in addition a further device-internal communication 11 with additional content (e.g. an additional communication for the device utility function 7) has been added by the communication control system 5.For example, certain user data and / or control commands are added in the further device-internal communication 11 by the communication control system 5, which, depending on the situation, cause a certain influence on the device-internal communication that goes beyond the content of the original network communication 9.

[0070] According to the Figures 4E and 4F an alternative modification of the communication takes place. The communication control system 5 initiates a new communication such that, due to an event or a condition 6 that has been detected by the communication control system 5, a newly created device-external communication 10 ( Figure 4E ) or a newly created device-internal communication 11 ( Figure 4F ) with new content (for example, an initiated communication for the device utility function 7) has been created by the communication control system 5.

[0071] According to Figure 4Gan alternative modification of the communication takes place from within the device 1, e.g. initiated by the device user function 7, to outside the device 1 into the communication network 4 by means of the communication control system 5. The communication control system 5 influences the communication content in such a way that, due to an event or a condition 6 that has been detected by the communication control system 5, a device-internal communication 8 (e.g. a communication of the device user function 7) is converted into a network communication 9 within the communication network 4 whose content has been exchanged or changed. For example, certain user data and / or control commands in the device-internal communication 8 are replaced by the communication control system 5 by at least partially or completely different or modified user data and / or control commands in the network communication 9.

[0072] According to Figure 4H an alternative modification of the communication from the communication network 4 (e.g. initiated by another device in the communication network 4) takes place within the device 1 by means of the communication control system 5. The communication control system 5 influences the communication content in such a way that, due to an event or a condition 6 that has been detected by the communication control system 5, a network communication 9 from the communication network 4 is converted into a device-internal communication 8 (e.g. a communication of the device user function 7) whose content has been exchanged or changed. For example, certain user data and / or control commands in the network communication 9 are replaced by the communication control system 5 by at least partially or completely different or modified user data and / or control commands in the device-internal communication 8.

[0073] The Figures 5 and 6 show again combinations of different influences on different communication topics from and to outside of device 1 according to the previous figures. In Figure 5The communication topics T1, T2, and T5 of a device-internal communication are forwarded unchanged outside of the device 1 into the communication network 4 by means of the communication control system 5. The communication topics T3 and T4 of the device-internal communication are, however, suppressed by the communication control system 5 in such a way that they are not forwarded outside of the device 1. In contrast, the communication topics T7 and T9 of a network communication are forwarded unchanged into a device-internal communication (for example, a communication of the device utility function 7) by means of the communication control system 5. The communication topic T8 of the network communication is, however, suppressed by the communication control system 5 in such a way that it is not converted into a device-internal communication.

[0074] In Figure 6Different communication topics of a device-internal communication are influenced differently by the communication control system 5. The communication topic T1 is converted unchanged into a network communication. The communication topic T2 is modified in content or exchanged in its content and converted in this modified form into a network communication. The communication topic T3 is completely suppressed. Finally, the communication topic T4 is restricted or limited in content and converted in this limited form into a network communication.

[0075] Alternatively or additionally, network communication is carried out in accordance with Figure 6modified by the communication control system 5. For example, the communication topic T5 is both restricted or limited in its content and supplemented with additional content, resulting in device-internal communication (see two separate topic blocks T5). Alternatively or additionally, the communication control system 5 initiates a new device-internal communication T6 and / or a new network communication T7 on its own initiative.

[0076] The use or configuration of the Figures 4A to 6 The influences on communication or communication topics explained are carried out, for example, in a manner independent of the concrete implementation of the devices 1 (abstract) and correspondingly simplified, for example by using communication topics in an abstract grammar / high-level language that differs from a device-dependent, more concrete processing (grammar / low-level language).

[0077] Figure 7 shows a schematic representation of an exemplary embodiment of a system 12 with several devices 0, 1, 2 and 3, which are each analogous to device 1 according to Figure 3 are configured. System 12, for example, is a cyber-physical system.

[0078] In the configuration according to Figure 7 Three devices 1, 2 and 3 are integrated in the system 12, which are connected to each other in the communication network 4. The devices 1, 2 and 3 can communicate with each other via the communication network 4. In addition, a device 0 is set up, which in the exemplary configuration in Figure 7 can signal a condition 6 to devices 1 and 2 via signaling separate from the communication network 4.

