BACKGROUND

[0001] The present embodiments relate to communications in an industrial control system (ICS). A programmable logic controller (PLC) is accessed via a transmission control protocol (TCP) connection over an internet protocol (IP) network of an Ethernet network. An attacker with access to the Ethernet or IP network may be able to intercept communications to and from the

programmable logic controller. Intercepted communication traffic may reveal sensitive information about the industrial process being controlled by the programmable logic controller. This sensitive information may include information that would be useful to an attacker in order to further penetrate the target systems, such as passwords. An attacker with access to the network may also send malicious commands to the programmable logic controller to disrupt the industrial process.

[0002] Sensitive communications with a programmable logic controller are protected by physically securing networks. The networks are buried or placed in inaccessible locations. Air gaps between control networks and external networks (e.g. the Internet) are often employed. The communications may be protected by encryption at the application layer (layer 7 in the open systems interconnection (OSI) model). VPN network bridges, which provide encryption at the network layer (layer 3 in the OSI model), may be used to secure communications. However, undesired access may still be provided through unsecured channels, whether due to lack of physical security or

communications security.

BRIEF SUMMARY

[0003] By way of introduction, the preferred embodiments described below include methods, systems, instructions, and computer readable media for restricting communication in industrial control. VPN functionality is integrated within the PLC so that physical access to a cable may be insufficient to access information. Further communication security is provided by the programmable logic controller only accepting commands or messages provided through the VPN interface and not accepting messages addressed to the physical interface itself.

[0004] In a first aspect, a method is provided for restricting communication in industrial control. A virtual private network is established in an industrial control network. The virtual private network is established with a

programmable logic controller as an end point with virtual private network support provided by the programmable logic controller. Access to the programmable logic controller is allowed only by communications addressed to the end point of the virtual private network supported by the programmable logic controller. Access to the programmable logic controller of

communications other than the communications addressed to the end point of the virtual private network is prevented.

[0005] In a second aspect, a system is provided for restricting

communication in industrial control. A cable of an industrial control network connects to a physical interface of a programmable logic controller of the industrial control network. The programmable logic controller is configured for virtual private network communications and configured to only change operation in response to the virtual private network communications and not change operation in response to other network communications received at the physical interface.

[0006] In a third aspect, a non-transitory computer readable storage medium has stored therein data representing instructions executable by a programmed processor for restricting communication in industrial control. The storage medium includes instructions for receiving first and second messages at a physical interface of a programmable logic controller, the first message addressed to the programmable logic controller, the second message addressed to a virtual private network node hosted by the programmable logic controller; altering a setting of the programmable logic controller in response to the second message; and preventing access to the programmable logic controller by the first message. [0007] The present invention is defined by the following claims, and nothing in this section should be taken as a limitation on those claims.

Further aspects and advantages of the invention are discussed below in conjunction with the preferred embodiments and may be later claimed independently or in combination.

BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The components and the figures are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention. Moreover, in the figures, like reference numerals designate corresponding parts throughout the different views.

[0009] Figure 1 is a block diagram of one embodiment of a system for restricting communication in industrial control; and

[0010] Figure 2 is a block diagram of one embodiment of a programmable logic controller in an industrial control network of the system of Figure 1 ;

[0011] Figure 3 is a flow chart diagram of one embodiment of a method for restricting communication in industrial control; and

[0012] Figure 4 is a block diagram of the system of Figure 1 with

established VPN communications.

DETAILED DESCRIPTION OF THE DRAWINGS AND PRESENTLY PREFERRED EMBODIMENTS

[0013] VPN communication support is integrated into the programmable logic controller. The integrated VPN is used to ignore all communication unless the communication arrives via the VPN. The integrated VPN provides encryption at the network layer (i.e., layer 3 in the OSI model). The

encryption secures the communication against eavesdropping and

manipulation. Physical attacks where the attacker disconnects the device's Ethernet cable and substitutes a dummy programmable logic controller or intercepts communications in the cable may be prevented. Attacks where the attacker impersonates a wireless access point or wireless stations are also prevented. Rather than using discrete VPN bridges and routers which may allow for physical disconnection between the bridge and the programmable logic controller, the VPN capability is directly integrated into the

programmable logic controller. Integrated VPN support provides the benefits of using a separate VPN device but without the space requirements. An integrated VPN may not be bypassed by physical manipulation.

