Embedded device utilizing airgap switching mechanism

Abstract

A network control device (90) or resource that includes an input signal line (111, 113), a signal processing component (140), and a space-gapped (air-gapped) switching mechanism (116). The input signal connects to a mechanically actuatable trigger (148, 150). The signal processing component is configured to provide a control signal when an electrical characteristic or attribute of a signal on the input signal line meets a predetermined condition. The space-gapped switching mechanism can be controlled to change its switch state based on the control signal.

Description

EMBEDDED DEVICE UTILIZING AIRGAP SWITCHING MECHANISMRELATED APPLICATIONS

[0001] This application claims benefit of priority to U.S. Provisional Patent Application No. 63 / 660,560, filed on June 16, 2024; the aforementioned priority application being hereby incorporated by reference in its entirety.TECHNICAL FIELD

[0002] Examples pertain to an embedded device for utilizing airgap switching mechanisms, as described herein.BACKGROUND

[0003] Network systems increasingly use a diverse range of components and devices. Operational Technology systems, for example, include hardware and software devices used in industrial environments. These types of settings face a diverse range of challenges, ranging from network vulnerabilities (e.g., cyber-intrusions and threats), malevolent actors, fire or disaster protection, power surges and outages, and compliance-mandated safety requirements (e.g., emergency shutoff button for heavy equipment). The diverse range of technologies makes implementation of safeguards difficult, and the safeguards themselves can be prone to vulnerabilities.BRIEF DESCRIPTION OF THE DRAWINGS

[0004] FIG. 1 illustrates a network control system, and an embedded module for a network control system, according to one or more embodiments.

[0005] FIG. 2A illustrates an example method for operating an embedded module that includes an airgap mechanism, according to one or more embodiments.

[0006] FIG. 2B illustrates an example method for operating one or multiple embedded modules to control a network system, according to one or more embodiments.DETAILED DESCRIPTION

[0007] According to embodiments, a network control device or resource includes an input signal line, a signal processing component, and a spacegapped switching mechanism. The input signal connects to a mechanically actuatable trigger. The signal processing component is configured to provide a control signal when an electrical characteristic or attribute of a signal on the input signal line meets a predetermined condition. The space-gapped switching mechanism can be controlled to change its switch state based on the control signal.

[0008] In additional examples, an embedded module can deploy a combination of airgap mechanisms, in order to automate airgap switching to multiple resources at one time.

[0009] Among other advantages, examples provide for an embedded module having a hardware-based switching mechanism that can physically isolate resources from power and / or communications. As described with some examples, an embedded module can be configured to selectively isolate and protect various types of network environments, including OTS networks that utilize mechanical actuators, sensors, appliances, and software systems and components alike.

[0010] In examples, a space-gap device is any device that can be controlled to physically separate end points of an electrical connection. In examples, a space-gap device can include a device that creates an airgap between two leads of a switch connection. In other examples, the space-gap device can form a separation across a vacuum space. Still further, the spacegap device can form a separation by causing the two electrical ends to be separated by a non-conductive medium or barrier. While numerous examples are described below as including an airgap device that physically separates electrical leads, in variations, other types of space-gap devices may be utilized to implement a space-gapped device, such as in configurations where electrical leads are selectively separated across a vacuum, across a medium other than "air", or by non-conductive material.

[0011] In examples as described, an airgap (or air-gapped) switching mechanism is a switching mechanism that can be controlled to implement a physical separation between electrical leads, sufficient to prevent electrical contact, coinciding with an open or non-conductive state. When in the closedor conductive state, the electrical leads are positioned to be in electrical contact (e.g., the leads are positioned to be in contact, or sufficiently close to enable electrical contact).

[0012] In an embodiment, the network control device is implemented as an embedded device, utilizing only hardware to implement functionality as described. The embedded device can utilize a signal processing component to determine whether the characteristics or attributes of the input signal meet predetermined thresholds or criteria of a valid trigger input signal generated from a corresponding mechanical actuation mechanism.

