WO2016081970A1

WO2016081970A1 - Automation system and method for operating same

Info

Publication number: WO2016081970A1
Application number: PCT/AT2015/050300
Authority: WO
Inventors: Michael Naderhirn
Original assignee: S&T Ag
Priority date: 2014-11-25
Filing date: 2015-11-25
Publication date: 2016-06-02
Also published as: DE102014117282A1

Abstract

The invention relates to an automation system which, according to an exemplary embodiment, comprises at least one programmable logic controller designed to communicate, via a data bus, with at least one system to be controlled, using a second communication protocol. The automation system further comprises at least one SCADA system which is designed to communicate with the programmable logic controller via a network and while using a first communication protocol, data being transmitted between the SCADA system and the programmable logic controller, said data containing operating information on nominal and/or actual states of the plant. The automation system comprises a monitoring unit, which is designed to extract the operating information from the data transmitted between the SCADA system and the programmable logic controller and to compare said operating information with a specification of admissible states of the plant.

Description

AUTOMATION SYSTEM AND METHOD OF OPERATION THEREOF

TECHNICAL AREA

The present invention relates to the field of automation systems or

Robotics systems, in particular their control and regulation.

BACKGROUND

In recent years, targeted attacks on industrial plants, Steunerungs- and control systems and robotic systems have become known. In 2010, the malware Stuxnet was known, with which a targeted attack on an industrial plant was carried out and this also successfully shut down. The malware (malicious software) was developed specifically for a specific system for monitoring and controlling technical processes (Supervisory Control and Data Acquisition System, abbreviated SCADA system) from Siemens, the Simatic S7 (see http://de.wikipedia.org/). org / wiki / Stuxnet of 25/11/2014). It has heretofore been known to intervene in the control of frequency converters, which can be used, for example, to control the speed of other devices, such as those of the prior art. To control engines. Such controllers are widely used in various industrial plants such as e.g. Waterworks, air conditioning, pipelines, etc.

used.

The invention described herein has the object of such an attack by means of

To avoid malware or to detect the attacked systems. SUMMARY

The stated object is achieved by a system according to claim 1, different embodiments and further developments are the subject of the dependent

Claims. An automation system is described below which, according to one exemplary embodiment, has at least one programmable logic controller which is designed to communicate via a data bus with at least one system to be controlled using a second communication protocol. The automation system further comprises at least one SCADA system configured to communicate with the programmable controller over a network and using a first communication protocol

communicate, wherein between the SCADA system and the programmable logic controller data are transmitted, which contain operating information about set and / or actual conditions of the system. The automation system sees one

Monitoring unit, which is adapted to extract the operating information from the data transmitted between SCADA system and programmable logic controller and to compare this with a specification of permissible conditions of the system.

According to a further embodiment, the automation system

has at least one programmable logic controller which is adapted to be connected to a system to be controlled via a data line (for example a field bus)

communicate. In this case, one or more control signals from the

programmable controller to the system to be controlled and / or one or more feedback signals transmitted from the controlling system to the programmable logic controller. The system further includes at least one SCADA system configured to communicate with the at least one programmable logic controller

Control over another data line (e.g., a network) and communicate using a first communication protocol and exchange data. In this case, data packets are transmitted, which include read and write commands for writing or reading of at least one register of the spoke rogrammierbaren control and corresponding response messages. A monitoring unit is designed to extract from the data packets transmitted between the SCADA system and the programmable logic controller by means of the first communication protocol operating data of the system to be controlled (ie operating information about desired and / or actual states of the system) and these with a previously known specification of permissible Compare operating data of the plant to be controlled.

The system to be controlled may have one or more actuators (eg motors) as well as one or more sensors, which actual values of deflections of the actuators (or also other operating parameters of the system to be controlled). For example, the system to be controlled is an industrial robot.

