Hardening a communication device
AssigneeSiemens Aktiengesellschaft
InventorsMichael Kirchner, Benedikt Vamos
Life of this patent
Estimating the term…
Abstract
Provided are methods and apparatuses for hardening a communication device, which methods and apparatuses make it possible to identify a use of at least one port, by which port a request is submitted to the communication device by a message, and to output a signal for blocking the at least one port if, after a specifiable time period, either the use of the port in question is detected as low or no use of the port in question is detected. Embodiments can be used to harden communication devices in a production line, in a hospital and/or in a power supply network.
Claims8
A method for hardening a communication device, having the following steps:
- identifying a use of at least one port via which a request is made to the communication device by a message;
- and
- outputting a signal to disable the at least one port if, after a prescribable period, either use of the respective port is detected as low or no use of the respective port is detected and if at least one further port from a reference list of ports including the port and the at least one further port is open,
- wherein the prescribable period is chosen differently based on a service addressable by the respective port and wherein the prescribable period is selected according to at least one of the following criteria:
- a) the more difficult the service of the communication device addressable by the port is to manipulate, the longer the prescribable period is chosen to be;
- b) the more rights are needed to perform the service addressable by the port, the shorter the prescribable period is chosen to be;
- c) the higher an expectation value for the port being used in the request, the shorter the prescribable period is chosen to be;
- d) if the communication device has an IP address from the global Internet, the prescribable period is chosen to be longer than if the communication device obtains its IP address from a local intranet.
An apparatus for hardening a communication device, having at least one hardware processor configured for:
- identifying a use of at least one port via which a request is made to the communication device by a message;
- and
- outputting a signal to disable the at least one port if, after a prescribable period, either use of the respective port is detected as low or no use of the respective port is detected and if at least one further port from a reference list of ports including the port and the at least one further port is open,
- wherein the prescribable period is chosen differently based on a service addressable by the respective port and wherein the prescribable period is selected according to at least one of the following criteria:
- a) the more difficult the service of the communication device addressable by the port is to manipulate, the longer the prescribable period is chosen to be;
- b) the more rights are needed to perform the service addressable by the port, the shorter the prescribable period is chosen to be;
- c) the higher an expectation value for the port being used in the request, the shorter the prescribable period is chosen to be;
- d) if the communication device has an IP address from the global Internet, the prescribable period is chosen to be longer than if the communication device obtains its IP address from a local intranet.
A computer program product, comprising a computer readable memory storing a computer readable program code, the computer readable program code comprising an algorithm that when executed by a computer processor of a computing system implements a method comprising:
- identifying a use of at least one port via which a request is made to the communication device by a message;
- and
- outputting a signal to disable the at least one port if, after a prescribable period, either use of the respective port is detected as low or no use of the respective port is detected and if at least one further port from a reference list of ports including the port and the at least one further port is open,
- wherein the prescribable period is chosen differently based on a service addressable by the respective port and wherein the prescribable period is selected according to at least one of the following criteria:
- a) the more difficult the service of the communication device addressable by the port is to manipulate, the longer the prescribable period is chosen to be;
- b) the more rights are needed to perform the service addressable by the port, the shorter the prescribable period is chosen to be;
- c) the higher an expectation value for the port being used in the request, the shorter the prescribable period is chosen to be;
- d) if the communication device has an IP address from the global Internet, the prescribable period is chosen to be longer than if the communication device obtains its IP address from a local intranet.
Dependencies are inferred from the claim text.