[0013] In examples, the embedded device includes a voltage filter to detect when a voltage on a voltage input line meets a predetermined level or range, coinciding with a voltage signal generated by a connected, mechanically (or manually) actuated button or other mechanism. As an addition or variation, the embedded device includes an optical isolator that checks the voltage level of the voltage input line. When the voltage on the voltage input line meets a predetermined threshold level or range, an airgap mechanism can be switched, so as to change its current switching state.

[0014] According to examples, an embedded module includes a signal processing component and an airgap switching mechanism. The signal processing component is coupled, via an input signal line, to a mechanically actuatable trigger. The signal processing component is configured to generate a control signal when an electrical characteristic or attribute of a signal on the input signal line meets a predetermined condition.

[0015] In examples, components that are connected directly or indirectly can be said to be coupled to one another.

[0016] Among other advantages, an example module or device is provided to preconfigure electrical and / or network isolation of select devices and / or segments of a networked environment, in a manner that is responsive to predetermined conditions and events.

[0017] Examples further include a device, module or component that operates to detect when an electrical characteristic of an input signal meets a predetermined condition. In response to determining that the electrical characteristic of the input signal meets the predetermined condition, an airgap mechanism is triggered to change its state, and when the airgapmechanism is switched to the closed state, the first signal line is connected to a second signal line.

[0018] Still further, in some examples, a network control system is provided that includes one or multiple embedded modules or devices, each having one or multiple airgap switching mechanisms that can be configured to selectively isolate segments or resources in a networked environment. As an addition or variation, a network control system as described can include one or multiple embedded modules or devices that interface with a power supply or buss, to selectively cut-off power to protected resource(s) of a network environment.

[0019] Further, in some variations, a network control system can be configured to tie one or more open-state signals lines to an output of the airgap mechanism. Such signal lines can be configured to, for example, signal low when the airgap mechanism is in a closed state, and high when the airgap mechanism is in an open state. In this way, when the airgap mechanism is triggered to open and isolate a protected resource, the open state signal line can automatically provide an input to another component or resource of the network environment.

[0020] FIG. 1 illustrates a network control system, and an embedded module for a network control system, according to one or more embodiments. In examples, a network control system 90 includes an embedded device or module 100 for controlling an availability or accessibility of a protected resource. The embedded module 100 can be implemented in a variety of forms and form factors, including, for example, as a printed circuit board or module. The embedded module 100 can be implemented as a hardware only device that is operable with a mechanical or machine generated input trigger. By way of example, the networked system 90 can include a system in which one or more terminals (e.g., desktop computers, laptops, etc.), servers (e.g., file server, application server, etc.) and appliances (e.g., firewall, gateway) are part of a common network, such as may be the case where the devices operate under a common network domain (e.g., connected to a domain controller) within a premise, facility, campus or region. In further examples, the networked system 90 can include numerous types of connected and autonomous equipment, such as printers, security cameras and devices, manufacturing equipment, and the like.

[0021] In an example of FIG. 1, the network control system 90 includes an embedded module 100, as well as one or more network interfaces (shown as internal and external network interfaces 120, 130) and / or one or multiple trigger mechanisms 148, 150 (or interfaces to such trigger mechanisms). As described with some examples, the network control system 90 can include or integrate with a supervisory control and data acquisition ("SCADA") system or a programmable logic controller ("PCL") component.

[0022] Further, in an example of FIG. 1, an embedded module 100 includes one or more airgap mechanisms 116, 116B and a signal processing component 140. The embedded module 100 can be provided as a discrete device, a distributed component, or a component that is integrated with a larger system, such as a SCADA or PLC component.

[0023] With further reference to an example of FIG. 1, the embedded module 100 can be implemented as a hardware device, using circuits, gates and signal lines to implement functionality as described. Further, while the embedded module 100 can be independent of the network control system 90, in variations, the embedded module 100 can be an integrated component of the network control 90.

