Control system backplane monitoring with FPGA

Described herein are various technologies for monitoring the backplane of a control system and detecting modifications of the control system (e.g., removal of modules, firmware updates, etc.). A monitoring device includes a field programmable gate array (FPGA), and is connected to the backplane of the control system. The monitoring device receives signals, by way of the backplane, that are communicated among modules connected to the backplane. The monitoring device detects a modification to the control system based upon the received signals.

BACKGROUND

Control systems regulate behavior of devices found in critical infrastructure (e.g., electric power, wastewater treatment, oil pipelines, etc.). Control systems can face disruption from physical interference (e.g., vibrations, water damage, etc.). Further, as control systems have become connected to the Internet, control systems have become vulnerable to cyber-attacks by malicious adversaries. For example, a cyber-attack on a control system can introduce alterations to low-level computer instructions that are executed by the control system. The alterations can lead to modifications in operation of the control system (e.g., disabling modules of control systems, preventing the modules from operating according to specifications, etc.). Modification of the control system can result in physical damage to the devices regulated by the control system. Additionally, the modification of the control system can result in machinery, controlled by the control system, operating in an undesirable manner.

Conventional approaches for monitoring a control system do not provide real-time detection of modifications of the control system. Further, conventional approaches may not monitor a control system in an electrically isolated manner. By not monitoring the control system in an electronically isolated manner, conventional approaches may present attack vectors for intelligent adversaries.

SUMMARY

Described herein are features related to a system that can monitor a backplane of a control system and detect a modification of the control system. A monitoring device (e.g., which can be or include a field programmable gate array (FPGA)) can be connected to the backplane of the control system. The monitoring device can receive signals communicated over the backplane from a plurality of modules that are connected to the backplane. Responsive to receiving the signals, the monitoring device can convert the signals and generate data frames based upon the converted signals. Further, the monitoring device can be configured to filter the data frames based upon a characteristic filter. The characteristic filter comprises a set of rules defining whether or not a data frame, individually or within a group, indicates that a modification of the control system has occurred. Additionally, use of the characteristic filter can result in a performance enhancement, as unnecessary computations are avoided.

The monitoring device, additionally, can be configured to identify a specific modification of the control system based upon a comparison of the filtered data frame to a predefined list, wherein the predefined list comprises data frames that indicate that specific modifications of the control system have occurred (e.g., when a module has been remove from a slot on the backplane, when a module has ceased functioning, etc.). After determining that a filtered data frame matches a data frame from the predefined list, the monitoring device can output an indication that a specific modification of the control system has occurred.

Further, the monitoring device can comprise a computing system. The computing system can be configured to receive a plurality of filtered data frames, and to further execute algorithms over the data frames to determine whether a modification of the control system has occurred based upon a comparison of the plurality of the data frames to a model of activity of the control system.

DETAILED DESCRIPTION

Various technologies are presented herein pertaining to monitoring a backplane of a control system and detecting modifications of the control system, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more aspects. It may be evident, however, that such aspect(s) may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing one or more aspects.

Further, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or”. That is, unless specified otherwise, or clear from the context, the phrase “X employs A or B” is intended to mean any of the natural inclusive permutations. That is, the phrase “X employs A or B” is satisfied by any of the following instances: X employs A; X employs B; or X employs both A and B. In addition, the articles “a” and “an” as used in this application and the appended claims should generally be construed to mean “one or more” unless specified otherwise or clear from the context to be directed to a singular form. Additionally, as used herein, the term “exemplary” is intended to mean serving as an illustration or example of something, and is not intended to indicate a preference.

