PLC Ladder Logic Translation for SMT-Based Security Checking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial networks, particularly those utilizing Programmable Logic Controllers (PLCs), are vulnerable to attacks due to the difficulty in detecting malicious code injected as 'Ladder Logic Bombs,' which can disrupt normal operations or cause harm by altering behavior persistently or upon trigger signals, as seen in incidents like the 2017 Saudi Arabian petrochemical plant malware Triton. Existing methods for translating PLC programs into formal models focus on timer blocks and automata diagrams, lacking accuracy in SMT-based model checking.
Innovation Solution
A method for automatic translation of ladder logic to a SMT-based model checker, which involves defining network topology, extracting PLC programs, identifying inputs, outputs, and variables, and translating these into a predefined formal model, specifically using the Intrepid Model Checker to analyze PLC programs for potential security violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing translation methods focusing on timer blocks and automata diagrams are used, then translation coverage is achieved, but translation accuracy to SMT-based model checker is insufficient
Solution Approach 1:
The patent replaces traditional automata diagram-based translation mechanisms with a direct SMT-based formal verification approach. Instead of using complex intermediate representations like timed automata and CTL model checking, the invention directly translates ladder logic into SMT (Satisfiability Modulo Theories) formulas, substituting the mechanical translation pipeline with a more direct logical formalization that achieves higher accuracy.
Solution Approach 2:
The invention changes the fundamental parameters of the translation process by shifting from approximate semantic mapping to precise logical encoding. It transforms the translation target from general model checkers to specifically SMT-based model checkers, changing the theoretical foundation and parameter space of the verification process to achieve superior translation accuracy.
2Difficulty of detecting and measuring
If automated detection tools are implemented, then security threat detection capability is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary translation layer that converts ladder logic into SMT formulas, which then serve as the basis for automated verification. This intermediary formal representation acts as a bridge between the PLC programming domain and the security verification domain, enabling automated detection without requiring complex direct analysis tools.
Solution Approach 2:
The invention creates a formal copy or model of the ladder logic program in SMT notation. This copied representation preserves the logical structure and semantics of the original program while enabling automated security property verification through SMT solvers, thus detecting malicious code without directly analyzing the original complex ladder logic.
3Reliability
If formal model translation is performed, then security verification capability is improved, but translation time and computational resources increase
Solution Approach 1:
The patent performs preliminary translation of ladder logic into SMT formulas before actual security verification takes place. This preliminary formalization step prepares the program in advance for efficient verification, allowing security properties to be checked systematically without repeated parsing and analysis during the verification process.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The present invention relates to a method for automatic translation of ladder logic to a SMT-based model checker in a network comprising defining (10) the topology of the network as an enriched network topology based on packets exchanged in the network, extracting (20) a program from the packets relating to a PLC in the network and identifying inputs, outputs, variables and a ladder diagram of the PLC, translating (30) the inputs, outputs, variables and ladder diagram into a predefined formal model, wherein the predefined formal model is a circuit-like SMT-based model checker, and wherein the translating (30) comprises translating the set of data types of the program according to a predefined model set of data types of the circuit-like SMT-based model checker, translating the inputs of the PLC as model inputs of the circuit-like SMT-based model checker of the same type, translating the outputs of the PLC as model output latches of the circuit-like SMT-based model checker of the same type, translating the variables of the PLC as model variable latches of the circuit-like SMT-based model checker of the same type, translating comparators and arithmetic operators of the ladder diagram into a plurality of predefined model functions of the circuit-like SMT-based model checker, translating contacts and coils of the ladder diagram according to predefined model recursive procedures relating to the predefined model set of data types, the model inputs, the model output latches, the model variable latches and the plurality of predefined model functions, wherein the contacts are switches that can block or allow the flow of the current in a connection and each of the contacts is controlled by a Boolean input or variable, and wherein the coils are assignments to Boolean variables.