Security device and field bus system for supporting secure communication by means of a field bus

A security device to support secure communication via a field bus, has a connecting apparatus for the direct coupling of the security device to a network interface of a field bus subscriber, which is formed for connecting to a field bus and which is not formed for secure communication via the field bus. In the coupled state, there is a link between the security device and the field bus subscriber such that, if the link is disconnected or damaged, proper operation of the security device is reversibly or irreversibly blocked. Further, a transmitting and receiving apparatus is provided which is formed to securely transfer data coming from a directly coupled field bus participant, which is not formed for secure communication, via the field bus according to a predetermined security protocol, and which is further formed to receive data transferred via the field bus and intended for the field bus participant according to the predetermined security protocol and to deliver them to the field bus participant.

FIELD

The invention relates to a security device and a field bus system to support a secure communication by means of a field bus.

BACKGROUND

Communication security in information and communication technology is now playing an increasingly important role in the entire cyberspace and thus also in industrial automation technology.

From the EP 2 940 541 A2, a measure is known with which a secure communication can be offered to a conventional device within a micro network (Microgrid). For this purpose, a security device is connected between a conventional local device and a remote connection, which is formed as a BITW (bump-in-the-wire) device. Such BITW devices are switched on and managed as separate and independent units.

Existing field bus network protocols such as Modbus, PROFONET, Ethernet/IP, HART or Foundation Field bus protocols do not contain any security mechanisms or functions, i.e. security mechanisms with which communication links between two or more subscribers can be protected against external attacks, for example. Known security functions that ensure communication security and, in particular, the protection of the exchange of information between subscribers are, for example, authentication algorithms. Algorithms for integrity protection or encryption and decryption algorithms. Up to now, the known field bus networks have been protected with the help of firewalls or application gateways arranged in the periphery, so that trustworthy zones are created within which communication, however, is insecure.

From the DE 102 48 100A1 a security-related device for the connection of field devices to a security-related field bus is known. For this purpose, a field bus plug, which has a security-related field bus interface that enables the transfer of security-related signals via the field bus to a control system. The security-related signals correspond to the required security categories and thus safety aspects. In addition, the field bus plug has a security-related, field bus-neutral device interface to which a security field device with a security-related, field bus-neutral field bus interface can be connected. Thanks to the special field bus plug, which has both a security-related, field bus-neutral field bus station and a security-related, but field bus-dependent field bus interface, field devices only have to be developed for a security-related, field bus-neutral field bus interface.

SUMMARY

The invention is based on the object to create a security device and a field bus system with which it is possible to give field bus subscribers, that do not have a security function, the possibility to communicate securely via a field bus.

The technical problem mentioned above is solved by the features of claim1.

Accordingly, a security device is provided for the support of a secure communication via a field bus. The security device has a connecting apparatus for the direct coupling of the security device to a field bus-formed network interface of a field bus subscriber which is not formed for a secure communication via the field bus. This means that the field bus subscriber does not have any security functionality for safeguarding a communication. In other word: the field bus subscriber that does not have a security functionality for securing a communication, is not technically capable to protect an information exchange between itself and at least one other field bus subscriber.

The security device is formed in such a way that in the coupled state between the security device and the field bus subscriber, which is not formed for secure communication via the field bus, there is a link in such a way that after disconnection or damage to the coupling, the proper operation of the security device is reversibly or irreversibly blocked. The security device also has a network interface for connecting the security device to the field bus. The security device further has a transmitting and receiving apparatus which is formed to securely transfer data coming from a directly coupled field bus subscriber which is not formed for secure communication via the field bus according to a predetermined security protocol. Furthermore, the transmitting and receiving apparatus is formed to receive, via the field bus, data determined for the field bus subscriber according to the predetermined security protocol and to deliver them to the field bus subscriber as non-secure.

A predetermined security protocol is a protocol that protects a communication link or information exchange between two or more subscribers. For example, the predetermined security protocol regulates authentication, integrity protection, data encryption or data decryption. Thus, the security device is preferably formed to perform an authentication method and/or to perform at least one cryptographic algorithm according to the predetermined security protocol to ensure secure communication, e.g. protected against external attacks.

