Device for the event-driven interrupting of a signal line connecting two network interfaces

Abstract

The invention relates to a device for the event-driven interrupting of a signal line (1) connecting two network interfaces (2a, 2b). In order to create a device of the aforementioned type, it is proposed that a switch (3), connected to a control unit (4), is provided in the signal line (1) for the physical disconnection of the signal line, and that the control unit (4) is connected via an internal control interface (6) to an actuation unit (5) otherwise disconnected from the control unit (4), said actuation unit having a network interface (2c) for receiving control messages, wherein the control unit (4) is not directly connected to any of the network interfaces (2a, 2b, 2c).

Description

[0001] Device for the occasion-related interruption of one of two

[0002] Signal line connecting network interfaces

[0003] Technical area

[0004] The invention relates to a device for the event-related interruption of a signal line connecting two network interfaces.

[0005] State of the art

[0006] State-of-the-art technology involves providing two physically separate networks or deploying a firewall between the networks to prevent unauthorized data traffic between them. Physical separation has the advantage that the introduction of malware or malicious configurations that impair proper operation can only occur via the exchange of data storage devices, but the disadvantage that all data traffic relies on such an exchange of data storage devices. The use of a firewall offers the advantage that data traffic can occur directly and without the detour via separate data storage devices, but the firewall itself can be compromised by malware, meaning unauthorized data traffic between the networks can no longer be prevented.In this case, the only option left is to break the connection between the networks by physically disconnecting the network. The disadvantage, however, is that the disconnection typically requires on-site user interaction, which complicates a rapid response to a security threat.

[0007] Description of the invention

[0008] The invention is therefore based on the object of proposing a device for the event-related interruption of a signal line connecting two network interfaces, which allows a physical connection between two networks, but also enables a reliable separation of the networks in the event of a security threat.

[0009] The invention achieves this objective by providing a switch connected to a control unit in the signal line for physical separation, and by connecting the control unit via an internal control interface to an actuating unit that is otherwise separate from the control unit and has a network interface for receiving control messages. The control unit is not directly connected to any of the network interfaces. The invention is based on the idea of ​​combining the safety of physical, galvanic, or optical isolation via a switch with the ease of use and the associated response time of an electronic control system, without introducing a safety risk through the electronic control system.This is achieved according to the invention in that the control unit controlling the switch for the physical, preferably galvanic and / or optical isolation of the signal line is separated both from the network interfaces connected by the signal line and from a network interface for receiving control messages. Thus, the control unit, which can comprise one or more control unit groups in a manner known from the prior art, cannot be accessed itself, but only its internal actuating unit, so that the control unit cannot be compromised with malware or defective configurations that impair proper operation, since it does not have a network interface. Communication with the control unit takes place according to the invention via the separate actuating unit, which is connected to the control unit via an internal control interface.Internal in this context means that the control interface, unlike the network interfaces, is not accessible from the outside. However, the operating unit has a network interface so that it can be accessed from the outside by sending user-initiated control messages to the operating unit. In the context of the invention, the network interface can be configured for wired or wireless data transmission. For example, the separate operating unit including its network interface can be an internal GSM modem that represents an interface to a mobile radio network, allowing for particularly simple operation. The control unit is connected at one end to a switch and at the other end to the operating unit via a control interface, so that the control unit has no direct signal connection to any of the network interfaces.If an attack originating from one of the networks connected via the signal line is detected and the signal line between the two network interfaces is severed, the other network is inaccessible to the attacker due to the physical separation and is safe from attack. The same applies to the network used for communication with the control unit, as this also has no signal connection for data exchange with the compromised network. Because the control unit has no direct connection to one of the network interfaces, which would allow data exchange that could allow the introduction of malicious software, in the event of an attack only the switch could be operated, thus physically, preferably galvanically, separating the signal line. However, access to the transmitted data via the signal line is thus prevented.It is therefore essential that the switch fulfills the function of physically separating the signal line connecting the two network interfaces. Such separation of the two network interfaces can also be achieved by separating the signal line and connecting one of the network interfaces to a backup interface that is independent of the two network interfaces. Accordingly, the switch can be a changeover switch that is configured to separate the signal line between the two network interfaces and to connect at least one of the two network interfaces to a backup interface. Any networks connected via the two network interfaces, for example machine systems, can be supplied with updates via the backup interface without having access to the control unit.Particularly in the area of ​​high data transmission rates and low latency times, optical fibers can be used as signal lines. Physical separation in connection with the device according to the invention comprises the separation of such optical fibers. In an embodiment of the device according to the invention that is particularly easy to adapt to user needs, the network interface can be signal-connected to a management unit to receive the control messages. The management unit can preferably manage several devices according to the invention, even if they are installed, for example, at different locations or for different customers. In particular, the management unit can be designed as a SaaS solution, whereby simple implementations, in particular of security-relevant updates regarding the control messages, can be achieved by the operator.