As used herein, the terms “component”, “device”, and “system” are intended to encompass computer-readable data storage that is configured with computer-executable instructions that cause certain functionality to be performed when executed by a processor. The computer-executable instructions may include a routine, a function, or the like. It is also to be understood that a component or system may be localized on a single device or distributed across several devices. The terms “component”, “device”, and “system” are also intended to encompass hardware configured to cause certain functionality to be performed, where such hardware can include, but is not limited to including, Field-programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

With reference now toFIG. 1, an exemplary control system100is illustrated. The control system100is configured to control a physical system102, wherein the physical system102comprises machinery. Generally, the control system100is configured to transmit control signals to the machinery of the physical system102, wherein operation of the machinery is controlled based upon the control signals. The machinery can be or comprise the machinery of an assembly line in a manufacturing plant, machinery deployed in a power station that is used to operate the station, machinery on maritime vessels, etc. As noted above, conventionally, there has been a lack of a suitable system that is configured to detect modifications made to the control system100when the control system100is controlling operation of the physical system102. Exemplary modifications of the control system include a (possibly undesired) firmware update, modules being added or removed from the control system, etc. The control system100, as will be described in greater detail below, includes a monitoring device104that is configured to detect modification to the control system100while the physical system102is being controlled by the control system100.

With more detail pertaining to the control system100, the control system100comprises a backplane106, modules108-110(which can include sensors, programmable logic controllers (PLCs), actuators, etc.), and the monitoring device104. The backplane106comprises a physical assembly and a communications bus for modules of the control system100. In an exemplary embodiment, the backplane106provides physical slots by way of which the modules108-110and the monitoring device104can be physically connected to the backplane106. The communications bus of the backplane106facilitates communication for modules connected to the backplane106. Further, the backplane106can provide power to the modules connected to the backplane106.

The modules108-110can comprise a programmable logic controller (PLC) that executes control logic, where the PLC, when executing the control logic, monitors sensor signals and generates control signals based upon the sensor signals, wherein the control signals are configured to control operation of machinery controlled by way of the control system100. Further, the modules108-110can comprise: 1) input devices (e.g. push-button, micro-switches, selector switches, proximity sensors, etc.) that are configured to signals that can be received as input to a PLC; and 2) output devices (displays, motors, etc.) that output data or signals.

The monitoring device104is configured to monitor the backplane106of the control system100and detect modifications of the control system100based upon signals communicated on the backplane106. The monitoring device104comprises an interface112and a hardware logic device114, such as a field-programmable gate array (FPGA). The interface112can be conceptualized as a physical interface and associated circuitry that allows for the monitoring device110to be coupled to a slot on the backplane106, to receive signals placed on the backplane106, and to place signals on the backplane. Therefore, the circuitry mentioned above can include passive components. Such configuration allows the interface112to receive signals communicated (by the modules108-110) on the communications bus of the backplane106. In the exemplary control system100, the interface112is configured to refrain from sending signals to the backplane106from the monitoring device104. Such configuration allows the monitoring device104to be electrically isolated from the remainder of the control system100, thereby preventing the monitoring device104from compromising the security of the control system100.

Due to the architecture of the exemplary control system100, signals placed on the backplane106are received by all modules connected to the backplane106. When a module from the modules108-110outputs a sensor signal to the backplane106, for example, the remaining modules108-110and the monitoring device104can receive the sensor signal by way of the backplane106, even when the signal is not directed to the remaining modules108-110or the monitoring device104.

The modules108-110of the control system100communicate various signals (e.g., control signals, sensor signals, etc.) with one another by way of the communications bus of the backplane106. A control signal comprises a command for a module from the modules108-110to perform an action (e.g., send data, execute a firmware update, control machinery on the physical system102, etc.). A sensor signal comprises data that indicates the status of a module from the modules108-110(e.g., data indicating that the machinery connected to the physical system102is operating in a certain way, data representing a measurement from a device monitored by a sensor, etc.). For example, a signal communicated by the first module108can be a control signal that directs a second module110to read data from computer-readable memory of a source (e.g., machinery on the physical system102). In the example, the first module108sends the control signal over the communications bus of the backplane106, and the second module110receives the signal from the communications bus of the backplane106.

Responsive to receiving the signals, the interface112converts the signals. For instance, the interface112can convert the signals into header signals and data signals, wherein a header signal of a received signal can comprise data that is indicative of an origin of the received signal, such as a module that generated the signal, an intended recipient module of the signal, time that the signal was generated, etc. A data signal of a received signal can comprise at least a portion of a payload. Further, the interface112can organize the header signals and data signals into first in, first out (FIFO) queues so that a header signal (from the header signals) can be grouped with one or more data signals (from the data signals) that correspond to the header signal. These queues are made accessible to the hardware logic device114.