Depending on the predetermined security protocol, the transmitting and receiving apparatus can also be formed for decrypting encrypted data received via the field bus and for encrypting data to be transferred from a connected field bus subscriber which is not formed for secure communication via the field bus.

In order to execute cryptographic algorithms, the security device can have a secure storage apparatus for storing cryptographic keys. Programs for the execution of security functions according to the predetermined security protocol can also be stored in the secure storage apparatus.

At this point it should already be mentioned that the security device can be adapted to changing security protocols for communication security. For this purpose, the security device can have a programming interface that allows appropriate programming of the security device. However, it is also conceivable that the security device can be updated via the field bus.

Advantageously, the security device has a control apparatus and a monitoring apparatus formed to monitor the link between the security device and a connected field bus subscriber. The control apparatus is formed to block the appropriate operation of the security device in response to an error signal from the monitoring apparatus. Such an error signal can be triggered by the security device if the security device is disconnected appropriately, i.e. without damage, or by force from the coupled field bus subscriber.

An advantageous further embodiment provides that the security device is integrated in a plug connector, in particular in an RJ45 plug.

Advantageously, the control apparatus can be formed to erase at least one of the cryptographic keys saved in the secure storage apparatus and/or irreversibly or reversibly block the connecting apparatus and/or the network interface of the security device in response to an error signal from the monitoring apparatus.

Due to this measure it is ensured that the security device can only, if at all, continue to be operated if a disconnection or damage of the coupling with the field bus subscriber is determined, when an operator releases the security device again, e.g. if the previously deleted cryptographic keys are resaved and/or the locked network interface and/or connecting apparatus is unlocked.

Expediently, the power supply of the security device occurs via the field bus, for example, by means of the known Power-Over-Ethernet technology, and/or by means of an internal power supply source and/or via a connected field bus subscriber and/or by means of Energy Harvesting technologies.

In the case that a field bus subscriber which is not formed for secure communication via the field bus and which is already coupled to the security device is to be enabled for non-secure communication via the field bus, the transmitting apparatus and receiving apparatus can be formed to transparently conduct data from the connected field bus subscriber to the field bus.

Preferably, a field device or a control device can be linked to the security device as a field bus subscriber.

The predetermined security protocol contains several defined security functions, such as authentication functions, encryption functions and integrity backup functions, which can be deployed as a separate protocol stack or integrated in a field bus protocol.

The above-mentioned technical problem is also solved by the features of claim12.

Accordingly, a field bus system is provided for the support of secure communication via a field bus. The field bus system comprises a field bus, at least one first field bus subscriber which has a network interface formed for switching on to the field bus, wherein the at least one first field bus subscriber is not formed for secure communication via the field bus. The at least one first field bus subscriber is connected to a security device which has been previously defined, wherein the security device is formed for secure communication according to a predetermined security protocol.

Advantageously, the at least one field bus subscriber and the security device coupled thereto are managed in the field bus system as a single field bus subscriber, for example if a common address is assigned to the at least one field bus subscriber and the security device coupled thereto.

Advantageously, a second field bus subscriber is connected to the field bus which is formed for secure communication with the security device of the at least one first field bus subscriber according to the predetermined security protocol.

In order to establish a stable and reliable coupling between the at least one first field bus subscriber and the at least one security device, the security device is detachably or non-detachably linked to the at least one first field bus subscriber. A detachable link is understood to be, for example, a bolted joint, whereas a non-detachable link can be, for example, a riveted, weld or adhesive joint.

According to an advantageous embodiment, at least one first field bus subscriber can be formed as a field device or control device and at least one second field bus subscriber as a field device or control device. A field device can, for example, be a sensor or actuator, while a control device can, for example, be a PLC (Programmable Logic Controller) or a DCS (Distributed Control System).

DETAILED DESCRIPTION

FIG. 1shows an exemplary security device20for supporting a secure communication via a field bus60, which is exemplarily shown inFIG. 3. In other words: The security device20is used for securing communication via the field bus60, for example to protect an information exchange against external attacks. AsFIG. 1exemplarily shows, the security device20can be integrated in a plug connector, in particular in an RJ45 plug20.