The programmable logic controller may be configured to communicate with the system to be controlled via the data line using a second real-time capable one

Communicate communication protocol. The data line can be, for example, a field bus (or part of a fieldbus system). The first communication protocol, however, does not have to be real-time capable. For example, the first one is

Communication Protocol a protocol based on TCP / IP such as e.g. ModBus / TCP.

The extracted operating data of the plant to be controlled comprises, for example, nominal and actual values of one or more states of the plant to be controlled, such as e.g. the desired value of a deflection of at least one actuator of the system to be controlled or the (measured by sensors) actual value of a deflection of at least one actuator of the system to be controlled (or both). The mentioned permissible operating data of the system to be controlled include, for example, the maximum and / or minimum deflection of at least one actuator of the system to be controlled, the maximum and / or minimum temporal change of a target value of a deflection of at least one actuator of the system to be controlled, the maximum and / or minimum temporal change of an actual value of a deflection of at least one actuator of the system to be controlled or any combination of the aforementioned parameters. These permissible operating data may e.g. depend on the date and time and / or other external variables and do not have to be constant. The programmable logic controller may comprise at least one register which depends on a feedback signal received from the equipment to be controlled and / or on a write command received from the SCADA system (e.g.

Control command) is described. Depending on the content of at least one register, a control signal for the system to be controlled can be generated and / or a

Response message are generated on a read command received from the SCADA system. The operating data to be extracted of the system to be controlled are stored, for example, in at least one register of the spoke-programmable controller. The monitoring unit may be configured to block a write command if an operating data extracted therefrom has a value which does not lie within a permissible range defined by specification. The monitoring unit can also be designed to trigger an alarm when one of a

Reply message to a read command extracted operating data has a value that is not within a specified range defined by specification.

Finally, a method for operating at least one system is described, which is controlled by means of at least one spoke programmable controller and at least one SCADA system. The programmable logic controller communicates via a data bus with a system to be controlled using a second communication protocol. The SCADA system communicates with the programmable logic controller via a network and using a first communication protocol, wherein data is transmitted between the SCADA system and the programmable logic controller containing operating information about set and / or actual conditions of the system. The operating information is extracted from the data transferred between the SCADA system and the programmable logic controller so that it can then be compared with a specification of permissible conditions of the system.

According to a further exemplary embodiment of the method, the programmable logic controller communicates with the system via a data line in order to control the latter, wherein one or more control signals from the programmable logic controller to the system and / or one or more feedback signals from the system to the system

programmable logic controller can be transmitted. The SCADA system

communicates with the at least one spoke-programmable controller over a network and using a first communication protocol to exchange data, transmitting data packets comprising write and read commands for writing to or reading at least one register of the programmable logic controller and corresponding response messages. According to one example of the invention, the method comprises extracting plant operating data from the data packets transmitted between the SCADA system and the programmable logic controller using the first communication protocol. Furthermore, this includes Method of comparing the extracted operating data with a previously known

Specification of permissible operating data of the control system.

BRIEF DESCRIPTION OF THE FIGURES

The invention will be explained in more detail with reference to the examples shown in the figures. The illustrations are not necessarily to scale and the invention is not limited to the aspects presented. Rather, emphasis is placed on representing the principles underlying the invention. In the pictures shows:

FIG. 1 shows an example of an automation system according to an example of FIG

Invention;

FIG. 2 schematically shows an attack on an automation system according to FIG.

FIG. 3 shows an example of an automation system that is protected against external attacks via the Internet;

Figure 4 shows the time course of a sensor or feedback signal;

Figure 5 shows the possible configuration of a block in Matlab / Simulink; and

FIG. 6 shows the exemplary use of control blocks in a Matlab / Simulink

Model.

FIG. 7 shows a further example of an automation system which is protected against attacks from the outside via the Internet and has an encryption of the data communication.