[0024] As described in more detail, the embedded module 100 provides an air-gapped switching mechanism for the network control system 90, where the air-gapped switching mechanism is triggerable by an out-of-band ("OOB") signal that is generated from mechanical actuators (e.g., buttons, pull switches, etc.) and / or physical events (e.g., generated by machinery operating as part of the networked system and / or sensors for detecting physical evens within a region of the networked system). Accordingly, in examples, the embedded module 100 is operable with one or more trigger signals that are generated from a mechanism that is physically within a region, area or building where devices and components of the networked system reside. As an addition or variation, the embedded module 100 is operable within a common network domain, with devices or components (e.g., sensors, detectors, manually triggered actuators, machinery and the like) from which trigger or OOB signals are generated to change a state of the embedded module. As described with some examples, the trigger or OOB signal is an electrical signal, such as a voltage input signal, generated by a mechanical actuator such as a push button. In other examples, the trigger orOOB signal can be generated by a generator, voltage detector, or other component, in response to an electrical event (e.g., power surge, blackout, etc.).

[0025] Accordingly, in examples, the embedded module 100 controls a switch state of one or multiple airgap mechanisms 116 (represented by airgap mechanism 116 in FIG. 1), where the airgap mechanisms interconnect (when in a closed state) a protected resource to one or more connectable components or networks of the networked system. Examples of a protected resource can include an internal network or internal network interface, an internal network segment, a connected device of an internal network, and / or a memory or other component of a connected device. Examples of a connectable component or network can include (i) an external network interface to an external network (e.g., World Wide Web), (ii) an internal network interface to an internal network or segment where the protected resource is provided, and / or (iii) a computer or terminal that can otherwise access the protected resource when the corresponding airgap mechanism 116 is closed.

[0026] The airgap mechanism 116 can be implemented by, for example, one or more mechanical relays, actuators, or optocouplers. In variations, the airgap mechanism 116 can be implemented by a robotic mechanism that physically moves conductive elements to selectively form an electrical connection, and to separate the electrical connection. As described with examples, the airgap mechanism 116 can form a physical space gap, coinciding with a switch state that is in an open state. Further, the airgap mechanism 116 is operable so that the physical space gap is closed when in the closed state.

[0027] In at least some examples, the embedded module 100 is configured to receive a machine or mechanically generated input trigger signal, and further to perform a switching operation, or set of switching operations, to change a switch state of the airgap device(s) 116 based on the received input trigger. In this way, the embedded module 100 enables an out-of-bound trigger signal (e.g., voltage input signal, current signal) to be used to control the switch state of the airgap device(s) 116. In some variations, a source of the trigger signal is physically connected or in proximity to the embedded device.

[0028] Amongst other advantages, the embedded module 100 enables one or more airgap mechanisms 116, implemented as mechanically actuatable switches, to be onsite at the location of the protected resource (e.g., an enterprise network), where actuation of the mechanical trigger controls the switch state of the airgap mechanisms 116.

[0029] In more detail, an example of FIG. 1 provides that that the network control system 90 includes an internal network interface 120 to an internal network 102, a set of airgap mechanisms 116, and an external network interface 130 to an external network 104. The internal network interfacel20 is an example of a protected resource (or interface thereto). Similarly, the external network interface 130 is an example of an unprotected resource that can be selectively interconnected to the protected resource via the airgap mechanism 116.

[0030] In examples, the embedded module 100 controls a switch state of one or multiple airgap mechanisms 116 (represented by airgap mechanism 116) that are positioned to selectively interconnect an internal network 102 to an external network interface 104. Each of the airgap mechanisms 116 can selectively interconnect signal lines 117, 119, which can provide (when the airgap mechanism 116 is closed) a signal path that is selectively air-gapped and thus isolated. When, for example, the airgap mechanism 116 is in a closed state, the internal network interface 120 is accessible to the external network 104 via the external network interface 130. Conversely, when the airgap mechanism 116 is in an open state, the internal network 102 is airgapped from the external interface 130, and therefore inaccessible to the external network 104. In the open state, the airgap mechanisms 116 are physically air-gapped from the external network interface 104, meaning a physical barrier interrupts the continuity of the signal lines that would otherwise interconnect the respective internal and external network interfaces.