The security device20has a connecting apparatus10for the direct coupling of the security device20with a network interface31of a field bus subscriber30which is not formed for secure communication via the field bus60and is formed for connection to the field bus60. In other words, the field bus subscriber30does not have any security functionalities for securing of a communication. The network interface of the field bus subscriber30is preferably an RJ45 socket into which the RJ45 plug housing the security device20can be inserted. The RJ45 plug10and the RJ45 socket can be mechanically coupled to each other either detachably or non-detachably.

In the coupled state, as shown for example inFIG. 3, there is a link or coupling between the security device20and the field bus subscriber30such that, in the event of disconnection or damage to the coupling, the proper operation of the security device20is reversibly or irreversibly blocked.

It is conceivable that the security device20can be riveted to the field bus subscriber30, so that an attempt to remove the security device20from the field bus subscriber30will damage the security device20to such an extent that proper operation is irreversibly blocked. Advantageously, the field bus subscriber30will not be damaged when removing the security device20, or will not be damaged in such a way that it is no longer functional.

The security device20has a network interface50for connecting to the Field bus60. Preferably, the network interface50is an RJ45 socket which can be linked to the security device20via a cable40. Furthermore, a transmitting apparatus and receiving apparatus24is deployed in the security device20, which is formed to securely transfer data coming from a directly coupled field bus subscriber, for example the field bus subscriber30, which is not formed for secure communication, via the field bus60according to a predetermined security protocol. The transmitting apparatus and receiving apparatus24are further formed to receive data transferred via the field bus60and determined for the field bus subscriber30according to the predetermined security protocol, to unlock them subsequently and to deliver them to the field bus subscriber30. In this way, the exchange of information via the field bus60, for example, can be protected against external attacks.

The security device20can have a control apparatus22, which can be formed as a microcontroller. Furthermore, a monitoring apparatus21can be provided to monitor the electrical and/or mechanical link between the security device20and a connected field bus subscriber, such as the field bus subscriber30, wherein the control apparatus22is formed to block proper operation of the security device20in response to an error signal of the monitoring apparatus21. Such an error signal can be triggered by the security device20if the security device20is disconnected properly, i.e. without damage, or by force from the coupled field bus subscriber30.

The monitoring apparatus21, for example, can be formed as a pressure sensor that detects when the security device20is coupled to the field bus subscriber30. It is also conceivable that the monitoring apparatus21is formed to detect a current flow when the security device20is connected to field bus subscriber30.

Depending on the predetermined security protocol, the transmitting and receiving apparatus24can be formed for decrypting encrypted data received via the field bus60and for encrypting data to be transferred by a connected field bus subscriber, for example the field bus subscriber30, which is not formed for secure communication via the field bus. Additionally, or optionally, the security device20can be formed for carrying out an authentication method and/or at least one cryptographic algorithm according to the predetermined security protocol.

In order to encrypt data and execute a cryptographic algorithm, the security device20has a secure storage apparatus23in which cryptographic keys can be stored. In the secure storage apparatus23or a separate storage apparatus, programs can also be stored that can be executed for performing security functions according to the predetermined security protocol of control apparatus22. A Hardware Security Module (HSM) can be used as a secure storage apparatus.

The predetermined security protocol contains a plurality of security functions which can be executed by the security device20and which are known or still being developed. In particular, the predetermined security protocol is capable of supporting security functions for communication security independent of a protocol layer, for example of the 7-layer OSI model. An exemplary security function can support the performance of a MAC (Message Authentication Code) algorithm on layer2. Another security function can support Transport Layer Security (TLS) for TCP-based protocols. Another security function can support endpoint authentication and session key management on an application layer of the OSI layer model.

The security protocol, comprising a plurality of security functions, can be formed as a separate protocol stack or integrated into a field bus protocol that can be stored in the security devices.

Control apparatus22can be formed to erase at least one of the cryptographic keys saved in the secure storage apparatus23in response to an error signal from the monitoring apparatus21. In this way, the functionality of the security device20can be reversibly blocked. In the event that the security device20continues to be used, the deleted cryptographic key or a newly defined key can be written into storage23again. For this purpose, the security device20can have a programming interface for external programming. The programming interface can also be used to adapt the security device20to changing security protocols. In order to irreversibly block the functionality or proper operation of the security device20, it can be provided that the control apparatus22is formed to irreversibly or reversibly block the connecting apparatus10and/or the network interface50in response to an error signal from the monitoring apparatus21.