In the figures, the same reference numerals designate the same or similar components, each having the same or similar meaning. DETAILED DESCRIPTION

Described below is an automation system or a robotic system, which can be characterized by the structure shown in FIG. According to the example illustrated in FIG. 1, the automation system 1 comprises a SCADA system 10, a programmable logic controller 20 (SPS, programmable logic

Controller, PLC), as well as a system 30 to be controlled (plant, control system), which in the present example is shown as an industrial robot.

A SCADA system 10 (SCADA = supervisory control and data acquisition) is generally a computer-based monitoring system and control system for technical processes. In the present example, SCADA system 20 controls and monitors a programmable controller (PLC, PLC) using an industry protocol (communication protocol) (referred to herein as ModBus / TCP) for communications between SCADA system 10 and SPS 20, which typically has no or very limited real-time capability (for Modbus / TCP, TCP / IP packets are used to transmit the data; since 2007 the Modbus version Modbus / TCP is part of the IEC 61158 standard). The SCADA system 10 may be connected to the SPS 20 via a computer network, which in turn may be connected to the Internet. The SCADA system 10 may transmit read commands (such as reading one or more registers of a PLC) or write commands (such as commands that write a value to a register of the PLC 20) to the PLC 20. The PLC / PLC 20 responds with responses defined in the specification of the communication protocol. For example, the value of the register is read out or a status message of the PLC 20 is sent back to the SCADA system 10. A general explanation of SCADA can be found e.g. online at

http://en.wikipedia.org/wiki/Supervisory_Control_and_Data_Acquisition (retrieved 25.11.2014).

The second part of the system typically includes the PLC 20 and the plant 30 to be controlled (eg, industrial robots). Here the actual control or regulation of the application executed by the system takes place, and as a communication protocol (referred to in the drawings as "Real Time Industrial Protocol"), a bus protocol (eg a fieldbus protocol such as PROFIBUS, INTERBUS, etc.) is used which is in Dependence of the application must also meet hard real-time requirements. One or more sensor signals Y (generally feedback signals) of the system 30 are written into one or more registers of the PLC 20, which then converts them into control signals X for the system 30 by means of control or regulation algorithms (eg PID controller) and transmits to this. The definition of "real time" of DIN standard DIN 44300 (information processing), which has since been replaced by DUST ISO / IEC 2382, Part 9

(Processing procedures) read: "Under real time one understands the enterprise of a

A computing system in which programs for processing accumulating data are always operational, such that the processing results are available within a predetermined period of time. Depending on the application, the data may be generated randomly or at predetermined times. "

Hardware and software must therefore be ensured that there are no delays that could prevent compliance with this condition (results must be available within a given period of time). The processing of the data does not have to be very fast, it just has to be done fast enough for the respective application. Communication (data transmission) in real time enables e.g. some modern fieldbus systems (based for example on real-time Ethernet, PROFIBUS, INTERBUS, etc.). By contrast, protocols of the "traditional" communications protocol family TCP / IP (Transmission Control Protocol / Internet Protocol) are not readily real-time capable.

If an automation system is attacked, this can be done in different ways:

Option 1 - it will be fake messages (fake messages) of an attacker 1 1

(Attacker) sent to the PLC 20, such. B. not allowed

Write commands;

Possibility 2 - the operating system of the PLC 20 is hacked and then targeted

PLC register incorrectly described. The following FIG. 2 essentially shows the procedure of an attack

Method 1 and 2. An automation system 1 according to an example of the invention is secured to avoid such attacks by providing an independent monitoring system 15 between SCADA system 10 and SPS 20. Becomes If the monitoring system 15 is placed in the left part (between SCADA system 10 and SPS 20, see Figure 3), no significant real-time requirements are necessary.

