Method for monitoring communication of field devices

Abstract

A method for monitoring communications of one field device of a plurality of field devices (112, 114, 116) is described, the method including providing at least one stored characteristic characteristic of power consumption of each field device of the plurality of field devices (112, 114, 116) caused by a respective query of a plurality of queries to the respective field device (112, 114, 116), determining a respective query requested to each field device of the plurality of field devices (112, 114, 116) during communications with the plurality of field devices (112, 114, 116), and measuring a characteristic characteristic (200, 211, 212, 213) of power consumption for each of the plurality of field devices (112, 114, 116) caused by a query during communication with the field devices (112, 114, 116); and determining a similarity between the stored characteristic characteristic of power consumption for each of the respective field devices caused by the respective query and the respective measured characteristic characteristic (200, 211, 212, 213) of power consumption for each field device and for each query to monitor communication of the field devices (112, 114, 116).

Description

[Background technology]

[0001] Industrial devices and systems are increasingly being targeted by cyberattacks. Therefore, cybersecurity of such systems is becoming increasingly relevant. Security information and event management (SIEM) systems are crucial for detecting threats to critical operational technology (OT) systems. While such systems aggregate security-related information from information technology (IT) and OT systems, their reach in the OT domain is limited. More feature-rich, networked field devices are becoming available, such as Ethernet APL advanced physical layer devices that use the upcoming Open Platform Communication Unified Architecture (OPC UA). While such devices are beginning to resemble IT resources such as servers, options for integrating them with SIEM systems remain limited. Summary of the Invention

[0002] Legacy and highly resource-constrained devices are common and difficult to integrate into SIEM systems. Field devices are often resource-constrained, internal monitoring suffers from a lack of isolation, and there are no standards for monitoring such devices.

[0003] They often do not offer security monitoring or logging capabilities and do not support the deployment of endpoint monitoring solutions or agents.

[0004] Monitoring communication patterns or network traffic is an alternative, however the detection capabilities of such approaches are limited as encrypted traffic, e.g., OPC UA Secure Conversations, becomes more common.

[0005] Another alternative is to monitor the health of field devices, such as their power consumption, via a side channel. This allows for monitoring external to the field device and can be used to detect changes in field device status, such as when a field device becomes infected with malware and begins executing unusual code. However, this behavioral monitoring relies solely on the side channel and cannot detect changes in the device's communication patterns. Therefore, it lacks the important contextual information needed to distinguish between harmless differences in field device behavior and attacks, which can lead to false positive status messages or limited detection capabilities. While network and side channel monitoring can be performed separately and the results merged in a SIEM system, this does not fully address these shortcomings and requires field device-specific rules. To enable easy integration of field devices into a SIEM system, a solution is needed that overcomes these limitations and can monitor the communications and status of a wide range of field devices without manual configuration. Such a solution would further enhance the benefits of SIEM deployment in industrial environments and improve overall cybersecurity.

[0006] Rather than requiring all such devices to be upgraded or replaced, we propose adding external monitoring capabilities based on both the devices' communication behavior and their power consumption. To limit the amount of hardware required, our proposed solution operates on a combined power trace of all monitored devices and uses contextual information derived from observed device communications to associate deviations from baseline power consumption to specific devices.

[0007] This solution can be deployed as an enhancement to the communications infrastructure, for example as part of an APL field switch, or as a separate monitoring unit placed between a communications device such as an APL field switch and its upstream connection.

[0008] Therefore, the present invention is directed to a method for monitoring communications of one field device among a plurality of field devices, a monitoring unit, use of a monitoring unit for monitoring secure communications of a field device, a computer program, and a computer-readable storage medium.

[0009] Advantageous modifications of the invention are set forth in the dependent claims. All combinations of at least two of the features disclosed in the description, claims and drawings are included within the scope of the invention. To avoid repetition, features disclosed according to the method shall also be applied and claimable according to the described system.

[0010] Throughout this specification of the present invention, the sequence of procedural steps is presented in such a way that the process is easily understandable. However, those skilled in the art will recognize that many of the process steps can be performed in a different order and still lead to the same or corresponding results. In this sense, the sequence of process steps can be modified accordingly. Some features are provided with a letter designation to improve readability or make the designation clearer, but this does not imply the presence of a particular feature.