[0031] The network control system 90 includes one or multiple trigger mechanisms. For example, the network control system 90 can include a group of trigger mechanisms, dispersed in, for example, a facility or campus. In an example shown by FIG. 1, the network control system 90 includes a set of voltage input line 111 that connects to a trigger mechanism 148 that generates a voltage input as a trigger. The trigger mechanism 148 can beimplemented as one or more mechanical actuators, such as may be placed in a building or space of an enterprise. For example, the trigger mechanism 148 can include a button set 142 or similar structure, that is mechanically operable to generate a designated voltage level on the voltage input line 111. For example, the button set 142 can include one or multiple buttons that are connected to a power source (e.g., battery, main, etc.), and actuation of the button set 142 causes a voltage signal to be present on the voltage input line 111.

[0032] The embedded module 100 includes one or more signal processing components 140. The signal processing components 140 can include, for example, a voltage filter component 144 that is configured to detect a voltage level of the voltage input line 111. The voltage filter component 144 can be configured to detect a threshold voltage range (e.g., between 3V and 30V) on a voltage input line 111. In some examples, if the threshold voltage is detected on the voltage signal line 111, the voltage filter component 144 provides a corresponding control signal on a switch input line 121, where the control signal causes the airgap mechanism 116 to change its switch state (e.g., from open to close or vice-versa).

[0033] As an addition or variation, the voltage filter component 144 can be configured to detect multiple threshold voltage levels (e.g., from different buttons) on the voltage input line 111 (e.g., above 5V, 10V, 15V, etc.), and different control signals can be provided to the airgap mechanism 116 based on the detected voltage level on the voltage input line 111. For example, the voltage filter component 144 can include associated circuitry and logic to associate each of multiple voltage levels on the voltage input line 111 with a particular control signal.

[0034] The embedded module 100 can include control circuits and logic to associate the control signal with a particular switch state of the airgap mechanism 116. Thus, a particular control signal may cause the airgap mechanism 116 to change switch states only if the airgap mechanism 116 is not already in the switch state associated with the particular control signal and voltage level. Still further, in examples in which the embedded module 100 includes multiple airgap mechanisms 116, the control signal can select which airgap mechanisms 116 to change switch states and / or designate the switch state of specific airgap mechanisms 116.

[0035] As an addition or variation, the embedded module 100 can receive an input trigger from a second type of trigger mechanism 150, such as an actuator that generates a dry loop signal when it is actuated into a switch mode. For example, the second trigger mechanism 150 can include a device that can be mechanically manipulated (e.g., by lever or push action) to short two pins, so as to create a short signal as a trigger. The embedded module 100 can include a second set of input lines 113 on which the trigger signal generated by the second trigger mechanism 150 is received. A signal detector 146 can filter the electrical signals of the second set of input lines for an electrical attribute that is characteristic of the actuation of the trigger mechanism. Once detected, the signal detector 146 can generate a control signal 123 to change the switch state of one or more airgap mechanisms 116, and / or to set the switch state of one or more airgap mechanisms 116.

[0036] In some examples, the embedded module 100 includes additional resources to validate that the embedded module 100 has received a valid trigger signal. For example, the embedded module 100 can include additional hardware signal processing components, such as an optical isolator (not shown), that can detect an attribute or characteristic of the electrical signal generated by the trigger mechanisms 148, 150. For example, an optical isolator can measure the voltage of the signal that is provided by the trigger mechanism 148 to verify that the signal is within the predetermined threshold range (e.g., between 3 and 30 volts). As an addition or variation, the optical isolator can measure the voltage of the signal that is provided the trigger mechanism 150 to verify that the signal has a corresponding electrical characteristic or attribute of a signal generated by the second trigger mechanism 150.

[0037] As another variation, the embedded module 100 can be configured to receive an input trigger from a programmable logic controller ("PLC") provided with the networked system of the network control system 90. A PLC can, for example, read input data from connected devices (e.g., automated industrial equipment) of the networked system, and based on the input data, generate one or more control signals 123 for the airgap mechanisms 116.

