Patent ID: 8555373

Claim:
A network device configured to provide security for an industrial control system, the network device comprising: a first port connectable to a network carrying industrial control data employing an industrial control protocol; a second port connectable to a control device communicating with an industrial process for control thereof; a hardware security component configured to communicate with the first and second port, receive network packets, and extract packet identifying data from the network packets to compare with an allow list in a data table, the hardware security component configured to pass the network packets to the second port when the extracted packet-identifying data is in the allow list and otherwise configured to pass the network packet to a software security component; and the software security component executing separately from the hardware component and configured to communicate with, the second port and the hardware security component, the software security component comprising an electronic computer configured to execute a stored program to receive network packets passed from the hardware security component and extract state data from multiple network packets according to the industrial control protocol to: identify objectionable network packets passed from the hardware security component; reject the objectionable network packets without transmitting them to the second port; identify allowable network packets passed from the hardware security component; identify which of the allowable network packets require high speed processing; obtain packet-identifying data from the allowable network packets requiring the high speed processing; load the packet-identifying data into the allow list; and pass the allowable network packets to the second port without further intervention by the hardware security component.