A placement of the monitoring unit in the right part of the system (between PLC 20 and control system 30) is difficult to implement, because there are typically hard

Real-time requirements are to be met. This would mean that a monitoring unit would have to have deterministic properties (the monitoring task would have to be fulfilled in a predefined time) and on the other side would be the

Monitoring unit part of the control system and would thus e.g. Part of a

Certification according to Machinery Directive in terms of functional safety. Furthermore, an arrangement of the monitoring unit in the right-hand part would have a high outlay in terms of compliance with laws and directives, a reduced set of rules to be processed in a given time and in an increased level

Implementation effort for algorithm for checking rule sets and sorting them.

One aspect to defend an attack is to match the specifications of the plant 30 to be controlled (eg, specified limits for the target values of the

Actuator states or limits for the actual values determined by the sensors) is used to monitor the communication between SCADA system 10 and PLC 20 with the aid of the independent monitoring unit 15 independent of the PLC 20 and the SCADA system 10 and to check whether the specifications are respected or violated. If it is determined in the monitoring unit 15 that operating data of the system (which represent operating information about desired and / or actual states of the system, such as desired or actual values of the states of the actuators, temperature, etc.) are in the range specified as permissible , one can assume that the system works reasonably. In the case of values outside of a specified range, either an alarm or other safety measures are triggered, the corresponding command is blocked so that it does not reach the PLC 20 at all.

The following Fig. 4 shows the time course of a sensor signal X (which is transmitted, for example, from the system to be controlled 30 to the PLC 20). In the system specification of the system to be controlled, a permissible working range of the signal X can now be defined be (signal level Signal_max and _min signal) or a time limit such as the time derivative dX / dt of the signal X (tangent slopes dSignal_max and dSignal_min). Of course, other restrictions or

Boundary conditions such as concerning calculated quality criteria possible.

For example, a dynamic observer (eg Kalman filter) can be used to achieve monitoring of non-directly measurable operating data (states, state variables) of the system to be monitored. Specified, allowed

Operating data can also be based on indirectly measured or monitored states of the system.

According to FIG. 4, the sensor signal X exceeds the permissible maximum signal level Signal_max at the point 1, at the point 2 it falls below the permissible minimum values

Signal level Signal_min. At points 3 and 4 exceeds or falls below the

Tangent slope (the tangent to the sensor signal X, corresponds to the first derivative or the rate of change) the permissible upper or lower limit dSignal_max and dSignal_min.

In the following, the monitoring unit 15 is shown in the left part of FIG

Automation system 1 described (see illustration of Fig. 3). The above methods would also be possible for the right-hand part of the system, but with the limitations described above. To attack according to Method 1 (fake

To avoid register write commands by so-called fake messages), rules or rule sets are used which examine the content of the data according to the communication protocol used and block the corresponding commands in case of a detected violation of a specified area.

To avoid an attack according to Method 2 - Register Read Commands -

Uses check rules that examine the contents of the data according to the communication protocol used and produce an alarm in the event of a violation of a specified area.

To work through the rules, a pattern matching program can be used, for example, which works in a similar way. Snort (a free Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS)) or similar. Another possibility is that the rules (rules) in a logic or a

Program code to be translated. The rules may now be established based on the knowledge of the specification of the protocol used (e.g., Modbus / TCP), the network assignment of the register assignment of the PLC 20, and the specification of the equipment 30 to be controlled. This can be done manually by means of an editor or automated. A typical rule consists of the following components, as exemplified by a typical Snort rule: alert tcp 10.0.2.10/32 any -> 10.0.1.10/32 502 \

(content: "I 04 I"; offset: 7; depth: 1; content: "| 0003 |"; offset: 8; depth: 2; flowbits: set, sidl03;

flowbits: noalert; \

sid: 103)

Where: alert - activity of the Alamierens;

tcp - the protocol used as a basis;

10.0.1.110/32 - IP addresses to be observed (address range);

any, 502 - ports to be monitored;

content, offset, depth - Describes the content and its location in the log that needs to be monitored;

flowbits - used to dynamically integrate other rules. alert tcp 10.0.1.10/32 502 -> 10.0.2.10/32 any \

(content: "I 04 I"; offset: 7; depth: 1;

flowbits: isset, sidl03; \

byte_test: 2, <, 31768, 9; \

msg: "IDS Alert: 10.0.1.10 to 10.0.2.10, function code 04, start address 0003, value to small"; \ byte test - describes the test of a value whether it is within or outside the specfication range;

msg - is the command that produces the textual output if the value is outside the specification range.