[0079] Each of the devices 0, 1, 2, and 3 comprises, for example, a device utility function 7 and a communication control system 5 with the functionalities explained above. Furthermore, the system 12 comprises modules 13 and 14 for exemplary signaling to the respective communication control systems 5 of the devices 0, 2, and 3. The communication control systems 5 in the respective devices 0, 2, and 3 are activated or deactivated via modules 13 and 14, for example. Alternatively or additionally, a situation-dependent condition 6 is triggered via modules 13 and 14, which in turn influences the content of the communication by the individual communication control systems 5 of the devices 0, 2, and 3. For example, modules 13 or 14 actuate a switching device, which is detected as the occurrence of a situation-dependent condition 6 by the respective communication control systems 5. In the configuration according to Figure 7Module 13 controls the communication control systems 5 of devices 0 and 2, while module 14 controls the communication control system 5 of device 3.

[0080] In the exemplary implementation according to Figure 7 Device 0 itself does not influence communication between the communication network 4 and devices 1, 2, 3, but rather determines a situation-dependent condition for devices 1 and 2. For example, device 0 activates or deactivates the communication control systems 5 in the respective devices 1 and 2. Alternatively or additionally, a situation-dependent condition 6 is triggered via device 0, which in turn influences the content of the communication by the individual communication control systems 5 of devices 1 and 2.

[0081] The system 12 according to Figure 7further comprises a module 15 for configuring the communication control systems 5 of devices 1 and 2, as well as further modules 16 and 17 for configuring the communication control systems 5 of devices 0 and 3. Modules 15, 16, and 17 can be used to preconfigure the respective communication control systems 5 with the communication scenarios, rules, or topics explained above, which control the influencing of communication. The configuration of each communication control system 5 is explained in more detail below.

[0082] Figure 8 shows a schematic representation of an exemplary configuration of components of a communication network 4. The communication network 4 is set up, for example, in a cyber-physical system. Figure 8shows three components 1, 2, 3. Component 1 is, for example, a human-machine interface (HMI). Component 2 is, for example, a safety controller or programmable controller (PLC). Component 3 is, for example, a programming device. Components 1, 2, and 3 are communicatively interconnected / connected as a communication network within the communication network 4. This means that components 1, 2, and 3 are configured, possibly in different states and operating modes, to communicate with each other in different ways and to exchange various communication signals and information. The exemplary configuration according to Figure 8shows various communication strands A, B and C, communication strand A between components 1 and 2, communication strand B between components 1 and 3 and communication strand C between components 2 and 3. Within the various communication strands A, B and C, different communications (communication topics) T1 to T3 are set up in communication strand A, T4 and T5 in communication strand B and C depending on the system or configuration. These different communications are preconfigured due to the basic configuration / function of the components and devices of the system or based on communication scenarios or rules.Configuration of communication topics can be carried out in a manner independent of the concrete implementation of the components and devices (abstract) and correspondingly simplified, for example by using communication topics in an abstract grammar / high-level language that differs from a device-dependent more concrete processing (grammar / low-level language).

[0083] In the communication network 4 according to the configuration in Figure 8 A centrally set up communication control system 5 is also provided, which, however, for the sake of simplicity, is Figure 8 is not shown to illustrate the different communication lines A, B and C. The communication control system 5 is configured according to Figure 8For example, any communication between components 1, 2, and 3 is interposed. This means that any communication between components 1, 2, and 3 is routed via the communication control system 5. The communication control system 5 is configured to control, influence, or modify the communication between components 1, 2, and 3 depending on the situation.

[0084] For example, assume that a process control system (PCT) controls a mechanical, chemical, or thermal process. The process control system (PCT) can then include the programming device (component 3, e.g., PC, laptop, mobile device), which is used to program the controller (component 2, e.g., PLC) and the human-machine interface (component 1, MMS), as well as to parameterize and calibrate some sensors.

[0085] Below, various exemplary communication scenarios are presented, based on which the communication control system 5 of the type explained above controls or modifies a corresponding communication, divided into the various communication topics, depending on the situation. This can mean, for example, that a communication configured for one or more operating states or operating modes across all communication strands A, B, and C is changed into a communication specified by the communication control system 5 depending on the situation and restricted, for example, to communication strand A according to a specific communication scenario. Alternatively or additionally, a communication configured for one or more operating states or operating modes, for example,across both communication topics T4 and T5 of communication line B - both communication topics T4 and T5 permitted in communication line B - into a situation-dependent (isolated) communication specified by the communication control system 5 and restricted to one of the communication topics T4 or T5 of communication line B according to a specific communication scenario. In this way, only a restricted communication content of one of the communication topics T4 or T5 is permitted.

