Method for obscuring a control device's network presence by dynamically changing the device's network addresses using a cryptography-based pattern
AssigneeRockwell Automation Technologies, Inc.
InventorsMark B. Anderson, David D. Brandt, Ramadas M. Pai, Taryl J. Jasper
Life of this patent
Estimating the term…
Abstract
A network security system comprises a first component that generates an address for identifying a communicating device on a network. A second component receives the address generated by the first component and facilitates transitioning from an existent address to the generated address. Such transitioning is effectuated in order to protect the network against attack while providing seamless communications with respect to the communicating device.
Claims25
A system for implementing network security, comprising:
- a configuration component configured to generate a new address that identifies a first industrial device on a network and timing information defining a time at which the first industrial device is to transition to the new address, and send a first instruction that includes the new address and the timing information to the first industrial device, wherein the first instruction is configured to set a first timing component associated with the first industrial device to the time defined by the timing information, trigger a count-down based on the time defined by the timing information, and cause the first industrial device to transition from an existent address to the new address in response to expiration of the count-down;
- and
- a second timing component configured to select the time defined by the timing information, wherein the first timing component is further configured to synchronize with the second timing component.
A method for securing a network against stealth attacks, comprising:
- altering, by a system including a processor, a network address of a first industrial device at varying time intervals, the altering comprising:
- synchronizing a first timing component associated with an address authority device with a second timing component associated with the first industrial device;
- generating a new address for the first industrial device;
- determining, by the first timing component, an address change time at which to replace an existent address assigned to the first industrial device with the new address;
- communicating a first instruction that includes the new address and the address change time to the first industrial device, the first instruction initiating a count-down of the second timing component associated with the first industrial device based on the address change time;
- and
- replacing the existent address assigned to the first industrial device with the new address in response to expiration of the count-down.
A non-transitory computer-readable medium having stored thereon computer-executable components that, in response to execution, cause a processor to perform operations, the operations comprising:
- synchronizing a first clocking mechanism associated with an address authority device with a second clocking mechanism associated with an industrial device;
- associating the industrial device with a first address;
- generating a second address for the industrial device;
- specifying an address change time at which to implement an address alteration in the industrial device based on the first clocking mechanism;
- informing the industrial device of the second address and initiating a count-down of the second clocking mechanism of the industrial device based on the address change time;
- and
- replacing the first address with the second address in the industrial device in response to the count-down expiring.
A method for protecting devices on an industrial network against unauthorized access, comprising:
- altering, by a system including a processor, a network address of an industrial device at pre-defined intervals, the altering comprising:
- synchronizing a first timing component associated with an address authority device with a second timing mechanism associated with the industrial device;
- generating a new address for the industrial device;
- determining, based on the first timing component, an address change time at which to replace an existent address assigned to the industrial device with the new address;
- communicating a first instruction that includes the new address and the address change time to the industrial device, wherein the first instruction sets the second timing component of the industrial device to the address change time and initiates a count-down of the second timing component based on the address change time;
- and
- replacing the existent address assigned to the industrial device with the new address in response to expiration of the count-down.
Dependencies are inferred from the claim text.