PLC Security Failover for Malicious Control Logic Revisions

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional security solutions for industrial control systems are inadequate in addressing cyberattacks, particularly in open and dynamic production cell networks with increased risks from IoT devices, as they rely on perimeter protection mechanisms that are insufficient against internal threats and interactions with external devices.

Innovation Solution

Implementing security failover procedures within the control layer of industrial production environments, using programmable logic controllers (PLCs) to detect malicious revisions in function blocks or data blocks by verifying digital signatures and switching to revised replicas or alternative network sessions to minimize the impact of cyberattacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If perimeter protection mechanisms (firewalls/VPN) are used to secure production cell networks, then external security threats are blocked, but internal threats and attacks from connected devices (IoT, mobile devices) cannot be addressed

Engineering Contradiction:
Improveexternal security threatsVSAvoidprotection against internal threats
Core Design Contradiction:
Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The patent divides the control system into multiple independent control layers (control layer, automation layer, enterprise layer) with separate security mechanisms for each. The control layer implements its own security failover procedures independent of the automation layer, creating segmented security zones that can independently respond to threats from any source (external or internal).

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces a security failover mechanism as an intermediary layer between the control system and potential threats. This failover mechanism acts as a mediator that can detect malicious revisions and switch to backup control logic, providing protection against both external and internal threats without compromising the open architecture needed for IoT device integration.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Adaptability or versatility

If control systems exchange data with external devices (IoT, smart devices) in open networks, then system functionality and data collection are enhanced, but security risks from malicious revisions increase

Engineering Contradiction:
Improvedata exchange capabilityVSAvoidsecurity against malicious revision
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements preliminary security actions by continuously monitoring control logic for malicious revisions before they can execute harmful operations. The system performs proactive integrity checks and maintains ready-to-switch backup control logic, enabling it to detect and respond to threats before they compromise system reliability, while still allowing open data exchange with IoT devices.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent establishes feedback mechanisms where the control system continuously monitors its own control logic for signs of malicious revision. When anomalies are detected, the system provides feedback by switching to backup control logic and can communicate threat status to higher layers. This closed-loop feedback enables real-time security responses without restricting data exchange capabilities.

Inventive Principle:
Principle #23Feedback

3Reliability

If security failover procedures are implemented at the control layer, then system resilience against cyberattacks is improved, but system complexity increases

Engineering Contradiction:
Improvesystem resilienceVSAvoidsecurity failover mechanism
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements security failover by creating backup copies of control logic at the control layer. When malicious revision is detected in the primary control logic, the system switches to a pre-stored copy of the legitimate control logic. This copying approach provides resilience against cyberattacks without requiring complex real-time verification mechanisms, as the backup copies are prepared in advance.

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The patent employs a security approach where temporary or disposable backup control logic can be rapidly deployed when threats are detected. Rather than maintaining permanently active complex security infrastructure, the system can activate pre-prepared backup control versions only when needed, reducing ongoing system complexity while maintaining high resilience.

Inventive Principle:
Principle #27Cheap short-living objects (Disposable)

Data Source

PatentEP3497570B1Cyberattack-resilient control system design
Publication Date: 2024.01.03 SIEMENS AG
  • EP3497570B1 patent drawingFigure 1
  • EP3497570B1 patent drawingFigure 2A~2B
  • EP3497570B1 patent drawingFigure 3

AI summary

A method for performing security failover in an industrial production environment includes a programmable logic controller (PLC) receiving notification that a function block (FB) or a function (FC) on the programmable logic controller has been maliciously revised. The PLC next determines whether the function block or the function is also maliciously revised on a failover computing device. If the failover computing device is not maliciously revised, a failover operation is performed by the PLC. This operation includes sending a data block comprising one or more input parameters to the function block or the function and receiving an output data resulting from executing the function block or the function with the data block on the failover computing device.