[0011] 1. To achieve these and other advantages embodied and broadly described herein, and in accordance with the objectives of the present invention, a method is provided for monitoring communications of one field device of a plurality of field devices, wherein in one step of the method, at least one stored characteristic property of power consumption of each of the plurality of field devices caused by a respective one of a plurality of queries to the respective field device is provided. In a further step of the method, a respective query requested for each of the plurality of field devices during communications with the plurality of field devices is determined. In a further step of the method, a characteristic property of power consumption for each of the plurality of field devices caused by the query during communications with the plurality of field devices is measured. In a further step of the method, a similarity between the stored characteristic property of power consumption of each respective field device caused by the respective query and each measured characteristic property of power consumption for each field device and for each query is determined to monitor the communications of the field devices.

[0012] The query may be an incoming request to each field device of the control system, and each field device may generate an outgoing response to the query. During the received query and the generated response, the field device may increase its power consumption, which may be described by a characteristic characteristic of the power consumption of each field device caused by the respective query.

[0013] According to one aspect, the communication queries and / or responses of each of the plurality of field devices and the power consumption characteristics of each of the plurality of field devices are electrically and / or signal-accessible to one another. This may mean that the communication electrical signals and power consumption electrical signals of the plurality of field devices are determined and / or detected and / or sensed at a location signal-upstream from the plurality of field devices that has access to the communication of all of the plurality of field devices and to a power source configured to provide power to all of the individual field devices. This location may be, for example, a field switch configured to connect to all of the plurality of field devices and / or a monitoring unit that may be part of an APL field switch, where the field switch is configured to provide power to each of the plurality of field devices.

[0014] According to one aspect, each field device of a plurality of field devices may be configured to be powered and communicate, for example, by jointly using the same wires as an Ethernet APL device, which, among other things, allows multiple field devices to be accessed adjacent to one another at the same location and / or in the same unit, such as a remote I / O or APL field switch.

[0015] At the location and / or unit, a monitoring unit may be used to monitor the communications of all connected respective field devices of the plurality of field devices and the individual and / or total power consumption of each field device of the plurality of field devices coupled to such location and / or unit.

[0016] The characteristic characteristics of the power consumption of the field devices may be the maximum power consumption of each field device during communication, and / or the duration of power consumption of each field device during communication, and / or the signal form of power consumption of each field device during communication, and / or statistical parameters of power consumption during communication. The power consumption of each field device during communication may be determined within a time window that may be defined by a query to each field device and a response from the field device to the query, and thus the power consumption of each field device within the time window is caused by a query. Such a query may be provided by a control unit at least signal-coupled to each field device of the plurality of field devices. As an example, the control unit may access an APL field switch with a query to each field device at least signal-coupled to the APL field switch.

[0017] In other words, the method for monitoring field device communications may be a hybrid security monitoring method for multiple industrial field devices that uses both field device communications and tracking of power consumption of each monitored field device to detect abnormal behavior of each field device. Monitoring field device communications may be contextualizing characteristics of power consumption of each field device corresponding to the power consumption trace to detect deviations in behavior of each field device.

[0018] A method for monitoring field device communications may be to observe or monitor deviations of measured characteristic characteristics of power consumption compared to stored characteristic characteristics associated with each field device's communications, including queries and / or responses. Normal behavior of the field devices, as described by the stored characteristic characteristics of each field device's power consumption when performing a particular action determined based on the device's communications, may be based on the measured characteristic characteristics of each field device's power consumption during normal operation.

[0019] The proposed method for monitoring field device communications can be used for security monitoring of field devices without requiring device upgrades or reconfiguration, and can be deployed as part of a communications infrastructure, for example, as an extension of APL field switches or remote I / O.

[0020] Advantageously, the local analysis performed by the monitoring unit can limit the impact on IT network traffic, and the automatic configuration described below can minimize the manual effort for setting up the method. The proposed method may enable the integration of field devices into a centralized security monitoring system, as described below.

[0021] When field devices are communicating, the communications can be analyzed to determine each query and / or response and each communicating field device within a time window that may be defined by the time between an incoming query and an outgoing response.

[0022] The change in the power consumption of idle field devices relative to the power consumption of active field devices within a time window of communication can be related to a characteristic characteristic of the power consumption of each field device for a particular type of communication, which can mean a particular query and / or a particular response to a query.

[0023] A method for monitoring field device communications tracks communications of a plurality of field devices and the respective power consumption of each field device.

