TRANSMISSION DEVICE FOR TRANSMITTING DATA

Description

[0001] The present invention relates to a transmission device for transmitting data between a first network and a second network.

[0002] For secure communication between a safety-critical network, such as a production network or a railway safety network, and an open network, such as a local area network or the Internet, transmission devices such as data diodes or firewalls are conventionally used to enable unidirectional data transmission between the safety-critical network and the open network. These transmission devices are designed, for example, to ensure that no arbitrary data can be transmitted from the open network to the safety-critical network and are also designed, in particular, to protect the safety-critical network from attacks and intrusion attempts.

[0003] A document EP 3 139 548 A1 proposes a gateway with an architecture that enables bi-directional communication between applications located in different domains and offers a high level of security protection.

[0004] Document WO 2004 / 028107A2 relates to a monitoring system for monitoring the security of network-based data transmissions, comprising a computer system for determining from first data contained by at least one system for controlling first data transmissions between a first network and a second network, which data characterize each of the first data transmissions, whether the data transmissions meet predetermined first security requirements. Document EP 3 425 865 A1 deals with a transmission device for the non-reactive unidirectional transmission of data from a first network zone to a second network zone for evaluation by a remote application server.

[0005] Against this background, it is an object of the present invention to provide an improved transmission device. The invention is defined in the appended independent claims. According to a first aspect, a transmission device for transmitting data between a first network and a second network is proposed. The transmission device has a first network port for coupling to the first network and a second network port for coupling to the second network, and further comprises: a first detection unit connected to the first network port and configured to receive data transmitted from the first network via the first network port and to detect anomalies in the received data, and a second detection unit connected to the second network port and configured to receive data transmitted from the second network via the second network port and to detect anomalies in the received data.

[0006] The provided transmission device makes it possible to monitor and analyze data transmitted from the first network to the transmission device, as well as data transmitted from the second network to the transmission device, using the first and second detection units, in order to detect anomalies in the first and second networks. At the same time, the provided transmission device allows the first network to be separated from the second network to ensure that no arbitrary data can be transmitted from the second network to the first network.

[0007] In detail, anomalies such as deviations in the data transmitted from the first network to the transmission device can be advantageously detected by using the first detection unit, and at the same time anomalies such as attacks or intrusion attempts on the transmission device from the second network can be detected by using the second detection unit, while at the same time the first network is separated from the second network.

[0008] This leads to a reliable and optimized detection of anomalies in the first network and in the second network, thus increasing the security of data transmission between the first network and the second network.

[0009] A network port, such as the first or second network port, is particularly designed as a physical network port. The physical network port preferably has an RJ-45 connection, an M12 connection, or a single-pair Ethernet connection for connecting or coupling to the first network or the second network, respectively. The transmission device may, for example, comprise further network ports in addition to the first and second network ports. The first and / or second network port may also be part of a network address that enables the assignment of TCP ("Transmission Control Protocol") and UDP ("User Datagram Protocol") connections and data packets to servers and / or clients located in the first and / or second network.

[0010] An anomaly in the received data or in currently received data exists in particular when the data currently received from the first and / or the second network exhibits an irregularity or a deviation compared to older received data. Furthermore, it is particularly possible for the data received from the first network to be examined for a deviation from older received data, while the data received from the second network is examined for a match with attack signatures. This is advantageous if the first network is preferably an industrial (control) network in which fixed communication patterns exist, and the second network is, for example, an open or public network, such as the Internet, with diverse or changing communication patterns.

[0011] The transmission device comprises, in particular, a CPU ("Central Processing Unit") in which the first detection unit and the second detection unit are implemented. The first CPU and the second CPU are, in particular, connected to one another and, for example, have a shared memory, a shared memory area, or a serial connection. The respective unit, for example, the first detection unit or the second detection unit, can be implemented in hardware and / or software. In a hardware implementation, the respective unit can be designed as a device or as part of a device, for example, as a computer or as a microprocessor or as a control computer of a vehicle.In a software implementation, the respective unit can be designed as a computer program product, as a function, as a routine, as part of a program code or as an executable object.

