US 8,782,771 B2 · Real-time industrial firewall

Abstract

Providing for employing a real time firewall to secure components of an automation control network from unauthorized communication to or from such components is disclosed herein. A monitoring component can inspect at least a portion of an instance of communication directed toward or originating from a component of the automation control network. Such inspection can, e.g., be a deep packet inspection based on information received from a communication request and/or response protocol. A filtering component can selectively admit or deny propagation of the instance of communication based on the inspection and a predetermined security criterion. In such a manner, the subject innovation can provide for limited access to network components from office network machines and for securing components of an automation control network from influence by unauthorized entities.

Claims24

Dependent claims

A system, comprising:

a memory configured to store computer-executable components;
a processor, communicatively coupled to the memory, configured to execute or facilitate execution of the computer-executable components, the computer-executable components comprising:
an identification component configured to determine disparate functions represented at disparate tiers of a tiered command structure and performed by an industrial device of an industrial automation network based on topological structure data associated with a composition of the industrial device that is specified by an industrial automation protocol employed by the industrial automation network, wherein the topological structure data comprises hierarchical structure information related to the disparate functions;
and
a device assignment interface configured to determine, based on information extracted from a received communication request protocol message, one or more access rules employed to independently restrict access to the disparate functions by a specified device that is external to the industrial automation network.

2 more elements

A non-transitory computer readable storage medium comprising computer-executable instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:

based on a topological structure data associated with a composition of the industrial device that is specified by an industrial automation protocol employed by an automation control network, determining a tiered command structure that represents, at disparate tiers, disparate functions performed by an industrial device, wherein the topological structure comprises hierarchical structure information related to the disparate functions;
and
based on information extracted from a communication protocol data packet, assigning respective access criteria to the disparate functions to independently control access of the disparate functions by a device coupled to a network that is external to the automation control network.

A method, comprising:

determining, by a system comprising a processor, topological structure data that is indicative of different functions represented at disparate tiers of a tiered command structure and performed by a first device of an industrial automation network, wherein the topological structure data comprises hierarchical structure information related to the different functions that is specified by an industrial automation protocol utilized by the industrial automation network;
and
based on respective access criteria assigned to the different functions, independently controlling access of the different functions by a second device external to the industrial automation network, wherein the respective access criteria is determined based on information extracted from a received communication protocol data packet.

A non-transitory device-readable storage medium comprising device-executable instructions that, in response to execution, cause a system comprising a processor, to perform operations, comprising:

determining, based on information extracted from a received communication protocol data packet, respective access rights that are to be assigned to different functions performed via an industrial device within an industrial automation network, wherein the different functions are determined based on hierarchical structure data of the industrial device that represents the different functions at different tiers of a tiered command structure specified by an industrial automation protocol employed by the industrial automation network;
and
based on the access rights, independently controlling access to the different functions by a device external to the industrial automation network.

Dependencies are inferred from the claim text.

Real-time industrial firewall

Life of this patent

Real-time industrial firewall

Life of this patent

Abstract

Claims24