Security function execution device

Abstract

To provide a device and a method that perform security functions in legacy operational technology (OT) systems without system configuration changes and additional updates.SOLUTION: In a communication system 20, a device 100 that communicates with a plurality of nodes (GW 120, HMI 130, PLC 140, PLC 150) via a network switch 110 and executes security functions, is configured to: identify attributions of the plurality of nodes in communications with a network; determine criticality of each node of the plurality of nodes based on the attributions; and mediate communications between nodes (for example, GW 120, HMI 130) of the plurality of nodes that are determined as being non-critical and execute security functions on the mediated communications.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure is generally directed to methods and devices for performing security functions. [Background technology]

[0002] Enabling security measures in legacy operational technology (OT) systems such as factory automation (FA) and process automation (PA) is particularly challenging due to the need for system updates and / or partial replacement. In most cases, it is difficult to update all OT systems just to address security issues due to the high engineering costs. To enhance cybersecurity, cybersecurity risk assessment and cost-effective countermeasure planning, including enabling temporary security measures for OT system users, are areas of focus.

[0003] Network intermediaries (man-in-the-middle (MitM)) are useful for securing communication between two nodes on legacy networks. However, using MitM on Internet Protocol-based (IP-based) networks (wired networks such as Ethernet or wireless networks such as WiFi) may result in communication delays and resource exhaustion. The resulting loss of control may have a significant impact on legacy OT systems. Therefore, it is difficult to apply the MitM method to legacy IP-based network systems in OT systems.

[0004] Related art discloses a method for enabling security functions using a proxy server. The proxy server performs security function execution by mediating communication between nodes. However, the mediation of communication is performed for all communication between any two nodes on the network. This causes communication delays and reduces resource availability. The impact is especially significant for businesses that use legacy OT systems, as communication delays can result in production outages and loss of safety features.

[0005] In addition, vulnerability is not the same across all nodes. For example, assume that two nodes are connected to one network (network A), the first node is a Windows® personal computer (PC) connected to an enterprise system, and the other is an embedded system connected to another network through network A. Then, the Windows PC node is relatively more vulnerable than the embedded system node. An adversary may attack the critical node through a node that is more vulnerable than the critical node. The related art does not describe any rules for narrowing down the communication to obtain an effective security approach.

[0006] There is a need to enable security measures in legacy OT systems without requiring changes to system configuration and additional updates. Summary of the Invention

[0007] Aspects of the present disclosure include an innovative method for performing security functions that may include identifying, by a processor, attributes of a plurality of nodes in communication with a network, determining, by the processor, a criticality of each node of the plurality of nodes based on the attributes, and mediating, by the processor, communications between nodes of the plurality of nodes determined to be non-critical, and performing a security function on the mediated communications.

[0008] Aspects of the present disclosure include an innovative non-transitory computer-readable medium storing instructions for performing security functions, which may include identifying attributes of a plurality of nodes in communication with a network, determining a criticality of each node of the plurality of nodes based on the attributes, brokering communications between nodes of the plurality of nodes determined to be non-critical, and performing the security functions on the brokered communications.

[0009] Aspects of the present disclosure include an innovative device in communication with a network for performing security functions, which may include a processor configured to identify attributes of a plurality of nodes in communication with the network, determine a criticality of each node of the plurality of nodes based on the attributes, broker communications between nodes of the plurality of nodes determined to be non-critical, and perform security functions on the brokered communications.

[0010] Aspects of the present disclosure include an innovative system for performing security functions that may include means for identifying attributes of a plurality of nodes in communication with a network, means for determining a criticality of each node of the plurality of nodes based on the attributes, and means for mediating communications between nodes of the plurality of nodes determined to be non-critical and performing security functions on the mediated communications.

