Factory Control Client Integrity Checks With Server Lockout

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing client-server architectures in control systems of technical plants lack robust protection against code manipulation and fail to implement immediate sanctions and seamless rehabilitation, risking operational integrity and continuity.

Innovation Solution

A method involving asymmetric key pairs and cryptographic hash functions is employed to verify the integrity of code executed in clients, ensuring immediate detection and sanctioning of manipulation attempts, with clients being rehabilitated upon reconnection if integrity is restored.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If code is protected against manipulation through cryptographic verification, then system security and integrity are improved, but device complexity and operational overhead increase

Engineering Contradiction:
Improvecode integrityVSAvoidverification mechanism
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The server generates a cryptographic hash of the code and stores it beforehand before the client downloads the code. This preliminary action eliminates the need for the client to perform complex verification calculations, as the server has already prepared the verification data (hash value) that the client can simply compare against its own hash calculation.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The verification mechanism extracts only the essential element (cryptographic hash) from the complete code set. Instead of verifying the entire code on the client side, only the condensed hash value is transmitted and compared, dramatically reducing the computational burden and complexity on the client device while maintaining security.

Inventive Principle:
Principle #2Taking out (Extraction)

2Reliability

If manipulated code is detected and rejected immediately, then system security is improved, but operational continuity and availability deteriorate

Engineering Contradiction:
ImprovesecurityVSAvoidoperational continuity
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The system dynamically adjusts its response to detected manipulations based on the severity and context. Instead of always rejecting manipulated code, the system can apply graduated responses ranging from warnings to temporary suspensions to permanent bans, allowing operational continuity when manipulations are minor or unintentional while maintaining security against serious threats.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system implements a feedback mechanism where clients that are suspended or banned can request review, and the server can re-evaluate the situation. This feedback loop allows for correction of false positives and restoration of operational continuity when the manipulation detection was erroneous or the issue has been resolved.

Inventive Principle:
Principle #23Feedback

3Difficulty of detecting and measuring

If cryptographic verification is implemented for all code downloads, then manipulation detection capability is improved, but communication overhead and processing time increase

Engineering Contradiction:
Improvemanipulation detectionVSAvoidverification time
Core Design Contradiction:
Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

Instead of transmitting and verifying the complete code on the server side, the system creates a cryptographic copy (hash) of the code that is much smaller in size. This hash copy is what is actually transmitted and verified during downloads, reducing communication overhead and verification time while maintaining the ability to detect manipulation.

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The system changes the parameter being verified from the complete code (large data volume, long verification time) to a cryptographic hash of the code (small data volume, instant verification). This parameter transformation maintains the security property of manipulation detection while dramatically reducing the time and computational resources required.

Inventive Principle:
Principle #35Parameter changes

4Reliability

If clients are banned upon manipulation detection, then security enforcement is improved, but system availability and operational resilience worsen

Engineering Contradiction:
Improvesecurity enforcementVSAvoidclient availability
Core Design Contradiction:
ReliabilityVSDuration of action of stationary object

Solution Approach 1:

The suspension duration is dynamic rather than fixed. The system can impose temporary suspensions that automatically expire, or adjustable bans based on the severity of the manipulation. This allows the system to enforce security while automatically restoring availability when the threat has passed or was a false positive.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system implements appeal and review mechanisms in advance of permanent bans. Clients have the opportunity to contest suspensions and provide evidence of legitimate use before facing permanent exclusion. This cushioning mechanism prevents erroneous permanent bans and maintains client availability when appropriate.

Inventive Principle:
Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentEP3997857B1Detection of manipulated clients of a factory control system
Publication Date: 2026.01.14 SIEMENS AG
  • EP3997857B1 patent drawingFigure 1

AI summary

Proposed is a client-server architecture for a control system (1) of a technical installation, said client-server architecture comprising at least one first device, which is designed and provided as a client (4), and at least one second device, which is designed and provided as a server (2, 3) assigned to the client (4), and wherein: the client (4) is designed to establish a contact with the server (2, 3), and to receive and execute a code from the server (2, 3); communication from the client (4) to the control system (1) exists by means of the server (2, 3); the server (2, 3) is designed to detect whether the code, which the client (4) executes, corresponds to the code that the client (4) received from the server (2, 3); and the server (2, 3) is designed, in the event of the code not corresponding, to interrupt the execution of the code by the client (4) and to lock the client (4) out of communication with the control system (1).