[0012] According to one embodiment, the transmission device is configured to execute the first recognition unit and the second recognition unit in parallel.

[0013] This embodiment has the advantage that the first and second detection units are executed simultaneously or in parallel or are active or in operation at the same time.

[0014] This leads to a reliable and optimized detection of anomalies in the first network and in the second network, thus increasing the security of data transmission between the first network and the second network.

[0015] The term “parallel” is understood in particular to mean that the transmission device is configured to execute or operate the first recognition unit and the second recognition unit simultaneously, at the same time, or simultaneously.

[0016] Furthermore, the first detection unit is configured to transmit a first detection signal at least to the second detection unit upon detection of anomalies in the received data, and the second detection unit is configured to transmit a second detection signal at least to the first detection unit upon detection of anomalies in the received data.

[0017] This embodiment enables the first detection unit to signal the second detection unit using the first detection signal when an anomaly is detected in the data received by the first detection unit. Conversely, the second detection unit can signal the first detection unit using the second detection signal when an anomaly is detected in the data received by the second detection unit.

[0018] Thus, it is advantageously possible for the first and second detection units to inform each other when an anomaly occurs in one and / or both detection units. This leads to reliable and optimized detection of anomalies in the first network and in the second network, thus increasing the security of data transmission between the first network and the second network.

[0019] A recognition signal, such as the first or second recognition signal, is particularly embodied as a message. Depending on the respective recognition unit, the message can be transmitted to the transmission device, the first recognition unit, the second recognition unit, and / or a computer, such as a server or a client, connected to the transmission device.

[0020] According to a further embodiment, the anomalies detectable by the first detection unit comprise a first anomaly type and the anomalies detectable by the second detection unit comprise a second anomaly type, wherein the first anomaly type differs from the second anomaly type.

[0021] According to a further embodiment, the first detection unit is configured to detect the first anomaly type if at least one new endpoint and / or a deviation of a network topology in the first network can be derived from the data received from the first network, and the second detection unit is configured to detect the second anomaly type if at least one attack from the second network via the second network port on the second detection unit can be derived from the data received from the second network.

[0022] Advantageously, the first and second detection units make it possible to detect different anomaly types, such as the first and second anomaly types. This leads to reliable and optimized detection of anomalies in the first network and in the second network, thus increasing the security of data transmission between the first network and the second network.

[0023] An endpoint or a new endpoint is, in particular, a participant in the first network and / or the second network. A participant is, for example, a computer such as a server, a client, or a router.

[0024] The deviation is particularly present if a comparison of an older network topology of the first network with a current network topology of the first network shows that certain participants in the older network topology have been removed or added, or their status has changed, compared to the current network topology.

[0025] The first and second anomaly types are determined, in particular, by thresholding the data received by the respective detection unit. Furthermore, the determination can be performed by defining at least one interval that indicates which received deviation is still permissible.

[0026] The attack is preferably deduced from the fact that during the attack or even before the attack there is a deviation that suggests that an attack or an attempted attack has taken place or is currently taking place. The attack can be deduced, for example, from a deviation in the data received from the second network. The attack can be a software attack, in particular a hacker attack. A software attack is in particular an attack on the second detection unit via the second network port from the second network. The attack can also comprise an attempted attack and / or an attempted penetration of the transmission device. The transmission device is in particular configured to connect the first network to the second network.Preferably, the first detection unit of the transmission device monitors the state or data of the first network on the one hand, while the second detection unit of the transmission device can detect attacks or intrusion attempts from the second network onto the transmission device on the other hand.

[0027] According to a further embodiment, the transmission device is configured to receive the data from the first network via a network switch arranged between the first network and the first network port, wherein at least one input of the network switch is connected to the first network for transmitting data and a mirroring port configured as an output of the network switch is connected to the first network port for transmitting data.