[0038] In additional examples, the embedded module 100 can be configured to receive an input trigger from a supervisory control and data acquisition ("SCADA") system, which can interact with, for example, sensors,motors, pumps and other machinery to detect pre-defined conditions or events that are associated with a desired switch state of the airgap mechanism 116. For example, the SCADA system can detect an overheat condition, which may be associated with an offline condition, and in response to receiving the trigger signal generated by the SCADA system, the embedded module 100 changes the switch state of the airgap mechanisms 116 to be offline.

[0039] While an example of FIG. 1 illustrates an example embedded module 100 in context of a network control system 90 (e.g., to control accessibility to a protected resource or internal network), in variations, the embedded module 100 can be used to control a power supply to a component, device or system (e.g., a segment of the networked system). In such examples, the embedded module 100 can interconnect, for example, a power buss of the networked system with a power source, or a controller to a power source. When a designated event occurs, the airgap mechanism 116 can be used to switch the power signal for the power bus. By way of example, the embedded module 100 can respond to a mechanical push button or actuation (e.g., operator pushes the emergency button) of the first trigger mechanism, or notification generated by a PLC or SCADA system, by signaling a power controller to initiate a shutdown process affecting a computer, a segment of a network, or machinery.

[0040] EXAMPLES

[0041] By way of illustration, a network system can include work stations in a room where workstations are connected to an enterprise network. When an enterprise user first enters the room (e.g., beginning of day), he pushes a button or manually actuates a mechanism that generates a voltage signal to trigger the network control system 90. The voltage filter 144 and / or optical isolator validates the input signal generated by the button or actuation mechanism, which in turn cause one or more airgap mechanisms 116 to change switch states - from open to closed. When the airgap mechanism 116 are closed, one or more network ports in the room become active, enabling the user to use a workstation to access the external network 104, and / or enabling the work station or resource within the room to be accessed from the external network 104. In the same example, before the user leaves the room, he can press / actuate the trigger mechanism again, to cause the airgapmechanism 116 to switch to the open state. In the open state, the workstation or resource within the room has no connectivity, and is not accessible or even visible from, for example, the external network. Such an example illustrates how embodiments can enable enterprises to implement a best practice where a terminal, connected device or space is accessible to an external network, or other segments of an internal network, when persons are physically present.

[0042] As another illustrative example, an onsite operator can manually actuate a mechanism to disconnect the operation of automation machinery, to, for example, enable manual control. The actuation mechanism may generate a OOB trigger signal that causes the network control system 90 to open the airgap mechanism 116 that interconnects the machinery with automation control, thereby enabling the operator to control the machinery.

[0043] Still further, a camera device can be used to monitor a protected space such as a server room. If an intruder is detected in the server room, a security operator can actuate a trigger mechanism to implement a security action, where the security action causes the airgap mechanism to open, isolating protected resources that would otherwise be available from a machine in the server room from the intruder. In a variation to the illustrative example, the camera device can be connected to a PLC component or integrated as part of a SCADA system to generate an internal notification that automatically implements the security action. For example, the security system can program the cameras for intrusion detection, and when intruders are detected, the camera or PLC component can generate the OOB signal for the airgap mechanism 116.

[0044] INPUT LOGIC VARIATIONS

[0045] In some variations, the input signal lines 111, 113 and / or the signal processing component(s) 140 can be connected, or otherwise integrated with hardware logic 138 to enable multiple input signal states.

[0046] In an example, the input signal lines 111, 113 can be combined or integrated with input logic 138 to generate one or multiple combined input signals based on actuation of trigger mechanisms 148, 150. The input logic 138 can be configurable to define a sequence or pattern of inputs, received from, for example, multiple trigger mechanisms of a group of trigger mechanisms. By way of example, the input logic 138 can be configured as orsimilar to a dual in-line package (DIP) switch, or a group of switches. The input logic 138 can be structured to define combined input for the embedded module 100, or the airgap mechanism 116, based on a predefined sequence, cascade, or pattern amongst signals generated by the group of trigger mechanisms 148, 150.