[0011] A general architecture for implementing various features of the present disclosure will now be described with reference to the drawings. The drawings and the associated description are provided to illustrate example implementations of the present disclosure and are not intended to limit the scope of the present disclosure. Reference numbers are reused throughout the drawings to indicate correspondence between referenced elements. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 illustrates an example communication system 20 according to an exemplary implementation. [Diagram 2] FIG. 2 is an example diagram illustrating application of security features to communications according to an exemplary implementation. [Diagram 3] FIG. 3 illustrates an example system 300 of the device 100 according to one exemplary implementation. [Figure 4] FIG. 1 illustrates an example hardware architecture of a device 100 according to an exemplary implementation. [Diagram 5] FIG. 1 illustrates an example business category model for determining criticality, according to one exemplary implementation. [Figure 6] FIG. 6 illustrates an example criticality determination flow 600 using a feature decision tree according to an exemplary implementation. [Figure 7] FIG. 7 illustrates an example process flow 700 for implementing communication mediation, according to one exemplary implementation. [Figure 8] FIG. 8 illustrates an example communication system 800 according to an exemplary implementation. [Figure 9] FIG. 1 illustrates an example computing environment having example computing devices suitable for use in some example implementations. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The following detailed description provides details of the drawings and exemplary implementations of the present application. Reference numbers and descriptions of elements that overlap between drawings are omitted for clarity. The terms used throughout the description are provided by way of example and are not intended to be limiting. For example, the use of the term "automatic" may include a fully automatic implementation or a semi-automatic implementation that requires user or administrator control over certain aspects of the implementation, depending on the desired implementation in the art practicing the implementation of the present application. Selection may be performed by a user through a user interface or other input means, or may be realized through a desired algorithm. The exemplary implementations as described herein may be utilized alone or in combination, and the functionality of the exemplary implementations may be realized through any means according to the desired implementation.

[0014] An exemplary implementation of the present invention relates to a method and system for performing security functions to intercept communications between flagged nodes. The flags are defined based on the criticality of each node connected to the network. The criticality is defined based on the system architecture role and processing state of the node. The security functions are performed while restricting communication mediation to nodes with low criticality. Network data collection can be performed on the network of the target system through any automatic or manual method or on the nodes joining the network. At the same time, attributes related to the criticality can also be determined based on the role and state of each node. The exemplary implementation also enables security functions such as detailed packet anomaly analysis, packet filtering, authentication functions, etc.

[0015] 1 illustrates an example communication system 20 according to an exemplary implementation. As illustrated in FIG. 1, the communication system 20 may include components such as, but not limited to, a device 100, a network switch (SW) 110, a network gateway (GW) 120, a human machine interface (HMI) 130, a number of programmable logic controllers (PLCs) (e.g., PLC 140 and PLC 150), an enterprise network 160, and the like.

[0016] The device 100 has the ability to join any IP-based network. For an Ethernet-based network, the device 100 has the ability to join the network through a free port of the network switch 110. The device 100 can obtain its Internet Protocol (IP) address for the network manually or automatically (DHCP, network capture, self-IP assignment, etc.). Upon obtaining its IP address, the device 100 collects information about the network. The device 100 attempts to scan the network using network and port scanning methods or by loading a packet capture (PCAP) file that can be obtained from the network switch 110. The device 100 also has the ability to load information manually entered by a user via a graphical user interface (GUI) or a command line interface (CLI).

[0017] The device 100 determines the criticality of each node it identifies in the network by an algorithm processed in the computing features of the device 100. The criticality is expressed as a set of attributes or a numerical value such as a level for each node. A numerical value can be calculated from those attributes. Table T1 as shown in FIG. 1 shows the criticality associated with various nodes of the communication system 20. For example, a criticality of "non-critical" is associated with the network GW 120.

[0018] Communication brokering between any two nodes that join the same network is performed by the device 100. Specifically, the device 100 uses the criticality associated with each node to select the communication to be brokered. Communication brokering is performed between nodes determined to be non-critical, and communication between nodes that are critical is excluded from communication brokering. Taking table T1 in FIG. 1 as an example, communication with the network GW 120 and the HMI 130 has a criticality of "non-critical" and is therefore selected to be brokered. FIG. 2 shows an example diagram illustrating the application of security functions to communication according to one exemplary implementation. For nodes determined to be non-critical assets (e.g., node 202 and node 204), the security functions 208 of the device 100 can be applied to the communication between such nodes to ensure communication security.