[0028] By using a network switch with a mirror port, it is advantageously possible to provide all data traffic of the first network to the transmission device at the first network port. This advantageously enables the transmission device to receive, monitor, and analyze the data traffic of each participant in the first network. This increases the reliability of detecting an anomaly in the first network and thus the security of data processing in the first network and the transmission device.

[0029] In particular, a first connection section is arranged between the first network and the network switch, a second connection section is arranged between the network switch and the transmission device, and a third connection section is arranged between the transmission device and the second network. The first connection section in particular establishes a connection between the first network and the network switch. The second connection section preferably establishes a connection between the network switch and the transmission device. The third connection section, for example, establishes a connection between the second network and the transmission device. The first, second and / or third connection section is in particular wired, for example in the form of at least one copper line or an aluminum line, and / or optical in the form of at least one fiber optic line.The network switch is specifically designed as a switch.

[0030] The mirroring port of the network switch serves in particular to mirror the network traffic of the first network in order to provide the entire data and / or network traffic of the first network to the transmission device at the first network port.

[0031] According to a further embodiment, the transmission device further comprises a first CPU in which the first recognition unit is implemented, and a second CPU in which the second recognition unit is implemented.

[0032] Thus, the first CPU is implemented physically separately from the second CPU or physically isolated from the second CPU. The first CPU can thus be implemented independently of the second CPU. In particular, the first CPU and the second CPU share a common memory, such as a dual RAM ("random access memory") and / or a common serial connection.

[0033] This has the advantage that, in the event of an attack on the second detection unit, the attack prevents the first detection unit from being influenced, since the first detection unit is implemented on a first CPU isolated from the second CPU. This increases the reliability of the transmission device, particularly the operation of the first and second detection units, and thus increases the security of data transmission between the first and second networks.

[0034] The CPU, like the first CPU or the second CPU, is a central processing unit or processor.

[0035] According to a further embodiment, the transmission device is configured to provide the second network with a routing table comprising a plurality A of IP addresses of subscribers from the first network.

[0036] The routing table is, in particular, a table that provides information about which participants in a network, such as the first network, can be reached via which IP addresses, or which IP addresses are assigned to the participants. This provides another network, such as the second network, with information about which IP address a participant in the first network can be reached via from the second network.

[0037] According to a further embodiment, the transmission device is configured to provide the second network with at least one specific IP address of a specific subscriber from the first network.

[0038] The provided routing table provides at least one specific IP address of a specific participant from the first network to the second network.

[0039] This provided specific IP address is advantageously used, in particular, as a trap with a technical endpoint. This trap can also be referred to as a "honeypot." If, in particular, entire network segments with multiple participants of the first network are simulated, this can be referred to as a "honeynet." For example, if an attacker attempts to attack the specific participant via the transmission device and / or the second detection unit using the specific IP address assigned to it, the attack ends at the technical endpoint. The technical endpoint is, in particular, isolated from the first and second networks. Thus, the attacker is deliberately misled using the specific IP address and the routing table, increasing the security and reliability of the operation of the transmission device and the first network.

[0040] According to a further embodiment, the transmission device is configured to carry out a transmission of data between the first network and the second network in a transmission layer, layer 2 according to the OSI / ISO layer model.

[0041] According to a further embodiment, the first detection unit and the second detection unit each comprise an intrusion detection system.

[0042] An intrusion detection system (IDS) is a security technology that detects unauthorized intrusion into a network, for example, when malware exploits a system's security vulnerabilities using so-called exploit code. The intrusion detection system specifically includes a network intrusion detection system (NIDS). Using an IDS or a NIDS, the network in question, for example, the first network and / or the second network, can be monitored and effectively scanned for anomalies.

[0043] According to a further embodiment, the first network comprises a control network, in particular a production network or a railway safety network, and the second network comprises a diagnostic network, a local network or the Internet.

[0044] The first network is specifically designed as a security-critical network, while the second network is designed as an open network. The first network can also be described as a network with high security requirements, while the second network is described as a network with low security requirements.

[0045] A production network is used primarily in a production facility. The production facility comprises, in particular, several machines and computers connected to each other via the production network.