[0047] By way of example, the network control system 90 can include a set of four trigger mechanisms, with two of the four trigger mechanisms being tied to a trigger mechanism of a fire alarm (e.g., fire alarms located in different floors of a building). The input logic 138 can be structured so that if just one of the two fire alarms are triggered, the combined input communicated to the embedded module 100 does not change the switch state of the airgap mechanism 116. In additional examples, the input logic 138 can be configured to generate a signal to cause one or more airgap mechanisms 116 to switch to the open state in response to, for example, three of four fire alarms triggering, or two fire alarms triggering in a sequence.

[0048] OPEN STATE SIGNAL LINE

[0049] In variations, the airgap mechanisms 116, 116B can be configured to include at least one active output signal for each switch state. For example, when an airgap mechanism 116 is in the open state, an open state signal line 119 can carry a signal to control another mechanism of the network control system 90. In a network control system where the default state of the airgap mechanism is a closed state, the open state signal line 119 can be used to provide a voltage input or trigger signal to an output 152 (e.g., LED lights, alarm or other feedback mechanism) in response to an event that causes the airgap mechanism 116 to close. In an example of FIG. 1, the open state signal line 119 located with or near one of the trigger mechanisms 148, 150, can be used to signal nearby personnel of the open switch position of the airgap mechanism 116.

[0050] As an addition or variation, the open-state signal can 119 can, in response to a corresponding airgap mechanism 116 being switched to an open state, signal a second airgap mechanism 116B to switch from the open state to a closed state. In such an example, the second airgap mechanism 116B may be used to protect another resource. For example, when the second airgap mechanism 116B is in the open state (coinciding with the firstairgap mechanism being closed), the second airgap mechanism 116B can be in the open state, so that a resource being protected by that switch is isolated. When the first switching mechanism 116 is switched to an open state, the second switching mechanism 116B is switched from the open state to a closed state. In the closed state, the protected resource can be powered and / or connected to an external network to enable remote access to the resource.

[0051] In this way, in some examples, an open switch condition at one segment of the network can result in a closed switch signal in another segment. For example, an outage may trigger the first airgap mechanism 116 to switch to an open state, and a second airgap mechanism to switch from an open state to a closed state, to enable external access to a resource that was being isolated by the second airgap mechanism. By way of illustration, the first airgap mechanism 116A can switch to an open state in response to a voltage surge on a powerline (as detected by a sensor), causing resources or a segment of the network environment to be isolated. The closing of the first airgap mechanism 116 can cause the second airgap mechanism 116B to switch from the open state to a closed state. When in the closed state, a generator can be enabled, and / or connected to an external network interface to enable external network. In this way, while the generator is on, operators can remotely access and operate the generator (or other protected resource), and when the generator is off, the remote access is cut-off.

[0052] METHODOLOGY

[0053] FIG. 2A illustrates an example method for operating an airgap mechanism, according to one or more embodiments. In some embodiments, an example method of FIG. 2A can be implemented using, for example, an embedded module 100 or network control system 90 such as described with an example of FIG. 1. Accordingly, reference to elements of FIG. 1 illustrate a suitable component for performing a step or sub-step being described.

[0054] Referring to FIG. 2, in step 210, an OBB signal is received. For example, the embedded module 100 or network control system 90 receives an input signal from a trigger mechanism 148, 150. The OOB signal can correspond to an electrical signal (e.g., current or voltage signal), generated by mechanical actuation of a button or other actuator. In an example, theOOB signal can be generated by a button or lever being pushed, pulled or otherwise actuated.

[0055] In step 220, a determination is made as to whether the OOB signal is a valid trigger signal for changing or setting a switch state of one or more airgap mechanisms 116. For example, a determination can be made as to whether the voltage input signal generated by the first trigger mechanism 148 is generated from noise, interference, a power surge, or actuation of, for example, one of the trigger mechanisms 148, 150. For example, the voltage filter 144 and / or optical isolator can enable the control signal 121 for the airgap mechanism 116 only when a voltage level of the voltage input line is within predetermined threshold range (e.g., between 3V and 30V). Similarly, the signal filter 146 and / or optical isolator can enable the control signal 123 for the airgap mechanism 116 only when the input signal on the input line 113 has attributes or characteristics (e.g., voltage level, current amplitude or waveform, etc.) that are pre-associated with a valid trigger signal.

