Security system for industrial control infrastructure using dynamic signatures

Patent metadata

Field	Value
Publication number	US-10042354-B2
Application number	US-201514728180-A
Country	US
Kind code	B2
Filing date	Jun 2, 2015
Priority date	Jun 2, 2015
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

An industrial control system hardened against malicious activity monitors highly dynamic control data to develop a dynamic thumbprint that can be evaluated to detect deviations from normal behavior of a type that suggest tampering or other attacks. Evaluation of the dynamic thumbprint may employ a set of ranges defining normal operation and reflecting known patterns of interrelationship between dynamic variables.

First claim

We claim:

1. An industrial control system comprising multiple inter-communicating industrial control devices coordinated according to a control program, the industrial control system comprising:
I. multiple control devices, each control device providing a direct interface to an element of an industrial process, each control device including:
(a) a device network port communicating with other elements of the industrial control system through an industrial control network;
(b) electrical connectors comprising screw terminals accepting electrical conductors communicating with industrial equipment to transmit electrical signals to that industrial equipment to control the industrial process and receive electrical signals from that industrial equipment, wherein the electrical signals are transmitted and received through the screw terminals, and wherein at least one control device provides an electrical signal controlling power applied to an electric motor;
(c) a control device processor communicating with the device network port and electrical connectors;
(d) a device electronic memory system accessible by the control device processor and holding: operating software describing operation of a control device, a data table holding representations of the electrical signals of the electrical connectors, a diagnostic program providing outputs monitoring the operation of the control device; the data table and the outputs of the diagnostic program together defining a dynamic device state, wherein the dynamic device state includes a digital signature allowing detection of tampering, and wherein the operating software is executable by the control device processor to:
(i) read at least a portion of the dynamic device state to generate a dynamic signature;
(ii) encrypt the dynamic signature; and
(iii) transmit the dynamic signature over the network port with context data relating to a common control task associated with a plurality of control devices of the industrial control system for linking the dynamic signature with a dynamic signature of another control device based on the common control task, wherein a hierarchy of context envelop collects and encapsulates a plurality of dynamic signatures of the plurality of control devices together as relating to the common control task; and

II. a security controller providing:
(a) a controller network port communicating with other elements of the industrial control system through an industrial control network;
(b) a security controller processor communicating with the controller network port; and
(c) a controller electronic memory system accessible by the security controller processor and holding: a security program;

wherein the security program is executable by the security controller processor to:
(i) receive the context envelope comprising linked dynamic signatures from the plurality of control devices through the network port and decrypt the dynamic signatures;
(ii) analyze the dynamic signatures against rules establishing a multi-value range of acceptable dynamic signature values; and
(iii) provide an output indicating whether each dynamic signature is outside the multi-value range of acceptable dynamic signature values, and
(iv) manage a thumbprint map that comprises, at least, hardware registers information of each of the plurality of control devices which is transmitted uncompressed to enable the security controller to detect any change of source data.

2. The industrial control system of claim 1 wherein the portion of the dynamic device state includes data indicating electrical signals of the electrical connectors.

3. The industrial control system of claim 1 wherein the security program executes to analyze the dynamic signatures against integrated rules relating to the combined dynamic signatures and establishing a multi-value range of acceptable dynamic signature values.

4. The industrial control system of claim 1 wherein each dynamic signature includes multiple time varying quantities and wherein the rules establish multi-value ranges for each quantity.

5. The industrial control system of claim 4 wherein the multi-value ranges vary as a function of other varying quantities.

6. Industrial control system of claim 5 wherein the multi-value ranges vary as a function of a random value.

7. The industrial control system of claim 5 wherein the rules are applied by a supervised machine learning system trained with each dynamic signatures from a properly operating industrial control system.

8. The industrial control system of claim 5 wherein the properly operating industrial control system is determined at least in part by historical operation of the industrial control system.

9. The industrial control system of claim 1 wherein the dynamic device state further includes at least one of a timestamp, a device identification number, and a changing random code.

10. The industrial control system of claim 1 wherein the operation of the control device is selected from the group consisting of: CPU utilization, free memory, and stack depth.

11. The industrial control system of claim 1 wherein rules are at least in part a function of calendar data indicating schedule changes in the industrial control system.

12. The industrial control system of claim 1 wherein the operation of the control device is selected from the group consisting of: port traffic over a predetermined interval and change in average port traffic.

13. The industrial control system of claim 1 wherein the device electronic memory system holds a transaction log recording individual access to the control device programs or settings and the diagnostic program analyzes the operating log for at least one of a pattern of access to settings of the control.

14. The industrial control system of claim 1 wherein the dynamic signature includes an operating mode of the control device selected from a run state indicating that the control device is running to execute a control program and a programming state indicating that the control device is being programmed with respect to a control program.

15. The industrial control system of claim 1 wherein a first control device produces a first dynamic signature and a second control device receives the first dynamic signature and produces a second dynamic signature based on a dynamic device state of the second control device and the first dynamic signature and transmits the second dynamic signature over a network port of the second control device.

16. The industrial control system of claim 15 wherein the second dynamic signature provides a lossy compression of the first dynamic signature.

17. The industrial control device of claim 1 wherein the operating software provides programming for operating the control device as at least one of an input module providing interface for communication from two-state electrical sensors providing a digital input, an input module providing interface for communications from sensors providing an analog signal, an output module providing an interface for communication to two-state actuators, and a motor drive for synthesizing voltage waveforms for controlling a motor.

18. The industrial control device of claim 1 wherein the industrial control network implements Common Industrial Protocol.

19. A method of establishing security in an industrial control system comprising multiple inter-communicating industrial control devices coordinated according to a control program, each control device providing a direct interface to an element of an industrial process, the method compris

Assignees

• Rockwell Automation Tech Inc

Inventors

• Chand Sujeet
• Vasko David A
• Boppre Timothy Patrick
• Snyder David A
• Nicoll Alex Laurence
• Mcmullen Brian J
• Seger Daniel B
• Dart John B

Classifications

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G05B19/4185 Primary

  characterised by the network communication · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title