# US 2016/0306337 A1 · Detection of mis-configuration and hostile attacks in industrial control networks using active querying

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0306337 A1
- Document ID: US20160306337A1
- Status: Published application
- Kind: A1
- Application number: 14/686,878
- Filed: 2015-04-15
- Published: 2016-10-20
- Earliest claimed: 2015-04-15
- Assignees: Indegy Ltd.
- Applicants: Indegy Ltd.
- Inventors: Mille Gandelsman
- Web page: https://patentgrep.com/patent/US20160306337A1

## CPC

- G05B 19/058: {Safety, monitoring}
- G05B 19/4185: {characterised by the network communication}
- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]}
- G05B 2219/13197: Host and remote version of ladder program, avoid different versions
- G05B 2219/24159: Several levels of security, passwords
- G05B 2219/31203: Purpose, identification of messages, programs, variables
- G05B 2219/31362: Verify correct configuration of system
- G05B 2219/31436: Host monitors plc, control processor without interrupting its program
- Y02P 90/02: Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y02P: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS

## Abstract

A method includes requesting a controller, which controls one or more field devices in an industrial control network, to report code currently used by the controller for controlling the field devices. The code reported by the controller is compared with a stored baseline version of the code, and a notification is issued upon detecting a discrepancy between the code reported by the controller and the baseline version.

## Claims

### Claim 1

A method, comprising:
requesting a controller, which controls one or more field devices in an industrial control network, to report code currently used by the controller for controlling the field devices;
comparing the code reported by the controller with a stored baseline version of the code; and
issuing a notification upon detecting a discrepancy between the code reported by the controller and the baseline version.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the code comprises at least one code type selected from a group of types consisting of firmware, application logic and configuration parameters of the controller.

### Claim 3 (depends on 1)

The method according to claim 1, wherein comparing the reported code to the baseline version comprises comparing a first digest of the reported code with a second digest of the baseline version.

### Claim 4 (depends on 1)

The method according to claim 1, wherein requesting the controller to report the code comprises emulating an engineering protocol used for configuring the controller.

### Claim 5 (depends on 1)

The method according to claim 1, and comprising verifying the stored baseline version of the code by intercepting code-update transactions exchanged with the controller.

### Claim 6 (depends on 5)

The method according to claim 5, wherein verifying the stored baseline version comprises outputting an alert in response to determining that an intercepted code-update transaction is illegitimate.

### Claim 7 (depends on 5)

The method according to claim 5, wherein verifying the stored baseline version comprises, in response to determining that an intercepted code-update transaction is legitimate, updating the stored baseline version with the intercepted code-update transaction.

### Claim 8

An apparatus, comprising:
a memory, which is configured to hold a baseline version of code used by a controller to control one or more field devices in an industrial control network; and
a processor, which is configured to request the controller to report the code currently used by the controller for controlling the field devices, to compare the code reported by the controller with the baseline version of the code stored in the memory, and to issue a notification upon detecting a discrepancy between the code reported by the controller and the baseline version.

### Claim 9 (depends on 8)

The apparatus according to claim 8, wherein the code comprises at least one code type selected from a group of types consisting of firmware, application logic and configuration parameters of the controller.

### Claim 10 (depends on 8)

The apparatus according to claim 8, wherein the processor is configured to compare the reported code with the baseline version by comparing a first digest of the reported code with a second digest of the baseline version.

### Claim 11 (depends on 8)

The apparatus according to claim 8, wherein the processor is configured to request the controller to report the code by emulating an engineering protocol used for configuring the controller.

### Claim 12 (depends on 8)

The apparatus according to claim 8, wherein the processor is configured to verify the stored baseline version of the code by intercepting code-update transactions exchanged with the controller.

### Claim 13 (depends on 12)

The apparatus according to claim 12, wherein the processor is configured to output an alert in response to determining that an intercepted code-update transaction is illegitimate.

### Claim 14 (depends on 12)

The apparatus according to claim 12, wherein the processor is configured to update the stored baseline version with the intercepted code-update transaction in response to determining that an intercepted code-update transaction is legitimate.

### Claim 15

A computer software product, the product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a processor, cause the processor to request a controller, which controls one or more field devices in an industrial control network, to report code currently used by the controller for controlling the field devices, to compare the code reported by the controller with a stored baseline version of the code, and to issue a notification upon detecting a discrepancy between the code reported by the controller and the baseline version.