Back to results
US 12,549,568 B1Granted
Cyber security platform and method
AssigneeAnalog Devices, Inc.
InventorsAlbert Rooyakkers, Samuel Galpin, Christopher Harlow
Life of this patent
Estimating the term…
Abstract
A method of providing cyber security to an industrial control system is described. The method includes detecting an anomaly and recording and reporting the detected anomaly to a control system within a network associated with the industrial control system. Detecting the anomaly may include recording all unauthorized attempts to connect to a communication port in the network, capturing identifying information associated with the unauthorized attempts, detecting scanning activity of a hacker in the network, detecting an attempt to manipulate a log file to conceal malicious activity in the network; and recording and reporting the detected anomaly to a controller within the network.
Claims18
An industrial control system comprising:
- a controller configured to operatively couple to at least a sensor and an actuator device on a network, the controller including one or more computer processors and one or more computer-readable storage media;
- and
- a cyber security platform for detecting network intrusions and/or anomalous behavior on the industrial control system, the cyber security platform comprising program instructions stored on the one or more computer-readable storage media for execution by at least the one or more processors, the program instructions including:
- program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock, the virtual key lock is configured to:
- require entry of authorized mode changing credentials separate from process logic editing credentials to change the mode of the controller to an editing mode of the controller,
- prevent an approved user with the process logic editing credentials and without the mode changing credentials from changing the mode of the controller to the editing mode, and
- allow the approved user to edit the process logic after the controller has been placed in the editing mode by the entry of the mode changing credentials;
- responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
- responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of:
- a time change or a current system time;
- and
- responsive to detection of either the open port scanning activity on the network or the system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
9 more elements
An industrial control system comprising:
- a sensor;
- an actuator device;
- a controller operatively coupled to the sensor and the actuator device on a network, the controller including one or more computer processors;
- one or more computer-readable storage media;
- a cyber security platform for detecting network intrusions and/or anomalous behavior on the industrial control system, the cyber security platform comprising program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more processors, the program instructions including:
- program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock, the virtual key lock is configured to require entry of authorized mode changing credentials separate from process logic editing credentials to change the mode of the controller to an editing mode of the controller, prevent an approved user with the process logic editing credentials and without the mode changing credentials from changing the mode of the controller to the editing mode, and allow the approved user to edit the process logic after the controller has been placed in the editing mode by the entry of the mode changing credentials;
- responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including at least one of:
- a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
- responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of:
- a time change or a current system time;
- and
- responsive to detection of either the open port scanning activity on the network or the system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
9 more elements
A cyber security program product for detecting network intrusions and/or anomalous behavior on an industrial control system, the industrial control system having a controller operatively coupled to at least a sensor and an actuator device on a network, the cyber security program product comprising:
- one or more computer-readable and non-transitory storage media and program instructions stored on the one or more computer-readable and non-transitory storage media, the program instructions configured to be performed by the controller of the industrial control system, the program instructions including:
- program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock, the virtual key lock is configured to require entry of authorized mode changing credentials separate from process logic editing credentials to change the mode of the controller to an editing mode of the controller, prevent an approved user with the process logic editing credentials and without the mode changing credentials from changing the mode of the controller to the editing mode, and allow the approved user to edit the process logic after the controller has been placed in the editing mode by the entry of the mode changing credentials;
- responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including at least one of:
- a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
- responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of:
- a time change or a current system time;
- and
- responsive to detecting either the controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
5 more elements
Dependencies are inferred from the claim text.