Patent application EP17164314A (EP), filed 2017-03-31
Publication number: EP3382479A1
Title: RULE-BASED COMMUNICATING OF EQUIPMENT DATA FROM AN INDUSTRIAL SYSTEM TO AN ANALYSIS SYSTEM USING UNI-DIRECTIONAL INTERFACES
Abstract: [0001]    A computer system (110) provides a rule-based communication of equipment data (105) from an industrial system (101) to an analysis system (120). The computer system (110) transmits equipment data (105) through a first uni-directional interface (150) in a first data direction, but receives rule modifications (115) through a second uni-directional interface (136). The first interface (150) can be implemented with a data diode (151), and the second interface (136) can be implemented by an air-gap for interaction with a mobile data carrier (132). The mobile data carrier (132) provides instructions that allow the modification of the rules.
IPC codes: G05B  19/   042            A I
G05B  19/   418            A I
H04L  67/    04            A I
H04L  67/   125            A I
Claims: number: 1
text: A computer system (110) that is adapted to communicate with an industrial system (101), the computer system (110) comprising:
number: 2
text: The computer system (110) according to claim 1, wherein the first uni-directional interface (150) is implemented with a data diode (151).
number: 3
text: The computer system (110) according to claim 2, wherein the second uni-directional interface (136) is adapted to receive the control instruction (115) in a first part (125-A) of the data packet (125) and that is adapted to receive the first part (125-A) of the data packet (125) in a size that correspond to the amounts of data required to identify the modification of the particular rule (Rk).
number: 4
text: The computer system (110) according to claim 3, wherein the second uni-directional interface (136) receives the data packet (125) from a mobile data carrier (132) that is communicatively coupled to the further computer system (120), wherein the second uni-directional interface (136) comprises an optical sensor (134) to receive the data packet (125) via an optical code from the mobile data carrier.
number: 5
text: The computer system (110) according to claim 3, wherein the second uni-directional interface (136) receives the data packet (125) from a mobile data carrier (132) being a mobile device that is communicatively coupled to the further computer system (120), wherein the second uni-directional interface (136) comprises an acoustical sensor (134) to receive the data packet (125) via a sequence of acoustical codes from a loudspeaker of the mobile device.
number: 6
text: The computer system (110) according to any of claims 3-5, wherein the data collection server (112) is adapted to receive the control instruction (115) in combination with a certificate that is identified in a second part (125-B) of the data packet (125) so that the further computer system (120) is authenticated.
number: 7
text: The computer system (110) according to any of the preceding claims, wherein the data collection server (112) is adapted to pre-process the equipment data (105) according to pre-determined rules that are selection rules to provide the data stream (114) as a sub-set of equipment data (105).
number: 8
text: The computer system (110) according to any of the preceding claims, wherein the data collection server (112) is adapted to pre-process the equipment data (105) according to pre-determined rules that are identification rules to provide the data stream (114) with identifiers to allow selective data transmission to different further computer system, or to allow selective data transmission to different applications (122-1, 122-2, 122-3) in the one or more further computer systems (120).
number: 9
text: Computer-implemented method (600) for operating a computer system (110) that forwards equipment data (105) from an industrial system (101) to an analysis system (120), the method (600) comprising:
number: 10
text: The method according to claim 9, wherein in step receiving (630) the data packet (125), the data packet (125) has a first part (125-A) that comprises the control instructions (115) in a size that allows to modify the at least one particular rule (Rk).
number: 11
text: The method according to claim 10, wherein in step receiving (630) the first part (125-A) comprises the control instructions (115) in a size that allows to modify an attribute set of the at least one particular rule (Rk).
number: 12
text: The method according to any of claims 10 and 11, wherein the data packet (125) has a second part (125-B) with a certificate to allow the computer system (110) to authenticate the origin of the data packet (125).
number: 13
text: A computer program product - when loaded into a memory of a computer and being executed by at least one processor of the computer - performs the steps of the computer-implemented method according to any of claims 9-12.
Office action: search_report, dated 2018-10-03
Prior art cited: ref_id: US2013117556A1
ref_type: patent
severity: background
ref_id: US2011295448A1
ref_type: patent
severity: background
ref_id: WO2005114364A1
ref_type: patent
severity: background
ref_id: US2014051380A1
ref_type: patent
severity: background
ref_id: - SEE: "Secure Cross Border Information Sharing Using One-way Data Transfer Systems", 1 April 2009 (2009-04-01), pages 1 - 21, XP055409146, Retrieved from the Internet <URL:https://www.researchgate.net/profile/Ronald_Mraz/publication/265232217_Secure_Cross_Border_Information_Sharing_Using_One-way_Data_Transfer_Systems/links/583c8b5608ae502a85e3e8ed/Secure-Cross-Border-Information-Sharing-Using-One-way-Data-Transfer-Systems.pdf?origin=publication_detail> [retrieved on 20170922]
ref_type: npl
severity: background
ref_id: - AUSTIN SCOTT ET AL: "Tactical Data Diodes in Industrial Automation and Control Systems", 18 May 2015 (2015-05-18), GIAC directory of certified professionals, pages 1 - 32, XP055290300, Retrieved from the Internet <URL:http://www.giac.org/paper/gicsp/242/tactical-data-diodes-industrial-automation-control-systems/142041> [retrieved on 20160721]
ref_type: npl
severity: background
ref_id: WO2005114364
ref_type: patent
severity: background
ref_id: US2011295448
ref_type: patent
severity: background
ref_id: US2013117556
ref_type: patent
severity: background
ref_id: US2014051380
ref_type: patent
severity: background
ref_id: - See, "Secure Cross Border Information Sharing Using One-way Data Transfer Systems", (20090401), pages 1 - 21, URL: https://www.researchgate.net/profile/Ronald_Mraz/publication/265232217_Secure_Cross_Border_Information_Sharing_Using_One-way_Data_Transfer_Systems/links/583c8b5608ae502a85e3e8ed/Secure-Cross-Border-Information-Sharing-Using-One-way-Data-Transfer-Systems.pdf?origin=publication_detail, (20170922), XP055409146 [A] 1,2,4,9,13 * the whole document *
ref_type: npl
severity: background
ref_id: - Austin Scott ET AL, "Tactical Data Diodes in Industrial Automation and Control Systems", GIAC directory of certified professionals, (20150518), pages 1 - 32, URL: http://www.giac.org/paper/gicsp/242/tactical-data-diodes-industrial-automation-control-systems/142041, (20160721), XP055290300 [A] 1,2,4,9,13 * the whole document *
ref_type: npl
severity: background
Final disposition: pending (2018-10-03)