Program Flow Monitoring for Secure Control Application Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face challenges in securely executing control applications due to vulnerabilities in program code, leading to potential false alarms and costly disruptions, as existing exploit protection concepts are not applicable and often result in unnecessary process interruptions.
Innovation Solution
A method is introduced where a program flow control device monitors deviations in control application sequences and triggers events, reporting them to a separate checking device for analysis using updatable test rules, allowing the system to transition into a safe operating state without immediate shutdown, enabling reliable protection from attacks and reducing false alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If exploit protection concepts are implemented in industrial automation systems, then security against code vulnerabilities is improved, but false alarms increase causing unnecessary process interruptions
Solution Approach 1:
A separate checking device is introduced as an intermediary between the program flow control device and the control application. This checking device independently analyzes events and determines whether they represent genuine threats or false alarms, preventing unnecessary process interruptions while maintaining security monitoring.
Solution Approach 2:
The system implements a feedback mechanism where the checking device receives events from the program flow control device, analyzes them using test rules, and provides decisions back to determine whether control components should be transferred to safe operating states. This feedback loop reduces false alarms by validating events before triggering security responses.
2Reliability
If immediate shutdown is triggered upon detecting potential code manipulation, then security response time is improved, but false alarms cause costly disruptions
Solution Approach 1:
The system performs preliminary analysis of potential security events by the checking device before triggering immediate shutdown actions. Events are first evaluated against test rules to determine their legitimacy, allowing the system to prepare security responses in advance without prematurely interrupting legitimate processes.
Solution Approach 2:
The system dynamically adjusts its security response based on the legitimacy assessment of each event. Rather than applying a static immediate shutdown rule, the system adapts its response - either transferring control components to safe operating states for genuine threats or allowing legitimate processes to continue - based on the checking device's analysis.
3Reliability
If existing exploit protection concepts are applied to control applications, then code vulnerability protection is improved, but adaptability to industrial automation constraints is worsened
Solution Approach 1:
The security monitoring function is segmented into two independent parts: the program flow control device that generates events and the separate checking device that analyzes them. This segmentation allows the security mechanism to operate independently from the control application execution, making it adaptable to industrial automation constraints without interfering with real-time control requirements.
Solution Approach 2:
The checking device serves as an intermediary layer between exploit protection concepts and industrial automation systems. It translates security events into appropriate industrial automation responses (safe operating states) and can be configured with test rules that adapt to specific industrial automation constraints and requirements.
Data Source
Figure 1
Figure 2
AI summary
At least one event is defined for at least one control application (113, 123), said event being triggered upon potential manipulation of program code associated with the control application and/or of at least one peripheral (510) that is connected to a program flow controller (101, 102) processing the program code. The program flow controller monitors a flow of the control application for deviations from an expected flow behaviour and triggers the defined event upon a deviation. Following triggering of the defined event, the program code is processed further by the program flow controller and the event is reported to an inspection device (300) separate from the program flow controller. The inspection device puts the control application and control components with an interdependency thereon into a predefined safe operating state upon detecting a flow behaviour of the control application that contravenes the inspection rules.