Modular edge network security
AssigneeAdveon Security Technologies, Inc.
InventorsEric Ong, Qiren Que
Life of this patent
Estimating the term…
Abstract
Systems and methods for monitoring network communications of low-level devices and sensors in an industrial control system (ICS) environment. A cloud-native application containerization platform allows for security visibility in the lower OT levels of the Purdue model, including by network traffic inspection in an active intrusion prevention system (IPS) mode or a passive intrusion detection system (IDS) mode.
Claims20
A security monitoring system for monitoring low-level network communications of an industrial control environment, comprising:
- an input/output module configured to:
- receive a signal from a process device associated with the industrial control environment,
- convert the signal into operational data that can be processed by a programmable logic controller (PLC);
- and
- a worker node configured to:
- intercept the operational data using a switch,
- decode the operational data based on a library of PLC supported protocols, and
- send the decoded operational data over a wireless network interface;
- and
- a gateway node configured to:
- receive the decoded operational data via the wireless network interface, and
- respond to a security threat in the decoded operational data.
A method for monitoring low-level network communications of an industrial control environment, comprising:
- receiving a signal from a process device associated with the industrial control environment;
- converting the signal into operational data that can be processed by a programmable logic controller (PLC);
- intercepting the operational data using a switch;
- decoding the operational data based on a library of PLC supported protocols;
- and
- sending the decoded operational data over a wireless network interface;
- and
- responding to a security threat in the decoded operational data.
A system for monitoring low-level network communications of an industrial control environment, comprising:
- at least one visibility node or relay node positioned on a communication channel between a process device and a control system, configured to:
- capture a stream of control system packets from the process device,
- decode the control system packets,
- preprocess the decoded control system packets to determine a subset of the decoded control system packets, and
- pack the subset of the decoded control system packets into a transfer protocol, the transfer protocol being different than a protocol of the stream of control system.
Dependencies are inferred from the claim text.