Mission-critical communication links for industrial control systems

Patent metadata

Field	Value
Publication number	US-11374689-B2
Application number	US-202017081631-A
Country	US
Kind code	B2
Filing date	Oct 27, 2020
Priority date	Nov 17, 2015
Publication date	Jun 28, 2022
Grant date	Jun 28, 2022

Abstract

An industrial control system includes an encryption device, a decryption device and a mission-critical communication link connecting the encryption device to the decryption device. The encryption device is configured to send encrypted messages to the decryption device over the mission-critical communication link. The system includes a failure monitor configured to monitor for a failure of the encryption device or the decryption device, and, in the event of failure, to continue the sending of the messages to the decryption device but without encrypting the messages.

First claim

The invention claimed is:

1. An industrial control system for controlling industrial equipment, the control system comprising:
a first crypto device,
a second crypto device and
a mission-critical communication link connecting the first crypto device to the second crypto device,
at least one of the crypto devices being configured to send encrypted messages to the other of the crypto devices over the mission-critical communication link,

a failure monitor configured to monitor for a failure of at least one of the crypto devices, and, in the event of failure, to continue the sending of the messages but without encryption to ensure continued functioning of the mission-critical communication link and control of the industrial equipment,
wherein the failure monitor includes a relay switch arrangement having an energized position and a default de-energized position, wherein in normal operation, the relay switch arrangement remains in the energized position such that messages are relayed via an encryption and/or decryption module in the at least one crypto device, and
wherein in the event of a failure, the relay switch arrangement switches to the de-energized position to bypass the encryption and/or decryption module.

2. The system as claimed in claim 1 , wherein the second crypto device is one of a plurality of controlled crypto devices, and the system further comprises a plurality of items of controlled industrial equipment, each controlled crypto device associated with one or the plurality of items of controlled industrial equipment.

3. The system as claimed in claim 1 , wherein the failure monitor is configured to send messages to a controlling computer while no failure is detected and to stop sending the messages when the failure of at least one of the crypto devices is detected or the failure monitor is configured to send, in the event of the failure, a message to the controlling computer to report the failure.

4. The system as claimed in claim 2 , wherein the first crypto device is a controlling crypto device, and wherein there is a separate mission-critical communication link between the controlling crypto device and each of the controlled crypto devices.

5. The system as claimed in claim 2 , further comprising a PLC or RTU between each controlled crypto device and associated item of controlled equipment.

6. The system as claimed in claim 1 , wherein there is encryption of messages sent in both directions between the controlling crypto device and the controlled crypto devices.

7. The system as claimed in claim 1 , wherein at least one of the crypto devices comprises an input port, through which incoming messages pass, and an output port, through which outgoing encrypted messages pass, and further comprising:
(i) an encryption module connected to receive plaintext from the input port and apply an encryption algorithm to the plaintext messages, and to supply resultant cyphertext messages to the output port; or
(ii) a decryption module connected to receive cyphertext messages from the input port and apply a decryption algorithm to the cyphertext messages, and to supply resultant plaintext messages to the output port; or
(iii) both.

8. The system as claimed in claim 7 , wherein the monitoring is for failure of the encryption module or decryption module, or for loss of power.

9. The system as claimed in claim 7 , wherein, in the event of the failure, the failure monitor connects the input port to the output port so that the encryption and/or decryption module is bypassed.

10. The system as claimed in claim 9 , wherein the failure monitor includes a bypass switch arrangement and the failure monitor bypasses the encryption and/or decryption module by connecting the input port to the output port by switching the bypass switch arrangement.

11. The system as claimed in claim 10 , wherein the bypass switch arrangement comprises the relay switch.

12. The system as claimed in claim 11 , wherein the relay switch is arranged so that, when powered normally, it is in a powered state in which it connects the input port to the output port via the encryption and/or decryption module and, on loss of power, the relay switch defaults to an unpowered state in which it connects the input port to the output port while bypassing the encryption and/or decryption module.

13. The system as claimed in claim 1 , wherein at least one of the crypto devices is configured to send messages, confirming that it is functioning correctly, to the other crypto device.

14. The system as claimed in claim 1 , wherein the first crypto device comprises a microprocessor and a configurable logic device.

15. The system as claimed in claim 1 , wherein the failure monitor is included in the first crypto device or the second crypto device.

16. The system as claimed in claim 15 , wherein both the first crypto device and the second crypto device include a failure monitor.

17. The industrial control system of claim 1 , wherein the failure comprises a power loss, or a failure of a field programmable gate array in at least one of the crypto devices, or a failure of a processor in at least one of the crypto devices, or a failure of a programmable logic controller in at least one of the crypto devices.

18. A method of operating an industrial control system for controlling industrial equipment, the method comprising:
sending encrypted messages over a mission-critical communication link,
monitoring for a system failure with a failure monitor, and,
in the event of a system failure being detected by the failure monitor, continuing to send messages, but sending the messages as unencrypted messages to ensure continued functioning of the mission-critical communication link and control of the industrial equipment,
wherein the failure monitor includes a relay switch arrangement having an energized position and a default de-energized position, wherein in normal operation, the relay switch arrangement remains in the energized position such that messages are relayed via an encryption and/or decryption module in the at least one crypto device, and
wherein in the event of a failure, the relay switch arrangement switches to the de-energized position to bypass the encryption and/or decryption module.

19. An industrial control system comprising:
a controller associated with a first crypto device,
a plurality of items of controlled equipment, each associated with a second crypto device, and
a mission-critical communication link connecting the first crypto device to the second crypto device,
at least one of the crypto devices being configured to send encrypted messages to the other of the crypto devices over the mission-critical communication link,

a failure monitor configured to monitor for a failure of at least one of the crypto devices, and, in the event of failure, to continue the sending of the messages but without encryption,
wherein the failure monitor includes a relay switch arrangement having an energized position and a default de-energized position, wherein in normal operation, the relay switch arrangement remains in the energized position such that messages are relayed via an encryption and/or decryption module in the at least one of the crypto devices, and
wherein in the event of a failure, the relay switch arrangement switches to the de-energized position to bypass the encryption and/or decryption module.

Assignees

• Airbus Defence & Space Ltd

Inventors

• James Ray
• Travis Keith
• Williams Stephen
• Jones Kevin

Classifications

• G06F11/0739 Primary

  in a data processing system embedded in automotive or aircraft systems · CPC title

• G06F11/0793 Primary

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title