[0056] If the determination of step 220 is that the OOB signal is a valid trigger signal, then in step 230, a corresponding control signal is provided to the airgap mechanism 116, to cause, for example, the airgap mechanism 116 to change switching states. For example, if the OOB signal is determined to be a valid trigger signal, then the airgap mechanism 116 is switched into the closed position, allowing, for example, data to pass through the input and output ports of the networked system 90. As another example, the internal port 120 of the networked system can be made accessible to the external network 104 via the external network port 104.

[0057] If, on the other hand, the determination is made that the OOB signal is not valid, then in step 234, no control signal is provided to the airgap mechanism 116, and the airgap mechanism 116 maintains its currents witch state. Thus, if the OOB signal is detected to not be within the threshold range, then it is not treated as a valid OOB trigger signal, and no action is taken in response to that signal.

[0058] In this way, the trigger mechanisms 148, 150 can be operated to change the states of the airgap mechanism(s) 116 as between open and closed states. Thus, for example, the trigger mechanisms 148, 150 can be operated again to change the state of the airgap mechanisms back to an initial state.

[0059] With reference to an example of FIG. 2B, in step 250, the embedded module 100 operates to detect when an electrical characteristic of an input signal meets a predetermined threshold. In examples, the embedded module 100 includes a signal processing component 140 that is connected to one or more trigger mechanisms 148, 150 of a network environment, such as an operational technology system ("OTS"). The electrical characteristic can correspond to, for example, an input trigger signal that exceeds a predetermined voltage threshold. For example, the input trigger signal can be actuated by a mechanical mechanism (e.g., button(s), lever), set of operational sensors (e.g., temperature, smoke sensor, camera, microphone), or power detectors or sensors. As additional examples, the input signal can be generated from a SCADA system, or from a PCL provided with a network control system. Still further, the electrical characteristic can correspond to a predetermined range of values, such as a voltage range (e.g., 3 to 5 volts).

[0060] In step 260, in response to the input signal meeting the predetermined threshold, the airgap mechanism 116 switches its switch state, between an open and closed state. In some examples, the airgap mechanism 116 is in the closed state by default. While in the closed state, the airgap mechanism 116 interconnects a first signal line to a second signal line. Further, in some examples, the first signal line may be coupled to a protected resource, such as an internal network interface, and the second signal line may be coupled to, for example, an external interface, such that in the closed state, the protected resource is accessible via an external network, such as the World Wide Web. In response to the input signal meeting the predetermined threshold, the airgap mechanism 116 switches to the open state, to separate the first and second signal lines, so as to isolate or otherwise protect the resource.

[0061] Step 262 illustrates a variation in which the embedded module 100 includes multiple airgap mechanisms 116, configured to that a single trigger signal (e.g., the input signal line meeting the predetermined threshold) or event (e.g., combination of two input trigger events) changes the switch state of multiple airgap mechanisms 116. The multiple airgap mechanisms 116 can be arranged in parallel or in series, to respond to a common trigger signal or event. Further, the default switch state of the airgap mechanismscan be reversed, such that a common trigger signal or event causes the switch state of at least one airgap mechanism 116 to be closed, while the switch state of at least one other airgap mechanism is open. For example, the embedded module 100 can include two airgap mechanisms 116, 116B can be configured in series, with the second airgap switch 116B having different default switch states, such as with the first airgap mechanism 116 has a default switch state that is closed, and the second airgap mechanism 116B has a default switch state that is open. The embedded module 100 can be configured so that when the first airgap mechanism 116 is switched to the open state (e.g., such as in response to a trigger signal or detected event), an open-state output line 119 is raised in voltage. The second airgap mechanism 116 can be configured, or integrated with a signal processing component, to respond to the raised voltage on the output line 119 by switching from the open state to the closed state. Thus, in such an example, when the first airgap mechanism 116 is triggered to the open state from the default closed state, the second airgap mechanism 116B is switched to a closed state from the default open state. This configuration enables a second resource to be accessible over, for example, an external network 104 (via the external network interface 130) only when the first resource is inaccessible. By way of example, the first airgap mechanism 116 can be connected to an internal network interface 120 that provides access to a primary computer or network system, and the second airgap mechanism can be connected via the same or different network interface 120 to a backup computer or network system. In such an example, the reverse configuration of the airgap mechanisms 116, 116B ensure that the backup system is not accessible over the external network when the primary system is running. In the default state, hackers, viruses, and other types of cyberthreats cannot enter the network through vulnerabilities of the backup system. However, when a trigger or event is detected that switches the first airgap mechanism 116 to the open state, the primary system can be taken offline. At the same time, the output signal of the first airgap mechanism 116 causes the second airgap mechanism 116B to switch to the closed state, making the backup system accessible to the external network.