[0046] A railway safety network preferably includes control and safety technology for a rail infrastructure.

[0047] The control network further comprises in particular a road safety network which comprises control and safety technology for a road infrastructure.

[0048] A local network includes, for example, a LAN ("Local Area Network") and / or a WLAN ("Wireless Local Area Network").

[0049] The first network and the second network each comprise, in particular, at least one endpoint configured as a respective participant. The first network and / or the second network each comprise, in particular, a plurality of participants that are connected to one another and thus form the respective network.

[0050] According to a further embodiment, the transmission device is partially or completely designed as a unidirectional data diode, as a firewall or as a gateway.

[0051] A unidirectional data diode is, in particular, a one-way communication device that enables a physically non-interactive separation of the first network and the second network. In particular, the unidirectional data diode is designed as a "data capture unit" (DCU). A "physically" non-interactive separation is present in particular when the non-interactive separation physically separates the first and second networks due to physical components in the unidirectional data diode.

[0052] A firewall is, in particular, a component that is implemented in hardware and / or software, especially in software, and that is configured to establish a connection between a first and a second network. The firewall can also be designed as a unidirectional firewall, which enables a logically non-reactive separation of the first network and the second network. The term "logically" non-reactive separation is understood in this case, in particular, when the non-reactive separation is achieved by means of an application of algorithms, in the case where the firewall is implemented in software.

[0053] A gateway is, in particular, a component implemented in hardware and / or software and configured to establish a connection between a first and a second network. The gateway can also be configured as a unidirectional gateway, which enables a physically or logically non-interactive separation of the first network and the second network.

[0054] Furthermore, in particular the unidirectional data diode, the unidirectional firewall and the unidirectional gateway are each configured to allow only released and / or specially marked data for transmission from the second network to the first network.

[0055] The term "non-reactive separation" means in particular that changes or attacks in the second network prevent any influence on the first network.

[0056] The term "partially" is understood here in particular to mean that the transmission device comprises further components in addition to the unidirectional data diode, the firewall, or the gateway. For example, the unidirectional data diode is part of the transmission device, whereby the transmission device also comprises further components.

[0057] The term "complete" is understood in this case to mean in particular that the transmission device as a whole is designed as a unidirectional data diode, as a firewall or as a gateway.

[0058] According to a further embodiment, the gateway is arranged between the first detection unit and the second detection unit, and an input of the first detection unit is connected to an external network switch and an output of the first detection unit is connected to the gateway, wherein the gateway is further configured to communicate with the first detection unit via an internal IP address of the first detection unit, wherein an input of the second detection unit is connected to the gateway and an output of the second detection unit is connected to the second network.

[0059] According to a further embodiment, at least the first detection unit, the second detection unit, the first network port and the second network port are implemented in a common housing.

[0060] Thus, the components listed in this embodiment, including the transmission device itself, are implemented in particular in a common housing.

[0061] A housing or a common housing is particularly designed as a housing for a processor or a computer chip, for example in the form of an integrated circuit (IC). Furthermore, a housing or a common housing is preferably designed as a common housing of a device or, for example, as a common implementation on an FPGA (Field Programmable Gate Array).

[0062] Further possible implementations of the invention also include combinations of features or embodiments described above or below with respect to the exemplary embodiments that are not explicitly mentioned. In this case, the person skilled in the art will also add individual aspects as improvements or additions to the respective basic form of the invention.

[0063] Further advantageous embodiments and aspects of the invention are the subject of the dependent claims and the exemplary embodiments of the invention described below. The invention will be explained in more detail below using preferred embodiments with reference to the accompanying figures. Fig. 1 shows a schematic block diagram of a first embodiment of a transmission device for transmitting data; and Fig. 2 shows a schematic block diagram of a second embodiment of a transmission device for transmitting data.

[0064] In the figures, identical or functionally equivalent elements have been given the same reference numerals unless otherwise stated.

