Industrial asset cyber-attack detection algorithm verification using secure, distributed ledger

Patent metadata

Field	Value
Publication number	US-2020137090-A1
Application number	US-201816176293-A
Country	US
Kind code	A1
Filing date	Oct 31, 2018
Priority date	Oct 31, 2018
Publication date	Apr 30, 2020
Grant date	—

Abstract

A verification platform may include a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data. The verification platform may store the subset into a data store (the subset of industrial asset cyber-attack detection algorithm data being marked as invalid) and record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger. The verification platform may then receive a transaction identifier from the secure, distributed ledger and mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

First claim

1 . A system to facilitate industrial asset cyber-attack detection algorithm verification, comprising:
a verification platform, including:
a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data, and
at least one verification platform computer processor coupled to the data connection and adapted to:
store the subset of industrial asset cyber-attack detection algorithm data into a data store, the subset of industrial asset cyber-attack detection algorithm data being marked as invalid,
record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger,
receive a transaction identifier from the secure, distributed ledger, and
mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

2 . The system of claim 1 , wherein the industrial asset cyber-attack detection algorithm data includes at least one feature-based classification boundary.

3 . The system of claim 1 , wherein the data connection is further to receive a stream of industrial asset data, including a subset of the industrial asset data, from industrial asset sensors, and
the verification platform computer is further adapted to:
store the subset of industrial asset data into the data store, the subset of industrial asset data being marked as invalid,
record a hash value associated with a compressed representation of the subset of industrial asset data combined with metadata in the secure, distributed ledger,
receive a transaction identifier from the secure, distributed ledger, and
mark the subset of industrial asset data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset data combined with metadata.

4 . The system of claim 3 , wherein the industrial asset sensors are associated with at least one of: (i) an engine, (ii) an aircraft, (iii) a locomotive, (iv) power generation, and (v) a wind turbine.

5 . The system of claim 1 , further comprising:
the data store, wherein the data store is adapted to provide information marked as being valid to a consuming platform.

6 . The system of claim 1 , wherein the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata comprises a trie.

7 . The system of claim 6 , wherein the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata comprises a Patricia-Merkle trie.

8 . The system of claim 1 , wherein the metadata includes at least one of: (i) a pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

9 . The system of claim 1 , wherein the verification platform is associated with at least one of: (i) a single network cloud-hosted topology, (ii) a multiple network cloud-hosted topology, and (iii) a participant hosted intranet environment.

10 . The system of claim 1 , wherein the secure, distributed ledger comprises blockchain technology.

11 . A method associated with industrial asset cyber-attack detection algorithm verification, comprising:
receiving, at a computer processor of a verification platform, a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data; storing, by the verification platform, the subset of industrial asset cyber-attack detection algorithm data into a data store, the subset of industrial asset cyber-attack detection algorithm data being marked as invalid; recording, by the verification platform, a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger; receiving, at the verification platform, a transaction identifier from the secure, distributed ledger; and marking the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify, at the verification platform, that the recorded hash value matches a hash value associated with an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

12 . The method of claim 11 , wherein the compressed representation of the subset of industrial data combined with metadata comprises a Patricia-Merkle trie.

13 . The method of claim 11 , wherein the metadata comprises at least one of: (i) a pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

14 . The method of claim 11 , wherein the secure, distributed ledger comprises blockchain technology.

15 . A system to facilitate industrial asset cyber-attack detection algorithm verification, comprising:
a verification client, including:
a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data, and
a verification client computer processor coupled to the data connection and adapted to:
create a Patricia-Merkle trie from the subset of the industrial asset cyber-attack detection algorithm data and metadata,
determine a hash trie value associated with the Patricia-Merkle trie,
receive a pseudo identifier from a verification engine, and
transmit raw Patricia-Merkle trie data to a verification server along with metadata,

the verification engine, including:
a verification engine computer processor adapted to:
receive the hash value from the verification client,
transmit a pseudo identifier to the verification client,
record the received hash trie value in a secure, distributed ledger,
receive a transaction identifier from the secure, distributed ledger, and
transmit the pseudo identifier and transaction identifier to the verification server, and

the verification server, including:
a verification server computer processor adapted to:
receive the subset of the industrial asset cyber-attack detection algorithm data and metadata from the verification client,
receive the pseudo identifier and transaction identifier from the verification engine,
store the subset of the industrial asset cyber-attack detection algorithm data into a data store, the subset of the industrial asset cyber-attack detection algorithm data being marked as being invalid,
independently create a Patricia-Merkle trie from the received subset of the industrial asset cyber-attack detection algorithm data and metadata,
retrieve the recorded hash value from the secure, distributed ledger, and
mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after verifying that the recorded hash value matches a hash value associated with the independently created Patricia-Merkle trie.

16 . The system of claim 15 , wherein the metadata includes at least one of: (i) the pseudo

Assignees

• Gen Electric

Inventors

• Holzhauer Daniel Francis
• Mestha Lalit
• John Justin

Classifications

• H04W12/009

  specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L2209/38

  Electricity · mapped topic