Apparatus and method for securing a distributed control system (DCS)

Patent metadata

Field	Value
Publication number	US-9438628-B2
Application number	US-201414308946-A
Country	US
Kind code	B2
Filing date	Jun 19, 2014
Priority date	Jan 27, 2014
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

A method includes receiving, at a first distributed control system (DCS) node over a network, information associated with a security manager. The method also includes establishing multiple communication channels between the first DCS node and the security manager over the network using the information, where the communication channels include a non-secure channel and a secure channel. The method further includes receiving security credentials from the security manager at the first DCS node over the non-secure channel and receiving a security policy and an activation time from the security manager at the first DCS node over the secure channel. In addition, the method includes transitioning the first DCS node to communicate with a second DCS node over the network using the security policy at the activation time.

First claim

What is claimed is:

1. A method comprising:
receiving, at a first distributed control system (DCS) node over a network, information associated with a security manager;
establishing multiple communication channels between the first DCS node and the security manager over the network using the information, the communication channels including a non-secure channel and a secure channel;
receiving security credentials from the security manager at the first DCS node over the non-secure channel;
receiving a security policy and an initial activation time from the security manager at the first DCS node over the secure channel;
performing a handshake operation with a second DCS node;
determining whether to adjust the initial activation time based on a result of the handshake operation with the second DCS node; and
transitioning the first DCS node to communicate with the second DCS node over the network using the security policy at one of: the initial activation time or an adjusted activation time.

2. The method of claim 1 , wherein receiving the information associated with the security manager comprises:
transmitting a bootstrap protocol (BOOTP) request from the first DCS node to a BOOTP server; and
receiving a BOOTP response from the BOOTP server at the first DCS node, the BOOTP response including a network address of the security manager and identifiers of ports to be used to communicate with the security manager.

3. The method of claim 1 , wherein establishing the multiple communication channels comprises:
establishing the non-secure channel with the security manager using a first predefined policy; and
establishing the secure channel with the security manager using a second predefined policy.

4. The method of claim 3 , wherein establishing the multiple communication channels further comprises, after establishing the non-secure channel but before establishing the secure channel:
transmitting a join request from the first DCS node to the security manager over the non-secure channel; and
receiving a join response from the security manager at the first DCS node over the non-secure channel, the join response comprising a certificate that represents the security credentials.

5. The method of claim 4 , wherein receiving the join response comprises receiving the join response from the security manager after a user approves the join request.

6. The method of claim 1 , further comprising:
communicating with the security manager indirectly via a security proxy, the security proxy located in a subnetwork, the security manager located outside the subnetwork.

7. The method of claim 1 , wherein performing the handshake operation comprises performing the handshake operation before transitioning the first DCS node to communicate with the second DCS node to verify that both the first and second DCS nodes are prepared to securely communicate with one another.

8. The method of claim 1 , wherein:
the handshake operation comprises a four-way handshake that includes:
the first DCS node transmitting a first policy update message including the initial activation time to the second DCS node and receiving a first acknowledgement from the second DCS node; and
the first DCS node receiving a second policy update message from the second DCS node and transmitting a second acknowledgement to the second DCS node; and

determining whether to adjust the initial activation time based on the result of the handshake operation with the second DCS node comprises determining whether to adjust the initial activation time based on whether the first and second acknowledgements were received in response to the first and second policy update messages, respectively.

9. An apparatus comprising:
a first distributed control system (DCS) node comprising:
at least one interface configured to receive over a network information associated with a security manager; and
at least one processing device configured to:
establish multiple communication channels including a non-secure channel and a secure channel between the first DCS node and the security manager over the network using the information;
receive security credentials from the security manager over the non-secure channel via the at least one interface;
receive a security policy and an initial activation time from the security manager over the secure channel via the at least one interface;
perform a handshake operation with a second DCS node;
determine whether to adjust the initial activation time based on a result of the handshake operation with the second DCS node; and
transition the at least one interface to communicate with the second DCS node over the network using the security policy at one of: the initial activation time or an adjusted activation time.

10. The apparatus of claim 9 , wherein the at least one processing device is configured to:
initiate transmission of a bootstrap protocol (BOOTP) request to a BOOTP server via the at least one interface; and
receive a BOOTP response from the BOOTP server via the at least one interface, the BOOTP response including a network address of the security manager and identifiers of ports to be used to communicate with the security manager.

11. The apparatus of claim 9 , wherein the at least one processing device is configured to:
establish the non-secure channel with the security manager using a first predefined policy; and
establish the secure channel with the security manager using a second predefined policy.

12. The apparatus of claim 11 , wherein the at least one processing device is configured, after establishing the non-secure channel but before establishing the secure channel, to:
initiate transmission of a join request to the security manager over the non-secure channel via the at least one interface; and
receive a join response from the security manager over the non-secure channel via the at least one interface, the join response comprising a certificate that represents the security credentials.

13. The apparatus of claim 11 , wherein the security policy is different from the first and second predefined policies.

14. The apparatus of claim 9 , wherein the at least one processing device is configured to perform the handshake operation before transitioning the at least one interface to communicate with the second DCS node to verify that both the first and second DCS nodes are prepared to securely communicate with one another.

15. The apparatus of claim 9 , wherein:
the handshake operation comprises a four-way handshake that includes:
the first DCS node transmitting a first policy update message including the initial activation time to the second DCS node and receiving a first acknowledgement from the second DCS node; and
the first DCS node receiving a second policy update message from the second DCS node and transmitting a second acknowledgement to the second DCS node; and

the at least one processing device is configured to determine whether to adjust the initial activation time based on whether the first and second acknowledgements were received in response to the first and second policy update messages, respectively.

16. A non-transitory computer readable medium embodying a computer program, the computer program comprising computer readable program code for:
receiving, at a first distributed control system (DCS) node over a network, information associated with a security manager;
establishing multiple communication channels between the first DCS node and the security manager over the network using the information, the communication channels including a non-secure channel and a secure chann

Assignees

• Honeywell Int Inc

Inventors

• Haridas Harshal S
• Chernoguzov Alexander

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04W12/50

  Secure pairing of devices · CPC title