[0014] Figure 1 shows a system for restricting communication in industrial control. The system is an industrial control system using an industrial control network. The industrial control network implements industrial processes using field devices. For example, the system may monitor and control a

manufacturing process using communications with field devices (e.g., programmable logic controllers or remote terminal units). The system provides control capabilities and may include a user interface for interacting with the control and data acquisition of the process.

[0015] The field devices are panels, programmable logic controllers, and/or remote terminal units. In the example of Figure 1 , three programmable logic controllers 20A-C, a human-machine interface device 22, and an operator station 24 are shown. Additional, different, or fewer field devices may be provided. Other controllers, monitors, or devices for monitoring physical processes or characteristics and/or controlling manufacturing or production may be used.

[0016] The programmable logic controllers 20A-C are panels, computers, processors, circuits, or other programmable devices for automation of electromechanical, chemical, pneumatic, fluid, electrical, mechanical, or other processes. For example, the programmable logic controllers 20A-C control machinery on assembly lines, heating-ventilation-air conditioning (HVAC), refinery flow, mixing, or other devices or processes. The programmable logic controllers 20A-C output in response to input conditions within a limited time.

[0017] For operating, the programmable logic controllers 20A-C may include sensors and/or actuators. The sensors may be temperature, pressure, rate, current, voltage, inductance, capacitance, chemical, flow, or other sensors. Any number of sensors may be used. The actuators may be magnetic, electric, pneumatic, or other devices for altering, moving, drilling, welding, mixing, spinning, changing, or otherwise actuating. The sensors and actuators communicate with or are part of the field devices for control and measuring.

[0018] The programmable logic controllers 20A-C may be configured to operate based on programming. The actions to perform and/or the set points for when to perform the actions may be programmed. The work flow or series of actions may be configured. Based on input at a user interface and/or a project provided over the network, the programmable logic controllers 20A-C are configured to control one or more aspects of the industrial process based on triggers and/or report events associated with the industrial process.

[0019] To configure the programmable logic controllers 20A-C for operation with the industrial process, communications with set points, programs, or other information are provided. The communications are to or are from one or more of the programmable logic controllers 20A-C.

[0020] Figure 2 shows one embodiment of one or more of the

programmable logic controllers 20A-C, human-machine interface devices 22, operator stations 24, and engineering station 26. The devices are not required to be identical. For example, the programmable logic controllers 20A-C are purpose built to withstand stresses and forces in the industrial environment and/or are computers. The human-machine interface devices 22 are switches or buttons with communications capabilities, computers, or field panels. The operator stations 24 are field panels or computers. The engineering station 26 is a personal computer with one or more cards for interfacing or communicating with the other components.

[0021] The components include a processor 12, memory 14, and network interface 16. These parts provide for securing communications in the industrial control network. Additional, different, or fewer parts may be provided. For example, a memory 14 or processor 12 are not provided in a human-machine interface 24. As another example, a display is provided for the engineering station 26 and/or operator station 24. Any type of display may be used, such as LEDs, monitor, LCD, projector, plasma display, CRT, or printer. [0022] The processor 12 is a general processor, central processing unit, control processor, graphics processor, digital signal processor, three- dimensional rendering processor, image processor, application specific integrated circuit, field programmable gate array, digital circuit, analog circuit, combinations thereof, or other now known or later developed device for use in the industrial control network. The processor 12 is a single device or multiple devices operating in serial, parallel, or separately. The processor 12 may be a main processor of a computer, such as a laptop or desktop computer, or may be a processor for handling tasks in a purpose-built system, such as in a programmable logic controller 20A-C. The processor 26 is configured by software and/or hardware.

[0023] The memory 14 is a graphics processing memory, video random access memory, system memory, random access memory, cache memory, hard drive, optical media, magnetic media, flash drive, buffer, database, combinations thereof, or other now known or later developed memory device for storing data. The memory 14 stores one or more datasets representing sensor readings, set points, and/or actuator status. The memory 14 may store calculated values or other information for reporting or operating in the network. For example, event data is stored. The memory 14 may buffer or store received communications, such as storing messages for parsing.