[0024] Advantageously, the method can enable simultaneous communication monitoring of a large number of multiple field devices and can provide plant-wide monitoring coverage.

[0025] Advantageously, the method can provide hybrid security monitoring for a large number of multiple field devices by combining side-channel, i.e., power consumption, and communication monitoring, i.e., query and / or response. That is, the tracked communications are used to contextualize the power consumption of each field device. In particular, the method can be used for field devices that use the same wire for their communication and for providing power to the field devices. This allows the communication queries and / or responses of each of the multiple field devices and the power consumption characteristics of each of the multiple field devices to be accessed at the point where the multiple field devices are first coupled upstream to a control system. For example, this point can be an APL field switch.

[0026] Advantageously, the described method for monitoring field device communications can be performed locally, particularly at the locations mentioned above.

[0027] Advantageously, the described method can enable existing industrial installations to be upgraded to provide monitoring, particularly for existing field devices, and integrating the monitoring of the field devices into a SIEM system without upgrading or reconfiguring the field devices.

[0028] Further advantageously, preferably by the monitoring unit described below, the similarity values ​​determined based on the described methods and / or the generated alerts and / or the generated status messages may be configured to be communicated within an IP network, in particular for forwarding the messages and / or alerts to a SIEM system.

[0029] Alternatively or additionally, the described method for monitoring field device communications may be integrated into a SIEM system as a separate sensor for use with the method over multiple communication protocols.

[0030] Advantageously, the described method enables security monitoring of industrial field devices using communication behavior and power side channels.

[0031] Industrial field devices are monitored and integrated into a SIEM system without requiring any modifications to the field devices themselves or any manual configuration of the field devices. Multiple field devices can be monitored from a single monitoring unit based on their communications, and in particular using single and / or composite power consumption traces, which are superpositions of the power consumption of multiple field devices that may be based on measurements using a single sensor for the superposed power consumption.

[0032] Further advantageously, this method, i.e., determining the similarity of power consumption of each field device characterized by its respective communications, can be performed locally at a location where power consumption data collection is accessible, particularly upstream of a field switch, in order to minimize additional communication load on the network. This local execution can be provided, for example, by a field switch and / or APL field switch that includes or is coupled to a monitoring unit, the monitoring unit being configured to perform the methods described throughout this specification.

[0033] According to one aspect, the power consumption of multiple field devices is determined jointly as a superposition of the power consumption of the multiple field devices, and a measurement of a characteristic characteristic of the power consumption for each requested query for each of the multiple field devices is based on the superposition power consumption.

[0034] Advantageously, this reduces hardware resources for this purpose, as for example only one current sensor needs to be used for determining power consumption.

[0035] According to one aspect, at least one stored characteristic characteristic of the power consumption of each of the plurality of field devices caused by each of the plurality of queries to the respective field devices is provided by a storage unit.

[0036] The stored characteristic properties may be provided by the manufacturer of the field device for easy setup.

[0037] According to one aspect, at least one stored characteristic characteristic of the power consumption of each of the plurality of field devices caused by each of the plurality of queries to the respective field devices is determined based on a measured characteristic characteristic of each of the first quantities at the start of executing the above-mentioned method for monitoring communication of the field devices, and the at least one stored characteristic characteristic of each of the power consumptions is stored by a storage unit.

[0038] Advantageously, this determination of the stored characteristic characteristics of the power consumption of each of the plurality of field devices provides a flexible setup of the method, since the normal behavior of the field device caused by each query, as described by the stored characteristic characteristics of the power consumption, will be learned by the method itself.

[0039] According to one aspect, at least one stored characteristic characteristic of the power consumption of each of the plurality of field devices caused by each of the plurality of queries to the respective field devices is determined based on repeatedly storing measured characteristic characteristics of each of the second quantities, particularly in a first-in, first-out manner, during execution of the above-mentioned method for monitoring communication of field devices, and the at least one stored characteristic characteristic of each of the power consumptions is stored by a storage unit.

[0040] Repeatedly storing the characteristic characteristic of the second amount of power consumption may be performed in such a way that previously stored data is overwritten by new data.