[0086] Further examples are explained below. One example generally distinguishes between two common situations for which different communication scenarios are prepared. Situation / Scenario 1 (Normal Operation):

[0087] During normal system operation, the required scope or content of communication should be limited to communication between the human-machine interface (component 1) and the controller (component 2), communication line A. Communication from or to the programming device (component 3, communication line B or C) is unnecessary or undesirable. The communication control system 5 specifies this restricted scope or content of communication by selecting and setting the correspondingly specified communication scenario and by controlling / restricting the communication accordingly using this communication scenario. Situation / Scenario 2 (Configuration Mode):

[0088] If the system is modified or reprogrammed, a connection between the programming device (component 3) and the controller (component 2) and / or between the programming device (component 3) and the human-machine interface (component 1) is required, communication line B or C. The connection (communication line A) between the controller (component 2) and the human-machine interface (component 1) is unnecessary or undesirable. The communication control system 5 specifies this changed communication scope or content compared to situation / scenario 1 by selecting and setting a different predefined communication scenario and correspondingly controlling / restricting the communication using this different communication scenario.

[0089] The following table illustrates such communication controlled / specified via the communication control system 5. Communication thread Situation 1 Situation 2 A approved suppressed B suppressed approved C suppressed approved

[0090] Depending on the situation—possibly deviating from a configured communication or its content specified by a state / configuration of components 1, 2, or 3—the communication or its content is thus driven into a permitted or prohibited, restricted communication or its content depending on a selected communication scenario. In the above example, depending on the selected communication scenario, the communication control system 5 enables or disables an entire communication line (channel) A, B, or C.

[0091] For some applications it is useful to apply the control to specific communication topics within a communication line (see the following explanations and overview in Figure 9 ). Situation / Scenario 1_1 Diagnostic mode:

[0092] The system is in operating mode. Prompted by a fault message, the maintenance engineer wants to read diagnostic data from the controller (component 2) using his programming device (component 3). Downloading data from the programming device (component 3) to the controller (component 2) or human-machine interface (component 1), communication line C, communication topic T5 "Load" and communication line B (communication topic T5 "Load") is not necessary or undesirable. Situation 1_2 Operation with increased risk level:

[0093] The system is in operation (as in situation / scenario 1_1). However, an increased level of danger is detected. The scope of communication between the human-machine interface (component 1) and the controller (component 2) should be limited to safe switching commands. These are switching commands that do not have the potential to put the entire system into a dangerous state (communication line A, communication topic T1 "Reset signal"). All other commands should be discarded (communication line A, communication topic T2 "Bridge"). Measured values ​​should still be transmitted from the controller (component 2) to the human-machine interface (component 1) (communication line A, communication topic T3 "Actual values"). Situation 1_3 Emergency shutdown:

[0094] An emergency situation has been detected. The system must be brought into a safe state. The transmission of measured values ​​from the controller (component 2) to the human-machine interface (component 1) must continue (communication line A, communication topic T3 "Actual Values"), as this is necessary for system monitoring. The transmission of reset commands from the human-machine interface (component 1) to the controller (component 2) is interrupted / prevented (communication line A, communication topic T1 "Reset Signal"). Bridging is automatically deactivated, and actual values ​​are replaced by default values. The communication control system 5 sends the corresponding communication to the controller (component 2) (communication line A, communication topic T2 "Bridging"). Situation 2_1 Configuration at standstill:

[0095] Communication between the human-machine interface (component 1) and the controller (component 2) is disabled (because it is not necessary) (communication thread A, all communication topics). Communication for loading the controller (component 2) is limited to a certain number of loading operations (communication thread C, communication topic T5 "Loading").

[0096] In an alternative implementation, the communication for loading components 1 and 2 is limited to a certain number of loading operations (communication threads B and C, communication topic T5 "Loading"). In this case, communication thread B behaves analogously to the states of communication thread C from Figure 9 (see explanations below). In particular, the influence 32 in Figure 9 also applied to communication strand B, communication topic T5. Situation 2_2 Configuration during operation:

[0097] All communication topics in all communication threads are permitted. The controller (component 2) (communication thread C, communication topic T5 "Loading") must be loaded within a predefined time period. The number of loading attempts and the amount of data that can be transferred are limited. If the time, amount, or number of loading processes is exceeded, this communication is prevented.

[0098] In an alternative implementation, the loading of both components 1 and 2 (communication threads B and C, communication topic T5 "Load") must occur within a predefined time period. In this case, communication thread B behaves analogously to the states of communication thread C from Figure 9 (see explanations below). In particular, the influences 33 and / or 34 in Figure 9 also applied to communication strand B, communication topic T5.

[0099] Alternatively to a centrally located Figure 8established communication control system 5 (in Figure 8 not shown), one or more communication control systems are provided, each of which is implemented decentrally internally in one or more of the components 1, 2, 3. The communication of the components 1, 2, 3 along the respective communication strands A, B, C in the communication network 4 is influenced, as explained above, wherein the influence is carried out in each case by the corresponding communication control system(s) within the components 1, 2, 3.