[0019] Referring again to FIG. 1, device 100 does not mediate communication between PLC 140 and PLC 150. In most cases, communication between PLCs includes control data that is critical and essential for the system control process. If communication between PLCs were mediated, this could lead to loss of data communication and problems in control operation. As shown in FIG. 2, communication with node 206 (e.g., PLC) is excluded from communication mediation by device 100, and thus security function 208 is not applied. Thus, device 100 enables effective security measures for legacy systems while limiting communication that must be mediated.

[0020] Devices that utilize current enterprise OS tend to be more vulnerable than those that do not. For example, when the network GW 120 is connected to the enterprise network 160, the network GW 120 becomes more vulnerable than other nodes on the same network. An adversary may attack a PLC (e.g., PLC 140, PLC 150, etc.) through the network GW 120. Therefore, communication between the network GW 120 and the PLCs needs to be protected as a higher priority than communication between the PLCs.

[0021] 3 illustrates an example system 300 of the device 100 according to an exemplary implementation. As illustrated in FIG. 3, the system 300 may include components such as a security function execution management unit 302, an interface unit 304, a user interface (UI) unit 306, a node management unit 308, a MitM unit 310, and an asset scan and management unit 312. The interface unit 304 joins the device 100 to a network controlled by the network switch 110. The UI unit 306 supports communication with a user through a graphic image display and / or command line input.

[0022] The node management unit 308 manages the nodes detected by the device 100 through node characteristic management, which may include identification and population of node addresses and attributes. The MitM unit 310 performs communication mediation between the nodes that have joined the network. The asset scanning and management unit 312 performs node scanning and analysis of the nodes that have joined the network. In addition, the asset scanning and management unit 312 can connect to a database on the secondary memory of the device 100 and refer to the database to retrieve attributes associated with each node for further processing.

[0023] The security function executing and managing unit 302 performs security function execution, such as detailed packet anomaly analysis, packet filtering, and authentication, on communications mediated by the device 100. Each security function may be performed by a different security module of the security function executing and managing unit 302 (e.g., detailed packet anomaly analysis may be performed by security module 314, packet filtering may be performed by security module 316, authentication may be performed by security module 318, etc.).

[0024] In some example implementations, the various units may be implemented by software libraries including OS native functions, and the software data is stored in a secondary memory of the device 100. In some example implementations, some or all of the functionality of each unit may be implemented as hardware logic.

[0025] 4 illustrates an example hardware architecture of device 100 according to one exemplary implementation. The hardware architecture may include components such as a central processing unit (CPU) 402, a random access memory (RAM) 404, a user interface (UI) 406, a network interface (IF) 408, and a secondary memory 410. In some exemplary implementations, the secondary memory 410 is a non-volatile storage device. The secondary memory 410 stores program data / programs 414, such as instructions for implementing the functions of device 100, as well as any tools, such as network scanning, UI applications, database management, and other support applications. The secondary memory 410 may also include a database 416 for referencing criticalities associated with each node. The various components communicate with each other through a bus 412.

[0026] The criticality of a node means to what extent the security function performing device should not affect the business functions processed by the node. Criticality can be expressed as "critical" or "non-critical". The criticality of each node is defined based on the role and processing state of the node's system architecture.

[0027] A node is critical if the following conditions are met: (a) the node handles a critical process of a business operation, and (b) the node does not have sufficient computing resources, and unintended consumption of resources may affect its business functions. In some example implementations, the sufficiency of computing resources is determined by determining whether the computing resources are equal to or greater than a resource threshold. If the computing resources are less than the resource threshold and the node is used to handle a critical process of a business operation, the node is determined to be critical. A node is non-critical if the following conditions are met: (a) the node does not handle a critical process of a business operation, and (b) the node has sufficient computing resources, and unintended consumption of resources is tolerable to a certain extent. For example, if the computing resources are equal to or greater than the resource threshold and the node does not handle a critical process of a business operation, the node is determined to be non-critical.

[0028] In some example implementations, the criticality can be determined from the system architecture and / or the processing state. The system architecture may include the network structure (whether connected to an external network or not), the type of device (e.g., enterprise OS, embedded device, etc.), and the application type (e.g., server, data logging, field control, control visualization, etc.). The processing state may include the resources (e.g., CPU, memory, etc.) and processing state (e.g., "stopped", "running", etc.) defined for each node.

