# US 11,451,541 B2 · Device and method for connecting a production device to a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,541 B2 - Document ID: US11451541B2 - Status: Granted - Kind: B2 - Application number: 16/064,619 - Filed: 2016-12-20 - Published: 2019-01-03 - Granted: 2022-09-20 - Earliest claimed: 2015-12-22 - Assignees: secunet SECURITY NETWORKS Aktiengesellschaft - Applicants: secunet Security Networks Aktiengesellschaft - Inventors: Jens Kulikowski - Web page: https://patentgrep.com/patent/US11451541B2 ## CPC - H04L 69/08: Protocols for interworking; Protocol conversion - G07D 11/28: Setting of parameters; Software updates - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 43/028: by filtering - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L 69/18: Multiprotocol handlers, e.g. single devices capable of handling multiple protocols - H04L 2012/4026: {Bus for use in automation systems} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G07D: HANDLING OF COINS OR VALUABLE PAPERS, e.g. TESTING, SORTING BY DENOMINATIONS, COUNTING, DISPENSING, CHANGING OR DEPOSITING ## Abstract An apparatus for connecting a data-processing and/or data-generating production apparatus with a network includes a first network interface to be connected with the network, a second network interface to be connected with the production apparatus, and a program code stored in the memory for execution by the at least one processor. The program code includes instructions upon whose execution data packets received at the second network interface via a second protocol are forwarded to the first network interface, and/or upon whose execution data packets received at the first network interface via a first protocol are forwarded to the second network interface and there are sent via a second protocol to the production apparatus. The program code includes instructions upon whose execution the at least one processor applies a packet filter to the data packets on the way between the network interfaces. ## Claims ### Claim 1 A system comprising: a production apparatus having a network interface, the production apparatus being a data-processing production apparatus and/or a data-generating production apparatus; and a connection apparatus connected to the production apparatus, wherein the connection apparatus is configured to connect the production apparatus with a network, wherein the connection apparatus includes: a memory, a processor with the memory, wherein the processor is configured to access the memory for reading and writing, a first network interface configured to be connected with the network, a second network interface configured to be connected with the production apparatus, a computer program code stored in the memory for execution by the processor, wherein the computer program code comprises instructions upon whose execution data packets received at the second network interface via a second protocol are forwarded to the first network interface and are sent via a first protocol into the network, and/or upon whose execution data packets received at the first network interface via a first protocol are forwarded to the second network interface and are sent via a second protocol to the production apparatus, and wherein the computer program code further comprises instructions upon whose execution the processor applies a packet filter to the data packets, wherein the packet filter is applied by the processor on the way of the data packets between the first network interface and the second network interface, and wherein the production apparatus is not visible from the network, wherein the production apparatus comprises at least one housing and the signal connection between the connection apparatus and the production apparatus extends completely within the housing and in which the connection apparatus is disposed in the housing, wherein the housing is constituted such that it prevents an unauthorized access at least to the ports of the network interfaces due to a locking element of the production apparatus which can be secured by a lock or by the production apparatus reacting to inputs of an authorized user, and wherein the program code stored in the connection apparatus includes instructions and configuration data, so that upon the execution of the instructions a setting up of a connection from the production apparatus to a specified internal IP address of the connection apparatus is recognized and the internal IP address is replaced by at least one IP address in the network, which at least one IP address is included in the configuration data of the connection apparatus. ### Claim 2 (depends on 1) The system according to claim 1, further comprising at least one further data-processing and/or data-generating production apparatus having a network interface, wherein the further production apparatus is connected with the network only by means of the further apparatus, and the network interface of the further production device is connected only with the second network interface of the further apparatus. ### Claim 3 (depends on 1) A method for updating a system according to claim 1, the method comprising: changing only the configuration data and/or the computer program code of the connection apparatus upon an alteration in the network. ### Claim 4 (depends on 1) A method for updating a system according to claim 1, the method comprising: changing only the computer program code and/or the configuration data of the connection apparatus or only the connection apparatus is exchanged in reaction to a newly recognized possibility of attacking the system or the connection apparatus. ### Claim 5 (depends on 1) The system according to claim 1, wherein the first protocol is different than the second protocol. ### Claim 6 (depends on 1) The system according to claim 1, wherein the first protocol is a protocol with encryption and the second protocol is without encryption. ### Claim 7 (depends on 1) The system according to claim 1, wherein the computer program code further comprises instructions upon whose execution the setting up of a data connection via the second network interface is monitored, and upon recognition of said setting up via the second network interface, a data connection is set up via the first network interface. ### Claim 8 (depends on 7) The system according to claim 7, wherein the computer program code further comprises instructions upon whose execution the transfer of data, which are transferred in a file from the production apparatus to the connection apparatus, into the network, when the file has not yet been completely transferred to the apparatus. ### Claim 9 (depends on 1) The system according to claim 1, further comprising a third network interface for connection with a further data-processing and/or data-generating production apparatus, which is connected via a signal connection with the processor, and in which the computer program code comprises instructions upon whose execution data packets received at the third network interface via a third protocol are forwarded to the first network interface and are sent via a first protocol into the network, and/or upon whose execution data packets received at the first network interface via a first protocol are forwarded to the third network interface and are sent via the third protocol to a further production apparatus, and/or upon whose execution data are transported between the second and the third network interface. ### Claim 10 (depends on 9) The system according to claim 9, wherein the computer program code comprises instructions upon whose execution data received via the second network interface are sent via the third network interface, and/or wherein the computer program code comprises program code upon whose execution data received via the third network interface are sent via the second network interface. ### Claim 11 (depends on 1) The system according to claim 1, further comprising a third network interface for connection with a further data-processing and/or data-generating production apparatus, which is connected via a signal connection with the processor, and in which the