The power supply of the security device20can be provided via the field bus60, and/or via an internal power supply source (not represented), and/or via a connected field bus subscriber, e.g. field bus subscriber30, and/or via energy harvesting technologies. A power supply of the security device20via the field bus60can, for example, be achieved with the known Power-over-Ethernet technology. A battery can be used as the internal power supply source.

For example, the field bus subscriber30shown inFIG. 1can be a control device. However, a field device, such as a sensor or actuator, can also be connected to the security device20as a field bus subscriber.

FIG. 2shows an alternative security device120, which is housed in a housing130. It should be noted here that the functioning and construction of the security device120can essentially correspond to the functioning and construction of the security device20, so that, in order to avoid repetitions, reference is made to the discussions regarding the security device20.

Two flanges127and128can be arranged on the housing130, in each of which an opening is provided through which, for example, a screw or a rivet for coupling the security device120to a field bus subscriber can be passed. The security device120has a connecting apparatus121for the direct coupling of the security device120with a network interface of a field bus subscriber, for example the field bus subscriber30, which is not formed for secure communication via the field bus, formed for connecting to a field bus. The connecting apparatus121can be formed as an RJ45 plug, which is led out of the housing130of the security device120. Furthermore, the security device120has a network interface122for connecting the security device120to the field bus60. The network interface122can be formed as an RJ45 socket into which an RF-45 plug of a network cable can be inserted to link the security device120to the field bus60.

Again, as depicted inFIG. 3, an electrical and mechanical link exists in the coupled state between the security device120and the field bus subscriber30in such a way that, in the event of disconnection or damage to the coupling, the proper operation of the security device120is reversibly or irreversibly blocked. The security device120also has a network interface122for connecting the security device120to the field bus60, as also depicted inFIG. 3. Furthermore, the security device120has a transmitting/receiving apparatus123which is formed to securely transfer data coming from a directly coupled field bus subscriber, for example the field bus subscriber30, which is not formed for secure communication, via the field bus60according to a predetermined security protocol. Furthermore, the transmitting apparatus and receiving apparatus123is formed to receive data transferred via the field bus60and determined for the field bus subscriber30according to the predetermined security protocol and to deliver them to the field bus subscriber30.

Similar to the security device20, the security device120can have a monitoring apparatus124, a secure storage125and a control apparatus126, which is formed, for example, as a microcontroller. A programming interface129can be provided for programming the security device120. A computer can be connected to this programming interface129, for example, via which, for example, cryptographic keys can be written to the secure storage125. The security device120can also be adapted to changing security protocols via the programming interface129. The corresponding security functions can also be deposited in the secure storage125or a separate storage (not represented). The microcontroller126can access the cryptographic keys and programs deposited in the secure storage125in order to execute the corresponding security functions.

FIG. 3shows an exemplary field bus system5for supporting a secure communication via the field bus60.

The field bus system5has the field bus60as well as at least one first field bus subscriber80, which has a network interface81, which is formed for switching on the field bus subscriber80to the field bus60. The at least one first field bus subscriber80, which can be a sensor, for example, is not formed for secure communication via field bus60. In other words, the field bus subscriber80does not include any security functionality to secure communication and therefore no security functionality to secure communication via field bus60.

At least one first field bus subscriber80is connected to a120′ security device via the network interface81. The120′ security device is formed for secure communication according to a predetermined security protocol. In other words, a security functionality is deployed in the120′ security device which can, for example, perform authentication, integrity protection, data encryption and data decryption in order to secure communication to and from the field bus subscriber80, in particularly against external attacks.

The security device120′ can be a security device which is essentially identical in structure and functionality to the security device120shown inFIG. 2. The security device120′ thus has a transmitter/receiver unit and a network interface122′ for connecting to field bus60and a connection interface121′ for mechanical and electrical linking to the field bus subscriber80. Optionally, the120′ security device can have a control apparatus, a monitoring apparatus, a secure storage apparatus and a programming interface. The security device120′ can be housed in a housing130′, on which two flanges127′ and128′ can be arranged. The flanges127′ and128′ each have an opening through which a screw111or110or a rivet for mechanical coupling with the field bus subscriber80can be passed. In the field bus subscriber80, corresponding recesses can be provided for accommodating the screws. A network cable92is linked to the network interface122′ of the security device120′ for connection of the security device120′ to the field bus60.