[0100] The overview in Figure 9 summarizes the various Figure 8 explained communication scenarios again, whereby the different communication scenarios 1_1, 1_2, 1_3, 2_1, 2_2 with the respective controlled communication topics T1 to T5 for each communication strand A, B, C (see Figure 8and above explanations). Reference numerals 29 to 34 denote the various communication influences. Here, influence 29 denotes permitted communication, influence 30 denotes rejected / blocked communication, influence 31 denotes forced / initiated communication (e.g., communication control system 5 sends certain communication (control) signals, e.g., signal: "Bridge Reset", to one or more components 1, 2, 3), influence 32 denotes communication restricted to a certain number, influence 33 denotes communication restricted to a certain period of time, and influence 34 denotes communication restricted to a certain time of day.

[0101] Figure 10 shows a schematic control diagram for controlling exemplary communication scenarios according to Figure 9and a corresponding exemplary communication control, which is specified by a communication control system 5 of the type explained above. The transition from communication scenario to communication scenario can be initiated in various ways. Either triggered by an external condition x (e.g., "overpressure in the boiler" signal) and / or another, possibly higher-level, communication control, or / and triggered by an internal automatic system a (e.g., permissible time in a communication scenario exceeded, permissible time of day exceeded in a communication scenario, data volume exceeded within the communication network 4, detection of a defined communication pattern in the user data) and / or by a user input detected / recognized by the communication control system 5 (e.g., actuation of a switching device, emergency stop switch, etc.).In this configuration, a user can be, for example, anyone J, an administrator Ad, an operations manager L, or an operations foreman M. In such an implementation, signals entering the communication control system 5 can also be used as occurring events or conditions.

[0102] In an exemplary system whose communication is to be controlled by the communication control system 5, according to Figure 10Communication scenario 0 is a defined initial state. From this initial state, a switch to communication scenario 1_1 can be initiated, for example, via an administrator / administration command Ad. Communication scenario 1_1 describes "normal and diagnostic operation" and thus essentially represents the normal state (i.e., the state that will be valid for the longest time over the life cycle). Communication control system 5 evaluates external conditions x and internal conditions a and, in the event of a hazard or emergency, drives communication into a different communication scenario, for example, communication scenario 1_2 or 1_3. These communication scenarios can also be triggered by recognized user inputs (everyone J). If a hazard or emergency is triggered,If an emergency situation arises again, the system switches back to communication scenario 1_1 - depending on the hazardous situation due to recognized (authorized) operator inputs from the operations manager M (communication scenario 1_2) or the operations manager L (communication scenario 1_3). In various implementations, a prerequisite for this is that internal conditions a and / or external conditions x do not prevent this (operating actions can be permitted or prohibited depending on internal conditions a or external conditions x). According to the configuration in . Figure 10 It is possible to switch from communication scenario 1_2 to communication scenario 1_3 via a recognized internal condition a or a recognized external condition x or a recognized operator input from any user J. However, a switch from communication scenario 1_3 to communication scenario 1_2 is only possible, for example, via a recognized operator input from an operations manager L.

[0103] The transition to configuration mode (communication scenarios 2_1 and 2_2) can be initiated by the operations manager M. Configuration mode (both communication scenarios 2_1 and 2_2) is limited by internal conditions a to a time period, a time of day, and / or a permissible data volume (data volume per communication participant / component). Communication scenario 2_2 is additionally limited by external conditions x. If these conditions are exceeded / occurred, or if triggered by a recognized operator input from a user J, the communication control system 5 automatically redirects communication to communication scenario 1_1 or to another communication scenario.

[0104] It should be noted that Figure 10various communication scenarios are illustrated, based on which communication or its communication content between components within a communication network 4 is changed, modified, influenced, expanded, or restricted via a communication control system 5. The communication scenarios do not necessarily correspond to different states of the components. This means, for example, that the communication control system 5 does not directly control the state of the components, but rather influences / controls the type, scope, content, etc. of the communication between the components depending on the situation. This means, for example, that depending on the situation, an emergency can occur without one or more states of components being changed, for example due to an external situation outside a system or facility.The communication control system 5 can detect this emergency based on detected input signals (see explanations above) and, as explained above, change communication from communication scenario 1_1 to communication scenario 1_2 or 1_3 accordingly. In other examples, the communication control system 5 directly influences the communication of the components involved, which ultimately influences their operating states or operating modes.