[0041] In other words, establishing knowledge of the normal behavior of each of the plurality of field devices can be provided by monitoring the characteristics of the power consumption of each field device during communication triggered by a communication query. Preferably, the monitored characteristics of the power consumption can be stored as a history, preferably a limited history, of power consumption traces triggered by each of the plurality of queries. In particular, actual measured characteristics of power consumption within one time window of communication can be compared based on the history of stored characteristics of power consumption of each field device triggered by each query, preferably within one time window of each communication, to determine similarity. If the determined similarity value is below a predetermined threshold, a respective status value or alert can be generated.

[0042] These power consumption characteristics may be stored as a difference from a respective baseline for each idle field device. This difference in power consumption from the baseline can improve accuracy. Thus, the described method includes automatic configuration of the stored characteristic characteristics of the field device power consumption for each of the plurality of field devices.

[0043] Advantageously, the method for monitoring field device communications, in which the stored characteristic characteristics are determined by each of the steps described above, does not require specific customization, manual configuration, or modification for each field device or type of field device, thereby making the method applicable to a variety of different field devices without requiring customization, thereby enabling the monitoring of a large number of multiple field devices at once and / or providing coverage for monitoring field devices at limited cost.

[0044] According to one aspect, the method includes the following steps: in one step, a baseline of power consumption of each field device is determined when the respective field device is idle; in a further step, a similarity between a stored characteristic characteristic of power consumption of each respective field device triggered by a respective query and a respective measured characteristic characteristic of power consumption for the respective field device is determined based on the characteristic characteristic of power consumption, and the baseline is subtracted from the measured characteristic characteristic of power consumption, and the baseline is subtracted from at least one stored characteristic characteristic of power consumption, respectively.

[0045] In other words, when no communication is occurring, i.e., when each field device is idle, individual power consumption baselines and / or composite or superimposed baseline power consumption may be obtained for multiple field devices. Each baseline may be subtracted from the measured power consumption of each field device in such a way that the similarity of stored characteristic characteristics of the power consumption to the measured characteristic characteristics of the power consumption are compared based on deviation from the respective baselines.

[0046] Establishing an idle baseline for each field device with respect to power consumption and a range of normal behavior for each respective field device can be automated without manual configuration, based on first observing the field device when idle and during certain communication actions to establish a history of observed behavior. Changes to connected devices or their settings require re-establishment of the baseline and normal range.

[0047] According to one aspect, the characteristic characteristics of the power consumption are the maximum value of the power consumption of each field device caused by each query, and / or the duration of the power consumption of each field device caused by each query, and / or the signal form of the power consumption of each field device caused by each query, and / or statistical parameters of the power consumption of each field device caused by each query.

[0048] The associated time window of each communication may include the resulting time span from receiving a query to responding to the query.

[0049] According to one aspect, a communication query or response for each of the plurality of field devices and a characteristic characteristic of the power consumption of each of the plurality of field devices are provided by a two-wire cable.

[0050] According to one aspect, the field device communication query or response of each of the plurality of field devices and the field device power consumption characteristics of each of the plurality of field devices conform to the Ethernet APL standard.

[0051] According to one aspect, if the determined similarity value of the stored characteristic characteristics of the power consumption compared to each measured characteristic characteristic of the power consumption for each field device triggered by each query is below a predetermined threshold, a security alert is generated, and preferably the security alert is reported to a SIEM system.

[0052] In other words, anomalies indicated by differences in device behavior with respect to power consumption may be reported to a security system, such as a SIEM system, by generating a security alert and / or status message, and when such an outlier in the power consumption of a respective field device occurs, the security alert and / or status message may be forwarded to the signal-coupled SIEM system.

[0053] Any deviation in the power consumption of each of the respective field devices outside this normal range, i.e., the stored characteristic characteristics of the power consumption, may indicate a change in the behavior of the field device and may be reported to the SIEM system by using the same upstream communication link used for field device communication. The monitoring unit may observe and / or monitor the communication of all connected field devices and may trace their individual and / or combined power consumption.

[0054] According to one aspect, a monitoring unit is proposed, the monitoring unit comprising: a storage unit, at least one measurement unit, a communication monitoring unit, and a processing unit, the storage unit being configured to store stored characteristic characteristics of power consumption of each of a plurality of field devices caused by a respective one of a plurality of queries to the respective field devices; the at least one measurement unit being configured to be electrically coupled to the plurality of field devices to measure the respective characteristic characteristics of power consumption; the communication monitoring unit being configured to monitor and identify queries and / or responses to each of the plurality of field devices; and the monitoring unit being configured to perform any one of the above-mentioned methods.