[0024] The memory 14 or other memory is a non-transitory computer readable storage medium storing data representing instructions executable by the programmed processor 12 for restricting communication in industrial control. The instructions for implementing the processes, methods and/or techniques discussed herein are provided on computer-readable storage media or memories, such as a cache, buffer, RAM, removable media, hard drive or other computer readable storage media. Computer readable storage media include various types of volatile and nonvolatile storage media. The functions, acts or tasks illustrated in the figures or described herein are executed in response to one or more sets of instructions stored in or on computer readable storage media. The functions, acts or tasks are

independent of the particular type of instructions set, storage media, processor or processing strategy and may be performed by software, hardware, integrated circuits, firmware, micro code and the like, operating alone, or in combination. Likewise, processing strategies may include multiprocessing, multitasking, parallel processing, and the like.

[0025] In one embodiment, the instructions are stored on a removable media device for reading by local or remote systems. In other embodiments, the instructions are stored in a remote location for transfer through a computer network or over telephone lines. In yet other embodiments, the instructions are stored within a given computer, CPU, GPU, or system.

[0026] The network interface 16 is a physical connector and associated electrical communications circuit for networked communications. For example, a network card is provided. In one embodiment, the network interface 16 is an Ethernet connector and corresponding circuit, such as a PHY chip. Alternatively, wireless or other wired connection is provided.

[0027] The programmable logic controllers 20A-C have network

addresses. The network addresses correspond to the physical network interface 16 for the programmable logic controller 20A-C. Communications within the industrial control network are routed to and from the programmable logic controllers 20A-C over the network. The physical network interfaces 16 connect the programmable logic controllers 20A-C to the industrial control network for receiving and transmitting communications, such as messages.

[0028] Referring to Figure 1 , one or more cables 33 interconnect the programmable logic devices 20A-C and other network devices. The cables 33 are Ethernet cables, such as for the connection directly to the intefaces 16 of the programmable logic controllers 20A-C. In other embodiments, other cables, such as shared busses, are used. Wireless connections may be provided instead of or in addition to the cables 33. Any transmission medium may be used, such as a cable, like Ethernet or RS485, or a radio signal, such as WiFi or cellular network, or an optical signal via fiber optic/open air

[0029] Switches and/or routers may be provided to switchably route communications to the desired devices in the industrial control network. The cables 33 provide the paths for communications to and/or from the devices (e.g., programmable logic controllers 20A-C). The switches or routers interconnect the nodes of the industrial control network using other cables or communications (e.g., wireless). The industrial control network includes one or more communications networks. For example, a field network

interconnects the field devices. The field network may be wired and/or wireless. Any communications format may be used, such as PROFINET, HTTP, FTP, Ethernet, or Modbus TCP. The field devices communicate to indicate events and to implement control, such as determining the status of operation of one programmable logic controller 20A to control another device with another programmable logic controller 20B.

[0030] For establishing secure communications, the engineering station 26 and field devices are configured by software and/or hardware to perform various functions. The engineering station 26 is configured to download operating programs to the field devices. Different field devices (e.g., programmable logic controllers 20A-C) may communicate amongst themselves or with other devices within the industrial control network.

Communications may occur with devices in other networks or outside the industrial control network.

[0031] Instead of routing the communications using the industrial control network or physical network addresses, VPNs are established. VPN tunnels are created and maintained or are dynamically created as needed. A virtual network is laid over the industrial control network. This virtual network establishes one or more point-to-point communications tunnels for secure communication. All communications use the VPNs, or some of the

communications may also use the base industrial control network. In alternative embodiments, one or more devices do not use a VPN.

[0032] The end-points 21 , 23, 25, 27, 29, 31 of the VPN manage the VPN. For the programmable logic controllers 20A-C, the end-point 21 , 23, 25 for the VPN is the programmable logic controllers 20A-C themselves. The

programmable logic controllers 20A-C are configured to support virtual private network communications and to operate in the industrial control network. For example, the processor 12 connects with the interface 16 as well as sensors and actuators directly or indirectly to control the industrial processing, and the processor also manages VPN communications.