[0065] Fig. 1 shows a schematic block diagram of a first embodiment of a transmission device 1 for transmitting data between a first network NW1, for example, comprising a production network, and a second network NW2, for example, comprising a local area network. This data transmission is carried out in particular in a transmission layer, layer 2 according to the OSI / ISO layer model. In a further embodiment, the first network NW1 can comprise a railway safety network, while the second network NW2 comprises the Internet.

[0066] In the first embodiment, the transmission device 1 is completely designed as a unidirectional data diode. In a further embodiment, the transmission device 1 can be partially or completely designed as a firewall (not shown) or as a gateway 6 (see Fig. 2 ) must be trained.

[0067] The transmission device 1 has a first network port P1 for coupling to the first network NW1 and a second network port P2 for coupling to the second network NW2. Furthermore, the transmission device 1 comprises a first detection unit 3 and a second detection unit 4. In the first embodiment, the transmission device 1, comprising the first detection unit 3, the second detection unit 4, the first network port P1, and the second network port P2, is implemented in a common housing 7.

[0068] The first detection unit 3 is connected to the first network port P1 and is configured to receive data transmitted from the first network NW1 via the first network port P1 and to detect anomalies in the received data. Furthermore, the first detection unit 3 is configured to transmit a first detection signal at least to the second detection unit 4 upon detection of anomalies in the received data.

[0069] The second detection unit 4 is connected to the second network port P2 and is configured to receive data transmitted from the second network NW2 via the second network port P2 and to detect anomalies in the received data. Furthermore, the second detection unit 4 is configured to transmit a second detection signal at least to the first detection unit 3 upon detecting anomalies in the received data.

[0070] Preferably, the transmission device 1 is configured to execute the first detection unit 3 and the second detection unit 4 in parallel. Furthermore, the first and second detection units 3, 4 each comprise, in particular, an intrusion detection system.

[0071] The anomalies detectable by the first detection unit 3 comprise, in particular, a first anomaly type, wherein the first detection unit 3 is configured to detect the first anomaly type if at least one new endpoint or a deviation of a network topology in the first network NW1 can be derived from the data received from the first network NW1.

[0072] In particular, the anomalies detectable by the second detection unit 4 comprise a second anomaly type, wherein the second detection unit 4 is configured to detect the second anomaly type if, based on the data received from the second network NW2, at least one attack from the second network NW2 via the second network port P2 on the second detection unit 4 can be derived.

[0073] As a result, the first type of anomaly differs particularly from the second type of anomaly.

[0074] In Fig. 1 Furthermore, a network switch 2 is arranged between the first network NW1 and the first network port P1.

[0075] The transmission device 1 is configured to receive data from the first network NW1 via the network switch 2. At least one input of the network switch 2 is connected to the first network NW1 for data transmission. A mirroring port SP, configured as an output of the network switch 2, for data transmission is connected to the first network port P1.

[0076] In a further embodiment, the transmission device 1 comprises a first CPU in which the first detection unit 3 is implemented, and a second CPU in which the second detection unit 4 is implemented. Preferably, the transmission device 1 is configured to provide the second network NW2 with a routing table comprising a plurality A of IP addresses of subscribers from the first network NW1. The transmission device 1 is further configured to provide the second network NW2 with at least one specific IP address of a specific subscriber from the first network NW1.

[0077] Fig. 2shows a schematic block diagram of a second embodiment of a transmission device 1 for transmitting data. The transmission device 1 includes a gateway 6. In the second embodiment, the transmission device 1, comprising the first detection unit 3, the second detection unit 4, and the gateway 6, is implemented in a common housing 7.

[0078] The gateway 6 is arranged in particular between the first detection unit 3 and the second detection unit 4.

[0079] An input of the first detection unit 3 is connected to an external network switch 8, and an output of the first detection unit 3 is connected to the gateway 6. The gateway 6 is configured to communicate with the first detection unit 3 via an internal IP address of the first detection unit 3. An input of the second detection unit 4 is connected to the gateway 6, while an output of the second detection unit 4 is connected to the second network NW2.

[0080] Although the present invention has been described using exemplary embodiments, it can be modified in many ways.

