Network security module for Ethernet-receiving industrial control devices

A network device configured to provide security for an industrial control system, the network device comprising:

• a first port connectable to a network carrying industrial control data employing an industrial control protocol;
• a second port connectable to a control device communicating with an industrial process for control thereof;
• a hardware security component being at least one of a field programmable gate array and an application specific integrated circuit, the hardware security component configured to communicate with the first and second port, receive encrypted network packets, review a data table to determine when a decryption key is available when the decryption key is available decrypt the packets and pass the packets to the second port and, when the decryption key is not available pass the packets to a software security component;
• and
• the software security component executing separately from the hardware security component and configured to communicate with the hardware security component, the software security component comprising an electronic computer configured to execute a stored program to receive encrypted network packets from the hardware security component and extract state data from multiple network packets according to the industrial control protocol to:
• execute a security protocol with a correspondent device communicating on the first port to authenticate the device on the first port;
• share a security code with the correspondent device;
• and
• load the security code in a data table.

A method of providing security for industrial control systems of control devices communicating over a network comprising the steps of:

• processing all incoming data from a first port using a hardware security component and with the hardware security component:
• reviewing the incoming data against allowance data stored in a data table of the hardware security component,
• identifying some incoming data as allowable,
• forwarding the data identified as allowable to a second port,
• identifying some incoming data as not allowable,
• sending the data identified as not allowable to a software security component without forwarding the data to the second port;
• and
• processing the data forwarded from the hardware security component using the software security component and with the software security component:
• analyzing the incoming data to identify some incoming data as allowable,
• forwarding the data identified as allowable to the second port without further intervention of the hardware security component,
• identifying a portion of the data identified as allowable as requiring high speed processing,
• updating the data table of the hardware security component with the portion of the data identified as allowable and requiring the high speed processing,
• identifying some incoming data as not allowable, and
• blocking the data identified as not allowable from the second port.