[0105] Figure 11Ashows a schematic representation of an exemplary configuration of instances of an overall system with a centrally integrated communication control system 5. The communication control system 5 is configured here as an embedded system and comprises a control logic 19 (e.g., a microprocessor) and a communication execution module 35 (e.g., an FPGA). In addition, the communication control system 5 comprises a memory 36 for storing communication logic and a memory 37 for storing network parameters or communication parameters of the communication infrastructure or the communication network 4.

[0106] The control logic 19 determines the necessary or permitted or enforced communication or communication topics depending on a communication scenario between the components, depending on the current situation (external / internal conditions, environmental conditions) and the operator inputs according to a preconfigured communication logic stored in the memory 36. Signals for evaluating the current situation are sent to the control logic 19 according to the configuration in Figure 11A via an operating application 41. The operating application 41 comprises an input acquisition module 42 and a condition acquisition module 43, which are configured to acquire operator inputs or external / internal conditions or environmental conditions. The modules 42 and 43 can transfer corresponding signals as condition 6 to the control logic 19 of the communication control system 5.

[0107] The communication logic with the associated communication scenarios or communication rules or communication topics is configured in a configuration application 38 and loaded into memory 36. For this purpose, the configuration application 38 provides a module 39. The communication infrastructure or network infrastructure (network parameters or communication parameters) is also configured in the configuration application 38 and loaded into memory 37. For this purpose, the configuration application 38 provides a module 40 separate from module 39.

[0108] Due to the separate configuration of modules 39, 36, and 19 from 40, 37, and 35, the configuration of the communication logic can be abstracted or performed separately (e.g., by other user roles) from the configuration of the communication infrastructure. Replacing components therefore advantageously does not require any changes to the communication logic (communication scenarios).

[0109] The communication execution module 35 applies the communication scenario determined in the control logic 19 based on the communication logic stored in the memory 36 to the various components (for example in Figure 11A the components 1, 2 and 3) within the communication network 4 and controls / influences their communication taking into account network parameters or communication parameters determined from the memory 37. The communication execution module 35 executes in the configuration according to Figure 11A in particular the following actions: a) Force / Create / Initiate necessary communication from the communication control system 5 to one or more components 1, 2, 3, x (e.g., alarm signal or generally communication control signal); b) Modify ongoing (existing) communication (e.g., replacement value or restriction to specific communication protocols, data types, data, signals, information, connection types, connection directions, communication partners, communication directions, communication scope or communication content); c) Reject unwanted or unauthorized communication (e.g., block specific communication protocols, data types, data, signals, information, connection types, connection directions, communication partners, communication directions, communication scope or communication content).

[0110] User data stream, control data, or other information of the communication control system 5 are transferred, for example, to a monitoring system 44 with an integrity monitoring system 45. The monitoring system 44 or the integrity monitoring system 45 monitors, for example, the states of the components 1, 2, 3, x or the entire communication network 4 or other instances of a system or installation (see above explanations) in which the communication network 4 is implemented.

[0111] In the configuration according to Figure 11A The communication control system 5 thus operates as a dynamic "communication firewall" that modifies and influences communication within the communication network 4 depending on certain situations (external / internal conditions, environmental conditions, operator inputs).

[0112] Figure 11Bshows a schematic representation of an exemplary configuration of instances of a component or device 1 with an integrated communication control system 5, wherein the device 1 is connected to an overall system. The overall system is, for example, a cyber-physical system.

[0113] Essentially, the functionalities of the internal instances in device 1 correspond to those described above for implementation in Figure 11A explained functionalities. In contrast to the implementation in Figure 11A the communication control system 5 is according to Figure 11B However, it is set up decentrally and internally in device 1 and not centrally separately from components or devices 1, 2, 3 in Figure 11A .

[0114] The control logic 19 is in Figure 11B additionally to another component 2 of the overall system or to another communication control system 5 (cf. e.g. Figure 7) and can receive signals from the operating application 41 as well as from the component 2 or the other communication control system 5 signaling of a condition 6 for influencing the communication of the device 1. These features are, for example, also in a configuration according to Figure 11A further training implementation.

[0115] According to Figure 11B The communication execution 35 is connected between a device user function 7 and the communication network 4, whereby the communication execution 35 is controlled via the control logic 19. The communication execution 35 carries out the influencing of the communication content from the device user function 7 into the communication network 4 and / or vice versa, as instructed by the control logic 19 (cf. e.g. Figures 4A to 4H , 5 and 6 ).

