Patent ID: 8756411
Filing Date: 2014-06-17
Classification: H04L,Y04S

Abstract:
1. A method for protecting a substation device that receives operation commands over an Internet Protocol (IP) communications network comprising: receiving an inbound data packet that contains an operation command for the device; comparing the layer 2 header MAC addresses, IP addresses, port numbers and protocol number with an access control list; responsive to at least one of the layer 2 header MAC addresses, IP addresses, port numbers and protocol number violating the access control list, dropping the data packet; comparing the layer 3 header source address, destination address and protocol number with the access control list; responsive to at least one of the layer 3 header source address, destination address and protocol number violating the access control list, dropping the data packet; comparing the layer 4 header sequence number and acknowledgement number with a connection status; responsive to the layer 4 sequence number or acknowledgement number not conforming with the connection status, dropping the data packet; decrypting application layer data into a predetermined communication protocol; comparing the application layer data sequence number with an expected application layer sequence number; responsive to the application layer data sequence number not conforming with the expected application layer sequence number, dropping the data packet; comparing the operation command with a Role-Based Access Control (RBAC) comprising: timestamping the received, inbound data packet; calculating a Round-Trip Time (RTT) for the received, inbound data packet, wherein the RTT is computed as the time difference between the received, inbound data packet and its subsequent acknowledgement packet; reading an Intrusion Detection Profile (IDP), wherein the IDP specifies an RTT range for the inbound, received data packet's source port; and responsive to the inbound data packet's RTT not being within the IDP RTT range, generating an alarm event.