# US 10,320,747 B2 · Automation network and method for monitoring the security of the transfer of data packets > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,747 B2 - Document ID: US10320747B2 - Status: Granted - Kind: B2 - Application number: 15/216,394 - Filed: 2016-07-21 - Published: 2017-01-26 - Granted: 2019-06-11 - Earliest claimed: 2015-07-22 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Anna Palmin - Web page: https://patentgrep.com/patent/US10320747B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/166: {at the transport layer} - H04L 67/133: Protocols for remote procedure calls [RPC] - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An automation network for monitoring the security of a transfer of data packets includes a first processing device configured to transfer a data packet from an installation component and to the installation component, and a second data processing device which is bidirectionally connected to the first data processing device. The second data processing device generates at least one response packet, when detecting a transmission of the data packet from the first data processing device, and sends the at least one response packet back to the first data processing device. The first data processing device includes a response filter which is configured to execute a check and subsequent rejection/acceptance of the at least one response packet. ## Claims ### Claim 1 An industrial automation network for monitoring the security of a transfer of data packets, comprising: a first processing device configured to transfer a data packet from an plant component and to the plant component; and a second data processing device bidirectionally connected to the first data processing device, said second data processing device configured to generate at least one response packet, when detecting a transmission of the data packet from the first data processing device, and to send the at least one response packet back to the first data processing device; said first data processing device including a response filter which is configured to execute a check and subsequent rejection/acceptance of the at least one response packet; wherein the industrial automation network is a network selected from a control automation installation network, a production automation installation network, a manufacturing automation installation, and any combination thereof; and wherein the plant component comprise at least one input and/or output facility which can detect process parameters and/or can output corresponding actuating signals. ### Claim 2 (depends on 1) The automation network of claim 1, wherein the second data processing device comprises a server. ### Claim 3 (depends on 2) The automation network of claim 2, wherein the server is a Syslog server or a Syslog-ng server or a Rsyslog server, or any combination thereof. ### Claim 4 (depends on 2) The automation network of claim 2, wherein the server is a SIEM server. ### Claim 5 (depends on 1) The automation network of claim 1, wherein the first data processing device comprises a TCP-based client. ### Claim 6 (depends on 5) The automation network of claim 5, wherein the TCP-based client comprises a protocol stack, said response filter being provided in the protocol stack. ### Claim 7 (depends on 1) The automation network of claim 1, wherein the response packets comprise at least one of synchronization packets, finish packets, acknowledgment packets, or any combination thereof. ### Claim 8 (depends on 1) The automation network of claim 1, wherein the data packets are security events. ### Claim 9 (depends on 1) The automation network of claim 1, further comprising a service device configured to output a warning signal, when a response packet is rejected. ### Claim 10 (depends on 1) The automation network of claim 1, further comprising a firewall configured to check the data packets at least in the first data processing device. ### Claim 11 A method for monitoring the security of a transfer of data packets in an industrial automation network, having first and second data processing devices which are bidirectionally connected to one another, the method comprising: at the first data processing device, communicating of a data packet from a plant component and to the plant component; at the second data processing device, generating at least one response packet, when detecting a transmission of the data packet from the first data processing device, and sending the at least one response packet back to the first data processing device; and at the first data processing device, checking and subsequently accepting or rejecting response packets by a response filter; wherein the Industrial automation network is a network selected from a control automation installation network, production automation installation network, a production automation installation, a manufacturing automation installation, and any combination thereof; and, wherein the plant component comprise at least one input and/or output facility which can detect process parameters and/or can output corresponding actuating signals. ### Claim 12 (depends on 11) The method of claim 11, wherein the response filter is constantly active. ### Claim 13 (depends on 11) The method of claim 11, further comprising generating a warning signal for display on a service device in response to a rejection of a response packet. ### Claim 14 (depends on 11) The method of claim 11, wherein responsive to rejection of a response packet, the confirmation of the receipt of the response packet from the first data processing device to the second data processing device is omitted. ### Claim 15 (depends on 11) The method of claim 11, wherein the second data processing device communicates with the first data processing device via a server, the server being at least one of a Syslog server, a Syslog-ng server, a Rsyslog server, a SIEM server, or any combination thereof. ### Claim 16 (depends on 11) The method of claim 11, wherein the first data processing device communicates with the second data processing device via transmission control protocol (TCP). ### Claim 17 (depends on 1) The automation network of claim 1, wherein the plant component is selected from a programmable logic controller (PLC) device, an actuator, or a measuring transducer device. ### Claim 18 (depends on 11) The method of claim 11, wherein the plant component is selected from a programmable logic controller (PLC) device, an actuator, or a measuring transducer device.