Automated discovery of security policy from design data

Patent metadata

Field	Value
Publication number	US-11212322-B2
Application number	US-201816156305-A
Country	US
Kind code	B2
Filing date	Oct 10, 2018
Priority date	Oct 10, 2018
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

An industrial security policy configuration system generates and implements security policies for industrial automation systems based on design data for the industrial systems generated by device manufacturers, system integrators, original equipment manufacturers, or the owners of the industrial assets during the design of the industrial systems. the collected design data to a security rule set defining device-level communication privileges. The system translates the collected design data to a security rule set defining device-level communication privileges, which are then translated to a comprehensive set of security policies customized to the requirements of the industrial systems represented by the design data. By leveraging the rich set of available design data to identify or infer security requirements and generate suitable security configurations, the system can mitigate the need to manually configure security policies based on human judgments regarding normal and abnormal network traffic.

First claim

What is claimed is:

1. A system for configuring security in an industrial environment, comprising:
a memory that stores executable components;
one or more processors, operatively coupled to the memory, that execute the executable components, the executable components comprising:
a design data discovery component configured to read design data from one or more industrial control project development platforms, wherein the design data is generated in connection with design of an industrial control system;
a model builder component configured to identify devices of the industrial control system, physical network connections between the devices, and communication paths between pairs of the devices based on analysis of the design data, and to generate model data representing the devices, the physical network connections, and the communication paths;
a policy translation component configured to:
translate the model data to security rules consisting of permitted network communications between pairs of the devices, and
translate the security rules to device-specific configuration instructions or security parameter settings in a format executable by respective devices; and

a device interface component configured to send the device-specific configuration instructions or security parameter settings to the respective devices to implement a network security policy defined by the security rules.

2. The system of claim 1 , wherein the design data comprises at least one of an industrial controller program file, controller I/O configuration data, a human-machine interface application, configuration data for an industrial device, hardware diagram data, or network architecture design data.

3. The system of claim 1 , wherein the model builder component is configured to identify the communication paths based at least on a subset of the design data comprising I/O module configuration data of an industrial controller, a read instruction of an industrial controller program, a write instruction of the industrial controller program, a global tag defined for the industrial controller, or communication setting data of one or more of the devices.

4. The system of claim 1 , wherein the model builder component is configured to identify, based on the design data, whether a communication path is a bi-directional communication path or a one-way communication path, and to record in the model data whether the communication path is the bi-directional communication path or the one-way communication path.

5. The system of claim 1 , wherein the device-specific configuration instructions or security parameter settings are executed on the respective devices to implement the network security policy defined by the security rules.

6. The system of claim 5 , wherein the device-specific configuration instructions or security parameter settings comprise at least one of a network address, a security zone participation setting, a security mode setting, a setting specifying a valid inbound connection, a setting specifying a valid outbound connection, enablement of a key-based or certificate-based security protocol, a whitelist identifying devices with which communication is permitted, a network router setting, a network switch setting, or identity of an authoritative policy source.

7. The system of claim 1 , further comprising a user interface component configured to render, on a graphical display interface, a nodal diagram representing the model data, wherein the nodal diagram comprises nodes representing the devices and lines between the nodes representing the physical network connections and the communication paths.

8. The system of claim 7 , wherein
the user interface component is further configured to receive, via interaction with the graphical display interface, modifications to at least one of the communication paths, and
the model builder component is configured to update the model data in accordance with the modification.

9. The system of claim 1 , wherein the security rules comprise communication restrictions indicating that communications between two devices are permitted when initiate by a specific device.

10. A method for configuring network security in an industrial environment, comprising:
reading, by a system comprising a processor, design data relating to an industrial automation system, wherein the design data is generated by an industrial control project development platform;
identifying, by the system based on an analysis of the design data, devices of the industrial automation system;
identifying, by the system based on the analysis of the design data, physical network connections between the devices;
identifying, by the system based on the analysis of the design data, communication paths between pairs of the devices based on analysis of the design data;
generating, by the system, model data representing the devices, the physical network connections, and the communication paths;
generating, by the system, security rules based on the model data, wherein the security rules consist of permitted network communications between pairs of the devices;
translating, by the system, the security rules to device-specific configuration instructions or security parameter settings in a format executable by respective devices;
sending, by the system, the device-specific configuration instructions or security parameter settings to the respective devices.

11. The method of claim 10 , wherein the reading the design data comprises reading at least one of an industrial controller program file, controller I/O configuration data, a human-machine interface application, configuration data for an industrial device, hardware diagram data, or network architecture design data.

12. The method of claim 10 , wherein the identifying the communication paths comprises identifying the communication paths based on I/O module configuration data of an industrial controller, a read instruction of an industrial controller program, a write instruction of the industrial controller program, a global tag defined for the industrial controller, or communication setting data of one or more of the devices.

13. The method of claim 10 , further comprising executing the device-specific configuration instructions or security parameter settings on the respective devices to implement the network security policy defined by the security rules.

14. The method of claim 13 , wherein the device-specific configuration instructions or security parameter settings comprise at least one of set a network address, a selected subset of the devices to a security zone, a security mode of one of the devices, a valid inbound connection for one of the devices, a valid outbound connection for one of the devices, a key-based or certificate-based security protocol for one of the devices, a whitelist identifying devices with which one of the devices is permitted to communication, a network router setting, a network switch setting, or an authoritative policy source.

15. The method of claim 10 , further comprising rendering, by the system on a client device, a nodal diagram representing the model data, wherein the nodal diagram comprises nodes representing the devices and lines between the nodes representing the physical network connections and the communication paths.

16. The method of claim 15 , further comprising:
receiving, by the system via interaction with the graphical display interface, modifications to at least one of the communication paths, and
updating, by the system, the model data in accordance with the modification.

17. The method of claim 10 , wherein the

Assignees

• Rockwell Automation Tech Inc
• Rockwelll Automation Tech Inc

Inventors

• Nicoll Alex L
• Crum Kyle
• Jasper Taryl J
• Bush Michael A
• Visoky Jack M

Classifications

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title