[0055] The monitoring unit may be supported by the processing unit to perform any one of the above-mentioned methods for monitoring a field device.

[0056] The described method for monitoring field devices can enhance the functionality of communication devices used in industrial systems, such as APL field switches, with security monitoring capabilities for multiple field devices based on their communication behavior and their individual and / or combined power consumption. The method can be implemented as a separate hardware module, e.g., as a monitoring unit, or as a feature of such communication devices.

[0057] According to one aspect, a communication monitoring unit is configured to be coupled to each of the plurality of field devices, the communication monitoring unit is further configured to be coupled to a control unit, the control unit generates requests to the field devices, and the communication monitoring unit is further configured to determine respective queries and / or responses requested for each of the plurality of field devices during communication of the control unit with each of the plurality of field devices.

[0058] It is proposed to use a monitoring unit as described above for monitoring secure communications of one field device of a plurality of field devices according to any one of the methods for monitoring communications of field devices as described above.

[0059] A computer program is proposed comprising instructions that, when the program is executed by a computer, cause the computer to carry out any one of the methods for monitoring communications of field devices mentioned above.

[0060] A computer readable storage medium for storing the above mentioned computer program is proposed.

[0061] The accompanying drawings, which are included to provide a further understanding of the invention, are incorporated in and constitute a part of this application, illustrate embodiments of the invention, and together with the description, serve to explain the principles of the invention. [Brief explanation of the drawings]

[0062] [Figure 1] A plant communication system with field devices. [Figure 2] A schematic plot of the power consumption of field devices. [Figure 3] A schematic plot of the combined power consumption of several field devices. [Figure 4] A schematic plot of the characteristic characteristics of the power consumption of a field device. DETAILED DESCRIPTION OF THE INVENTION

[0063] 1 illustrates a schematic diagram of a plant communication system in which multiple field devices 112, 114, 116 are coupled to an APL field switch 110, which is coupled to an APL power switch 120. The APL power switch 120 is coupled to a control system 140 and a SIEM system 130, which is coupled to the control system 140.

[0064] The APL field switch includes a monitoring unit 100 including a memory unit for storing stored characteristic characteristics of power consumption of each of the plurality of field devices 112, 114, 116 caused by respective queries of a plurality of queries to the respective field devices 112, 114, 116. Each query may be generated by the control system 140. The monitoring unit 100 further includes at least one measurement unit configured to be electrically coupled to the plurality of field devices 112, 114, 116 for measuring each characteristic characteristic of power consumption of each of the plurality of field devices 112, 114, 116. The monitoring unit 100 includes a communication monitoring unit configured to monitor and identify queries and / or responses to each of the plurality of field devices 112, 114, 116, and a processing unit. The monitoring unit 100 is configured to perform any one of the above-described methods.

[0065] FIG. 2 schematically illustrates plots 211, 212, and 213 of the power consumption of multiple field devices 112, 114, and 116. The vertical component, current i, of FIG. 2 represents the power consumption of each field device 112, 114, and 116, and the horizontal component, time t, represents the duration of the power consumption. Plot 200 illustrates a superposition of plots 211, 212, and 213 of the power consumption of multiple field devices 112, 114, and 116. Within a time window 210, the baselines of each field device 112, 114, and 116 and the baseline of the superposition of field devices 112, 114, and 116 are depicted. Time windows 211a, 213a, and 212a illustrate the standard normal behavior of the power consumption of each field device caused by characteristics associated with each field device and the corresponding power consumption signal for the superposition of the power consumption of the multiple field devices 112, 114, and 116. Since the time window 213a indicates the characteristic characteristics of the field device according to the characteristic pattern of the plot 213 within the above-mentioned multiple time windows, by comparing the time window 213a' with the time window 213a, the measured characteristic characteristics of the field device according to the power consumption plot 213 indicate a deviation between the two time windows 213a and 213a'. If the stored characteristic characteristics of the field device's power consumption 213 are similar to the characteristic characteristics shown in the time window 213a, the power consumption behavior within the time window 213a' indicates a malfunction of the respective field device. If the similarity is below a predetermined threshold, a security alert and / or a status message may be reported to a SIEM system. As can be seen by comparing the characteristic characteristics of the field device with the plot 213, deviations in the superimposed signals of the plot 200 indicate the same deviation. A monitoring unit configured to perform the method for monitoring the communication of one field device among a plurality of field devices may be deployed as an extension of the communication device, for example, as an APL field switch, and can observe the communication behavior of the monitored field devices and access their combined or superimposed power consumption.The communication behavior is used to determine periods of communication activity for each field device, which periods are then used to analyze composite and / or individual power traces to determine the characteristics of the power consumption of each field device for the multiple field devices.

