NETWORK ADAPTER FOR UNIDIRECTIONAL DATA TRANSFER

Description

[0001] The invention relates to a network adapter for the unidirectional transmission of a data stream to a bidirectional network interface.

[0002] Modern industrial plants, traffic control networks, and energy distribution networks comprise a multitude of devices that exchange data, such as device status or diagnostic information, via a communication network or transmit it to central control or monitoring servers. These devices are often referred to as Internet of Things (IoT) devices. Data, for example from industrial plants, is to be securely transmitted for analysis to an IoT server, which is located either near the industrial plant or in a remote, shared server system, also known as the cloud. There, the data can be analyzed, for example, to detect future defects in a timely manner, to optimize machine parameters, or to identify attacks or manipulations of the industrial plant.For cost reasons, a public network, such as the Internet, or an office network or factory network is usually used for data transmission.

[0003] A key security requirement is that an automation network, for example, cannot be attacked or influenced from the outside, such as via the internet. This is particularly important because some automation networks must meet specific real-time and operational reliability requirements. Furthermore, some automation networks use legacy devices with inadequate access control, and operational reliability is often achieved through strict network isolation, also known as perimeter protection. This means that direct, bidirectional connectivity of devices to external systems is not possible, as this would compromise the security level of the plant networks.

[0004] Data diodes or one-way gateways are known to enable a non-interfering connection of a plant network to an external or public network. Such a one-way gateway ensures that only data from the industrial plant, which represents a network zone with high security relevance, can be transmitted outwards. Data transmission from the external network, which may represent a network zone with lower security relevance, into the plant network is neither directly possible, nor should data from signaling protocols or other data sources from the external network be introduced into the plant network. This strict data flow control reliably prevents the operation of the industrial plant from being influenced or impaired from an external network.

[0005] WO 2019 / 040438 Al discloses a hardware-enforced information flow control device with a first and second network interface card connected to the transmit and receive sides, respectively. The first network interface card comprises two interconnected transceiver modules. The transmit output of one transceiver module of the first network interface card is additionally connected to a transceiver module of the second network interface card. Information flow between the first and second network interface cards is transmitted via this connection.

[0006] DE 10 2015 108109 Al discloses a device for unidirectional data transmission from a transmitter in a first network via a data diode to a receiver in a second network.

[0007] Currently available one-way gateways are, depending on the application, expensive network components, typically derived from components used in military or government applications. Their high cost prevents their widespread use in industrial networks. EP 3207683, for example, describes such a method and device for the non-intrusive acquisition of data in a safety-critical network zone and its transfer to a network zone with lower security requirements.

[0008] Furthermore, there is a need to extend existing network components, such as data gateways to cloud servers, to include one-way transmission functionality.

[0009] The object of the present invention is therefore to enable secure, strictly unidirectional data transmission from a security-critical, for example closed, network zone to a public network zone, or to a network zone with lower security relevance, for example a cloud server system, using the simplest and most cost-effective means possible. Existing network components with different types of transmission media should continue to be used, while ensuring one-way communication with minimal effort.

[0010] The present invention is defined in the appended claims. According to a first aspect, the invention relates to a network adapter for the unidirectional transmission of a user data stream to a bidirectional network interface, comprising a first connection unit that is physically connectable to a bidirectional network interface of a first device, a second connection unit that is physically connectable to a bidirectional network interface of a second device, and a termination unit that has at least one physical transmission module and is configured to establish a bidirectional data connection to the network interface of the first device, to receive the user data stream exclusively unidirectionally via the data connection from the first device, and not to send any user data to the first device.

[0011] The bidirectional data connection to the network interface of the first device can be, in particular, a bidirectional physical layer link, e.g., an Ethernet PHY. It is established bidirectionally so that the first device can detect and activate the established bidirectional connection. However, although the first device detects a bidirectional data connection, only unidirectional data transmission is possible.

