One-way coupling device, request apparatus and method for feedback-free transmission of data

Patent metadata

Field	Value
Publication number	US-11223657-B2
Application number	US-201615559524-A
Country	US
Kind code	B2
Filing date	Mar 18, 2016
Priority date	Mar 31, 2015
Publication date	Jan 11, 2022
Grant date	Jan 11, 2022

Abstract

A one-way coupling device for the feedback-free transmission of data from the first network with high security requirements into a second network with low security requirements, containing a request unit, an eavesdropping unit and a receiving unit, wherein the request unit is formed so as to provide a first communication link within the first network to at least one device and, moreover, to request first data from the at least one device and then to transmit the first data via a second communication link on a separate line loop of the request unit, and the eavesdropping unit, which is formed so as to eavesdrop on data on the separate line loop and to transmit data to a receiving unit which is arranged in the second network. Also, a corresponding request unit, a corresponding method and a corresponding computer program product is also provided.

First claim

The invention claimed is:

1. A one-way coupling device for feedback-free transmission of data from a first network with high security requirements into a second network with low security requirements, comprising at least one processor and a memory device, the at least one processor configured to provide: a request apparatus; a monitoring apparatus; and a receiver apparatus; wherein the request apparatus is designed to make available a first communication connection within the first network to at least one device, and to request first data from the at least one device via the first communication connection, and subsequently to transmit the first data via a second communication connection on a separate line loop from an interrogation interface of the request apparatus directly to an input interface of the request apparatus, wherein the separate line loop is contained only within the first network; wherein the monitoring apparatus is designed to monitor data on the separate line loop and to transfer the data to the receiver apparatus arranged in the second network to ensure a one-way transmission of data from the first network to the second network;
wherein the request apparatus has a first protocol unit for making available a first communication protocol for the first communication connection to the at least one device; and
wherein the request apparatus has a second protocol unit for making available a second communication protocol for transmittinq the first data via the separate line loop.

2. The one-way coupling system as claimed in claim 1 , wherein the first communication protocol being the Open Platform Communication Unified Architecture (OPC UA) protocol.

3. The one-way coupling system as claimed in claim 1 , wherein the request apparatus has a conversion unit for converting a format for the first data.

4. The one-way coupling system as claimed in claim 1 , wherein the request apparatus has a memory unit for storing the first data.

5. The one-way coupling system as claimed in claim 1 , wherein the monitoring apparatus is a data copier.

6. A request apparatus for a one-way coupling device for feedback-free transmission of first data from at least one device in a first network, the request apparatus designed to make available a first communication connection within the first network to the at least one device, and to request the first data from the at least one device via the first communication connection, and subsequently to transmit the first data via a second communication connection on a separate line loop, running outside the request apparatus, from an output interface of the request apparatus directly to an input interface of the request apparatus;
wherein a first communication protocol is used for the first communication connection to the at least one device, and a second communication protocol is used for transmitting the first data via the separate line loop.

7. A method for feedback-free transmission of data from a first network with high security requirements into a second network with low security requirements, the method comprising: providing a first communication connection within the first network; requesting and receiving the first data from at least one device in the first network via the first communication connection; transmitting the first data in a second communication connection via a separate line loop from an output interface of the request apparatus directly to an input interface within the first network, wherein the separate line loop is contained only within the first network; monitoring the first data on the separate line loop to ensure a one-way transmission of data from the first network to the second network; and transferring the first data to a second network with lower security requirements;
wherein a first communication protocol is used for the first communication connection to the at least one device, and a second communication protocol is used for transmitting the first data via the separate line loop.

8. The method as claimed in claim 7 , wherein the first communication protocol is an Open Platform Communication Unified Architecture (OPC UA) protocol.

9. The method as claimed in claim 7 , wherein a format of the first data is converted in the request apparatus, and/or the first data is stored in a memory unit.

10. The method as claimed in claim 7 , wherein the first data is transmitted in encrypted form on the first communication connection and is decrypted before the transmission on the connecting loop.

11. The method as claimed in claim 10 , wherein the data is transmitted in unencrypted form on the separate line loop.

12. The method as claimed in claim 10 , wherein the data for transmission on the separate line loop is transmitted in encrypted form.

13. The method as claimed in claim 7 , wherein the first data is stored in an evaluation database in the second network and is passed on in a retrievable or automatic fashion from the evaluation database to an evaluation apparatus.

14. A computer program product, comprising a computer readable hardware storage device having computer readable program code stored therein, the program code executable by a processor of a computer system to implement a method comprising: providing a first communication connection within the first network; requesting and receiving the first data from at least one device in the first network via the first communication connection; transmitting the first data in a second communication connection via a separate line loop from an output interface of the request apparatus directly to an input interface within the first network, wherein the separate line loop is contained only within the first network; monitoring the first data on the separate line loop to ensure a one-way transmission of data from the first network to a second network; and transferring the first data to the second network with lower security requirements;
wherein a first communication protocol is used for the first communication connection to the at least one device, and a second communication protocol is used for transmitting the first data via the separate line loop.

Assignees

• Siemens Ag

Inventors

• Blöcher Uwe
• Falk Rainer
• Reinert Jens
• Tang Wen
• Wimmer Martin

Classifications

• H04L63/02 Primary

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/0281

  Proxies · CPC title

• G06F21/6236

  between heterogeneous systems · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L63/306 Primary

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title