[0116] Figure 12Ashows a schematic representation of an exemplary configuration of interfaces of the configuration according to Figure 11A . The user communication interface 50 according to Figure 12A is connected to components 1, 2, 3 (wired / wireless, Ethernet, other communication types). The connection between the user communication interface 50 and components 1, 2, 3 can be protected by authentication mechanisms (e.g., MacSec). If the component is not capable of performing an authentication process itself, an authentication mechanism 51, e.g., a separate authentication module or a so-called "authentication satellite," can be connected upstream of the component. This allows, for example, components to be addressed across different rooms, spatial areas, areas, or buildings 52 and 53.

[0117] The operating control interface 46 according to Figure 12Ais connected to the operating application 41 (wired / wireless, Ethernet, other communication types). The operating application 41 supplies the communication control system 5 with current environmental conditions, operating signals, etc. and forms the operating interface for the operational operator. The operational operator (operator) is responsible for the operation of the system or plant in which the communication control system 5 is installed and can influence the communication control through control commands (e.g., driver, pilot, plant operator, caretaker, laboratory technician, etc.).

[0118] The Logic Configuration interface 47 is connected to the module 39 of the configuration application 38 (see Figure 11A ) (wired / wireless, Ethernet, other communication types). The communication control system 5, in particular the control logic 19 in connection with the memory 36, is configured via the configuration application 38 according to Figure 11A, programmed.

[0119] The Infrastructure Configuration 48 interface is connected to module 40 of the configuration application 38 (see Figure 11A ) (wired / wireless, Ethernet, other communication types). The configuration application 38 is used to configure the communication control system 5, e.g. the communication execution module 35 in connection with the memory 37 according to Figure 11A , programmed.

[0120] The monitoring interface 49 is connected to the monitoring application 44 (wired / wireless, Ethernet, other communication types). Via the monitoring application 44, a higher-level monitoring system is supplied with information about the communications infrastructure (parts of or the entire communications network 4) and the data traffic therein. The monitoring application 44 supplies, for example, systems for data stream analysis and / or network monitoring applications.

[0121] Figure 12Bshows a schematic representation of an exemplary configuration of interfaces of the configuration of a device 1 according to Figure 11B . Essentially, the functionalities of the now device-internal interfaces in device 1 correspond to those described above for implementation in Figure 12A explained functionalities. In contrast to the implementation in Figure 12A the interfaces are set up decentrally and internally in device 1 and not centrally separately from components or devices 1, 2, 3 in Figure 12A . The device's user function 7 and, indirectly via it, the further component 2 of the cyber-physical system as well as the communication network 4 and the other communication control system 5 are connected via the device's internal user communication interface 50.

[0122] Figure 13shows a schematic representation of an exemplary configuration of another embodiment of an entire system 12. The system 12 is, for example, a cyber-physical system. The implementation according to Figure 13 illustrates a combination of central and decentralized implementations of communication control systems 5 in the entire system 12. A centrally implemented control logic 19 (cf. Figure 11A ) is controlled accordingly by an input acquisition 42 and by a condition acquisition 43, whereby conditions 6 are signaled. A configuration application 38 is used to configure the respective communication control systems 5 or their interfaces SS1, SS2 and SS3 and to configure the control logic 19. The devices 1, 2 and 3 distributed in the system 12 are connected via a communication network 4.

[0123] A centrally implemented communication control system 5 influences communication contents of components 2 from or into the communication network 4 (cf. e.g. Figures 1 , 2A to 2C ) and exchanges signals / commands with the control logic 19 via its interface SS1. A further communication control system 5 implemented decentrally in the device 1 influences communication contents of an internal device utility function 7 of the device 1 from or into the communication network 4 (see, for example, Figures 3 , 4A to 4H) and exchanges signals / commands with the control logic 19 via its interface SS2. Furthermore, other components 3 are connected to the communication network 4 via a conventional firewall FW. The firewall FW exchanges signals / commands with the control logic 19 via its interface SS3, with SS3 transforming the selected communication scenarios into commands / signals in such a way that the firewall FW influences communication according to the specifications of the communication scenarios.

[0124] In further application examples, a system to be controlled in communication is an aircraft, wherein, for example, a distinction is made between communication scenarios of maintenance operation versus flight operation and / or between environmental conditions of snowstorm versus fair weather, wherein a pilot controlling the aircraft can influence a communication by means of the communication control system 5.

[0125] In further application examples, a system to be controlled via communication is a building or building system, whereby, for example, a distinction is made between communication scenarios of a building in the construction stage versus an operational stage and / or between environmental conditions of a building in fire versus normal operation.

[0126] In general, in all application examples described here, it may be advisable for safety reasons to reduce the communication by the communication control system 5 to the communication necessary in the situation or to enforce the communication necessary in dangerous situations.