[0012] The network adapter provides a cost-effective and technically minimalist implementation of a one-way gateway. This ensures that the first connected device is not affected by the data flow. The bidirectional data connection only receives the user data stream from the first device and does not send any user data stream back to it. This protection is enforced through hardware measures. The network adapter can be used with any first device located in a safety-critical network zone that has a standard bidirectional network interface. This allows data to be transmitted from the first device in a safety-critical network zone to a second device located in a zone with lower safety relevance.In this process, the two connected network interfaces of the first and second devices are tricked into believing that a conventional bidirectional data connection physically exists. Otherwise, these network interfaces would detect an error or would not recognize that a transmission medium, such as a network cable, is connected. The termination unit specifically includes a physical transmission module that terminates a bidirectional network connection at the physical level, meaning it can establish a conventional bidirectional connection with the bidirectional network interface of, for example, the first device. However, data packets can only be transmitted unidirectionally.Termination at the physical level refers to the execution of tasks and the exchange of information according to a first layer, also known as the bit transmission layer or physical layer, of a connection model for open systems that is standardized by the International Telecommunication Union ITU-T and is referred to as the OSI reference model.

[0013] In the network adapter according to the invention, the termination unit has a first bit transmission assembly that terminates the bidirectional data connection with respect to a bit transmission mode and has a media-dependent and a media-independent interface, wherein the media-dependent interface forms a mechanical connection of the first bit transmission assembly and is connected to the first connection unit.

[0014] The first physical transmission module can be configured to use either the media-dependent or the media-independent interface for unidirectional data transmission. The physical transmission module can be configured differently at its interfaces for transmitting the user data stream, thus allowing control over the transmission direction of the data connection. The physical transmission module is preferably designed as an integrated circuit.

[0015] In a non-inventive embodiment, only the media-dependent interface is connected to a first bit transmission module, and the media-dependent interface is configured to terminate the data connection according to a predetermined type of transmission medium of the bidirectional data connection.

[0016] This has the advantage that the network adapter is pre-configured for the specified type of transmission medium for the bidirectional data connection and is functional without further configuration.

[0017] In a non-inventive embodiment, the media-independent interface of the first bit transmission module is not connected.

[0018] Thus, the data connection is terminated at this point, and no data can be sent from the physical module to the first device. Specifically, on the media-dependent interface, the properties of the data connection, according to the remote endpoint and the type of connected transmission medium, are agreed upon by signals exchanged between the physical module in the network adapter and the first network interface in the first device. The connection between the network adapter and the first device is therefore free from feedback.

[0019] In a non-inventive embodiment, the user data stream is extracted between the first connection unit and the termination unit and output to the second connection unit.

[0020] Extracting the user data stream refers to the passive transmission or reading of the user data stream from a portion of the data connection within the network adapter. For example, the user data stream is duplicated, and the duplicated stream is transmitted to the network interface of the second device. The network interface in the first device and the network interface of the physical module are configured in promiscuous mode. The original user data stream is passed on to the physical module and terminated there. The physical module thus terminates the data connection in the network adapter.

[0021] The network adapter according to the invention comprises the termination unit, the first and a second bit transmission module, wherein the first bit transmission module transmits the user data stream unidirectionally to the second bit transmission module and the second bit transmission module terminates a second data connection to the second device.

[0022] This has the advantage that the data stream is actively forwarded, thus increasing the selection of usable transmission media types. Two active network connections are established: one from the first physical module to the network interface in the first device, and a second active data connection from the second physical module to the network interface of the second device.

[0023] The network adapter according to the invention transmits the user data stream from the first bit transmission module to the second bit transmission module via a media-independent interface.

[0024] Thus, the user data stream is only transmitted from the first to the second physical transmission module. No data stream is transmitted in the reverse direction, from the second to the first physical transmission module.

[0025] In an advantageous embodiment, the first bit transmission module agrees on a type of transmission medium for the bidirectional data connection with the first device.

[0026] This has the advantage that different types of transmission media can be used between the first device and the network adapter, especially the first connection unit.

[0027] In an advantageous embodiment, the second bit transmission module agrees on a type of transmission medium for the bidirectional data connection with the second device and forwards the user data stream received in the second bit transmission module to the second device.

[0028] This has the advantage that different types of transmission media can be used between the network adapter and the second device.

