Method and access unit for accessing industrial communication networks

Patent metadata

Field	Value
Publication number	US-11558279-B2
Application number	US-201916683366-A
Country	US
Kind code	B2
Filing date	Nov 14, 2019
Priority date	May 17, 2017
Publication date	Jan 17, 2023
Grant date	Jan 17, 2023

Abstract

A method and an access unit for accessing an industrial communication network are provided. An access unit has first ports connected to the communication network and at least one second port. The access unit is configured to pass data traffic between nodes of the communication network through the access unit in a first operational state of the access unit. The access unit is configured to pass data traffic to a test node via the at least one second port and/or allow test data to be injected into the communication network via the at least one second port in a second operational state of the access unit.

First claim

The invention claimed is:

1. A method of accessing an industrial communication network using an access unit, the access unit comprising a first component having first ports connected to the industrial communication network, and comprising at least one further component releasably connectable to the first component and having at least one second port, the method comprising:
passing data traffic between nodes of the industrial communication network through the access unit between the first ports of the access unit in a first operational state of the access unit in which no testing is performed, in which the at least one further component is disengaged from the first component, and in which the data traffic is passed between the first ports of the access unit through the access unit using only passive components, the passive components themselves not requiring a power supply to operate;
mechanically engaging the at least one further component to the first component to communicatively couple the at least one second port to the first ports, and to set the access unit to a second operational state: and
passing the data traffic to a test node from the first ports through the at least one second port of the access unit and/or allowing test data to be injected into the industrial communication network through the at least one second port of the access unit to the first ports, in the second operational state of the access unit, the at least one second port being connected to the test node.

2. The method of claim 1 , wherein the at least one further component comprises a second component having the at least one second port, the second component being connected to the first component in at least the second operational state of the access unit to pass the data traffic to the test node and/or to allow the test data to be injected into the industrial communication network via the at least one second port of the access unit.

3. The method of claim 2 , wherein the access unit comprises a third component, the third component being connected to the first component in the first operational state of the access unit to pass the data traffic between the nodes between the first ports of the access unit through the access unit.

4. The method of claim 1 , further comprising:
performing an authentication procedure when the at least one further component is connected to the first component to prevent unauthorized access to the industrial communication network.

5. The method of claim 4 , wherein the at least one further component comprises a second component having the at least one second port, the second component being connected to the first component in at least the second operational state of the access unit to pass the data traffic to the test node and/or to allow the test data to be injected into the industrial communication network via the at least one second port of the access unit.

6. The method of claim 5 , wherein the access unit comprises a third component, the third component being connected to the first component in the first operational state of the access unit to pass the data traffic between the nodes between the first ports of the access unit through the access unit.

7. The method of claim 1 , wherein the access unit comprises a third component, the third component being connected to the first component in the first operational state of the access unit to pass the data traffic between the nodes between the first ports of the access unit through the access unit.

8. The method of claim 1 , wherein the industrial communication network is a communication network in accordance with IEC 62439-3 or IEC 61850.

9. The method of claim 8 , further comprising: performing an authentication procedure when the at least one further component is connected to the first component to prevent unauthorized access to the industrial communication network.

10. An access unit for accessing an industrial communication network, the access unit comprising:
a first component having first ports configured to be connected to the industrial communication network, wherein the access unit is configured to pass data traffic between nodes of the industrial communication network through the access unit between the first ports of the access unit in a first testless operational state of the access unit using only passive components, the passive components themselves not requiring a power supply to operate; and
at least one further component having at least one second port configured to be connected to a test node, wherein the access unit is configured to pass the data traffic to the test node from the first ports through the at least one second port and/or allow test data to be injected into the industrial communication network through the at least one second port to the first ports, in a second operational state of the access unit, and wherein the at least one further component is releasably connectable to the first component to set the access unit to the first testless operational state when mechanically disengaged or to the second operational state when mechanically engaged to the first component.

11. The access unit of claim 10 , wherein the at least one further component comprises a second component configured to be connected to the first component in the second operational state of the access unit, the second component having the at least one second port to pass the data traffic to the test node and/or to allow the test data to be injected into the industrial communication network.

12. The access unit of claim 11 , wherein the at least one further component comprises a third component configured to be releasably connected to the first component in the first testless operational state of the access unit to enable the data traffic to pass between the first ports of the access unit through the access unit.

13. The access unit of claim 10 , wherein the first component includes a socket and the at least one further component includes a plug mating with the socket for connecting the at least one further component with the first component.

14. The access unit of claim 13 , wherein the at least one further component comprises a second component configured to be connected to the first component in the second operational state of the access unit, the second component having the at least one second port to pass the data traffic to the test node and/or to allow the test data to be injected into the industrial communication network.

15. The access unit of claim 10 , wherein the access unit comprises a splitter.

16. A kit for accessing the industrial communication network, the kit comprising:
the access unit of claim 10 ; and
the test node, configured to be connected to the access unit to analyse the data traffic between the nodes of the industrial communication network and/or to generate the test data for injection into the industrial communication network.

17. A digital substation, comprising:
a plurality of Intelligent Electronic Devices, IEDs;
a communication network to which the IEDs are coupled; and
the access unit of claim 10 coupled to the communication network, wherein the first ports of the access unit remain permanently connected to the communication network.

18. The access unit of claim 10 , wherein the at least one further component comprises a third component configured to be releasably connected to the first component in the first testless operational state of the access unit to enable the data traffic to pass between the first ports of the access unit through the access unit.

19.

Assignees

• Hitachi Energy Switzerland Ag
• Hitachi Energy Switzerland Ltd

Inventors

• Graber Dominique
• Obrist Michael
• Meier Stefan
• Gerspach Stephan
• Wimmer Wolfgang

Classifications

• G06F11/30

  Monitoring · CPC title

• Y04S40/00

  Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them · CPC title

• H04L2012/4026

  Bus for use in automation systems · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L43/50 Primary

  Testing arrangements · CPC title