Enhanced Smart Process Control Switch Port Lockdown

A method comprising:

• locking a process control switch by producing a static address table (i) that maps known physical addresses for devices in a process control environment to one or more of a plurality of ports of the process control switch to which the devices are connected and (ii) that cannot be updated with a new known physical address while the process control switch is locked, wherein the static address table maps a plurality of known physical addresses to a single port;
• limiting traffic at each of the plurality of ports by:
• (i) controlling the number of messages forwarded at each port to comply with a traffic threshold, and (ii) authenticating the source physical addresses included in each of the messages received at each port, wherein the authenticating includes:
• (a) analyzing a message to identify a source physical address included in the message;
• (b) when the static address table lists the source physical address as a known physical address mapped to the single port, forwarding the message via a one of the plurality of ports;
• and
• (c) when the static address table does not list the source physical address as a known physical address mapped to the single port, dropping the message.

A process control switch comprising:

• a plurality of ports;
• and
• a set of circuits communicatively connected to the plurality of ports, the set of circuits configured to implement a lockdown operation wherein the set of circuits:
• (a) detect that one of the plurality of ports is connected to a second switch;
• (b) analyze a handshake with the second switch to determine whether or not the second switch is lockable;
• (c) when the set of circuits determine that the second switch is lockable, forward messages received from the second switch without authenticating source physical addresses for the messages;
• and
• (d) when the set of circuits determine that the second switch is not lockable, authenticate source physical addresses included in messages received at the port such that a message received at the port is analyzed to determine whether or not the received message identifies a source physical address that is included in a list of known physical addresses.

A method for implementing a lockdown operation for process control switches comprising:

• (a) detecting that a port from a plurality of ports of a process control switch is connected to a second switch;
• (b) analyzing a handshake between the process control switch and the second switch to determine whether or not the second switch is lockable;
• and
• (c) operating the process control switch in a locked state, including:
• (1) when results from the analyzing indicate that the second switch is lockable, forwarding messages received at the process control switch from the second switch without authenticating source physical addresses for the messages;
• and
• (2) when the results from the analyzing indicate that the second switch is not lockable, authenticating source physical addresses included in messages received at the port such that a message received at the port is analyzed to determine whether or not the received message identifies a source physical address that is included in a list of known physical addresses.