BAS Network Monitoring for Anomaly Detection and Access Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures for building automation systems are inadequate in protecting against malicious attacks, making them vulnerable to unauthorized access and potential disruptions.
Innovation Solution
A network monitor system that includes a server configured to monitor and analyze network communications within a building automation system, performing geo-location-based assessments and security evaluations of incoming traffic to identify and mitigate potential threats, ensuring only authorized devices can access the network, and regulating communication protocols to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If commonly available network security is used, then basic protection is provided, but the system remains vulnerable to malicious attacks and unauthorized access
Solution Approach 1:
The system performs preliminary actions by monitoring and assessing incoming network communications before they can cause harm. The server evaluates each incoming communication's origin, destination, and content characteristics in advance, establishing a security assessment before the communication is fully processed by the BAS devices. This proactive approach allows the system to prepare defensive responses before actual attacks occur.
Solution Approach 2:
The patent introduces an intermediary security assessment layer between the external network and the building automation system devices. This intermediary server acts as a mediator that intercepts, evaluates, and filters incoming communications based on security criteria before they reach the target BAS devices. The server mediates the interaction by determining whether communications should be allowed, blocked, or flagged for further analysis.
2Measurement precision
If comprehensive network monitoring and assessment is implemented, then security detection capability is improved, but system complexity increases
Solution Approach 1:
The security monitoring system is segmented into distinct functional modules: a communication monitoring component that captures network traffic, an assessment component that evaluates communications against security criteria, and a response component that takes action based on assessment results. This segmentation allows each module to specialize in specific tasks, improving detection precision while managing complexity through modular design.
Solution Approach 2:
The server implementing the network monitor performs multiple functions within a single system: it monitors communications, assesses security risks, determines geo-location information, evaluates destination devices, and coordinates defensive responses. This multi-functionality consolidates what could be multiple separate systems into one unified platform, improving detection capabilities without proportionally increasing overall system complexity.
Data Source
AI summary
A network monitor or method provide network security specific to equipment of a building automation system (BAS) and server assessment of network communication directed thereto. A server couples to a building management network of the building automation system. The server monitors communication that is on the building management network, and determines whether such communication is directed to specific devices of the building automation system. The server determines a security assessment, a security-centric assessment, and/or a geo-location-based server assessment of a server that originated the incoming communication directed to specific device(s) of the building automation system.