For automatic generation of the rules, the previously described knowledge or rules / rule sentences are processed in a program and produces a text file, which then z. B. using Snort is used. To simplify the automatic generation blocks can also be used in one

Development environment (eg Matlab) are used, which are deposited with the necessary knowledge. Fig. 5 shows the possible configuration of a block in Matlab / Simulink. In the following figure Fig. 6 shows the exemplary use of control blocks in a Matlab / Simulink model. The check rules can then be generated during the processing of a block in the Matlab / Simulink, which enables the control engineer not to have to deal in detail with the details of the safeguarding of the automation system 1 against attackers.

An alternative method for (semi-) automatic generation of rules or

Rule sets consists of reading the communication between SCADA system 10 and PLC 20 for a certain time (during a learning phase). In this case, the content of the communication is extracted according to the protocol used and read out the register contents of the PLC, and thereby stored during the learning phase minimum and maximum values for each register. These "learned" minimum and maximum values (learned specification) can be manually adjusted in the next step and then converted into rules by computer-assisted methods, which makes sense if the monitoring unit 15 is to be integrated into an existing system, but this approach has the disadvantage in that one can not determine whether the automation system 1 had already been attacked in the learning phase, detection would only be possible if the learned minimum or maximum values were outside a range specified as permissible. In modern communication systems, communication is often encrypted (end-to-end encryption). Thus, the communication between SCADA system 10 and PLC (see Fig. 1 and 3) can be encrypted. Although encryption can increase security with regard to possible malware attacks, encryption is no guarantee that a successful attack will not occur. The attacker 11 (see FIG. 1) has essentially two options. First, the attack is directed directly against the SCADA system 10. The malware compromises the SCADA system 10, manipulates it and causes it to unwanted behavior. In this case, encryption does not provide protection because data is manipulated on the SCADA system 10 before encryption occurs. Second, the attack occurs "on the fly" during encrypted data transmission over the data line (ie, over a computer network) .This type of attack protects the encryption as long as the key used remains secret instead of end-to-end encryption between SCADA system 10 and PLC 20 (see Fig. 1), the communication between SCADA system 10 and monitoring unit 15 can be encrypted with a first key ENC I (or key pair) and the communication between monitoring unit 15 and PLC 20 with a second key This situation is shown in Fig. 7. In this case, as shown in Fig. 3, the monitoring unit 15 is arranged between SCADA system 10 and PLC 20 and configured to receive the data sent from the SCADA system 10 (and destined for the PLC 20) to decrypt data, check it by rules or rule sets as described above and then again (with the second key ENC 2) to encrypt.

Claims

Claims:

An automation system comprising:

at least one programmable logic controller (20), which is designed to communicate via a data bus with at least one system (30) to be controlled using a second communication protocol;

at least one SCADA system (10) adapted to communicate with the programmable logic controller (20) via a network and using a first communication protocol, between the SCADA system (10) and the spoke programmable controller (20) Data are transmitted, which contain operating information about set and / or actual states of the system (30); and

a monitoring unit (15), which is designed to extract the operating information from the data transmitted between the SCADA system (10) and the programmable logic controller (20) and supply this with a

To compare the specification of permissible states of the system (30).

2. Automation system according to claim 1,

according to the first communication protocol between the

SCADA system (10) and the programmable logic controller (20) data packets are transmitted, which write and read commands for writing or reading of at least one register of the programmable logic controller (20) and corresponding response messages include, and / or

wherein one or more control signals (X) from the spoke-programmable controller (20) to the system (30) to be controlled and / or one or more feedback signals (Y) from the system (30) to be controlled are sent to the programmable logic controller (20). be transmitted.

