# US 10,454,896 B2 · Critical infrastructure security framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,896 B2 - Document ID: US10454896B2 - Status: Granted - Kind: B2 - Application number: 15/641,280 - Filed: 2017-07-04 - Published: 2019-01-10 - Granted: 2019-10-22 - Earliest claimed: 2017-07-04 - Assignees: iS5 Communications Inc. - Applicants: iS5 Communications Inc. - Inventors: Tamer Soliman; Yuri Luskind; Boris Tseitin - Web page: https://patentgrep.com/patent/US10454896B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/105: {Multiple levels of security} - H04L 63/0254: {Stateful filtering} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/162: {at the data link layer} - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract The present invention relates to an environmentally robust critical infrastructure security framework for network use in high demand or mission critical environments and applications, including but not limited to power stations, sub-stations, intelligent transportation systems (ITS), rail, traffic control systems, chemical, oil & gas, critical manufacturing, and industrial applications is disclosed (e.g. complaint to most advanced industrial and military applications). The present invention provides a simple yet effective method suitable for critical infrastructure operations, their systems and protocol requirements. The framework includes role based access control (RBAC) down to each intelligent electronic device (TED), programmable logic controller (PLC), etc. regardless of the type of the device and without the need to have support at the IED level for specific requirements. ## Claims ### Claim 1 A system for an end-to-end security framework in a mission critical infrastructure site, the system comprising: (a) an L3 level network partitioned into a plurality of L2 level networks based on functional purpose and connected through a plurality of firewall devices; (b) a control device provided in the mission critical infrastructure site connected to one of the plurality of L2 level networks; (c) an input device connected to one of the plurality of L2 level networks for allowing a user to request access to the control device by inputting user information into the input device; (d) a secure gateway device with dynamic firewall function managing access between the input device and the control device through applying dynamic firewall rules; (e) a credential management application connected to at least one of the plurality L2 networks having a role based access control protocol for granting access to the control device by analyzing the user information; and (f) whereby the user can be granted access to the control device based on the analysis of the user information by the role based access control protocol of the credential management application. ### Claim 2 (depends on 1) The system of claim 1 wherein the secure gateway device is located in the mission critical infrastructure site. ### Claim 3 (depends on 1) The system of claim 1 wherein the secure gateway device is located remote from the mission critical infrastructure site. ### Claim 4 (depends on 1) The system of claim 1 wherein the credential management application is located in the mission critical infrastructure site. ### Claim 5 (depends on 1) The system of claim 1 wherein the credential management application is located remote from the mission critical infrastructure site. ### Claim 6 An end-to-end security framework for a mission critical infrastructure having plurality of sites, the framework comprising: (a) a L3 level network partitioned into a plurality of L2 level networks, (b) a plurality of intelligent electronic devices connected through one of a plurality of L2 level networks to form a plurality of functional groups across the plurality of sites, at least one device being accessible to a user and at least one device being a secure gateway, wherein L2 connectivity between the plurality of the intelligent electronic devices within the same functional group is maintained across sites to accommodate critical infrastructure L2 protocol communications requirements and non-L3 critical infrastructure communication protocols yet restricting access through a role based authentication control protocol, (c) an input device connected to one of the plurality of the L2 level networks for allowing a user to request access to the control device by inputting user information into the input device; (d) a secure gateway device connected to one of the plurality of the L2 level networks for control access between the input device and the plurality of intelligent electronic devices, (e) a credential management application connected to one of the plurality of the L2 level networks having a role based access control (RBAC) protocol for granting access to each of the plurality of intelligent electronic devices by analyzing the user information; and (f) whereby the user can be granted access to each of the plurality of intelligent electronic devices based on the analysis of the user information by the role based access control protocol of the credential management application. ### Claim 7 (depends on 6) The framework of claim 6 wherein each of the plurality of intelligent electronic devices are grouped based on functional purpose and connected through the secure gateway device. ### Claim 8 (depends on 7) The framework of claim 7 wherein the secure gateway device further comprises an authentication proxy function using role based access