[0010] Although the fact that the control unit has no network interfaces already provides a high level of security against any attacks on the control of the device according to the invention, compromise attempts can be fended off even more effectively if the control unit is configured to process a limited set of control commands transmitted via the control interface and to reject other control commands. Because the control unit only processes limited, predefined control commands, the control unit cannot incorporate any other program code, for example, to reprogram the functionality of the control unit.Such a control unit configuration can be achieved by the operating unit, for example a GSM modem, receiving a control message via its network interface and transmitting a signal to the control unit confirming receipt of a control message. The control unit then accesses the control message stored on the operating unit and processes only control commands from a limited, predefined command set, discarding control commands that are not part of the limited command set. For example, a control message can be received by a GSM modem acting as the operating unit and translated into a control command. Such a control command can, for example, be the content of an SMS message retrieved by the control unit, provided that the content of the SMS message also corresponds to a control command from the limited command set.If the control command does not correspond to the restricted command set, it is not processed by the control unit at all but immediately discarded, so that no malware or malicious configurations that could impair proper operation can be transmitted to the control unit via the control interface. For the purposes of the invention, a restricted command set is understood to be a predefined set of predetermined control commands, such as "establish connection" and "disconnect connection." The control unit is designed such that only control commands from this restricted command set can be transmitted. For example, it can be provided that the operating unit can only select one control command for transmission, but not transmit a previously undefined control command.

[0011] Another way to reduce the risk of an attack on the control unit is to have the control interface have a restricted instruction set and the operating unit have a processing device for translating the control messages into control commands from the restricted instruction set. Thanks to these measures, no malicious software can be transmitted via the control interface, as the control interface does not forward control messages unfiltered to the control unit, but only control commands from a restricted, predefined instruction set. The actual control commands are only received by a processing device that translates the control messages into control commands. Therefore, even if the control message is compromised, translation can only result in predefined control commands from a restricted instruction set, but not in program code that can reprogram the control unit.The operating unit or its processing device can be designed such that the software required for its operation is stored in a fixed memory and thus cannot be changed during operation. For the purposes of the invention, a restricted command set is understood to be a predefined set of specified control commands, such as "establish connection" and "disconnect connection." The internal control interface can be configured such that only control commands from this restricted command set can be transmitted. This means that on the operating unit side, only one control command can be selected for transmission; a previously undefined control command cannot be transmitted.

[0012] To ensure particularly secure protection of the control unit, the control interface can form a 1-to-1 connection between the control unit and the actuation unit. This means that the actuation unit is connected only to the control unit on the output side, and the control unit is connected only to the actuation unit on the input side, thus ruling out any potential compromise via other components of a bus system. Overall, this results in a particularly compact device, particularly when the switch, control unit, and actuation unit are arranged in a single unit, which promotes plug-and-play functionality and eliminates the need for complex installation measures. A serial interface, for example, can serve as a 1-to-1 connection.

