Back to results
US 11,736,497 B1Granted
Cyber security platform and method
AssigneeBedrock Automation Platforms Inc.
InventorsAlbert Rooyakkers, Samuel Galpin, Christopher Harlow
Life of this patent
Estimating the term…
Abstract
A method of providing cyber security to an industrial control system is described. The method includes detecting an anomaly and recording and reporting the detected anomaly to a control system within a network associated with the industrial control system. Detecting the anomaly may include recording all unauthorized attempts to connect to a communication port in the network, capturing identifying information associated with the unauthorized attempts, detecting scanning activity of a hacker in the network, detecting an attempt to manipulate a log file to conceal malicious activity in the network; and recording and reporting the detected anomaly to a controller within the network
Claims18
An industrial control system comprising:
- a controller configured to operatively couple to at least a sensor and an actuator device on a network, the controller including one or more computer processors and one or more computer-readable storage media;
- and
- a cyber security platform for detecting network intrusions and/or anomalous behavior on the industrial control system, the cyber security platform comprising program instructions stored on the one or more computer-readable storage media for execution by at least the one or more processors, the program instructions including:
- program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock;
- responsive to detecting a second controller or a communication point attempting to connect to the network, program instructions to record at least one of:
- an Internet Protocol version 4 (IPv4)/Internet Protocol version 6 (IPv6) address of an initiating host, a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number, a subject name in a certificate provided by the initiating host, a certificate thumbprint, or a status indicating a success or failure to connect to the network;
- responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
- responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of:
- a time change or a current system time;
- and
- responsive to detecting either the second controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
8 more elements
An industrial control system comprising:
- a sensor;
- an actuator device;
- a controller operatively coupled to the sensor and the actuator device on a network, the controller including one or more computer processors;
- one or more computer-readable storage media;
- a cyber security platform for detecting network intrusions and/or anomalous behavior on the industrial control system, the cyber security platform comprising program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more processors, the program instructions including:
- program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock;
- responsive to detecting a second controller or a communication point attempting to connect to the network, program instructions to record at least one of:
- an Internet Protocol version 4 (IPv4)/Internet Protocol version 6 (IPv6) address of an initiating host, a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number, a subject name in a certificate provided by the initiating host, a certificate thumbprint, or a status indicating a success or failure to connect to the network;
- responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including at least one of:
- a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
- responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of:
- a time change or a current system time;
- and
- responsive to detecting either the second controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
11 more elements
A cyber security program product for detecting network intrusions and/or anomalous behavior on an industrial control system, the industrial control system having a controller operatively coupled to at least a sensor and an actuator device on a network, the cyber security program product comprising:
- one or more computer-readable and non-transitory storage media and program instructions stored on the one or more computer-readable and non-transitory storage media, the program instructions configured to be performed by the controller of the industrial control system, the program instructions including:
- program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock;
- responsive to detecting a second controller or a communication point attempting to connect to the network, program instructions to record at least one of:
- an Internet Protocol version 4 (IPv4)/Internet Protocol version 6 (IPv6) address of an initiating host, a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number, a subject name in a certificate provided by the initiating host, a certificate thumbprint, or a status indicating a success or failure to connect to the network;
- responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including at least one of:
- a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
- responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of:
- a time change or a current system time;
- and
- responsive to detecting either the second controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
7 more elements
Dependencies are inferred from the claim text.