[0029] In some example implementations, the criticality can be determined by using a decision algorithm. Such algorithms may include rule-based algorithms (e.g., decision trees, decision matrices, etc.). In addition, the criticality can also be determined based on a predetermined business category model or asset condition model.

[0030] Figure 5 illustrates an example business category model for determining criticality, according to one exemplary implementation. The Purdue® Enterprise Reference Architecture (PERA, ISA-95) is illustrated in Figure 5. PERA is an architecture reference model commonly used for industrial automation and control systems.

[0031] Six levels of business capabilities, including software and hardware components, are defined using PERA. Lv.0 corresponds to the field device layer and may include sensors, actuators, signals, etc. Lv.1 corresponds to the controller layer and may include basic control. Lv.2 corresponds to the supervisory control and data acquisition (SCADA) layer and may include supervisory control. Lv.3 corresponds to the manufacturing operations management (MOM) / manufacturing execution system (MES) layer and may include manufacturing operations, etc. Lv.4 corresponds to the enterprise resource planning (ERP) system and business strategy layer and may include business management operations. Finally, Lv.5 corresponds to the Internet and cloud layer, linking external services. As shown in Figure 5, the criticality is lowest for Lv.5 and highest for Lv.0.

[0032] The asset condition model is a relationship model between asset condition and criticality. Asset conditions such as hardware, platform software such as operating system, network connectivity or computing, and data processing performance can be used to determine the criticality of an asset. If a node is an embedded device with limited computing resources or a device with very low communication response performance, the criticality of the node is "high".

[0033] In some example implementations, if the node is a device with an enterprise OS (e.g., Windows, Linux, etc.), a device with high communication response performance, or a device connected to an external network such as the Internet, the criticality of the node is set to "low." Such nodes are known to have high data processing performance and high security risks.

[0034] In some example implementations, the criticality of a node may be determined by features associated with the node, which may be derived from information or data obtained from the node and the network it participates in, from system specifications, or from information input by a user.

[0035] FIG. 6 illustrates an example criticality determination flow 600 using a feature decision tree according to an exemplary implementation. As shown in FIG. 6, if a node has a feature of "connected to any external network", the node is determined to be non-critical. If the node has a feature of "not connected to any external network", an additional feature determination for application type is performed. Specifically, if the node has a feature of "field control", the node is determined to be critical. On the other hand, if the feature associated with the application is other than field control, the node is determined to be non-critical.

[0036] 7 illustrates an example process flow 700 for implementing communication intermediation according to one example implementation. The process flow 700 may be initiated upon network joining of the device 100 or at any time determined by a user. The process begins at step S702, where the device 100 determines its network address. At step S704, the device 100 analyzes the network to obtain data / information for the network. At step S706, the device 100 determines attributes of each node. In some example implementations, the attributes of each node may be manually entered by a user via the UI unit 306.

[0037] Next, the device 100 determines the criticality of each node based on the received attributes in step S708. The criticality of each node is determined by attributes such as device type (e.g., host device, embedded device, etc.), operating system (OS) (e.g., Microsoft Windows, Linux, non-enterprise OS, etc.), and other application software or software such as middleware, the network to which the node connects, and the role in the system (e.g., control equipment, data collection, engineering, monitoring data management, web application, networking, etc.). In some example implementations, the device 100 can also determine the criticality from risk assessment results generated by humans or automatic methods using the attributes.

[0038] The process then proceeds to step S710, where device 100 generates data, including node information such as IP or Media Access Control (MAC) addresses. The node data is generated in a reusable format, such as JSON, YAML, SQL, and any other data format supported by a database management system. Any program / software running on device 100, or other applications running outside device 100 but authorized to access the node data, can retrieve them at any time as needed.

[0039] In step S712, the device 100 determines which communications to mediate. Finally, in step S714, the device 100 determines possible security measures and implements them between the selected communications.

[0040] The device 100 also has the ability to join an IP-based wireless network. Figure 8 shows an example communication system 800 according to one exemplary implementation. The device 100 has the ability to join an IP-based wireless network 804 controlled by an access point (AP) 802. The device also has the ability to impersonate the AP 210, which can be impersonated by the device 100 using any wireless-based man-in-the-middle method. Communications between any two nodes in the wireless network managed by the AP 210 can be mediated using the device 100.

