PLC Virtual Patching With Distributed Security Context Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial Control Systems (ICS) face challenges in security patching, requiring complete firmware updates and reboots, which can introduce new failures and vulnerabilities, and traditional patch management is manual and limited to network-level measures, increasing risk and cost in live production systems.
Innovation Solution
The implementation of virtual patching and automated distribution of security context information using a system with an industrial automation device, a distributed database, and a virtual patching engine security application that collects system information and applies virtual patches without reloading the software image, providing protection against vulnerabilities and potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual patch management is used, then patch compatibility testing can be performed, but productivity deteriorates due to long patch delays and manual processes
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing security contexts, attack signatures, and mitigation rules in a database before they are needed. When a vulnerability is detected, the system can quickly retrieve and apply the pre-prepared virtual patch without needing to perform time-consuming manual analysis or wait for complete firmware updates, thereby maintaining both compatibility and fast deployment.
Solution Approach 2:
The system enables self-service automated patch management where the PLC automatically receives, stores, and applies security contexts and virtual patches without manual intervention. The automated patch management system can independently manage the entire lifecycle from vulnerability detection to patch deployment, eliminating manual processes while maintaining compatibility through automated testing capabilities.
2Reliability
If external security controls are deployed at network level, then additional protection is provided, but device complexity increases and controls are limited to what can be done at network level
Solution Approach 1:
The patent merges security controls directly into the PLC by integrating the virtual patching engine, security context database, and attack signature storage within the PLC's own memory structures. This consolidation eliminates the need for separate external security devices while providing comprehensive protection that operates at both network and application levels, reducing overall system complexity while enhancing security capabilities.
Data Source
AI summary
A system for virtual patching of security vulnerabilities in an industrial production environment includes an industrial automation device (e.g., a PLC). The industrial automation device comprises an instance of a distributed database spanning a plurality of industrial automation devices and storing one or more virtual patches and an app container comprising a virtual patching engine security application. The app container is configured to collect system information generated by the industrial automation device during operation, and apply the one or more virtual patches to the system information to identify one or more security attacks.