# US 10,375,106 B1 · Backplane filtering and firewalls > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,106 B1 - Document ID: US10375106B1 - Status: Granted - Kind: B1 - Application number: 15/364,011 - Filed: 2016-11-29 - Granted: 2019-08-06 - Earliest claimed: 2016-01-13 - Assignees: National Technology & Engineering Solutions of Sandia, LLC - Applicants: National Technology & Engineering Solutions of Sandia, LLC - Inventors: Alexander Roesler; Abraham Anthony Clements; Jason Hamlet; John Mulder - Web page: https://patentgrep.com/patent/US10375106B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/70: Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer - G06F 21/71: to assure secure computing or processing of information - G06N 20/00: Machine learning - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1433: {Vulnerability analysis} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Described herein are various technologies for providing active mitigation of cyber-attacks against industrial and other control systems. A filtering device is connected to a backplane of a control system and receives communications from various modules of the control system. The filter device analyzes the received communications and determines whether they are genuine and permissible communications for the control system. Validated signals are output to a communications bus of the control system by the filter device, while impermissible communications are blocked. The filter device can be interposed between the modules of the control system and the backplane, or the filter device can be included as a component of a control system backplane. ## Claims ### Claim 1 A control system, comprising: a processing module; a plurality of input/output (IO) modules; a backplane communications bus; and a hardware logic component interposed between the backplane communications bus and the processing module such that the hardware logic component is in communication with the processing module and the backplane communications bus of the control system, wherein the hardware logic component receives signals output by the processing module, and wherein the hardware logic component is configured to perform the following acts: responsive to receiving a signal from the processing module that is directed to at least one of the IO modules, determining that the signal comprises an impermissible communication for the control system; and responsive to determining that the signal comprises an impermissible communication for the control system, executing, at the hardware logic component, a model of control logic of the processing module of the control system such that the hardware logic component performs at least some of the functionality of the processing module of the control system. ### Claim 2 (depends on 1) The system of claim 1, wherein the control system comprises a VME control system. ### Claim 3 (depends on 1) The system of claim 1, wherein the control system comprises a programmable logic controller (PLC). ### Claim 4 (depends on 1) The system of claim 1, wherein determining that the signal comprises an impermissible communication for the control system comprises determining that the signal does not satisfy a whitelist of approved system commands. ### Claim 5 (depends on 1) The system of claim 1, wherein determining that the signal comprises an impermissible communication for the control system is based at least in part upon the model of the control logic of the processing module. ### Claim 6 (depends on 1) The system of claim 1, wherein determining that the signal comprises an impermissible communication for the control system is based at least in part upon machine-learning data. ### Claim 7 (depends on 1) The control system of claim 1, the acts further comprising: responsive to receiving a second signal from the processing module that is directed to the at least one IO module, determining that the second signal comprises a permissible communication for the control system; and responsive to determining that the second signal comprises a permissible communication for the control system, outputting the second signal to the at least one IO module by way of the backplane communications bus. ### Claim 8 A method, comprising: receiving a signal from a processing module of a control system at a hardware logic device, the hardware logic device connected between the processing module of the control system and a backplane communications bus of the control system such that signals output by the processing module of the control system are received at the hardware logic device, the signal configured by the processing module to be provided to at least one other module of the control system; preventing the signal from being output to the at least one other module by way of the backplane communications bus based upon determining that the signal is an impermissible signal for the control system; and responsive to determining that the signal is an impermissible signal for the control system, executing, at the hardware logic device, a model of control logic of the processing module of the control system such that the hardware logic device performs at least some of the functionality of the processing module of the control system. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving a second signal at the hardware logic device; determining that the second signal is an impermissible signal for the control system based upon determining that the second signal originated from an input/output (IO) module of the control system and was configured by the IO module to be provided to at least one other IO module of the control system; and preventing the second signal from being output to the at least one other IO module by way of the backplane communications bus based upon determining that the second signal is an impermissible signal for the control system. ### Claim 10 (depends on 8) The method of claim 8, further comprising: receiving a second signal at the hardware logic device; determining that the second signal is an impermissible signal for the control system based upon determining that the signal originated from an invalid module address; and preventing the second signal from being output to the backplane communications bus based upon determining that the second signal is an impermissible signal for the control system. ### Claim 11 (depends on 8) The method of claim 8, wherein determining that the signal is an impermissible signal for the control system comprises determining that the signal is directed to an invalid module address. ### Claim 12 (depends on 8) The method of claim 8, wherein determining that the signal is an impermissible signal for the control system comprises determining that the signal comprises data configured to cause a set point or alarm value of a physical system controlled by the control system to exceed safe operating bounds. ### Claim 13 (depends on 8) The method of claim 8, further comprising constructing a first state machine model of the control logic of the processing module of the control system based upon a history of previous states of the control system, wherein determining that the signal is an impermissible signal for the control system is based at least in part upon the first state machine model. ### Claim 14 (depends on 13) The method of claim 13, wherein determining that the signal is an impermissible signal for the control system comprises determining that the signal diverges from the first state machine model of the control logic of the processing module. ### Claim 15 (depends on 13) The method of claim 13, further comprising constructing a second state machine model of the control logic of the processing module of the control system based upon the history of previous state of the control system, wherein determining that the signal is an impermissible signal for the control system is based upon a voting scheme that incorporates the first state machine model and the second state machine model. ### Claim 16 (depends on 8) The method of claim 8, wherein determining that the signal is an impermissible signal for the control system is based at least in part upon machine-learning data. ### Claim 17 (depends on 16) The method of claim 16, wherein the machine-learning data is data generated by execution of machine-learning algorithms over historic state data for the control system. ### Claim 18 (depends on 8) The method of claim 8, further comprising: responsive to determining that the processing module of the control system has been potentially compromised by a cyber-attack, preventing signals received from the processing module from being output to other modules of the control system. ### Claim 19 A system comprising: a control system comprising: a backplane communications bus; and a plurality of modules that receive signals from the backplane communications bus; and a field-programmable gate array (FPGA), the FPGA communicatively coupled between the backplane communications bus and the plurality of modules such that signals output by the plurality of modules are received at the FPGA, wherein the FPGA receives a signal from one of the plurality of modules and outputs the signal to the backplane communications bus based upon determining that the signal is a permissible communication for the control system, and wherein further the FPGA is configured to execute a model of control logic of a processing module of the control system responsive to determining that a signal received from a processing module in the plurality of modules is an impermissible communication for the control system, such that the FPGA performs at least some of the functionality of the processing module of the control system. ### Claim 20 (depends on 19) The system of claim 19, wherein the control system is a programmable logic controller (PLC).