computer program code comprises instructions upon whose execution data packets received at the third network interface via a third protocol are forwarded to the first network interface and are sent via a first protocol into the network, and upon whose execution data packets received at the first network interface via a first protocol are forwarded to the third network interface and are sent via the third protocol to a further production apparatus, and upon whose execution data are transported between the second and the third network interface. ### Claim 12 (depends on 11) The system according to claim 11, wherein the computer program code comprises instructions upon whose execution data received via the second network interface are sent via the third network interface, and wherein the computer program code comprises program code upon whose execution data received via the third network interface are sent via the second network interface. ### Claim 13 (depends on 1) The system according to claim 1, further comprising a Trusted Platform Module (TPM), wherein data relating to authentication and/or authorization and/or signing and/or details of the production apparatus are stored in the memory or the TPM module. ### Claim 14 (depends on 1) The system according to claim 1, wherein data relating to authentication and/or authorization and/or signing and/or details of the network are stored in the memory. ### Claim 15 (depends on 1) The system according to claim 1, further comprising a Trusted Platform Module (TPM), wherein data relating to authentication and/or authorization and/or signing and/or details of the production apparatus are stored in the TPM module. ### Claim 16 (depends on 1) The system according to claim 1, further comprising a maintenance network interface, and wherein the computer program code comprises instructions upon whose execution by the processor the configuration data of the connection apparatus can be changed. ### Claim 17 (depends on 1) The system according to claim 1, wherein the computer program code further comprises instructions upon whose execution the processor reads data which is used for authentication and/or authorization and/or signing, and/or details of the network necessary for setting up a data connection to the network and/or for filtering data which are transferred into the network or are transferred therefrom, only from the memory of the connection apparatus and/or receives them only from the network. ### Claim 18 (depends on 1) The system according to claim 1, wherein the computer program code further comprises instructions upon whose execution the processor reads data which is used for authentication and/or authorization and/or signing, and/or details of the network necessary for setting up a data connection to the network and/or for filtering data which are transferred into the network or are transferred therefrom, only from the memory of the connection apparatus and receives them only from the network. ### Claim 19 A method for connecting a production apparatus having a network interface with a network, the production apparatus being a data-processing production apparatus and/or a data-generating production apparatus, the method comprising: providing a connection apparatus, wherein the connection apparatus includes a memory, a processor with the memory, wherein the processor is configured to access the memory for reading and writing, a first network interface configured to be connected with the network, a second network interface configured to be connected with the production apparatus, a computer program code stored in the memory for execution by the processor, wherein the computer program code comprises instructions upon whose execution data packets received at the second network interface via a second protocol are forwarded to the first network interface and are sent via a first protocol into the network, and/or upon whose execution data packets received at the first network interface via a first protocol are forwarded to the second network interface and are sent via a second protocol to the production apparatus, and wherein the computer program code further comprises instructions upon whose execution the processor applies a packet filter to the data packets, wherein the packet filter is applied by the processor on the way of the data packets between the first network interface and the second network interface; and connecting the network interface of the production apparatus with the second network interface of the connection apparatus, wherein the production apparatus is not visible from the network, wherein the production apparatus comprises at least one housing and the signal connection between the connection apparatus and the production apparatus extends completely within the housing and in which the connection apparatus is disposed in the housing, wherein the housing is constituted such that it prevents an unauthorized access at least to the ports of the network interfaces due to a locking element of the production apparatus which can be secured by a lock or by the production apparatus reacting to inputs of an authorized user, and wherein the program code stored in the connection apparatus includes instructions and configuration data, so that upon the execution of the instructions a setting up of a connection from the production apparatus to a specified internal IP address of the connection apparatus is recognized and the internal IP address is replaced by at least one IP address in the network, which at least one IP address is included in the configuration data of the connection apparatus. ### Claim 20 A system comprising: a production apparatus having a network interface, the production apparatus being a data-processing production apparatus and/or a data-generating production apparatus; and a connection apparatus connected to the production apparatus, wherein the connection apparatus is configured to connect the production apparatus with a network, wherein the connection apparatus includes: a memory, a processor with the memory, wherein the processor is configured to access the memory for reading and writing, a first network interface configured to be connected with the network, a second network interface configured to be connected with the production apparatus, a computer program code stored in the memory for execution by the processor, wherein the computer program code comprises instructions upon whose execution data packets received at the second network interface via a second protocol are forwarded to the first network interface and are sent via a first protocol into the network, and/or upon whose execution data packets received at the first network interface via a first protocol are forwarded to the second network interface and are sent via a second protocol to the production apparatus, and wherein the computer program code further comprises instructions upon whose execution the processor applies a packet filter to the data packets, wherein the packet filter is applied by the processor on the way of the data packets between the first network interface and the second network interface, and wherein the production apparatus comprises at least one housing and the signal connection between the connection apparatus and the production apparatus extends completely within the housing and in which the connection apparatus is disposed in the housing, wherein the housing is constituted such that it prevents an unauthorized access at least to the ports of the network interfaces due to a locking element of the production apparatus which can be secured by a lock or by the production apparatus reacting to inputs of an authorized user, and wherein the program code stored in the connection apparatus includes instructions and configuration data, so that upon the execution of the instructions a setting up of a connection from the production apparatus to a specified internal IP address of the connection apparatus is recognized and the internal IP address is replaced by at least one IP address in the network, which at least one IP address is included in the configuration data of the connection apparatus.