[0066] 3 schematically illustrates a plot 200 of the combined or superimposed power consumption of the multiple field devices 112, 114, 116 and a plot 300 of the combined or superimposed power consumption of the multiple field devices 112, 114, 116 in which the baselines of the multiple field devices 112, 114, 116 have been subtracted, where the baselines result from an idle state of the multiple field devices 112, 114, 116. It is shown that the characteristic characteristics of the power consumption of each of the multiple field devices caused by each of the multiple queries for the respective field devices can be identified even when the baselines are subtracted. Advantageously, the subtraction of the baselines allows for a more accurate sense of the superimposed power consumption of the multiple field devices 112, 114, 116.

[0067] The monitoring unit can measure composite or overlapping characteristic characteristics of the power consumption of multiple field devices. Within each communication window, when a field device responds to a request, the deviation of the power consumption from the baseline power consumption can be associated with the power consumption characteristics of each field device and each query or request type.

[0068] Figure 4a schematically shows multiple plots 211a of characteristic characteristics of power consumption of a first field device among multiple field devices 112, 114, 116 caused by respective queries, in which one plot 211a' of characteristic characteristics of power consumption of the first field device caused by respective queries is deviated from the other plots, which may indicate that the first field device may be at risk.

[0069] 4b schematically illustrates a plurality of plots 212a of characteristic characteristics of power consumption of a second field device among the plurality of field devices 112, 114, 116 caused by respective queries, in which one plot 212a′ of the characteristic characteristics of power consumption of the second field device caused by respective queries is deviated from the other plots, which may indicate that the second field device may be at risk. Characteristic characteristics of the power consumption of the first and second field devices that are similar to each other within a certain range may be used to define a stored characteristic characteristic of the power consumption of each field device caused by each query.

[0070] In other words, a higher deviation 212a' or a lower deviation 211a' from the superimposed baseline power consumption may constitute anomalous behavior, which may cause the monitoring unit to generate an event.

[0071] Because slight variations in the characteristic characteristics of the power consumption of each field device can be expected, the monitoring unit can establish a range of normal behavior for each field device of the plurality of field devices. To this end, the monitoring unit can maintain a history of previously measured characteristic characteristics of power consumption for each field device of the plurality of field devices and each query or request type as a difference from a baseline of power consumption for the plurality of field devices. Storing these per-device histories as deviations from the baseline can provide the benefit that the monitoring unit can continue to use them as stored characteristic characteristics if the baseline power consumption changes, for example, if a field device is added or removed.

Claims

1. 1. A method for monitoring communications of a field device of a plurality of field devices (112, 114, 116), comprising: providing at least one stored characteristic characteristic of power consumption of each field device of the plurality of field devices (112, 114, 116) triggered by each of the plurality of queries to the respective field devices (112, 114, 116); determining a respective query requested for each of the respective field devices of the plurality of field devices (112, 114, 116) during communication with the plurality of field devices (112, 114, 116); measuring the power consumption characteristic (200, 211, 212, 213) for each of the respective field devices of the plurality of field devices (112, 114, 116) triggered by a query during communication with the plurality of field devices (112, 114, 116); determining a similarity between the stored characteristic characteristics of the power consumption of each of the respective field devices caused by the respective queries and the measured characteristic characteristics (200, 211, 212, 213) of the power consumption for each of the respective field devices and for each of the respective queries to monitor the communications of the field devices (112, 114, 116); A method comprising:

2. the power consumption of the plurality of field devices (112, 114, 116) is jointly determined as a superposition of the power consumptions (200, 300) of the plurality of field devices (112, 114, 116); measuring the characteristic characteristic of the power consumption for the requested respective query for each of the respective field devices of the plurality of field devices (112, 114, 116) is based on the superimposed power consumption (200, 300); The method of claim 1.

3. The method according to claim 1 or 2, wherein the at least one stored characteristic characteristic of the power consumption of each field device of the plurality of field devices (112, 114, 116) caused by each query of the plurality of queries for each field device (112, 114, 116) is provided by a storage unit.