[0033] The programmable logic controllers 20A-C are configured by hardware (e.g., a chip) and/or software to support VPN communications. This integrated VPN support allows the programmable logic controllers 20A-C, without an added component (e.g., bridge) outside the housing of the programmable logic controllers 20A-C, to accept and process VPN

communications.

[0034] Any VPN and corresponding support may be used. For example, the programmable logic controllers 20A-C are pre-loaded with or obtain a certificate or key for encryption and decryption. The end-points of the VPN connection share public keys or information allowing encryption and decryption of communications. Other security may be used. In one embodiment, the security is provided by use of the unique VPN addressing. The VPN addresses are created when needed or when a tunnel is formed and provided only between end-points sharing the VPN. SSL/TLS, IPsec, or other secure communications may be used. The support may be algorithms to establish the VPN and/or to operate as a VPN end-point.

[0035] The programmable logic controllers 20A-C may receive

communications from different networks. For example, messages are received on the industrial control network addressed to and formatted for the programmable logic controller 20A-C, and messages are received on the VPN addressed to and formatted for the VPN end-point hosted by the

programmable logic controllers 20A-C. Similarly, the programmable logic controllers 20A-C transmit messages addressed and formatted for use of the industrial control network or the VPN. The transmissions and receptions occur using the same physical interface 16 of the programmable logic controller 20A-C, but have different addressing, security, and/or formatting.

[0036] To provide additional security, the programmable logic controllers 20A-C are configured to only change operation in response to the VPN communications and not change operation in response to other network communications received at the physical interface 16. If the message is a VPN communication (e.g., addressed, secured and/or formatted for the VPN), the programmable logic controller 20A-C acts on the message. A response may be sent, the message may be parsed, settings may be changed, a sequence may be changed, or other change in operation may occur. The change in operation is relative to the industrial process and/or interaction on a network (e.g., VPN or industrial control network). If the message is a VPN communication, the programmable logic controller 20A-C may alter what, when, or how a process implemented by the programmable logic controller 20A-C occurs. If the message is a VPN communication, the programmable logic controller 20A-C may respond or process the message.

[0037] If the message is other than a VPN communication, such as being addressed using the industrial control network and not the VPN end-point address, the communication is not used to change operation. A response may not be sent. A setting or process may not change despite the message requesting change. The message is dropped, not buffered, not parsed, and/or not acted upon. In other embodiments, the non-VPN message is saved and/or transmitted for analysis as an error or anomaly.

[0038] When the industrial control network is set-up manually or automatically, the VPN may not exist. Messages for configuring the industrial control network may be allowed. Similarly, messages for configuring or setting-up the VPN may be allowed. Once the VPN exists on a functional network backbone (e.g., industrial control network), the messaging is limited to only VPN communications. In other embodiments, the limitation to only VPN communications applies just to one or more classes of messages. For example, the VPN only limitation is applied to any message associated with industrial process control. Messages associated with network maintenance, configuration, or use are not limited to only VPN. The reverse (e.g., VPN only limit for network and not industrial control messages) may be used. Other classes of messages may have the same or different limitations.

[0039] Figure 3 shows a method for restricting communication in industrial control. The method is implemented by the system of Figure 1 , a component of Figure 2, or another system and/or component. The acts are performed in the order shown or other orders. For example, acts 38 and 42 are performed at a same time as part of a same process.

[0040] Additional, different, or fewer acts may be provided. For example, the acts of Figure 3 focus on the operations of the programmable logic controller. Additional or different acts are provided for other devices of the industrial control network using VPN communications. For example, acts 38 and 42 for limiting communications or processing based on communications are or are not performed for or by other end-points or other field devices.

[0041] The industrial control network is commissioned. The components are placed and connected. The networked components are powered on and any tests are performed to confirm operation of the components and the network. Any acts for provisioning the industrial control system (industrial control network) are performed. The commissioning may occur in a known- good environment. The networked components are configured to operate without connection external to the industrial control system. Alternatively, the commissioning may occur in an environment where the network connects with another network.

[0042] The commissioning may include acts to arrange for and to exchange security tokens for establishing secure communications. In other embodiments, the commissioning is completed, and the exchange of security tokens occurs after commissioning and before operation of the industrial control process. In yet other embodiments, the industrial control network does not use security tokens.