[0127] In application examples or embodiments and implementations not shown, the communication logic is propagated to various subsystems or subsystems by separating the communication logic from the communication infrastructure or network infrastructure. The communication control system 5 can thus have various subsystems or subsystems, with the communication logic being distributed across these multiple subsystems or subsystems. Multiple communication control systems 5 can also be cascaded via operating applications 41. In this way, for example, operator inputs or general changes in communication scenarios can be cascaded to hierarchically subordinate communication control systems 5.

[0128] The embodiments and implementations described herein include merely examples of a variety of possible embodiments and implementations of the invention. List of reference symbols

[0129] 0, 1, 2, 3Component, device 4Communication network 5Communication control system 6Condition 7Device user function 8Device internal communication 9Network communication 10Added communication 11Added communication 12System 13Module operation 14Module operation 15Module configuration 16Module configuration 17Module configuration 19Control logic 29Communication permitted 30Communication denied 31Communication forced 32Number restricted 33Duration restricted 34Allowed at a specific time / day 35Communication execution module 36Memory communication logic 37Memory infrastructure 38Configuration application 39Module configuration communication logic 40Module configuration communication infrastructure 41Operational application 42Input acquisition 43Condition acquisition 44Supervision 45Monitoring 46Operational control interface 47Logic configuration interface 48Infrastructure configuration interface 49Monitoring interface 50User communication interface0Communication scenario 1_1Communication scenario 1_2Communication scenario 1_3Communication scenario 2_1Communication scenario 2_2Communication scenario xexternal condition ainternal automatic Jeveryone MOperations manager LOperations manager AdAdministrator A, B, CCommunication lines FWFirewall SS1...SS3Interface T1...T9Communication topics

Claims

1. Method for situation-dependent influencing of communication of at least one component (1, 2, 3) within a communication network (4), wherein a communication of the component (1, 2, 3) within the communication network (4) is routed via a communication control system (5), wherein the communication control system (5) distinguishes a plurality of communication scenarios (0, 1_1, ..., 2_2) and selects one of the communication scenarios (0, 1_1, ..., 2_2) depending on a situation, wherein the communication of the component (1, 2, 3) is influenced as a function of the respectively selected communication scenario (0, 1_1, ..., 2_2) in such a way that a communication content is changed or completely replaced by the communication control system (5) depending on the situation, wherein the communication control system (5) monitors the occurrence of a situation-dependent condition (6), wherein the situation-dependent condition (6) differs from network parameters of the component (1, 2, 3) and / or communication parameters of the component (1, 2, 3) and / or a data traffic of the component (1, 2, 3) within the communication network (4), and wherein the occurrence of the situation-dependent condition (6) comprises one or more of the following events: an occurrence of an external condition (x) or a change of an external condition (x) outside the communication network (4), a change of state of the component (1, 2, 3) within the communication network (4), an exceeding of a predetermined time of day, an exceeding of a predetermined duration of the presence of a selected communication scenario (0, 1_1, ..., 2_2), exceeding a predetermined timepoint, actuation of a switching device other than activation or deactivation of the communication control system (5), and a signal from another communication control system (5), wherein the communication control system (5) performs switching from a selected communication scenario (0, 1_1, ..., 2_2) to another communication scenario (0, 1_1, ..., 2_2) when the situation-dependent condition (6) occurs, and wherein the communication content is divided into different communication topics (T1, T2, T3,...) and each communication topic (T1, T2, T3,...) is influenced separately as a function of the respectively selected communication scenario (0, 1_1, ..., 2_2), wherein the different communication topics (T1, T2, T3,...) each represent a sub-field of the communication of the at least one component and wherein communication topics (T1, T2, T3, ...) each relate to an individual communication of a specific software application in the at least one component and / or communication topics (T1, T2, T3, ...) are structured on the basis of an abstract grammar or high-level language.

2. The method according to claim 1, wherein a configuration of the communication scenarios (0, 1_1, ..., 2_2) is independent and / or separated from a configuration of network parameters of the component (1, 2, 3) and / or communication parameters of the component (1, 2, 3).

3. The method according to one of claims 1 or 2, wherein a self-diagnosis of the communication control system (5) is performed and a change is made from a selected communication scenario (0, 1_1, ..., 2_2) to a specially predetermined safety communication scenario if the self-diagnosis of the communication control system (5) results in a fault case or a risk case of the communication control system (5).

4. The method according to one of claims 1 to 3, wherein the communication network (4) is implemented within a cyber-physical system (9) and an automation system (8) generates process signals of the cyber-physical system (9), wherein the process signals comprise hazard parameters and / or status parameters of the cyber-physical system (9), wherein the process signals are transferred to the communication control system (5), and wherein the communication control system (5) monitors the occurrence of the situation-dependent condition (6) by means of the process signals.