4. The method of claim 3, wherein the at least one stored characteristic characteristic of the power consumption of each field device of the plurality of field devices (112, 114, 116) caused by each query of the plurality of queries to each field device is determined based on a first amount of measured characteristic characteristics (200, 211, 212, 213) of each field device at the start of executing the method for monitoring the communication of the field devices (112, 114, 116) described in claim 1, and the at least one stored characteristic characteristic of each of the power consumption is stored by the storage unit.

5. The method of claim 3 or 4, wherein the at least one stored characteristic characteristic of the power consumption of each field device of the plurality of field devices (112, 114, 116) caused by each query of the plurality of queries to each field device is determined based on repeatedly storing, particularly in a first-in, first-out manner, measured characteristic characteristics (200, 211, 212, 213) of each second quantity during execution of the method for monitoring the communication of the field devices described in claim 1, and the at least one stored characteristic characteristic of each of the power consumptions is stored by the storage unit.

6. determining a baseline (210) of the power consumption of each field device (112, 114, 116) when the respective field device (112, 114, 116) is idle; determining the similarity between the stored characteristic characteristics of the power consumption of each of the respective field devices caused by the respective queries and the measured characteristic characteristics of each of the power consumptions (200, 211, 212, 213) for the respective field devices based on the characteristic characteristics of the power consumption; 6. The method according to claim 1, wherein the baseline (210) is subtracted from the measured characteristic characteristic of the power consumption (200, 211, 212, 213), and wherein the baseline (210) is subtracted from the at least one stored characteristic characteristic of the power consumption, respectively.

7. The method according to any one of claims 1 to 6, wherein the characteristic characteristics of the power consumption (200, 211, 212, 213) are a maximum value of the power consumption of each of the field devices (112, 114, 116) caused by each of the queries, and / or a duration of the power consumption of each of the field devices (112, 114, 116) caused by each of the queries, and / or a signal form of the power consumption of each of the field devices (112, 114, 116) caused by each of the queries, and / or statistical parameters of the power consumption of each of the field devices (112, 114, 116) caused by each of the queries.

8. The method of any one of claims 1 to 7, wherein the query or response of the communication of each field device of the plurality of field devices (112, 114, 116) and the characteristic characteristics of the power consumption of each field device of the plurality of field devices (112, 114, 116) are provided by a two-wire cable.

9. The method of any one of claims 1 to 8, wherein the query or response of the communication of each field device of the plurality of field devices (112, 114, 116) and the characteristic characteristics of the power consumption of each field device of the plurality of field devices (112, 114, 116) comply with the Ethernet APL standard.

10. The method according to any one of claims 1 to 9, wherein if the determined similarity value of the stored characteristic characteristics of the power consumption compared to the respective measured characteristic characteristics of the power consumption for the respective field device caused by the respective query is below a predefined threshold, a security alert is generated, preferably the security alert is reported to a SIEM system (130).

11. A monitoring unit (100), a storage unit configured to store stored characteristic characteristics of power consumption of each field device of the plurality of field devices (112, 114, 116) caused by each of the plurality of queries to the respective field devices (112, 114, 116); at least one measurement unit configured to be electrically coupled to the plurality of field devices (112, 114, 116) for measuring the characteristic characteristic of each of the power consumptions; a communication monitoring unit configured to monitor and identify queries and / or responses to each of the plurality of field devices (112, 114, 116); a processing unit; Equipped with A monitoring unit (100), wherein the monitoring unit (100) is configured to perform the method according to any one of claims 1 to 10.

12. The communication monitoring unit coupled to each of the plurality of field devices (112, 114, 116); coupled to a control unit (140), wherein the control unit (140) generates requests to the plurality of field devices (112, 114, 116); determining a respective query and / or response requested for each of the respective field devices of the plurality of field devices (112, 114, 116) during communication of the control unit (140) with the respective field devices of the plurality of field devices (112, 114, 116); The monitoring unit (100) of claim 11, configured to:

13. Use of a monitoring unit (100) according to claim 11 or 12 for monitoring secure communications of one field device of a plurality of field devices (112, 114, 116) according to any one of claims 1 to 10.

14. A computer program comprising instructions that, when the program is executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 10.

15. A computer readable storage medium for storing a computer program according to claim 14.

Images