[0013] Additional protection to prevent an attack on the control unit is provided if the network interface for receiving control messages is separated from the other network interfaces. This prevents data exchange between the control network for transmitting control messages and the networks connected and possibly separated via the signal line. In addition to the simple control commands mentioned above, the restricted command set can also include control commands for the automatic operation of the control unit. For example, the signal line can be connected or disconnected at specific times to allow access to a backup data storage device only during a backup time window. For this purpose, the control unit can have a time control unit for specifying times for interrupting the signal line.

[0014] To enable data traffic measurement without introducing a vulnerability for attacking the control unit, it is proposed that the control unit have a sensor for measuring data traffic on the signal line. Preferably, a sensor is used that detects physical variables without taking higher-level transmission protocols for data communication on the signal line into account. For example, an inductive sensor can be provided to determine a current flow via the signal line. Depending on the timing of such data traffic or detected signal pattern, the control unit can thus detect unwanted data traffic and, in an operating mode provided for this purpose, the signal line can be interrupted via the switch.

[0015] In principle, the device according to the invention makes it possible to completely cut off the connection between two networks if only one signal line is provided between them. A group of signal lines can also be provided between the two network interfaces, with each signal line in the group containing a switch connected to the control unit for galvanic isolation. In this way, only signal lines of a network connection acting in the receive direction (RX) or transmit direction (TX) can be cut off, so that only one direction of signal transmission is cut off. Signal lines with different transmission speeds can also be provided, so that, for example, in the event of an attack, only the transmission speed is throttled by cutting off the high-bandwidth signal lines.For example, only those signal lines required for data transmission can be separated, while signal lines for power supply remain connected.

[0016] Using the device according to the invention, a network arrangement can be constructed, wherein the network interfaces connected via the signal line interconnect two segments of a data network, and wherein the network interface for receiving control messages is connected to a control network separate from the data network. The data network can be wired. The control network can be a wireless network, for example, a mobile radio network.

[0017] In a particularly user-friendly embodiment, a user can specify desired interruption criteria for interrupting the signal line via an actuation application. These interruption criteria are transmitted as control messages via the network interface to the actuation unit, for example, via a GSM modem. These control messages are translated into control commands and transmitted to the control unit via the internal control interface. The control unit controls the switch exclusively in response to transmitted control commands from a limited command set and discards other transmitted control commands. Although desired criteria can be specified via an actuation application, for example, the actual interruption always occurs only based on the control commands from the specified command set.If, for example, the network via which the actuation application communicates with the actuation unit is attacked, the restricted instruction set represents a protective barrier, since any compromised control messages can only be translated into control commands of the restricted instruction set, so that any data transmission to the control unit outside of the specified control commands is not possible and thus the control unit cannot be infected with any malicious software.

[0018] Brief description of the invention The subject matter of the invention is shown by way of example in the drawing.

[0019] Fig. 1 is a schematic representation of a first embodiment of a device according to the invention and

[0020] Fig. 2 is a schematic representation of a second embodiment of a device according to the invention.

[0021] Ways to implement the invention

[0022] A device according to the invention can be used for the event-related interruption of a signal line 1 which connects two network interfaces 2a, 2b to one another. For interruption in the form of a physical, in particular galvanic, isolation of the signal line 1, a switch 3 which is connected to a control unit 4 is used, as can be seen, for example, in Fig. 1. According to the invention, the control unit 4 cannot be accessed directly from the outside, since it has no network interface and is also not directly connected to any of the network interfaces. Communication with the control unit 4 by a user takes place via an actuating unit 5, which is connected to the control unit 4 only via an internal control interface 6.

[0023] The control unit 4 can be configured to process a limited set of control commands transmitted via the control interface 6 and to discard other control commands so that any malicious control commands that do not correspond to the limited, predefined set of commands cannot compromise the control unit 4.

[0024] The operating unit 5 can transmit control commands from a limited command set to the control unit 4. The control commands from the command set can be selected by a user via control messages, which can be transmitted to the operating unit 5 via a control network 7 using a network interface 2c and translated into control commands by its processing device 8. Thus, no arbitrary data can be transmitted to the control unit 4 via the network interface 2c; instead, only a selection can be made from predefined control commands. Since the control unit 4 is not directly connected to any of the network interfaces 2a, 2b, 2c, it cannot be accessed from outside for arbitrary data transmission.

