Industrial Controller Whitelisting for Executable File Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems face challenges in verifying the authenticity and integrity of executable files before execution, particularly in ensuring that files are from trustworthy sources and have not been altered during transmission, while requiring efficient verification to avoid disrupting system operations.
Innovation Solution
A whitelisting system using hash key values, where a secure whitelist file containing hash key values for authorized executable files is provided, allowing the industrial controller to verify the identity and contents of files using algorithms like CRC, MD, or SHA before execution, and blocking unauthorized files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file execution control is used in industrial control systems, then system operation is simple and fast, but security against unauthorized or altered executable files is insufficient
Solution Approach 1:
The system performs preliminary verification of executable files by computing hash values and comparing them against stored reference hash values before execution. This preliminary action ensures that only authorized and unaltered files are executed, preventing security breaches while maintaining simple operational procedures during normal system operation.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that acts as a mediator between the executable file and the industrial controller. The verification process uses hash value comparison as an intermediary check to determine whether to allow execution, providing security without requiring complex access control lists or digital signature verification systems.
2Reliability
If comprehensive security verification is performed on all executable files, then security is improved, but system operation speed and efficiency deteriorate
Solution Approach 1:
The system extracts only the essential verification element (hash value comparison) from complex security verification processes. By computing a hash value of the executable file and comparing it against a stored reference hash value, the system achieves effective security verification with minimal processing overhead, maintaining fast system operation speed while ensuring file integrity and authorization.
Solution Approach 2:
The verification process uses computationally inexpensive hash functions that can be executed rapidly with minimal resource consumption. The hash value computation and comparison are designed to be lightweight operations that do not significantly impact system performance, allowing frequent verification without sacrificing productivity.
3Measurement precision
If detailed verification of executable file contents is performed, then measurement precision of file integrity is improved, but resource usage increases
Solution Approach 1:
The patent replaces complex mechanical or computational verification mechanisms with a mathematical hash function-based verification system. By substituting detailed content analysis with hash value comparison, the system achieves high measurement precision for file integrity verification while consuming minimal processor and memory resources. The hash function provides a deterministic and accurate method for detecting any alteration to the executable file contents.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A system 10 includes a controller 12 configured to control a process, and store at least one binary file, wherein the at least one binary files is generated from at least one source file, wherein the at least one source file comprises instructions configured to be executed by a processor in the controller 12. The controller 12 may also be configured to retrieve a whitelist file comprising a first hash key value derived from the at least one binary file, and execute an executable file based on the whitelist file, wherein the executable file comprises the source file.