5. The method according to claim 4, wherein a risk assessment system (13) carries out an operational and / or inter-operational risk assessment of the cyber-physical system (9) and determines a hazard level, wherein the determined hazard level is transferred to the communication control system (5), and wherein the communication control system (5) monitors the occurrence of the situation-dependent condition (6) on the basis of the determined hazard level.

6. Communication control system (5) for situation-dependent influencing of communication of at least one component (1, 2, 3) within a communication network (4), wherein the communication control system (5) distinguishes a plurality of communication scenarios (0, 1_1, ..., 2_2) which can be selected or are selected depending on a situation, wherein the communication control system (5) is configured to influence the communication of the component (1, 2, 3) depending on the respectively selected communication scenario (0, 1_1, ..., 2_2) in such a way that a communication content is changed or completely replaced by the communication control system (5) depending on the situation, wherein the communication control system (5) is configured to monitor the occurrence of a situation-dependent condition (6), wherein the occurrence of the situation-dependent condition (6) comprises one or more of the following events: an occurrence of an external condition (x) or a change of an external condition (x) outside the communication network (4), a change of state of the component (1, 2, 3) within the communication network (4), an exceeding of a predetermined time of day, an exceeding of a predetermined time duration of the existence of a selected communication scenario (0, 1_1, ..., 2_2), an exceeding of a predetermined point in time, an actuation of a switching device which differs from an activation or deactivation of the communication control system (5), and a signal from another communication control system (5), wherein the situation-dependent condition (6) differs from network parameters of the component (1, 2, 3) and / or communication parameters of the component (1, 2, 3) and / or a data traffic of the component (1, 2, 3) within the communication network (4), wherein the communication control system (5) is configured to trigger a change from a selected communication scenario (0, 1_1, ..., 2_2) to another communication scenario (0, 1_1, ..., 2_2) when the situation-dependent condition (6) occurs, and wherein the communication control system (5) is arranged to divide the communication content into different communication topics (T1, T2, T3,...) and to influence each communication topic (T1, T2, T3,...) separately depending on the respectively selected communication scenario (0, 1_1, ..., 2_2), wherein the different communication topics (T1, T2, T3, ....) each represent a sub-field of the communication of the at least one component and wherein communication topics (T1, T2, T3, ...) each relate to an individual communication of a specific software application in the at least one component and / or communication topics (T1, T2, T3, ...) are structured on the basis of an abstract grammar or high-level language.

7. The communication control system (5) according to claim 6, having a control logic (19) and a communication execution module (35), wherein the control logic (19) is configured to determine a communication scenario (0, 1_1, ..., 2_2) to be selected as a function of the present situation-dependent condition (6) in accordance with a preconfigured communication logic, and wherein the communication execution module (35) is configured to implement the communication scenario (0, 1_1, ..., 2_2) determined in the control logic (19).

8. The communication control system (5) according to one of claims 6 or 7, wherein a configuration of the communication scenarios (0, 1_1, ..., 2_2) is independent and / or separated from a configuration of network parameters of the component (1, 2, 3) or communication parameters of the component (1, 2, 3).

9. The communication control system (5) according to one of claims 6 to 8, wherein the communication control system (5) is configured to perform a self-diagnosis and to make a change from a selected communication scenario (0, 1_1, ..., 2_2) to a specially predetermined safety communication scenario if the self-diagnosis of the communication control system (5) results in a fault case or a risk case of the communication control system (5).

10. Communication network (4) having at least one component (1, 2, 3) which is configured for communication within the communication network (4), and having a communication control system (5) according to one of claims 6 to 9, the communication network (4) and / or the component (1, 2, 3) being configured to route the communication of the component (1, 2, 3) within the communication network (4) via the communication control system (5).

11. Cyber-physical system (9) with a communication network (4) according to claim 10 and with an automation system (8), wherein the automation system (8) is configured to generate process signals of the cyber-physical system (9), wherein the process signals comprise hazard parameters and / or status parameters of the cyber-physical system (9), wherein the cyber-physical system (9) is configured to transfer the process signals to the communication control system (5), and wherein the communication control system (5) is configured to monitor the occurrence of the situation-dependent condition (6) on the basis of the process signals.

12. The cyber-physical system (9) according to claim 11, further comprising a risk assessment system (13), wherein the risk assessment system (13) is configured to carry out an operational and / or inter-operational risk assessment of the cyber-physical system (9) and to determine a hazard level, wherein the cyber-physical system (9) is configured to transfer the determined hazard level to the communication control system (5), and wherein the communication control system (5) is configured to monitor the occurrence of the situation-dependent condition (6) on the basis of the determined hazard level.