[0029] In an advantageous embodiment, the second physical transmission module is configured to receive the user data stream from the first physical transmission module on the media-independent interface and to transmit the user data stream from the media-independent interface to the network interface of the second device, preferably in a promiscuous mode.

[0030] This has the advantage that only user data is transmitted unidirectionally via the media-independent interface. The media-dependent interfaces of the first and second physical transmission modules are not connected and therefore decoupled, and no user data can be transmitted between the first and second physical transmission modules via media-dependent interfaces.

[0031] In an advantageous embodiment, the network adapter includes a media control unit that configures the first and / or the second physical transmission assembly to provide the specified or agreed type of transmission medium.

[0032] Thus, the bit transmission module can be simply structured, since logic for setting and adapting to the different types of transmission media is carried out by the media control unit.

[0033] In an advantageous embodiment, the first and second connection units are designed as connectors for connecting a transmission medium. The connector can be a plug, a plug adapter, or a plug adapter cable.

[0034] This allows the network adapter to be easily connected to an existing transmission medium. Such a connector can, for example, be an Ethernet socket according to the RJ-45 or M12 standard, or IEC 63171-2 (Single Pair Ethernet for office environments) or IEC 63171-5 (Single Pair Ethernet for industrial environments), and accommodate a corresponding Ethernet cable or its connector.

[0035] In an advantageous embodiment, the network adapter comprises two transmission media which are permanently connected to the first and / or the second connection unit.

[0036] This means that combinations of network adapter plus transmission medium can be pre-configured and thus connected to devices without additional transmission media.

[0037] In an advantageous embodiment, the first and / or second bit transmission module terminates the bidirectional data connection with respect to the bit transmission mode according to an Ethernet standard.

[0038] The Ethernet standard, standardized by the IEEE under the number 802.3, is widely used in network technology. A corresponding network adapter therefore covers a broad range of applications.

[0039] The respective "unit" can be implemented in hardware and / or software. In a hardware implementation, the respective unit can be designed as a device or as part of a device. The network adapter and the included units, in particular the termination unit, can be designed as integrated circuits, microprocessors, or programmable logic devices. In a software implementation, the respective unit can be designed as a computer program product, a function, a routine, part of program code, or an executable object. Exemplary embodiments of the network adapter according to the invention are shown in the drawings and are explained in more detail below. The drawings show: Fig. 1 shows a first embodiment of a network adapter not according to the invention with a passive tap of the user data stream in block representation; Fig. 2 shows a second embodiment of the network adapter according to the invention with an active tap of the user data stream in block representation; and Fig. 3 shows a third embodiment of the network adapter according to the invention with transmission media in block representation.

[0040] Corresponding parts are marked with the same reference symbols in all figures.

[0041] Figure 1Figure 1 shows a network adapter 20 having a first connection unit 21 that can be physically connected to a bidirectional network interface 11 of a first device 10. The network adapter 20 also has a second connection unit 24 that can be physically connected to a second bidirectional network interface 31 of a second device 30. The first device 10 is located in a safety-relevant network zone 12. The first connection unit 21 thus forms an interface to the safety-relevant network zone, for example, a data network of an automation system or an operational safety network. The second device 30 is preferably located in a network zone 13 with low safety relevance, for example, an office network or a public network, such as the Internet.The second device 30 can be connected to a server 50, in particular a cloud system, via another network interface 32.

[0042] The network adapter 20 further includes a termination unit 22, which is configured to establish a bidirectional data connection 14 to the network interface 11 of the first device 10. The data connection 14 is established, for example, via a network cable connected to the first connection unit 21 and the network interface 11 of the first device 10. A data connection 33 is then extended via the second connection unit 24 to the bidirectional network interface of the second device 30.

[0043] The termination unit 22 comprises a first physical transmission group 23, which terminates the bidirectional data connection 14 with respect to a physical transmission mode. Thus, an active data connection 14 is established between the first bidirectional network interface 11 and the physical transmission group 23. The physical transmission mode encompasses functions at a physical physical layer according to an OSI reference model. These functions are defined according to the connected transmission medium. For network cables conforming to the Ethernet standard, the corresponding functions are defined in IEEE standard 802.3. However, the network adapter 20 is not limited to transmission media conforming to the Ethernet standard, i.e., Ethernet cables. Other transmission media conforming to other standards can also be connected to the first and second termination units 21, 24.

