Back to results
US 7,607,166 B2Granted
Secure manufacturing devices in a switched Ethernet network
AssigneeCisco Technology, Inc.
InventorsKenneth Coley, Pauline Shuen
Life of this patent
Estimating the term…
Abstract
A method and apparatus for providing security to factory automation devices in a switched Ethernet network. Traffic between factory automation devices and an Ethernet switch is limited to packets including approved TCP/UDP port numbers and to selected data rates.
Claims12
A method comprising:
- controlling traffic between devices in a group of devices coupled to physical ports of an Ethernet switching platform by enabling only a single Media Access Control (MAC) address for each physical port coupled to a device in the group, wherein the group of devices is included in an assembly line that is part of a factory automation system and wherein the group of devices is assigned its own virtual local area network (VLAN);
- ingress policing the physical ports on the Ethernet switching platform to allow only packets having source TCP or UDP port numbers of approved special factory automation protocols or network protocol packets to access the physical ports;
- and
- limiting transmission and reception data rates on the physical ports of the Ethernet switching platform to selected values.
1 more element
An apparatus comprising:
- means for controlling traffic between devices in a group of devices coupled to physical ports of an Ethernet switching platform by enabling only a single Media Access Control (MAC) address for each physical port coupled to a device in the group, wherein the group of devices is included in an assembly line that is part of a factory automation system and wherein the group of devices is assigned its own virtual local area network (VLAN);
- means for ingress policing the physical ports on the Ethernet switching platform to allow only packets having source TCP or UDP port numbers of approved special factory automation protocols or network protocol packets to access the physical ports;
- and
- means for limiting transmission and reception data rates on the physical ports of the Ethernet switching platform to selected values.
1 more element
One or more computer readable storage media encoded with software comprising computer executable instructions and with the software operable to:
- control traffic between devices in a group of devices coupled to physical ports of an Ethernet switching platform by enabling a single Media Access Control (MAC) address for each physical port coupled to a device in the group, wherein the group of devices is included in an assembly line that is part of a factory automation system and wherein the group of devices is assigned its own virtual local area network (VLAN);
- ingress police the physical ports on the Ethernet switching platform to allow only packets having source TCP or UDP port numbers of approved factory automation protocols or network protocol packets to access the physical ports;
- and
- limit transmission and reception data rates on the physical ports to selected values.
1 more element
Dependencies are inferred from the claim text.