The hardware logic device114accesses the organized signals from the queues, buffers the organized signals, and generates at least one data frame for each organized signal in the organized signals. Further, the hardware logic device114filters the data frames based upon a characteristic filter, wherein a data frame or data frames that satisfy the characteristic filter are flagged as indicating a possible modification to the control system100. The characteristic filter is a set of rules that, when satisfied with respect to a data frame or data frames, indicates that a modification of the control system100has possibly occurred. The set of rules can be based upon values of characteristics of the data frames relative to predefined values. Thus, the rules comprise the following operators: greater than, greater than or equal to, equal, less than, less than or equal to, not equal to, and bit mask. For example, the set of rules can comprise a rule that requires that a value at a bit location of the data frame be greater than a first predefined value. In another example, the set of rules can comprise a rule that requires that a size of the data frame is less than a second predefined value. The hardware logic device114can be configured to determine that a data frame (or a collective group of data frames) satisfies the characteristic filter when the data frame (or the collective group of data frames) satisfies all the rules in the set of rules. Alternatively, the hardware logic device114can be configured to determine that a data frame satisfies the characteristic filter when the data frame satisfies at least one rule (or a predetermined number of rules). Based upon determining that a data frame satisfies the characteristic filter, the hardware logic device114can determine that a modification of the control system100has possibly occurred. The hardware logic device114, as described in greater detail below, can be configured to send the filtered data frame to an optional computing system116.

The hardware logic device114is further configured to, responsive to determining that a data frame satisfies the characteristic filter (wherein a data frame that satisfies a characteristic filter is hereafter referred to as a filtered data frame), compare the filtered data frame to a predefined list. The predefined list comprises data frames that are mapped to specific modifications of the control system100(e.g., when a module from the modules108-110has been remove from a slot on the backplane102, when a module from the modules108-110has ceased functioning, etc.). When the filtered data frame matches a data frame in the predefined list, the hardware logic device114determines that the modification mapped to the data frame in the predefined list has occurred. Responsive to determining that the specific modification has occurred, the monitoring device104can output an indication that the specific modification of the control system100has occurred. The indication can be output as a real-time visual message (e.g., a notification that a modification of the control system has been detected) to a human machine interface that comprises a display. The indication, additionally, can be output as a report on a system log (syslog) on a computing system.

Furthermore, while certain functionality is described herein as being performed by the hardware logic device114, in some embodiments the hardware logic device114can perform various operations in conjunction with other systems and/or devices. For example, the monitoring device104can optionally comprise a computing system116. The computing system116can comprise a system on a chip (e.g., XILINX ZYNC SoC). A portion of the acts described herein as being performed by the hardware logic device114can instead be performed by the computing system116. Further, the computing system116can be configured to detect a modification of the control system100based upon a plurality of data frames that collectively satisfy the characteristic filter (and thus indicate a possibility of modification to the control system100). An example of a modification that can be detected based upon the plurality of data frames comprise occurrence of a firmware update of a module in the modules108-110.

With reference now toFIG. 2a functional block diagram of the exemplary computing system116is illustrated. The computing system116comprises at least one processor200and memory202. The computing system116is configured to receive a plurality of data frames (that individually or collectively satisfy the characteristic filter) from the hardware logic device114. The memory comprises202a monitoring component204that, when executed by the at least one processor200, determines whether a modification of the control system100has occurred based upon a comparison of the plurality of the data frames (received from the hardware logic device114) to a model of activity of the control system100.

The monitoring component204comprises a modeling component206that is configured to generate a model of activity of the control system100based upon previously captured control signals and sensor signals. The previously captured control signals and sensor signals can be captured when the control system100is operating under normal operating conditions. The model can be, for instance, a statistical model that can represent probabilities of certain control signals and/or sensor signals occurring with a modification of the control system100(e.g., firmware update of a module from the modules108-110) concurrently, within some window of time, etc.