[0044] The physical transmission module 23 has a media-independent interface and a media-dependent interface. The media-independent interface is used to communicate, for example, the physical encoding of the data to be transmitted, such as the clock frequency and encoding method, with the opposite network interface, here network interface 11 of the first device. The media-dependent interface forms the mechanical connection of the physical transmission module and is connected to the first interface unit 21.

[0045] In the present embodiment, the data connection 14 is connected from the first bidirectional network interface 11 of the first device via the first connection unit 21 to the physical transmission module 23 of the termination unit 22 and is terminated there. The media-independent interface of the physical transmission module 23 is not connected. Therefore, no user data stream can be transmitted from the physical transmission module 23 to the first device. The physical transmission module 23 is permanently configured for a specific type of connected transmission medium over which the data connection 14 is physically transmitted. For example, the physical transmission module 23 is configured to establish a data connection corresponding to a 10 Mbit or a 100 Mbit transmission medium according to the Ethernet standard. The physical transmission module 23 is configured, for example, via a media control unit 25.Alternatively, the physical transmission module 23 can be permanently configured for a specific type of transmission medium and thus only support that particular transmission medium. The network interface 31 of the second device 30 is preferably operated in promiscuous mode.

[0046] The user data stream is now unidirectionally coupled between the first connection unit 21 and the first physical transmission module 23 via the data connection 14 and passed on via the second connection unit 31 to the bidirectional network interface 31 of the second device 30. The second device 30 can forward the data or the user data stream, for example, via the second network interface 32 to the server 50. The network adapter 20 can, in particular, terminate a data connection 14 via transmission media according to the Ethernet standard with a transmission rate of 10 Mbit / s or 100 Mbit / s.

[0047] Figure 2 Figure 1 shows an active tap of the user data stream from data connection 14. The network adapter 40 comprises a first connection unit 41 and a second connection unit 44, each of which can be connected to the bidirectional network interface 11, 31 of the first device 10 and the second device 30, respectively. A first physical transmission module 43 is arranged in the termination unit 42, which maintains and terminates an active bidirectional data connection 14 with the first network interface 11 of the first device 10. The first device 10 is the sender of the user data stream. The user data stream is received via the media-dependent interface in the physical transmission module 43.

[0048] The termination unit 42 further comprises a second physical transmission module 46, which is connected to the media-independent interface of the first physical transmission module 43 via a unidirectional data connection 47. The user data stream is forwarded from the first physical transmission module 43 via this unidirectional data connection 47 to the media-independent interface of the second physical transmission module 46. The media-independent interface of the first physical transmission module is configured so that data is transmitted to the second physical transmission module 46 only in one direction. This ensures that data can only be routed out of the safety-critical network zone 12, but no data can be introduced into the safety-critical network 12.

[0049] The first and second physical transmission modules 43, 46 are preferably each connected to a media control unit 45, 47, which configures the respective physical transmission module 43, 46. The media control unit 45, 47 can also be configured as a single media control unit that configures both the first and the second physical transmission modules 43, 46.

[0050] A bidirectional data connection 33 exists between the second physical transmission module 46 and, further via the second connection unit 44, to the network interface 31 of the second device 30, which is a receiver of the data connection or the user data stream. Advantageously, the bidirectional network interface 31 of the second device 30 is operated in promiscuous mode. The user data stream received by the second physical transmission module 46 is transmitted in the second data connection 33 via the second connection unit 44 to the network interface 31 of the second device 30. The second device 30 includes, for example, a cloud gateway and transmits the user data stream, optionally processed or filtered, to the cloud system 50.

[0051] Figure 3Figure 1 shows a network adapter 60 with a termination unit 62, a first and second connection unit 61, 64, and two transmission media 63, 65. The first and / or second connection unit 61, 64 of the network adapter 60 is, for example, designed as a connector for connecting a transmission medium 63, 65. The transmission media 63, 65 can each be detachably connected to a connection unit.