[0041] The above-mentioned exemplary implementation may have various benefits and advantages. For example, security measures such as detailed packet anomaly analysis, packet filtering, and authentication can be enabled in legacy systems, and communication delays and resource exhaustion of the system can be minimized. In addition, effective security measures can be provided to protect critical assets from attacks via vulnerable nodes.

[0042] 9 illustrates an example computing environment having an example computing device suitable for use in some exemplary implementations. The computing device 905 of the computing environment 900 can include one or more processing units, cores, or processors 910, memory 915 (e.g., RAM, ROM, and / or other), internal storage 920 (e.g., magnetic, optical, solid-state storage, and / or organic), and / or IO interface 925, any of which can be coupled with a communication mechanism or bus 930 for communicating information or embedded in the computing device 905. The IO interface 925 is also configured to receive images from a camera or provide images to a projector or display, depending on the desired implementation.

[0043] The computing device 905 can be communicatively coupled to an input / user interface 935 and an output device / interface 940. Either or both of the input / user interface 935 and the output device / interface 940 can be wired or wireless interfaces and can be removable. The input / user interface 935 can include any device, component, sensor, or interface, physical or virtual, that can be used to provide input (e.g., buttons, touch screen interfaces, keyboards, pointing / cursor control, microphones, cameras, Braille, motion sensors, accelerometers, optical readers, and / or others). The output device / interface 940 can include displays, televisions, monitors, printers, speakers, Braille, and / or the like. In some illustrative implementations, the input / user interface 935 and the output device / interface 940 can be embedded in or physically coupled to the computing device 905. In other illustrative implementations, other computing devices can function as or provide the functionality of the input / user interface 935 and the output device / interface 940 of the computing device 905.

[0044] Examples of computing devices 905 may include, but are not limited to, highly mobile devices (e.g., smart phones, automobiles and other mechanical devices, devices carried by people and animals, etc.), mobile devices (e.g., tablets, notebooks, laptops, personal computers, portable televisions, radios, etc.), and devices not designed for mobility (e.g., desktop computers, other computers, information kiosks, televisions with one or more embedded processors and / or combined televisions, radios, etc.).

[0045] Computing device 905 can be communicatively coupled (e.g., via IO interface 925) to external storage 945 and network 950 for communicating with any number of networked components, devices, and systems, including one or more computing devices of the same or different configurations. Computing device 905, or any connected computing device, can function, provide services, or be referred to as a server, client, thin server, general purpose machine, special purpose machine, or another label.

[0046] The IO interface 925 can include, but is not limited to, wired and / or wireless interfaces using any communication or IO protocol or standard (e.g., Ethernet, 802.11x, Universal System Bus (USB), WiMAX, modem, cellular network protocols, etc.) to communicate information to and from at least all connected components, devices, and networks of the computing environment 900. The network 950 can be any network or combination of networks (e.g., the Internet, a local area network, a wide area network, a telephone network, a cellular network, a satellite network, etc.).

[0047] The computing device 905 can use and / or communicate using computer usable or computer readable media, including transitory and non-transitory media. Transitory media include transmission media (e.g., metallic cables, optical fibers), signals, carrier waves, and the like. Non-transitory media include magnetic media (e.g., disks and tapes), optical media (e.g., CD ROM, digital video disks, Blu-ray disks), solid media (e.g., RAM, ROM, flash memory, solid-state storage), and other non-volatile storage or memory.

[0048] The computing device 905 can be used to implement techniques, methods, applications, processes, or computer-executable instructions in some example computing environments. The computer-executable instructions can be retrieved from a transitory medium and can be stored in and retrieved from a non-transitory medium. The executable instructions can be in one or more of any programming, scripting, and machine language (e.g., C, C++, C#, Java, Visual Basic, Python, Perl, JavaScript, etc.).

[0049] The processor 910 can run under any operating system (OS) (not shown) in a native or virtual environment. One or more applications can be deployed, including a logic unit 960, an application programming interface (API) unit 965, an input unit 970, an output unit 975, and an inter-unit communication mechanism 995 for different units to communicate with each other, with the OS, and with other applications (not shown). The described units and elements can vary in design, function, configuration, or implementation and are not limited to the description provided. The processor 910 can be in the form of a hardware processor, such as a central processing unit (CPU), or a combination of hardware and software units.

