# US 9,438,628 B2 · Apparatus and method for securing a distributed control system (DCS) > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,628 B2 - Document ID: US9438628B2 - Status: Granted - Kind: B2 - Application number: 14/308,946 - Filed: 2014-06-19 - Published: 2015-07-30 - Granted: 2016-09-06 - Earliest claimed: 2014-01-27 - Assignees: Honeywell International Inc. - Applicants: Honeywell International Inc. - Inventors: Harshal S. Haridas; Alexander Chernoguzov - Web page: https://patentgrep.com/patent/US9438628B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04W 12/50: Secure pairing of devices - H04L 63/0281: {Proxies} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method includes receiving, at a first distributed control system (DCS) node over a network, information associated with a security manager. The method also includes establishing multiple communication channels between the first DCS node and the security manager over the network using the information, where the communication channels include a non-secure channel and a secure channel. The method further includes receiving security credentials from the security manager at the first DCS node over the non-secure channel and receiving a security policy and an activation time from the security manager at the first DCS node over the secure channel. In addition, the method includes transitioning the first DCS node to communicate with a second DCS node over the network using the security policy at the activation time. ## Claims ### Claim 1 A method comprising: receiving, at a first distributed control system (DCS) node over a network, information associated with a security manager; establishing multiple communication channels between the first DCS node and the security manager over the network using the information, the communication channels including a non-secure channel and a secure channel; receiving security credentials from the security manager at the first DCS node over the non-secure channel; receiving a security policy and an initial activation time from the security manager at the first DCS node over the secure channel; performing a handshake operation with a second DCS node; determining whether to adjust the initial activation time based on a result of the handshake operation with the second DCS node; and transitioning the first DCS node to communicate with the second DCS node over the network using the security policy at one of: the initial activation time or an adjusted activation time. ### Claim 2 (depends on 1) The method of claim 1, wherein receiving the information associated with the security manager comprises: transmitting a bootstrap protocol (BOOTP) request from the first DCS node to a BOOTP server; and receiving a BOOTP response from the BOOTP server at the first DCS node, the BOOTP response including a network address of the security manager and identifiers of ports to be used to communicate with the security manager. ### Claim 3 (depends on 1) The method of claim 1, wherein establishing the multiple communication channels comprises: establishing the non-secure channel with the security manager using a first predefined policy; and establishing the secure channel with the security manager using a second predefined policy. ### Claim 4 (depends on 3) The method of claim 3, wherein establishing the multiple communication channels further comprises, after establishing the non-secure channel but before establishing the secure channel: transmitting a join request from the first DCS node to the security manager over the non-secure channel; and receiving a join response from the security manager at the first DCS node over the non-secure channel, the join response comprising a certificate that represents the security credentials. ### Claim 5 (depends on 4) The method of claim 4, wherein receiving the join response comprises receiving the join response from the security manager after a user approves the join request. ### Claim 6 (depends on 1) The method of claim 1, further comprising: communicating with the security manager indirectly via a security proxy, the security proxy located in a subnetwork, the security manager located outside the subnetwork. ### Claim 7 (depends on 1) The method of claim 1, wherein performing the handshake operation comprises performing the handshake operation before transitioning the first DCS node to communicate with the second DCS node to verify that both the first and second DCS nodes are prepared to securely communicate with one another. ### Claim 8 (depends on 1) The method of claim 1, wherein: the handshake operation comprises a four-way handshake that includes: the first DCS node transmitting a first policy update message including the initial activation time to the second DCS node and receiving a first acknowledgement from the second DCS node; and the first DCS node receiving a second policy update message from the second DCS node and transmitting a second acknowledgement to the second DCS node; and determining whether to adjust the initial activation time based on the result of the handshake operation with the second DCS node comprises determining whether to adjust the initial activation time based on whether the first and second acknowledgements were received in response to the first and second policy update messages, respectively. ### Claim 9 An apparatus comprising: a first distributed control system (DCS) node comprising: at least one interface configured to receive over a network information associated with a security manager; and at least one processing device configured to: establish multiple communication channels including a non-secure channel and a secure channel between the first DCS node and the security manager over the network using the information; receive security credentials from the security manager over the non-secure channel via the at least one interface; receive a security policy and an initial activation time from the security manager over the secure channel via the at least one interface; perform a handshake operation with a second DCS node; determine whether to adjust the initial activation time based on a result of the handshake operation with the second DCS node; and transition the at least one interface to communicate with the second DCS node over the network using the security policy at one of: the initial activation time or an adjusted activation time. