# US 7,614,083 B2 · Process control methods and apparatus for intrusion detection, protection and network hardening

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,614,083 B2
- Document ID: US7614083B2
- Status: Granted
- Kind: B2
- Application number: 11/078,082
- Filed: 2005-03-11
- Published: 2006-03-09
- Granted: 2009-11-03
- Earliest claimed: 2004-03-01
- Assignees: Invensys Systems, Inc.
- Inventors: Bharat Khuti; Clayton Coleman; David Rath; Ernest Rakaczky; Jim Leslie; Juan Peralta; George Simpson
- Web page: https://patentgrep.com/patent/US7614083B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/02: {for separating internal from external traffic, e.g. firewalls}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/105: {Multiple levels of security}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The invention provides an improved network and methods of operation thereof for use in or with process control systems, computer-based manufacturing or production control systems, environmental control systems, industrial control system, and the like (collectively, “control systems”). Those networks utilize a unique combination of firewalls, intrusion detection systems, intrusion protection devices and/or other devices for hardening (e.g., security against hacking, intrusion or other mischievous conduct) and/or intrusion detection. The networks and methods have application, by way of example, in plants, sites and other facilities in which networks that support control systems interface with corporate, business or other networks.

## Claims

### Claim 1

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:
(a) network media that supports communications between digital data devices in first zone and second zones, each zone including one or more of the digital data devices,
(b) an intrusion system that is coupled to the network media between the first and second zones such that traffic between those zones must traverse the intrusion system,
(c) the intrusion system blocking traffic on the network media matching one or more signatures specific to a control network (“control signatures”) and thereby shutting down a communications connection between the first and second zone.

### Claim 2

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:
(a) network media that supports communications between digital data devices,
(b) an intrusion system that is coupled to the network media,
(c) the intrusion system blocking traffic on the network media matching one or more signatures specific to a control network (“control signatures”),
wherein one or more of the control signatures are indicative of traffic that would change, to an out-of range value, a setpoint for one or more control devices in communications coupling with the network media, and wherein the intrusion system blocks traffic matching those one or more control signatures.

### Claim 3 (depends on 2)

The digital data network of claim 2, wherein one or more of the control signatures are indicative of one or more of the following:
an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;
traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address; traffic other than from MAC addresses falling within a selected range; and
wherein the intrusion system blocks traffic matching those one or more control signatures.

### Claim 4 (depends on 2)

The digital data network of claim 2, wherein one or more of the control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of
a password “gnomes”;
a username “fox” and a password “gnomes”; and
wherein the intrusion system blocks traffic matching those one or more control signatures.

### Claim 5 (depends on 2)

The digital data network of claim 2, wherein one or more of the control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of
a username “hstorian”, wherein that username is a misspelled formative of “historian”;
a username “Administrator” with password “password”; a username “bpm”; a username “pam”; and wherein
the intrusion system blocks traffic matching those one or more control signatures.

### Claim 6 (depends on 2)

The digital data network of claim 2, wherein one or more of the control signatures are indicative of an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the intrusion system blocks traffic matching that one or more control signatures.

### Claim 7 (depends on 6)

The digital data network of claim 6, wherein one or more of the control signatures are indicative of an attempt to access, via any of the ftp and the tftp protocol, any of the following:
a password file named “sam” on a digital data device executing a Windows operating system;
a password file named “passwd” on a digital data device executing a Unix operating system;
a password file named dmpasswd_cfg on a digital data device comprising a display manager; and wherein
the intrusion system blocks traffic matching those one or more control signatures.

### Claim 8 (depends on 2)

The digital data network of claim 2, wherein the one or more of the control signatures are indicative of packets with a data payload bearing one or more selected commands.

### Claim 9 (depends on 8)

The digital data network of claim 8, wherein the one or more of the control signatures are indicative of packets with a data payload bearing any of a “setpars” and “omset” command.

### Claim 10

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:
(a) network media that supports digital data communications,
(b) an intrusion system that is coupled to the network media and that monitors traffic thereon utilizing signature-based detection in order to identify traffic that is potentially adverse to the control system control or devices therefor in communications coupling with the network media,
(c) the intrusion system utilizing one or more signatures specific to a control network (“control signatures”) and blocking traffic on the network media matching at least a selected control signature,
(d) wherein the control signatures are indicative of the following:
traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media;
an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;
traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;
traffic other than from MAC addresses within a selected range;
an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of
a password “gnomes”;
a username “fox” and a password “gnomes”;
an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of
a username “hstorian”, wherein that username is a misspelled formative of “historian”;
a username “Administrator” with password “password”;
a username “bpm”;
a username “pam”;
an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the intrusion system blocks traffic matching at least the selected control signature.

### Claim 11

A method of operating a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the method comprising:
(a) transmitting digital data traffic on digital data network media between digital data devices in first and second zones, each zone including one or more digital data devices,
(b) monitoring that traffic with an intrusion system that is coupled to the network media between the first and second zones such that traffic between those zones must traverse the intrusion system,
(c) blocking, with the intrusion system, traffic on the network media matching one or more signatures specific to a control network (“control signature”) so as to shut down a communications connection between the first and second zones.

