Patent ID: 8737398

Claim:
An interface module in a programmable logic controller (PLC) comprising: an Ethernet switch; a first port electrically coupled to a CPU module of the PLC and to the Ethernet switch; a second port electrically coupled to a plant network and the Ethernet switch; a third port electrically coupled to a control office network and the Ethernet switch; and a processor configured to control communication to the PLC and the plant network from the control office network by: extracting a valid source media access control (MAC) address, a valid destination MAC address, and a service protocol type from a packet, wherein the valid source MAC address and the valid destination MAC address are included in a subset of predetermined addresses; determining a layer 2 packet activity level; determining whether to pass the packet for further processing at layer 3 based on layer 2 configuration information, the extracted valid MAC addresses and extracted service protocol type, and the determined layer 2 packet activity level; when the packet is processed at layer 3, extracting a valid IP source address, a valid IP destination address, and a valid application services indicator from the packet; determining a layer 3 packet activity level; determining whether to pass the packet based on layer 3 configuration information, the extracted valid IP addresses and the extracted valid application services indicator at a deepest level of information, and the determined layer 3 packet activity level, wherein the packet is either forwarded to the valid IP destination address through one of the ports or sent to higher layer processing when the valid destination IP address corresponds to the interface module; and filtering as configured at a deepest level of an application protocol.