OT Network Monitoring for Rule-Based Data Blocking

The patent introduces a monitoring device as an intermediary component positioned between the network and OT devices. This monitoring device intercepts data packets, applies rules to determine whether to forward or block them, and thereby protects OT devices from undesirable data while maintaining legitimate communication flexibility. The intermediary resolves the contradiction by filtering data based on predefined criteria rather than allowing unrestricted transmission.

The patent implements preliminary action by establishing a comprehensive set of rules before the monitoring device begins operation. These rules predefine conditions for forwarding or blocking data packets based on OT device identifiers, data characteristics, and communication patterns. By preparing the rule set in advance, the system achieves effective protection without requiring complex real-time analysis, thereby reducing operational complexity while maintaining high security.

The monitoring device creates a copy of incoming data packets for inspection against the rule set, while the original packet remains intact for rapid forwarding. This copying approach allows the system to perform thorough filtering analysis on the duplicate without delaying the processing of the original packet. When a packet matches forwarding criteria, the original can be transmitted immediately, minimizing latency while still achieving effective filtering through the copied packet analysis.