control authentication rules used to control access to the plurality of intelligent electronic devices. ### Claim 9 (depends on 6) The framework of claim 6 wherein the functional separation is based on application, control element, user role or managing authority jurisdiction. ### Claim 10 (depends on 9) The framework of claim 9 wherein user access to one of the plurality of intelligent electronic device is restricted across functional groups though access control function using dynamic firewall rules based on user credentials. ### Claim 11 (depends on 10) The framework of claim 10 wherein the L3 level network is part of a critical infrastructure. ### Claim 12 (depends on 11) The framework of claim 11 wherein one of the plurality of sites is a control room. ### Claim 13 (depends on 12) The framework of claim 12 wherein one of the plurality of L2 Level Networks is a SCADA or Operator Network Segment. ### Claim 14 (depends on 13) The framework of claim 13 wherein at least one of the plurality of L2 Level Networks is a SCADA network segment. ### Claim 15 (depends on 13) The framework of claim 13 wherein at least one of the plurality of L2 Level Networks is an Operator Network Segment. ### Claim 16 (depends on 13) The framework of claim 13 wherein the control room is provided with OT DMZ for OT partner access. ### Claim 17 (depends on 13) The framework of claim 13 further comprising a stateful firewall between the SCADA and Operator network segment. ### Claim 18 (depends on 13) The framework of claim 13 wherein the control room further comprises enterprise grade IDS. ### Claim 19 (depends on 13) The framework of claim 13 wherein the plurality of L2 Level Networks further comprise an antivirus, anti-spam or anomaly detection function. ### Claim 20 (depends on 13) The framework of claim 13 wherein the plurality of L2 Level Networks further comprises a SIEM platform for security monitoring. ### Claim 21 (depends on 13) The framework of claim 13 wherein the user authentication is conducted by a fallback mode supported on the secure gateway to facilitate site independent operation requirements for critical infrastructure sites. ### Claim 22 (depends on 21) The framework of claim 21 wherein the secure gateway utilizes dynamic firewall roles applied and removed based on RBAC according to user credentials. ### Claim 23 (depends on 22) The framework of claim 22 wherein a critical infrastructure protocol aware grade IDS monitors security. ### Claim 24 (depends on 22) The framework of claim 22 wherein the plurality of L2 Level Networks further comprises VLANs. ### Claim 25 (depends on 24) The framework of claim 24 wherein logical separation into functional groups uses device MAC address to restrict access to network ports to the specific intended device specially on the SCADA network segment and control room network segment. ### Claim 26 (depends on 25) The framework of claim 25 wherein an unused port on a device is put in disable or shut down mode with the exception of maintenance ports for which the appropriate VLAN needs to be configured for functional separation and maintaining security. ### Claim 27 (depends on 26) The framework of claim 26 wherein a static connection is created across functional groups. ### Claim 28 (depends on 27) The framework of claim 27 wherein the static connection can be accommodated through the use of static client mode. ### Claim 29 (depends on 22) The framework of claim 22 wherein L2 encryption is used between the first and second site while maintaining the L2 connectivity required to support non-L3 critical infrastructure communication protocols. ### Claim 30 (depends on 22) The framework of claim 22 further comprising a plurality of secure gateways to enhance the availability and reliability of the framework. ### Claim 31 (depends on 13) The framework of claim 13 wherein the secure gateways further comprise stateful firewalls to maintain security between the SCADA network segment and Operator network Segment. ### Claim 32 (depends on 31) The framework of claim 31 wherein the stateful firewalls enhance security between SCADA and OT DMZ. ### Claim 33 (depends on 32) The framework of claim 32 further comprising enterprise grade IDS system for anomaly detection and reporting. ### Claim 34 A method for implementing a security framework for mission critical infrastructure applications maintaining L2 connectivity across infrastructure sites, the method comprising: (a) partitioning an L3 level network into a plurality of L2 level networks based on functional purpose and connected through a plurality of firewall devices; (b) providing a control device in the mission critical infrastructure site connected to one of the plurality of L2 level networks; (c) allowing a user to request access to the control device through an input device connected to one of the plurality of L2 level networks, the user inputting user information into the input device; (d) managing access between the input device and the control device through a secure gateway device with dynamic firewall function applying dynamic firewall rules; (e) granting access to the control device through a credential management application connected to at least one of the plurality L2 networks analyzing the user information using a role based access control protocol; and (f) whereby the user can be granted access to the control device based on the analysis of the user information by the role based access control protocol of the credential management application.