### Claim 12

A method of operating a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the method comprising:
(a) transmitting digital data traffic on digital data network,
(b) monitoring that traffic with an intrusion system that is coupled to the network,
(c) blocking, with the intrusion system, traffic on the network media matching one or more control signatures specific to a control network (“control signatures”),
wherein one or of the control signatures are indicative of traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media, and wherein the blocking step includes blocking traffic matching those one or more control signatures.

### Claim 13 (depends on 12)

The method of claim 12, wherein one or more of the control signatures are indicative of one or more of the following:
an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login with any of a standard user name and standard password, via
any of an FTP and a telnet protocol, to a digital data device in communications
coupling with the network media; an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;
traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;
traffic other than from MAC addresses falling within a selected range; and wherein
the blocking step includes blocking traffic matching those one or more control signatures.

### Claim 14 (depends on 12)

The method of claim 12, wherein one or more of the control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of
a password “gnomes”;
a username “fox” and a password “gnomes”; and wherein
the blocking step includes blocking traffic matching those one or more control signatures.

### Claim 15 (depends on 12)

The method of claim 12, wherein one or more of the control signatures are indicative of an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of
a username “hstorian”, wherein that username is a misspelled formative of “historian”;
a username “Administrator” with password “password”;
a username “bpm”;
a username “pam”; and wherein
the blocking step includes blocking traffic matching those one or more control signatures.

### Claim 16 (depends on 12)

The method of claim 12, wherein one or more of the control signatures are indicative of an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the blocking step includes blocking traffic matching those one or more control signatures.

### Claim 17 (depends on 16)

The method of claim 16, wherein one or more of the control signatures are indicative of an attempt to access, via any of the ftp and the tftp protocol, any of the following:
a password file named “sam” on a digital data device executing a Windows operating system;
a password file named “passwd” on a digital data device executing a Unix operating system;
a password file named dmpasswd_cfg on a digital data device comprising a display manager; and wherein
wherein the blocking step includes blocking traffic matching those one or more control signatures.

### Claim 18 (depends on 12)

The method of claim 12, wherein the one or more of the control signatures are indicative of packets with a data payload bearing one or more selected commands.

### Claim 19 (depends on 18)

The method of claim 18, wherein the one or more of the control signatures are indicative of packets with a data payload bearing any of a “setpars” and “omset” command.

### Claim 20

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:
(a) network media that is coupled to control devices to support digital data communications therewith,
(b) an intrusion system that monitors traffic on the network media utilizing signature-based detection in order to identify traffic that is potentially adverse to the control devices or control system,
(c) the intrusion system utilizing one or more signatures specific to a control network (“control signatures”) and blocking traffic on the network media matching at least a selected control signature,
(d) wherein the control signatures are indicative of the following:
traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media; an
attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login with any of a standard user name and standard password, via any of
an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;
an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;
traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;
traffic other than from MAC addresses within a selected range;
an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of
a password “gnomes”;
a username “fox” and a password “gnomes”;
an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of
a username “hstorian”, wherein that username is a misspelled formative of “historian”;
a username “Administrator” with password “password”;
a username “bpm”;
a username “pam”;
an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and
wherein the blocking step includes blocking traffic matching at least the selected control signature.

### Claim 21

A method of hardening a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the method comprising:
(a) selectively deactivating any of an operating system service and other service on one or more digital data processors on the digital data network;
(b) backing up the one or more digital data processors to preserve at least current system status;
(c) testing, following deactivation, to determine whether such deactivation affects normal and/or expected operation of any of the control system, the digital data network and the one or more digital data processors;
(d) responding to testing revealing that the deactivation resulted in any of abnormal and unexpected operation by re-activating the deactivated service, and repeating steps (a)-(c) with other services;
(e) following deactivation of services believed non-essential to said normal and/or expected operation, testing any of said digital data network and said one or more digital data processors for any of hacking, intrusion and mischievous action (collectively, “penetration”);
(f) responding to testing revealing that such penetration occurs by repeating steps (a)-(d) with additional services.

### Claim 22 (depends on 21)

The method of claim 21, wherein the backing up step includes performing an incremental backup.

### Claim 23 (depends on 21)

The method of claim 21, wherein the deactivating step includes deactivating a plurality of services.

### Claim 24 (depends on 1)

The digital data network of claim 1, wherein the intrusion system provides a failure-mode in which traffic on the network media cannot pass the intrusion protection system in the event of fault of the intrusion protection system (“fail-closed”), thereby shutting down a communications connection between the first and second zones.

### Claim 25 (depends on 1)

The digital data network of claim 1, wherein the intrusion system provides a failure-mode in which traffic on the network media cannot pass the intrusion protection system in the event of fault of the intrusion protection system (“fail-closed”), thereby shutting down a communications connection between the first and second zones, and another failure mode in which traffic on the network media can pass the intrusion protection system in the event of fault of the intrusion protection system (“fail-open”).