[0025] To minimize the potential attack possibilities of the control unit 4, the control interface 6 can form a 1-to-1 connection between the control unit 4 and the actuation unit 5. Additionally or alternatively, as a further effective protective measure, the network interface 2c for receiving control messages can be separated from the other network interfaces 2a, 2b, so that no data exchange can take place between the networks that cannot be separated via the switch 3.

[0026] In order that the signal line 1 can be interrupted and reconnected depending on a time component, the control unit 4 can have a time control unit 9.

[0027] The control unit 4 can have one or more sensors 10, which can detect the data traffic on the signal line 1. Inductive sensors are suitable for this purpose, since they do not require access to the data stream by measuring physical quantities.

[0028] Within the framework of a network arrangement, two segments 11a, 11b of a data network can be interconnected via the network interfaces 2a, 2b connected via the signal line 1. The network interface 2c for receiving control messages can be connected to a control network 7 separate from the data network.

[0029] Fig. 2 shows a second embodiment of the device according to the invention with two groups of signal lines 1. A group of signal lines 1 comprises three signal lines, namely, from top to bottom, the first, second, and fourth signal lines 1. All signal lines in this group have a switch 3 connected to the control unit 4 for their galvanic isolation. A second group of signal lines 1 comprises one signal line, namely, from top to bottom, the third signal line 1. This group may not have a switch 3. This makes it possible to separate only signal lines 1 that act in the receive direction (RX) or transmit direction (TX), or to throttle the transmission speed by separating the signal lines 1 with high bandwidth. Furthermore, signal lines 1 required only for data transmission can be separated, while signal lines 1 for a power supply remain connected.

Claims

Patent claims 1. Device for the event-related interruption of a signal line (1) connecting two network interfaces (2a, 2b), characterized in that a switch (3) connected to a control unit (4) is provided in the signal line (1) for the physical separation thereof, and in that the control unit (4) is connected via an internal control interface (6) to an actuating unit (5) which is otherwise separate from the control unit (4) and has a network interface (2c) for receiving control messages, wherein the control unit (4) is not directly connected to any of the network interfaces (2a, 2b, 2c).

2. Device according to claim 1, characterized in that the control unit (4) is designed to process a limited set of control commands transmitted via the control interface (6) and to reject other control commands.

3. Device according to claim 1 or 2, characterized in that the control interface (6) has a restricted command set and that the actuating unit (5) has a processing device (8) for translating the control messages into control commands of the restricted command set.

4. Device according to one of claims 1 to 3, characterized in that the control interface (6) forms a 1-to-1 connection between the control unit (4) and the actuating unit (5).

5. Device according to one of claims 1 to 4, characterized in that the network interface (2c) for receiving control messages is separated from the other network interfaces (2a, 2b).

6. Device according to one of claims 1 to 5, characterized in that the control unit (4) has a time control unit (9) for specifying times of interruption of the signal line.

7. Device according to one of claims 1 to 6, characterized in that the control unit (4) has a sensor (10) for measuring data traffic on the signal line (1).

8. Device according to one of claims 1 to 7, characterized in that a group of signal lines (1) is provided between the two network interfaces (2a, 2b) and that in each signal line (1) of the group a switch (3) connected to the control unit (4) is provided for their galvanic isolation.

9. Network arrangement with a device according to one of the preceding claims, wherein the network interfaces (2a, 2b) connected via the signal line (1) connect two segments (11a, 11b) of a data network to one another, and wherein the network interface (2c) for receiving control messages is connected to a control network (7) separate from the data network.

10. A method for operating a device of claims 2 to 8, characterized in that control messages are transmitted via the network interface (2c) of the actuating unit (5) and translated into control commands which are transmitted via the internal control interface (6) to the control unit (4), wherein the control unit (4) controls the switch (3) exclusively in dependence on transmitted control commands of a restricted command set and discards other transmitted control commands.

Images