Active Response Security System for Industrial Control Infrastructure

摘要

An industrial controller resistant to malicious attacks may provide a graduated response employing the elements of the control system to reduce access to the control system, log data, and announce intrusion based on a dynamically evolving assessment of the severity of any detected security issues.

主权项

1. A security controller for an industrial control system comprising:
(a) a network port for communicating with other control elements of the industrial control system; (b) at least one processor communicating with the network port; and (c) an electronic memory system accessible by the processor and holding a security program executing on the processor to: (1) receive from at least one other given control element of the industrial control system a security thumbprint providing an encrypted compressed representation of a current state of the given control element; (2) analyze the security thumbprint against a stored benchmark thumbprint representing a security thumbprint of the given control element when the given control element is properly operating; (3) when the security thumbprint does not match the stored benchmark thumbprint, assess the mismatch to produce a severity assessment having a multi-value range; and (4) implement a security response action selected from among multiple security response actions to respond to the mismatch based on the severity assessment.