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the at least one processing device is configured to: initiate transmission of a bootstrap protocol (BOOTP) request to a BOOTP server via the at least one interface; and receive a BOOTP response from the BOOTP server via the at least one interface, the BOOTP response including a network address of the security manager and identifiers of ports to be used to communicate with the security manager. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the at least one processing device is configured to: establish the non-secure channel with the security manager using a first predefined policy; and establish the secure channel with the security manager using a second predefined policy. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the at least one processing device is configured, after establishing the non-secure channel but before establishing the secure channel, to: initiate transmission of a join request to the security manager over the non-secure channel via the at least one interface; and receive a join response from the security manager over the non-secure channel via the at least one interface, the join response comprising a certificate that represents the security credentials. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the security policy is different from the first and second predefined policies. ### Claim 14 (depends on 9) The apparatus of claim 9, wherein the at least one processing device is configured to perform the handshake operation before transitioning the at least one interface to communicate with the second DCS node to verify that both the first and second DCS nodes are prepared to securely communicate with one another. ### Claim 15 (depends on 9) The apparatus of claim 9, wherein: the handshake operation comprises a four-way handshake that includes: the first DCS node transmitting a first policy update message including the initial activation time to the second DCS node and receiving a first acknowledgement from the second DCS node; and the first DCS node receiving a second policy update message from the second DCS node and transmitting a second acknowledgement to the second DCS node; and the at least one processing device is configured to determine whether to adjust the initial activation time based on whether the first and second acknowledgements were received in response to the first and second policy update messages, respectively. ### Claim 16 A non-transitory computer readable medium embodying a computer program, the computer program comprising computer readable program code for: receiving, at a first distributed control system (DCS) node over a network, information associated with a security manager; establishing multiple communication channels between the first DCS node and the security manager over the network using the information, the communication channels including a non-secure channel and a secure channel; receiving security credentials from the security manager at the first DCS node over the non-secure channel; receiving a security policy and an initial activation time from the security manager at the first DCS node over the secure channel; performing a handshake operation with a second DCS node; determining whether to adjust the initial activation time based on a result of the handshake operation with the second DCS node; and transitioning the first DCS node to communicate with the second DCS node over the network using the security policy at one of: the initial activation time or an adjusted activation time. ### Claim 17 (depends on 16) The computer readable medium of claim 16, wherein the computer readable program code for receiving the information associated with the security manager comprises computer readable program code for: initiating transmission of a bootstrap protocol (BOOTP) request from the first DCS node to a BOOTP server; and receiving a BOOTP response from the BOOTP server at the first DCS node, the BOOTP response including a network address of the security manager and identifiers of ports to be used to communicate with the security manager. ### Claim 18 (depends on 16) The computer readable medium of claim 16, wherein the computer readable program code for establishing the multiple communication channels comprises computer readable program code for: establishing the non-secure channel with the security manager using a first predefined policy; initiating transmission of a join request from the first DCS node to the security manager over the non-secure channel; receiving a join response from the security manager at the first DCS node over the non-secure channel, the join response comprising a certificate that represents the security credentials; and establishing the secure channel with the security manager using a second predefined policy. ### Claim 19 (depends on 16) The computer readable medium of claim 16, wherein the computer readable program code for performing the handshake operation comprises: computer readable program code for performing the handshake operation before transitioning the first DCS node to communicate with the second DCS node to verify that both the first and second DCS nodes are prepared to securely communicate with one another. ### Claim 20 (depends on 16) The computer readable medium of claim 16, wherein: the handshake operation comprises a four-way handshake that includes: the first DCS node transmitting a first policy update message to the second DCS node and receiving a first acknowledgement from the second DCS node; and the first DCS node receiving a second policy update message from the second DCS node and transmitting a second acknowledgement to the second DCS node; and the computer readable program code for determining whether to adjust the initial activation time based on the result of the handshake operation with the second DCS node comprises computer readable program code for determining whether to adjust the initial activation time based on whether the first and second acknowledgements were received in response to the first and second policy update messages, respectively.