The monitoring component204further comprises a comparison component208that is configured to determine whether the plurality of data frames that satisfy the characteristic filter (received from the hardware logic device114) correspond to a modification of the control system100represented in the model. The comparison component208, for example, can compare the plurality of data frames (representative of signals communicated on the backplane106) to control signal or sensor signal activity represented in the model. When the model indicates that the data frames are likely to occur during a specific modification (to the control system100), the comparison component208can output an indication that the specific modification of the control system100has occurred. Alternatively, when the model indicates that the data frames are unlikely to occur during a modification (to the control system100), the comparison component208can determine that a modification to the control system100has not occurred.

Responsive to determining that the specific modification has occurred, a notification component210can output an indication that the specific modification of the control system100has occurred. The indication can be output as a real-time visual message (e.g., a notification that a modification of the control system has been detected) to a human machine interface that comprises a display or a computing system. The indication, additionally, can be output as a report on a system log (syslog) on a computing system.

Referring now toFIG. 3, an exemplary methodology300that facilitates monitoring of a backplane of a control system and detecting modifications of the control system is illustrated. In an example, the methodology300is executed by a monitoring device, which can comprise an interface and a hardware logic device, such as an FPGA. The methodology300begins at302and, at304, a signal is received at the interface from at least one of a CPU module or an I/O module, where the CPU module and the I/O module communicate with one another by way of a communications bus of a backplane of a control system. At306, the interface converts the signal and sends the converted signal to the hardware logic device. At308, the hardware logic device receives the converted signal and generates a data frame based upon the converted signal. At310, the data frame is filtered through use of a characteristic filter, wherein the characteristic filter comprises a set of rules that are applied to the data frame. When the data frame satisfies one or more rules of the characteristic filter, the data frame can be held for further analysis (e.g., filtered from other data frames). At312, a determination is made as to whether the filtered data frame indicates that a specific modification of the control system has occurred based upon a predefined list, wherein the predefined list comprises a mapping between data frames and specific modifications to the control system. At314, when it is determined that the specific modification of the control system has occurred, the hardware logic device outputs a notification that the specific modification of the control system has occurred. The methodology300completes at316.

Referring now toFIG. 4, an exemplary methodology400that facilitates monitoring of a backplane of a control system and detecting modifications of the control system is illustrated. In an example, the methodology400is executed by a monitoring device, which can comprise an interface, a hardware logic device, such as an FPGA, and a computing system, such as a SoC. The methodology400begins at402and, at404, signals are received at the interface from at least one of a CPU module or an I/O module, where the CPU module and the I/O module communicate with one another by way of a communications bus of a backplane of a control system. At406, the interface converts the signals and sends the converted signals to the hardware logic device. At408, the hardware logic device receives the converted signals and generates data frames based upon the converted signals. At410, the hardware logic device filters the data frames based upon a characteristic filter (as described above), and outputs the data frames to the SoC. At412, a determination is made as to whether data frames indicate that a modification of the control system has occurred. At414, when it is determined that the modification of the control system has occurred, the hardware logic device outputs a notification that the modification of the control system has occurred. The methodology400completes at416.

Referring now toFIG. 5, a high-level illustration of an exemplary computing device500that can be used in accordance with the systems and methodologies disclosed herein is illustrated. For example, the computing device500may be utilized to determine whether a modification to a control system has been made. For example, the computing device500can operate as the computing system116and/or a portion thereof. The computing device500includes at least one processor502that executes instructions that are stored in a memory504. The instructions may be, for instance, instructions for implementing functionality described as being carried out by one or more components discussed above or instructions for implementing one or more of the methods described above. The processor502may access the memory504by way of a system bus506(which may be subdivided into a plurality of buses). In addition to storing executable instructions, the memory504may also store signals generated by modules on a control system, a set of rules, etc.

The computing device500additionally includes a data store508that is accessible by the processor502by way of the system bus506. The data store508may include executable instructions, data frames, etc. The computing device500also includes an input interface510that allows external devices to communicate with the computing device500. For instance, the input interface510may be used to receive instructions from an external computer device, from a user, etc. The computing device500also includes an output interface512that interfaces the computing device500with one or more external devices. For example, the computing device500may display text, images, etc., by way of the output interface512.