[0043] Peers between the programmable logic controllers 20A-C, human machine interface devices 22, engineering station 26, and/or operator stations 24 may be established in the industrial control network. To establish peers, the identities are read from the field devices. Messaging may be used to obtain the identities. Because the engineering station 26 may have access to all of the field devices on the network, the engineering station 26 retrieves the physical or logical identifiers from each of the field devices. Alternatively, a broadcast, neighbor discovery, or query system is used to determine identities. The field devices may be programmed to seek out specific other devices of the industrial control network.

[0044] Once communications are established and/or secured for the industrial control network, one or more virtual private networks (VPNs) may be established using the industrial control network. The VPN or VPNs are established between peers in act 30. For example, Figure 4 shows the industrial control network of Figure 1 , but with connections for which communications are to occur in normal operation of the industrial control process. The programmable logic controllers 20A and 20B are to

communicate. The programmable logic controller 20C is to communicate with the operator station 24. The engineering station 26 or other supervisor or administrator control may communicate with all of the devices. Groups of more than two devices may be formed.

[0045] VPNs are established for the peer groups. Different VPNs are provided for different groups. Within a group, a single VPN is used.

Alternatively, more than one VPN may be used within a group. For example, three devices are to communicate. Three separate point-to-point VPNs are created to provide for the communications.

[0046] The VPN or VPNs are established in the industrial control network or other industrial control network. The devices of the industrial control network are used to host the virtual nodes of the VPN. The backbone (e.g., cabling and/or communications channels) of the industrial control network is used to transmit and receive VPN communications.

[0047] The programmable logic controllers and other devices are established as end points of the VPNs. In act 32, the programmable logic controllers provide VPN support. VPN software and/or hardware are included in or integrated with the programmable logic controllers. The tunneling, negotiating, verifying, or other acts for creating the VPN are performed, at least in part, by the processor or other components of the programmable logic controllers. By having VPN support, the programmable logic controller is capable of hosting an end-point of the VPN. Secured VPN communications are decrypted by the programmable logic controller, so there is no gap to intercept or insert non-encrypted messages.

[0048] The same processor controls or is part of controlling an industrial process and supports VPN. The resources of the programmable logic controller are shared for both industrial control and VPN support. The software and/or hardware supporting the VPN are in a same housing as the rest of the programmable logic controller. Different processors may be used for the VPN support and industrial control in the same programmable logic controller.

[0049] In act 34, a point-to-point connection is created for the VPN. A tunnel is created to provide communications between two end-points.

Different devices host the end-points. The VPN is established at the Open Systems Interconnection network or data link layer. The physical interface of the programmable logic controller is used for the VPN.

[0050] Since the virtual network is being created, the end-points of the VPN are assigned or create separate addresses. The hosting device has a different address for the base network (e.g., industrial control network) and for the virtual network. These VPN addresses are used for communicating in the VPN.

[0051] The VPN support authenticates the other end-point, such as by certificate exchange, checking from a trusted source, looking-up from a table, or other authentication. Any authentication may be used.

[0052] The VPN support of the programmable logic controller provisions security and/or formatting for the VPN. Encryption and decryption may be provisioned by the exchange of keys, certificates, or tokens. Rather than exchange, pre-stored information may be used to provision security. In one embodiment, security of communications for the VPN is established pursuant to Internet protocol security (IPsec) or transport layer security (SSL/TLS). Other protocols may be used.

[0053] In one embodiment, a key-exchange is used. Any key-exchange algorithm may be used. HTTPS, IPSEC, SSL, PKI or other cryptographic method may be used. For example, the VPN support randomly generates key pairs. One private key is kept by the component and the other public key is sent to the peer. Each peer receives a key for encrypting messages and/or digital signatures. The keys are the security tokens. Symmetric or

asymmetric (e.g., RSA) key algorithms may be used. In another example, a stateful connection is negotiated using a handshaking procedure. The lead end-point sends a digital certificate to the other end-point. The other end- point may or may not likewise send digital certificates to the lead end-point. The certificates may be used to generate shared secrets between the end- points for later authentication and/or encryption. The shared secret and/or the certificates are security tokens. In yet another example, the engineering station acts as an authentication server in a PKI system. As another example, preloaded and negotiated keys are used and the exchange algorithm confirms operability using the preloaded keys.

