Back to results
US 10,007,783 B2Granted
Method for protecting an automation component against program manipulations by signature reconciliation
AssigneeSiemens Aktiengesellschaft
InventorPeter Schoenemann
Life of this patent
Estimating the term…
Abstract
In a method for determining a threat situation for an automation component of the controller or field level, wherein the automation component has at least one essentially cyclic program behavior, a number of required program behaviors is established in a learning phase in a processor, and the determined required program behaviors are stored and compared cyclically with actual program behaviors, that are established in operation of the automation component. The result of the comparison is logically linked with results of other security components for verification as to whether a threat situation exists.
Claims13
A method for operating an automation component in order to control a process that is external to said automation component, said method comprising:
- operating said automation component in a plurality of sequential cycles;
- providing a processor of said automation component with inputs, in each of said cycles, that represent a current process state of said process in that respective cycle;
- upon receipt of said inputs for said respective cycle, executing an internal program in said processor in order to apply said internal program to said inputs for said respective cycle, and in order to then generate outputs that represent a generated cycle behavior of said automation component in that respective cycle;
- in a memory of said automation component, storing a plurality of sets of stored inputs, with each set of stored inputs correlated with multiple sets of stored outputs in said memory, each set of stored outputs, in the multiple sets of stored outputs that are correlated with a respective set of stored inputs, representing a possible correct cycle behavior of said automation component that can result from correct execution of said internal program applied to the respective set of stored inputs;
- before omitting, from said processor, said outputs representing said generated cycle behavior, accessing said memory from said processor and, in said processor, identifying one of said sets of stored inputs that most closely corresponds to said inputs representing said current process state of said process, and comparing said generated cycle behavior in said respective cycle to the correct cycle behaviors of all of said multiple sets of stored outputs that correspond with said identified one set of stored inputs, in order to obtain a comparison result;
- and
- from said processor, emitting a threat-indicating output signal, which indicates that manipulation of said internal program may have occurred, if said comparison result is that said generated cycle behavior deviates from all of said correct cycle behaviors.
4 more elements
An automation component that controls a process, said automation component comprising:
- a processor configured to operate said automation component in a plurality of sequential cycles;
- said processor of said automation component being provided with inputs, in each of said cycles, that represent a current process state of said process in that respective cycle;
- upon receipt of said inputs for said respective cycle, said processor being configured to execute an internal program in said processor in order to apply said internal program to said inputs for said respective cycle, and in order to then generate outputs that represent a generated cycle behavior of said automation component in that respective cycle;
- a memory in which a plurality of sets of stored inputs are stored, with each set of stored inputs correlated with multiple sets of stored outputs in said memory, each set of stored outputs, in the multiple sets of stored outputs that are correlated with a respective set of stored inputs, representing a possible correct cycle behavior of said automation component that can result from correct execution of said internal program applied to the respective set of stored inputs;
- said processor being configured to access said memory, before emitting said outputs representing said generated cycle behavior, and said processor being configured to identify one of said sets of stored inputs that most closely corresponds to said inputs representing said current process state of said process, and to compare said generated cycle behavior in said respective cycle to the correct cycle behaviors of all of said multiple sets of stored outputs that correspond with said identified one set of stored inputs, in order to obtain a comparison result;
- and
- said processor being configured to emit a threat-indicating output signal, which indicates that manipulation of said internal program may have occurred, if said comparison result is that said generated cycle behavior deviates from all of said correct cycle behaviors.
4 more elements
Dependencies are inferred from the claim text.