[0050] In some example implementations, when information or instructions for execution are received by the API unit 965, they may be communicated to one or more other units (e.g., logic unit 960, input unit 970, output unit 975). In some examples, logic unit 960 may be configured to control information flow between units and direct services provided by API unit 965, input unit 970, output unit 975 in some example implementations described above. For example, the flow of one or more processes or implementations may be controlled by logic unit 960 alone or in combination with API unit 965. Input unit 970 may be configured to obtain inputs for calculations described in example implementations, and output unit 975 may be configured to provide outputs based on calculations described in example implementations.

[0051] The processor 910 may be configured to identify attributes of a plurality of nodes in communication with a network such as that shown in Figures 2 and 6-7. The processor 910 may also be configured to determine a criticality of each node of the plurality of nodes based on the attributes as shown in Figures 2 and 6-7. The processor 910 may also be configured to broker communications between nodes of the plurality of nodes determined to be non-critical and perform security functions on the brokered communications as shown in Figures 2 and 6-7.

[0052] Some portions of the detailed description are presented in terms of algorithms and symbolic representations of operations within a computer. These algorithmic descriptions and symbolic representations are the means used by those skilled in the data processing arts to convey the substance of their innovations to others skilled in the art. An algorithm is a sequence of predefined steps leading to a desired end state or result. In an exemplary implementation, the steps performed require physical manipulations of tangible quantities to achieve a tangible result.

[0053] Unless otherwise specifically indicated, and as will be apparent from the discussion, throughout the description, discussion utilizing terms such as "processing," "computing," "calculating," "determining," "displaying," and the like will be recognized to include operations and processes of a computer system or other information processing device that manipulates and converts data represented as physical (electronic) quantities in the computer system's registers and memory into other data that is similarly represented as physical quantities in the computer system's memory or registers or other information storage, transmission, or display devices.

[0054] Exemplary implementations may also relate to an apparatus for performing the operations of the present specification. The apparatus may be specially constructed for the required purposes, or may include one or more general-purpose computers selectively activated or reconfigured by one or more computer programs. Such computer programs may be stored on a computer-readable medium, such as a computer-readable storage medium or a computer-readable signal medium. Computer-readable storage media may include tangible media, such as, but not limited to, optical disks, magnetic disks, read-only memory, random access memory, solid-state devices and drives, or any other type of tangible or non-transitory medium suitable for storing electronic information. Computer-readable signal media may include media such as carrier waves. The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. A computer program may include a pure software implementation that includes instructions for performing the operations of a desired implementation.

[0055] Various general-purpose systems may be used with the programs and modules according to the examples herein, or it may prove useful to construct more specialized apparatus to perform the desired method steps. Additionally, the example implementations are not described with reference to any particular programming language. It will be appreciated that various programming languages ​​may be used to implement the teachings of the example implementations as described herein. Instructions in the programming language may be executed by one or more processing devices, such as a central processing unit (CPU), processor, or controller.

[0056] As known in the art, the operations described above may be implemented by hardware, software, or some combination of software and hardware. Various aspects of the exemplary implementations may be implemented using circuits and logic devices (hardware), while other aspects may be implemented using instructions stored on a machine-readable medium (software) that, when executed by a processor, cause the processor to perform a method for performing an implementation of the present application. Furthermore, some exemplary implementations of the present application may be implemented exclusively in hardware, while other exemplary implementations may be implemented exclusively in software. Furthermore, the various functions described may be implemented in a single unit or may be spread across multiple components in various manners. When implemented by software, the method may be executed by a processor, such as a general-purpose computer, based on instructions stored on a machine-readable medium. If desired, the instructions may be stored on the medium in compressed and / or encrypted form.

[0057] Moreover, other implementations of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the teachings of the present application. Various aspects and / or components of the described example implementations may be used alone or in any combination. It is intended that the specification and example implementations be considered as examples only, with a true scope and spirit of the present application being indicated by the following claims.