[0054] In act 36, communications occur using the established VPN and/or the control network. The programmable logic controller may route messages to be transmitted to the VPN end-point hosted by the programmable logic controller. The messages are transmitted from the programmable logic controller over the VPN rather than with the addressing, security, and/or format of the industrial control network. Alternatively, the messages use the different addressing, security, and/or format of the industrial control network.

[0055] Similarly, messages destined for the programmable logic controller are received at the physical interface. The received messages are

addressed, secured, and/or formatted for the industrial control network or for the VPN node. Messages addressed for the VPN may include industrial control network address information, but also include the VPN address.

Conversely, messages for the industrial control network do not include the VPN information.

[0056] The received message or messages are decrypted if encrypted. The decryption used is based on the addressing or network used for communication. The format of the message and/or security (e.g., type of encryption, key or other aspect of security) appropriate for the industrial control network may not be appropriate for the VPN and vice versa. Even if the same type of encryption is used, the VPN uses a different key or certificate than the industrial control network. Decrypting using the wrong key prevents use of the message, so the decryption appropriate for the type of message is applied. A VPN message is decrypted as appropriate for the VPN.

[0057] In acts 38 and 42, access is or is not allowed to the programmable logic controller. Access may be further message processing, such as using resources of the programmable logic controller to parse and read a message. Access may be to settings or operation of the programmable logic controller. For example, a set point, event log read-out, configuration, or other industrial control characteristic is altered. Access may be to network configuration. For example, the programmable logic controller is changed to use a different format, address, peer, or other operation associated with communications over the network. The access may be for control network administration. Any ability to read data from, elicit a response from, or change operation of the programmable logic controller uses access to the controller.

[0058] The requests for access are included in one or more messages. The message may request information, request a change in operation, or include other information relying on access to the programmable logic controller. The messages may be command messages.

[0059] In act 38, the access is allowed for messages received on the VPN. Messages addressed, secured, and/or formatted for the VPN as opposed to the industrial control network are processed in order to allow access.

Message processing of the programmable logic controller is permitted for VPN messaging. The messages are decrypted and parsed. Actions corresponding to the message content or payload are performed by the programmable logic controller. The programmable logic controller operates according to the message.

[0060] In act 40, the operation of the programmable logic controller changes according to the access. A setting is altered in response to the message or messages. The settings are set points, processes, configuration, or other values of variables that alter operation of the programmable logic controller. The control of the industrial equipment or process is changed based on a value provided in the message. Network, communications, administration, or other operation may be altered.

[0061] In act 42, access is prevented. Access to the programmable logic controller is prevented for communications other than VPN communications. If the address, security, and/or formatting of the message are for the industrial control network or other industrial control network and not for the VPN hosted by the network, access is prevented. The message is not parsed or processed. Even if parsed or processed, the access to the industrial control aspects of the operation are prevented. Set points or other control processing is not altered in response to the message even if the message includes a payload requesting or instructing the alteration. Access is only granted in response to messages received via the VPN.

[0062] Other messages may be dropped, not processed, processed but not implemented, or handled pursuant to an exception process. For example, the non-VPN communications are ignored. If the address is to the

programmable logic controller and not the end-point of the VPN hosted by the controller, the message is not processed or operated on.

[0063] The prevention is for all messages received by the programmable logic controller using other communications than the VPN. Alternatively, the prevention is for all messages of a particular type. Messages corresponding to network administration, industrial process control, or network

communication may be have different access and prevention controls. For example, the messaging is allowed and prevented in acts 38 and 42 for all messages dealing with industrial process control. Different standards, such as only allowing access for non-VPN messages, may be used for other types of messages, such as network administration messages for the industrial control network.

[0064] While the invention has been described above by reference to various embodiments, it should be understood that many changes and modifications can be made without departing from the scope of the invention. It is therefore intended that the foregoing detailed description be regarded as illustrative rather than limiting, and that it be understood that it is the following claims, including all equivalents, that are intended to define the spirit and scope of this invention.