3. Automation system according to claim 1 or 2,

where the second communication protocol is a real-time capable

Communication protocol, in particular a real-time fieldbus protocol is, and / or wherein the first communication protocol is a non-real-time communication protocol, in particular TCP / IP based

Communication protocol, e.g. the Modbus / TCP protocol is.

4. Automation system according to one of claims 1 to 3, wherein the extracted operating information about set and / or actual states of the system (30) comprise at least one of the following parameters:

Desired value of a deflection of at least one actuator of the system (30); Actual value of a deflection of at least one actuator of the system (30).

The automation system according to one of claims 1 to 4, wherein the specification of allowable states specifies at least one of the following parameters:

maximum deflection of at least one actuator of the system (30);

minimum deflection of at least one actuator of the system (30); maximum or minimum temporal change of a setpoint of a

Deflection of at least one actuator of the system (30);

maximum or minimum time change of an actual value of a deflection of at least one actuator of the system (30).

6. Automation system according to one of claims 1 to 5, wherein the

Memory Rogrammable control (20) has at least one register, which

depending on a received from the system feedback signal (Y) of the system (30) and / or

depending on a write command received from the SCADA system (10).

7. Automation system according to one of claims 1 to 6, wherein the

programmable logic controller (20) has at least one register,

depending on the content of a control signal (X) for the system (30) is generated and / or

depending on its content, a reply message is generated on a read command received from the SCADA system (10).

8. The automation system according to one of claims 1 to 7, wherein the

extracting operating information of the system (30) are stored in at least one register of the spoke programmable controller (20).

9. Automation system according to one of claims 1 to 8,

wherein the monitoring unit (15) is connected to the network and capable of communicating with both the SCADA system (10) and the programmable logic controller (20) using the first communication protocol over the network.

10. automation system according to claim 9,

in which the monitoring unit (15) is so connected to the network that all communication between the SCADA system (10) and the

rogrammable control (20) via the monitoring unit (15) is passed and thus can be monitored by this.

11. The automation system according to one of claims 1 to 10, wherein the

Monitoring unit (15), designed to

block data packets destined for the programmable logic controller (20) if an operating information extracted therefrom indicates a state of the system which is not within an admissible range defined by the specification; or

to trigger an alarm when extracted from a data packet

Indicates a system condition that is not within an acceptable range defined by the specification.

12. The automation system according to one of claims 1 to 10, wherein the

Monitoring unit (15), designed to

to block a write command if any extracted from it

Operating date has a value that is not within a permissible range defined by specification; or to trigger an alarm when an operating date extracted from a response message to a read command has a value that is not within an allowable range defined by specification.

13. The automation system according to one of claims 1 to 12, wherein the

Monitoring unit (15), designed to

decrypted by the SCADA system (10) to decrypt sent data, examine the decrypted data, re-encrypted and sent to the

to forward the programmable logic controller (20) according to the first communication protocol,

wherein the SCADA system (10) for encryption uses a different key or encryption system than the one of

Monitoring unit.

14. Method for operating at least one system (30) which is controlled by means of at least one programmable controller (20) and at least one SCADA system,

wherein the programmable logic controller (20) communicates with a device (30) to be controlled via a data bus using a second communication protocol;

the SCADA system (10) having the programmable logic controller

Control (20) over a network and using a first one

Communication protocol communicates, between the SCADA system (10) and the programmable logic controller (20) data is transmitted, which

Include operating information about desired and / or actual states of the system (30); and extracting the operating information from the data transferred between the SCADA system (10) and the programmable logic controller (20) and comparing it with a specification of allowable conditions of the plant (30).

15. The method according to claim 14,

wherein the extracting of the operating information is performed by a monitoring unit (15) connected to the network such that all communication between the SCADA system (10) and the

Control (20) via the monitoring unit (15) is passed.