[0062] In this way, the embedded module 100 can enable access to a first resource while isolating, segmenting or otherwise protecting a secondresource. Then, in response to a triggering event, the embedded module 100 can isolate, segment or protect the first resource, while enabling the second resource to be connected to and accessible over the external network.

[0063] CONCLUSION

[0064] Although examples are described in detail herein with reference to the accompanying drawings, it is to be understood that the concepts are not limited to those precise examples. Accordingly, it is intended that the scope of the concepts be defined by the following claims and their equivalents. Furthermore, it is contemplated that a particular feature described either individually or as part of an example can be combined with other individually described features, or parts of other examples, even if the other features and examples make no mentioned of the particular feature. Thus, the absence of describing combinations should not preclude having rights to such combinations.

Claims

WHAT IS CLAIMED IS:

1. An embedded module comprising: a signal processing component, coupled via an input signal line, to a mechanically actuatable trigger, the signal processing component being configured to generate a control signal when an electrical characteristic or attribute of a signal on the input signal line meets a predetermined condition; and an airgap switching mechanism coupled to the signal processing component, the control signal causing the airgap switching mechanism to change its switch state as between an open state and a closed state, wherein in the closed state, the airgap switching mechanism interconnects a first signal line to a second signal line, to interconnect a resource, and wherein the open state, the airgap switching mechanism physically separates the first signal line and the second signal line, so that the resource is isolated.

2. The embedded module of claim 1, wherein the signal processing component and the airgap switching mechanism are hardware components.

3. The embedded module of any preceding claim, wherein the signal processing component includes a voltage filter to filter a voltage signal on the input signal line, the voltage filter providing the control signal for the airgap switching mechanism when a voltage level on the input signal line is within a predetermined threshold level or range.

4. The embedded module of any preceding claim, wherein the signal processing component includes a signal detector to filter a signal of the input signal line for a signal characteristic that is characteristic of a corresponding trigger mechanism being actuated.

5. The embedded module of any preceding claim, wherein the signal processing component includes an optical isolator.

6. A network control system for controlling a networked system, the network control system including an embedded module in accordance with any of claims 1 through 5.

7. A method for controlling a networked system, the method comprising: detecting when an electrical characteristic of an input signal meets a predetermined condition; and in response to determining that the electrical characteristic of the input signal meets the predetermined condition, causing an airgap mechanism to change its state, wherein the airgap switching mechanism interconnects a first signal line to a second signal line when the airgap switching mechanism is in a closed switch state.

8. The method of claim 7, wherein detecting the electrical characteristic includes detecting when a voltage level of the input signal meets a threshold level or range.

9. The method of claim 8, wherein detecting the electrical characteristic includes detecting when the voltage level of the input signal meets the threshold level or range.

10. The method of claim 9, wherein said detecting is performed using a voltage filter.

11. The method of claim 9 or claim 10, wherein said detecting is performed using an optical isolator.

12. An embedded module configured to implement a method for controlling a network system, as described with any of claims 7 through 11.

13. A network control system configured to implement a method for controlling a networked system, as described with any of claims 7 through

Images