DCS Security Manager Bootstrap Protocol

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Industrial process control and automation systems are vulnerable to illicit access and use due to the use of commercial off-the-shelf (COTS) networking components, which lack secure communication mechanisms, leading to security challenges and potential network breaches.

Innovation Solution

The implementation of a method and apparatus that establishes multiple communication channels between DCS nodes and a security manager, including a non-secure and a secure channel, to receive security credentials and policies, allowing secure communication and transitioning to secure communication at a designated activation time, utilizing bootstrap protocol extensions and canned policies to maintain network availability and protect communications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If commercial off-the-shelf (COTS) networking components are used in DCS, then system cost and ease of operation are improved, but security vulnerability increases

Engineering Contradiction:
Improveease of operationVSAvoidsecurity vulnerability
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

A security manager is introduced as an intermediary component that mediates all security-related operations between DCS nodes and external entities. The security manager handles authentication, authorization, and security policy enforcement, isolating the vulnerability of COTS components while maintaining their ease of operation. The security manager acts as a protective layer that enables COTS components to be used without directly exposing the system to security risks.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Adaptability or versatility

If multiple communication channels (secure and non-secure) are established, then security flexibility is improved, but device complexity increases

Engineering Contradiction:
Improvesecurity flexibilityVSAvoiddevice complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The communication infrastructure is segmented into distinct secure and non-secure channels, each with specific purposes. The secure channel (using TLS/SSL) handles sensitive operations like authentication and security policy distribution, while the non-secure channel handles routine data exchange. This segmentation allows the system to maintain security flexibility by choosing appropriate channels for different operations, while the underlying complexity is managed by the security manager which abstracts the channel selection logic from individual DCS nodes.

Inventive Principle:
Principle #1Segmentation

3Ease of operation

If security credentials are transmitted over non-secure channel, then ease of operation is improved, but security risk increases

Engineering Contradiction:
Improveease of operationVSAvoidsecurity risk
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

Security credentials are transmitted over the non-secure channel only during the initial setup phase before the secure channel is established. The system performs preliminary authentication and credential distribution when the risk is acceptable (controlled environment), then immediately transitions to using the secure channel for all subsequent communications. This preliminary action allows easy initial configuration while mitigating long-term security risks through the subsequent establishment of encrypted communication paths.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3100404B1Apparatus and method for securing a distributed control system (DCS)
Publication Date: 2019.06.19 HONEYWELL INTERNATIONAL INC
  • EP3100404B1 patent drawingFigure 1
  • EP3100404B1 patent drawingFigure 2~5
  • EP3100404B1 patent drawingFigure 3

AI summary

A method includes receiving (304), at a first distributed control system (DCS) node (202) over a network, information associated with a security manager (208). The method also includes establishing (306, 310) multiple communication channels between the first DCS node and the security manager over the network using the information, where the communication channels include a non-secure channel and a secure channel. The method further includes receiving (308) security credentials from the security manager at the first DCS node over the non-secure channel and receiving (312) a security policy and an activation time from the security manager at the first DCS node over the secure channel. In addition, the method includes transitioning (316) the first DCS node to communicate with a second DCS node over the network using the security policy at the activation time.