Claims

1. Transmission device (1) for transmitting data between a first network (NW1) and a second network (NW2), wherein the transmission device (1) has a first network port (P1) for coupling to the first network (NW1) and a second network port (P2) for coupling to the second network (NW2) and also comprises: a first detection unit (3) which is connected at the first network port (P1) and is configured to receive data transmitted from the first network (NW1) via the first network port (P1) and to detect anomalies in the received data, and a second detection unit (4) which is connected at the second network port (P2) and is configured to receive data transmitted from the second network (NW2) via the second network port (P2) and to detect anomalies in the received data, and the first detection unit (3) is configured to transmit a first detection signal at least to the second detection unit (4) when anomalies are detected in the received data, and the second detection unit (4) is configured to transmit a second detection signal at least to the first detection unit (3) when anomalies are detected in the received data.

2. Transmission device according to Claim 1, characterized in that the transmission device (1) is configured to execute the first detection unit (3) and the second detection unit (4) in a parallel manner.

3. Transmission device according to one of Claims 1-2, characterized in that the anomalies which can be detected by the first detection unit (3) comprise a first anomaly type and the anomalies which can be detected by the second detection unit (4) comprise a second anomaly type, wherein the first anomaly type differs from the second anomaly type.

4. Transmission device according to Claim 3, characterized in that the first detection unit (3) is configured to detect the first anomaly type if, on the basis of the data received from the first network (NW1), it is possible to derive at least one new end point and / or a discrepancy of a network topology in the first network (NW1), and the second detection unit (4) is configured to detect the second anomaly type if, on the basis of the data received from the second network (NW2), it is possible to derive at least one attack on the second detection unit (4) from the second network (NW2) via the second network port (P2).

5. Transmission device according to one of Claims 1-4, characterized in that the transmission device (1) is configured to receive the data from the first network (NW1) via a network switch arranged between the first network (NW1) and the first network port (P1), wherein at least one input of the network switch is connected to the first network (NW1) for the purpose of transmitting data and a mirror port (SP) in the form of an output of the network switch is connected to the first network port (P1) for the purpose of transmitting data.

6. Transmission device according to one of Claims 1-5, characterized in that the transmission device (1) also comprises a first CPU, in which the first detection unit (3) is implemented, and a second CPU, in which the second detection unit (4) is implemented.

7. Transmission device according to one of Claims 1-6, characterized in that the transmission device (1) is configured to provide the second network (NW2) with a routing table comprising a plurality A of IP addresses of subscribers from the first network (NW1).

8. Transmission device according to one of Claims 1-7, characterized in that the transmission device (1) is also configured to provide the second network (NW2) with at least one particular IP address of a particular subscriber from the first network (NW1).

9. Transmission device according to one of Claims 1-8, characterized in that the transmission device (1) is configured to transmit data between the first network (NW1) and the second network (NW2) in a data link layer, layer 2 according to the OSI / ISO layer model.

10. Transmission device according to one of Claims 1-9, characterized in that the first detection unit (3) and the second detection unit (4) each comprise an intrusion detection system.

11. Transmission device according to one of Claims 1-10, characterized in that the first network (NW1) comprises a control network, in particular a production network or a rail safety network, and the second network (NW2) comprises a diagnostic network, a local area network or the Internet.

12. Transmission device according to one of Claims 1-11, characterized in that the transmission device (1) is partially or completely in the form of a unidirectional data diode, a firewall or a gateway.

13. Transmission device according to Claim 12, characterized in that the gateway is arranged between the first detection unit (3) and the second detection unit (4), and an input of the first detection unit (3) is connected to an external network switch and an output of the first detection unit (3) is connected to the gateway, wherein the gateway is also configured to communicate with the first detection unit (3) using an internal IP address of the first detection unit (3), wherein an input of the second detection unit (4) is connected to the gateway and an output of the second detection unit (4) is connected to the second network (NW2).

14. Transmission device according to one of Claims 1-13, characterized in that at least the first detection unit (3), the second detection unit (4), the first network port (P1) and the second network port (P2) are implemented in a common housing.