# US 9,438,562 B2 · Network security module for Ethernet-receiving industrial control devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,562 B2 - Document ID: US9438562B2 - Status: Granted - Kind: B2 - Application number: 14/042,782 - Filed: 2013-10-01 - Published: 2014-01-30 - Granted: 2016-09-06 - Earliest claimed: 2008-02-14 - Assignees: Rockwell Automation Technologies, Inc. - Applicants: Rockwell Automation Technologies, Inc. - Inventors: Brian A. Batke; Sivaram Balasubramanian - Web page: https://patentgrep.com/patent/US9438562B2 ## CPC - H04L 63/0254: {Stateful filtering} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A high-speed security device for network connected industrial controls provides hybrid processing in tandem hardware and software security components. The software security component establishes state-less data identifying each packet that requires high-speed processing and loads a data table in the hardware component. The hardware component may then allow packets matching data of the data table to bypass the software component while passing other non-matching packets to the software component for more sophisticated state analysis. ## Claims ### Claim 1 A network device configured to provide security for an industrial control system, wherein the industrial control system includes a plurality of network devices connected by an industrial network and wherein the industrial control system controls an industrial machine or process, the network device comprising: a dedicated hardware component configured to: receive a plurality of packets from a network, extract identifying data from each of the packets, compare the identifying data to an allow list, when the identifying data matches the allow list pass the corresponding packet through the network device, and when the identifying data does not match the allow list pass the corresponding packet to a processor configured to execute independently from the dedicated hardware component; a first port in communication between the industrial network and the dedicated hardware component; and a second port in communication between both the dedicated hardware component and the processor and a control device operatively connected to the industrial machine or process; and the processor configured to execute a series of instructions to: extract additional data from the packets received from the dedicated hardware component, identify each of the packets as allowable or objectionable based on the additional data, reject the objectionable packets, pass the allowable packets through the network device, determine whether the allowable packets should be added to the allow list, and when the allowable packets should be added to the allow list, extract the identifying data from the packet and add the identifying data to the allow list. ### Claim 2 (depends on 1) The network device of claim 1 wherein the additional data is used to determine whether the allowable packet should he added to the allow list. ### Claim 3 (depends on 1) The network device of claim 1 wherein the additional data includes at least one of an input signal and an output signal for a control device in communication with the processor. ### Claim 4 (depends on 1) The network device of claim 1 wherein the dedicated hardware component is selected from one of an application specific integrated circuit and a field programmable gate array. ### Claim 5 (depends on 1) The network device of claim 1 wherein the dedicated hardware component and the processor are separate modules both integrated onto one of an application specific integrated circuit and a field programmable gate array. ### Claim 6 (depends on 1) The network device of claim 1 wherein each of the packets from the network are encrypted and wherein the dedicated hardware component includes an encryption key and is configured to decrypt the packet with the encryption key. ### Claim 7 (depends on 1) The network device of claim 1 wherein the identifying data is selected from the group consisting of: a source address indicating a source of the packet, a port number indicating a logical port at which the packet is received, and a connection identification number assigned to the communication connection. ### Claim 8 A network device configured to provide security for an industrial control system, wherein the industrial control system includes a plurality of network devices connected by an industrial network and wherein the industrial control system controls an industrial machine or process, the network device comprising: a dedicated hardware component configured to: receive a plurality of packets from a network, extract identifying data from each of the packets, compare the identifying data to an allow list, when the identifying data matches the allow list pass the corresponding packet through the network device, and when the identifying data does not match the allow list pass the corresponding packet to a processor configured to execute independently from the dedicated hardware component; a first port in communication between the industrial network and the dedicated hardware component; a second port in communication between both the dedicated hardware component and the processor and a control device operatively connected to the industrial machine or process, and the processor configured to execute a series of instructions to: extract additional data from the packets received from the dedicated hardware component, identify each of the packets as allowable or objectionable based on the additional data, reject the objectionable packets, and pass the allowable packets through the network device. ### Claim 9 (depends on 8) The network device of claim 8 wherein the processor is further configured to execute the series of instructions to: determine whether the allowable packets should be added to the allow list, and when the allowable packets should be added to the allow list, extract the identifying data from the packet and add the identifying data to the allow list. ### Claim 10 (depends on 8) The network device of claim 8 wherein the additional data is used to determine whether the allowable packet should be added to the allow list. ### Claim 11 (depends on 8) The network device of claim 8 wherein each of the packets from the network are encrypted and wherein the dedicated hardware component includes an encryption key and is configured to decrypt the packet with the encryption key. ### Claim 12 (depends on 8) The network device of claim 8 wherein the identifying data is selected from the group consisting of a source address indicating a source of the packet, a port number indicating a logical port at which the packet is received, and a connection identification number assigned to the communication connection. ### Claim 13 A method of providing security for a network device in an industrial control system having an industrial network transmitting a plurality of message packets, wherein each message packet includes at least one packet identifying field and at least one additional field, the method comprising the steps of: receiving the plurality of message packets from the industrial network with a hardware security component via a first port; extracting the at least one packet identifying field of the message packet with the hardware security component; comparing the at least one packet identifying field of the message packet to an allow list with the hardware security component; passing each message packet to a second port on the network device with the hardware security component when the at least one packet identifying field of the message packet matches the allow list, wherein the second port is in communication with a control device for the industrial control system; passing each message packet to a software security component executing on a separate processor when the at least one packet identifying field of the message packet does not match the allow list; identifying which of the message packets received from the hardware security component are allowable with the software security component; and passing each allowable message packet to the second port on the network device with the software security component. ### Claim 14 (depends on 13) The method of claim 13 wherein the step of identifying which of the message packets received from the hardware security component are allowable with the software security component includes: comparing the at least one packet identifying field of the message packet to a second allow list with the software security component; and identifying the message packets as allowable when the at least one packet identifying field of the message packet matches the second allow list. ### Claim 15 (depends on 13) The method of claim 13 further comprising the steps of: selecting a portion of the message packets identified as allowable with the software security component to be added to the allow list; extracting the at least one packet identifying field of the selected message packets with the software security component; and adding the at least one packet identifying field of the selected message packets to the allow list with the software security component. ### Claim 16 (depends on 15) The method of claim 15 wherein the step of selecting a portion of the message packets identified as allowable with the software security component to be added to the allow list includes: extracting data from at least one additional field of the message packets; and selecting the portion of message packets as a function of the data from the at least one additional field.