On field bus60, another field bus subscriber70, formed, for example, as an actuator, can be connected via a network cable91. The field bus subscriber70, unlike the field bus subscriber80, is formed for secure communication via field bus60. In other words: The security functions of the predetermined security protocol are already deployed in the field bus subscriber70.

For example, the control device30shown inFIG. 1is also connected to the fieldbus60via the security device120shown inFIG. 2. The security device120, for example, is not detachably connected to the control device30via screws100and101that pass through the openings in flanges127and128of the housing130. As shown further inFIG. 3, the security device120is also connected to the fieldbus60via a network cable90. For this purpose, the network cable90is connected to the network interface122of the security device120.

According to an advantageous further embodiment, the security device120and the security device122′ can also be connected to the control device30or the sensor80in a non-detachable way via a riveted joint. Such a mechanical coupling ensures that the respective security device cannot be removed from the respective field bus subscriber without destroying or damaging the network interface122or122′. Such a riveted joint thus ensures that the functionality of the security device120or120′ is irreversibly blocked after removal. This means that the security device can no longer be used.

As already mentioned, the security devices120and120′ can, for example, be supplied with power via the field bus60by means of the known Power-Over Ethernet technology. Alternatively, or additionally, the security device120can be supplied with power by the control device30and the security device120by the sensor80. Alternatively, or additionally, each security device can have its own internal power supply, for example in the form of a battery. In addition, the known energy harvesting technologies can also be used to supply the security devices120and120′ with power.

It should also be noted that the security devices20,120and120′ can be considered as so-called hardware security modules in which security algorithms, random number generators and encryption algorithms can be deployed according to a predetermined security protocol.

With the exemplary field bus system5it is possible, among other things, to transfer encrypted data from the sensor80to the control device30. For this purpose, the data transferred from sensor80to security device120′ is encrypted according to a security function and transmitted to security device120via the field bus. The security device120decrypts the received data and transmits it to the control apparatus30unencrypted. In a similar way, data can be transmitted in encrypted form from actuator70to security device120and then delivered in decrypted form to the control apparatus30. In a similar way, data determined by the control apparatus30for the sensor80are first transmitted in encrypted form from the security device120via the field bus60to the security device120. The received data are then decrypted by the security device120′ and delivered to the sensor80. Furthermore, the security devices120and120′ and the actuator70can be adapted to perform mutual authentication according to the predetermined security protocol.

Thanks to the security devices120and120′, it is now possible to enable secure communication, for example protected against external attacks, between the field bus subscribers70and80and the control device30via the field bus60, even if the control device30and the field bus subscriber80themselves have no communication security measures.

It is conceivable that proper operation of security device120will only be reversibly blocked if the security device20together with the control device30is disconnected from the field bus60without the control device30being removed from the security device120. In this case, the proper operation of the security device120can be reactivated by a targeted intervention of an operator, so that the control device30can be re-connected to the field bus60and operated with the coupled security device120.

In the event that security functions of a predetermined security protocol have not yet been saved or unlocked in the security devices120and120′, the transmitting and receiving apparatus123of the security device120and the security device120′, respectively, are formed to transparently pass data from the control device30and data from the sensor80to the field bus60to enable conventional, i.e. non-secure, communication between the control device30and the sensor80. This can be useful if an existing, non-secure field bus system is to be converted to a secure field bus system. For this purpose, the security devices120and120′ are coupled to the field bus subscribers30and80, which are not formed for a secure communication, and then connected to the field bus60. Initially, security devices work transparently. At a later point in time, the corresponding security functions are then enabled in the security devices120and120′ in accordance with the security protocol.

Advantageously, the field bus subscriber30and the security device120coupled to it are managed in the field bus system5as a single field bus subscriber, for example by assigning a common address to the field bus subscriber30and the security device120coupled to it. In a similar way, a shared address can also be assigned to field bus subscriber80and the coupled security device120′. In this way, the exemplary field bus system5can be considered as a field bus system with three field bus subscribers.