[0052] The network adapter 60 can alternatively include one or two transmission media 63, 65. The one and / or second transmission media 63, 65 is permanently connected to the first or second connection unit 61, 64, respectively. The transmission media 63, 65 are, for example, Ethernet cables. Furthermore, only one connection unit can be configured as a connector, while the other connection unit can be permanently attached to a transmission medium.

[0053] Compared to previously known unidirectional data transmission devices, such as a unidirectional gateway, the hardware requirements of the present network adapter are drastically reduced. Various configuration options allow for the support of different transmission media, in particular transmission media conforming to the Ethernet standard IEEE 802.3. The network adapter according to the invention significantly reduces the cost of an industrial data diode. The network adapter can be used with existing devices, so-called brownfield devices, as well as with new devices.

[0054] The in Figure 1 The variant shown and described supports purely passive data acquisition. It therefore enables cost-effective implementation both as a non-reactive network tap and as a unidirectional gateway, i.e., as a data diode for critical infrastructures.

[0055] The in Figure 2 The second variant of the network adapter described also supports data connections over transmission media with a transmission rate of 1 Gbit / s. Since the data is actively accessed, this solution is not completely impervious in a physical sense. However, this variant is very well suited for the cost-effective implementation of a unidirectional gateway with dedicated additional transmitter and receiver systems. Even in the event of a performance drop in the gateway link, the solution has no impact on the critical network.

[0056] All features described and / or illustrated can be advantageously combined within the scope of the invention. The invention is not limited to the described embodiments.

Claims

1. Network adapter (20, 40, 60) for unidirectional transfer of a payload data stream to a bidirectional network interface, comprising - a first connection unit (21, 41, 61), which is physically connectable to a bidirectional network interface (11) of a first device (10), - a second connection unit (24, 44, 64), which is physically connectable to a bidirectional network interface (31) of a second device (30), and - a terminating unit (22, 42) comprising at least one bit transfer assembly (23, 43) and configured in such a way as to establish a bidirectional data connection (14) to the network interface (11) of the first device (10), to receive the payload data stream from the first device (10) exclusively unidirectionally via the data connection (14), and not to transmit a payload data stream to the first device (10), wherein the terminating unit (42) comprises a first bit transfer assembly (43), which terminates the bidirectional data connection (14) in relation to a bit transfer mode and comprises a media-dependent interface and a media-independent interface, wherein the media-dependent interface forms a mechanical connection of the first bit transfer assembly and is connected to the first connection unit, wherein the first bit transfer assembly (43) communicates the payload data stream unidirectionally (47) to a second bit transfer assembly (46) and the second bit transfer assembly (46) terminates a second data connection (33) to the second device (30) and the first bit transfer assembly (43) communicates the payload data stream to the second bit transfer assembly (46) via the media-independent interface.

2. Network adapter according to Claim 1, wherein the first bit transfer assembly (43) agrees a type of a transfer medium of the bidirectional data connection (14) with the first device (10).

3. Network adapter according to one of the preceding claims, wherein the second bit transfer assembly (46) agrees a type of a transfer medium of the bidirectional data connection (33) with the second device, and forwards the payload data stream received in the second bit transfer assembly (46) to the second device (30).

4. Network adapter according to one of the preceding claims, wherein the second bit transfer assembly (46) is configured in such a way as to receive the payload data stream from the first bit transfer assembly (43) on the media-independent interface and to communicate the payload data stream from the media-independent interface to the network interface of the second device (30), preferably in a promiscuous mode.

5. Network adapter according to one of the preceding claims comprising a media control unit (45, 47), which configures the first and / or the second bit transfer assembly (43, 46) for providing the predefined or agreed type of the transfer medium.

6. Network adapter according to one of the preceding claims, wherein the first and second connection units (41, 44) are embodied as plug connectors for the connection of a transfer medium.

7. Network adapter according to one of Claims 1 to 5, comprising at least one transfer medium, which is fixedly connected to the first and / or the second connection unit (41, 44) .

8. Network adapter according to one of the preceding claims, wherein the first and / or second bit transfer assembly (43, 46) terminate(s) the bidirectional data connection (14, 33) in relation to the bit transfer mode according to an Ethernet standard.