Factory Control Client Integrity Checks With Server Lockout
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing client-server architectures in control systems of technical plants lack robust protection against code manipulation and fail to implement immediate sanctions and seamless rehabilitation, risking operational integrity and continuity.
Innovation Solution
A method involving asymmetric key pairs and cryptographic hash functions is employed to verify the integrity of code executed in clients, ensuring immediate detection and sanctioning of manipulation attempts, with clients being rehabilitated upon reconnection if integrity is restored.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is protected against manipulation through cryptographic verification, then system security and integrity are improved, but device complexity and operational overhead increase
Solution Approach 1:
The server generates a cryptographic hash of the code and stores it beforehand before the client downloads the code. This preliminary action eliminates the need for the client to perform complex verification calculations, as the server has already prepared the verification data (hash value) that the client can simply compare against its own hash calculation.
Solution Approach 2:
The verification mechanism extracts only the essential element (cryptographic hash) from the complete code set. Instead of verifying the entire code on the client side, only the condensed hash value is transmitted and compared, dramatically reducing the computational burden and complexity on the client device while maintaining security.
2Reliability
If manipulated code is detected and rejected immediately, then system security is improved, but operational continuity and availability deteriorate
Solution Approach 1:
The system dynamically adjusts its response to detected manipulations based on the severity and context. Instead of always rejecting manipulated code, the system can apply graduated responses ranging from warnings to temporary suspensions to permanent bans, allowing operational continuity when manipulations are minor or unintentional while maintaining security against serious threats.
Solution Approach 2:
The system implements a feedback mechanism where clients that are suspended or banned can request review, and the server can re-evaluate the situation. This feedback loop allows for correction of false positives and restoration of operational continuity when the manipulation detection was erroneous or the issue has been resolved.
3Difficulty of detecting and measuring
If cryptographic verification is implemented for all code downloads, then manipulation detection capability is improved, but communication overhead and processing time increase
Solution Approach 1:
Instead of transmitting and verifying the complete code on the server side, the system creates a cryptographic copy (hash) of the code that is much smaller in size. This hash copy is what is actually transmitted and verified during downloads, reducing communication overhead and verification time while maintaining the ability to detect manipulation.
Solution Approach 2:
The system changes the parameter being verified from the complete code (large data volume, long verification time) to a cryptographic hash of the code (small data volume, instant verification). This parameter transformation maintains the security property of manipulation detection while dramatically reducing the time and computational resources required.
4Reliability
If clients are banned upon manipulation detection, then security enforcement is improved, but system availability and operational resilience worsen
Solution Approach 1:
The suspension duration is dynamic rather than fixed. The system can impose temporary suspensions that automatically expire, or adjustable bans based on the severity of the manipulation. This allows the system to enforce security while automatically restoring availability when the threat has passed or was a false positive.
Solution Approach 2:
The system implements appeal and review mechanisms in advance of permanent bans. Clients have the opportunity to contest suspensions and provide evidence of legitimate use before facing permanent exclusion. This cushioning mechanism prevents erroneous permanent bans and maintains client availability when appropriate.
Data Source
Figure 1
AI summary
Proposed is a client-server architecture for a control system (1) of a technical installation, said client-server architecture comprising at least one first device, which is designed and provided as a client (4), and at least one second device, which is designed and provided as a server (2, 3) assigned to the client (4), and wherein: the client (4) is designed to establish a contact with the server (2, 3), and to receive and execute a code from the server (2, 3); communication from the client (4) to the control system (1) exists by means of the server (2, 3); the server (2, 3) is designed to detect whether the code, which the client (4) executes, corresponds to the code that the client (4) received from the server (2, 3); and the server (2, 3) is designed, in the event of the code not corresponding, to interrupt the execution of the code by the client (4) and to lock the client (4) out of communication with the control system (1).