Claims

1. 1. A security function performing device in communication with a network, comprising: a processor, the processor comprising: identifying attributes of a plurality of nodes in communication with said network; determining a criticality of each node among the plurality of nodes based on the attributes; Mediating communication between nodes determined to be non-critical among the plurality of nodes, and executing a security function for the mediated communication. The device is configured to:

2. determining a criticality of each node among the plurality of nodes based on the attribute; determining a criticality of a node connected to an external network among the plurality of nodes as non-critical; determining a criticality of a node having a field control application among the plurality of nodes as critical; determining a criticality of a node having an application other than a field control among the plurality of nodes as non-critical; The device of claim 1 , comprising:

3. The device of claim 2 , further comprising, for a node of the plurality of nodes determined to be critical, excluding the node from communication mediation.

4. determining a criticality of each node among the plurality of nodes based on the attribute; determining a criticality of a node associated with a critical process of a business operation among the plurality of nodes as critical; For a node among the plurality of nodes determined to have a computing resource less than a resource threshold, determining a criticality of the node as critical; determining a criticality of a node among the plurality of nodes that is not associated with a critical process of a business operation as non-critical; determining a criticality of a node among the plurality of nodes that is determined to have a computing resource equal to or greater than the resource threshold as non-critical; The device of claim 1 , comprising:

5. The device of claim 1 , wherein identifying attributes of the plurality of nodes in communication with the network comprises automatically retrieving the attributes of the plurality of nodes from the network.

6. the plurality of nodes includes software components, hardware components, or a combination of software and hardware components; The software components include a supervisory control and data acquisition (SCADA) system, a manufacturing execution system (MES), a manufacturing operations management (MOM) system, and an enterprise resource planning (ERP) system; The hardware components include field devices, controllers, and servers; The device of claim 1 .

7. The device of claim 1 , wherein the attributes include a network structure, a device type, an application, a resource, and a processing state associated with the plurality of nodes.

8. the network is a wireless network, and the plurality of nodes communicate with the wireless network through an access point that manages the wireless network; identifying attributes of the plurality of nodes in communication with the network includes identifying the attributes of the plurality of nodes by scanning the access points; The device of claim 1 .

9. identifying, by a processor, attributes of a plurality of nodes in communication with the network; determining, by the processor, a criticality of each node of the plurality of nodes based on the attributes; mediating, by the processor, communications between nodes determined to be non-critical among the plurality of nodes, and performing security functions on the mediated communications; 23. A method for performing a security function, comprising:

10. determining a criticality of each node among the plurality of nodes based on the attribute; determining a criticality of a node connected to an external network among the plurality of nodes as non-critical; determining a criticality of a node having a field control application among the plurality of nodes as critical; determining a criticality of a node having an application other than a field control among the plurality of nodes as non-critical; 10. The method of claim 9, comprising:

11. With respect to a node determined to be critical among the plurality of nodes, excluding the node from communication mediation. The method of claim 10 further comprising:

12. determining a criticality of each node among the plurality of nodes based on the attribute; determining a criticality of a node associated with a critical process of a business operation among the plurality of nodes as critical; For a node among the plurality of nodes determined to have a computing resource less than a resource threshold, determining a criticality of the node as critical; determining a criticality of a node among the plurality of nodes that is not associated with a critical process of a business operation as non-critical; determining a criticality of a node among the plurality of nodes that is determined to have a computing resource equal to or greater than the resource threshold as non-critical; 10. The method of claim 9, comprising:

13. The method of claim 9 , wherein identifying attributes of the plurality of nodes in communication with the network comprises automatically retrieving the attributes of the plurality of nodes from the network.

14. the plurality of nodes includes software components, hardware components, or a combination of software and hardware components; The software components include a supervisory control and data acquisition (SCADA) system, a manufacturing execution system (MES), a manufacturing operations management (MOM) system, and an enterprise resource planning (ERP) system; The hardware components include field devices, controllers, and servers; 10. The method of claim 9.

15. The method of claim 9 , wherein the attributes include a network structure, a device type, an application, a resource, and a processing state associated with the plurality of nodes.

16. the network is a wireless network, and the plurality of nodes communicate with the wireless network through an access point that manages the wireless network; identifying attributes of the plurality of nodes in communication with the network includes identifying the attributes of the plurality of nodes by scanning the access points; 10. The method of claim 9.

Images