WO2023206522A1

WO2023206522A1 - Method, apparatusand device for hardening assets in ot system and storage medium and computer program product

Info

Publication number: WO2023206522A1
Application number: PCT/CN2022/090641
Authority: WO
Inventors: Daifei Guo; Lijuan Zhao
Original assignee: Siemens Aktiengesellschaft; Siemens Ltd., China
Priority date: 2022-04-29
Filing date: 2022-04-29
Publication date: 2023-11-02

Abstract

A method for hardening assets in OT system, characterized in that collecting communication traffic among the assets to identify instruction property; determining a status property of the assets according to configuration file of the assets; determining the assets roles according to the identified instruction property and the status property of the assets; determining asset work modes according to the identified instruction property from communication traffic among the assets; and calculating an asset criticality score in a time frame according to the determined asset work mode and the assets role to determine whether harden the assets.

Description

METHOD, APPARATUSAND DEVICE FOR HARDENING ASSETS IN OT SYSTEM AND STORAGE MEDIUM AND COMPUTER PROGRAM PRODUCT

TECHNICAL FIELD

The present invention relates to industrial networksandoperational technology (OT) , specifically, relates to a method, apparatusand devicefor hardening assets in OT system and storage medium and computer program product.

BACKGROUND ART

In recent years, there are more and more industrial-ethernet based smart and IoT devices used as remote monitoring and management of industrial control systems (ICS) . That is, the majority of ICS in operation technology (OT) today connect directly or indirectly via industrial ethernet. This introduces them many threats like any other connected system. Many these systems monitor and control complex industrial processes and critical infrastructures that deliver electricity, petroleum production, watertransportation, manufacturing, communication, and other essential services. The downtime or infiltration of an ICS network could result in massive outages, hundreds of thousands of impacted users, and even national disasters.

ICS assets are the digital devices that are used in industrial production and operation process. This includes all the various components of digital critical infrastructure. There are some measures to mitigate the security risk of the ICS assets, for example, performing network segmentation, implementing least privilege, securing remote access, or updating and patching the assets etc. Considering that it takes a long time to prepare and test the upgrade or change of the industrial control system, which requires high personnel capabilities and the impact on continuous production. At present, many adopt a conservative attitude towards vulnerability fixes, which causes these problems to be hidden in the system. Once exploited by an attacker, it may cause unpredictable impact and loss. Usually, it is not realistic to fix all security vulnerabilities immediately. Therefore, it is neededto evaluate the importance and the critical status of the assets in OT environment to rank the risks and understand the risk impact on the corresponding business. Once you have a good grasp of the asset importance and critical status, you can understand risk situation better and formulate a priority remedial plan to minimize the risk even with limited budgets and resources.

Therefore, it is necessary to automatically identify the critical status of OT assets to analyze the business impact based on the asset importance. And then one system can rank the risk based on the OT asset critical status and the found vulnerabilities, formulate a priority remedial plan to mitigate the security risk of assets with critical control function as soon as possible. To do so, we propose a method of risk remediation based on asset critical status automatic identification in OT environment.

SUMMARY OF THE INVENTION

The above objects are achieved by a method for hardeningassets according to claim 1, an apparatus for hardening assets according to claim 8, a computer device for hardening assets according to claim 9, and a computer program according to claim 10 of the present invention. Advantageous embodiments of the present inventionare provided in dependent claims. Features of independent claims may be combined with features of claims dependent on the respective independent claim, and features of dependent claims can be combined, unless otherwise indicated.

According to a first aspect of the present invention, a method for hardening assets is presented. The method includes steps of:

- collecting communication traffic among the assets to identify instruction property;

- determininga status property of the assets according to configuration file of the assets;

- determining the assets roles according to the identified instruction property and the status property of the assets;

- determining asset work modes according to the identified instruction property from communication traffic among the assets; and

- calculating an asset criticality score in a time frame according to the determined asset work mode and the assets role to determine whether harden the assets.

With this solution, it conducts the update and patch without affecting the production process to ensure the most availability principle in OT.

In another embodiment of the method, charactered in thatcalculating the assets risk score based on security of OT system; wherein the security includes security event of OT system and vulnerability of the assets, wherein the vulnerability of the assets includes unpatched program or service, misconfiguration of security policy, account and password.

In anotherembodiment of the method, charactered in that calculating time period of hardening the assets based on the asset critical score and an asset risk score.

In anotherembodiment the method, charactered in that, providing a hardening plan for the assets according to time period of hardening the assets.

In anotherembodiment the method, charactered in that, providing a hardening plan with priority for the assets according to time period of hardening the assets.

In anotherembodiment the method, charactered in that, the hardening of the assets includes update of the program in the assets, update of the security policy of the assets, account management of the assets, and port management of the assets.

In anotherembodiment the method, charactered in that the asset is an OT asset; and the OT assets are computer hardware, computer software, or a combination of both.

BRIEF DESCRIPTION OF THE DRAWINGS

The above-mentioned attributes and other features and advantages of the present invention and the manner of attaining them will become more apparent and the present technique itself will be better understood by reference to the following description of embodiments of the present technique taken in conjunction with the accompanying drawings, wherein:

Fig. 1is a schematic diagram of OT systemaccording to an embodiment of the disclosure.

Fig. 2 is a flow chart of a method for hardening assets according to an embodiment of the disclosure.

Fig. 3 is a computer apparatus for hardening assets in OT system according to an embodiment of the disclosure.

Fig. 4 is a computer device for hardening assets in OT system according to an embodiment of the disclosure.

Hereinafter, above-mentioned and other features of the present technique are described in details. Various embodiments are described with reference to the drawing, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purpose of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more embodiments. It may be noted that the illustrated embodiments are intended to explain, and not to limit the invention. It may be evident that such embodiments may be practiced without these specific details.

REFERENCE NUMBERS

10 OT system

101 industrial controller

102a sensor

102b motor

100a engineer station

100b database server

100c application server

104a firewall

104b server for intrusion detection

105 network switching and routing device

S202-S216 Steps

300 apparatus

302 collection module

304 first determination module

306 second determination module

308 third determination module

310 calculation module

400 computer device

402 memory

404 processor

DETAILED DESCRIPTION

In order to make the technical solutions and advantages of the invention clearer, the invention is further described in detail below with reference to the accompanying drawings and embodiments. The specific embodiments described herein are only used to illustrate the invention and are not configured to limit the protection scope of the invention.

Currently, the organization (i.e., owner of factory) is only informed there are some assets that update is needed. But it is not realistic to stop the whole system to update because it may impact the critical production process that may cause damages. In addition, there is no solution to generate the remediation priority by identifying the criticality of the assets based on the asset configuration, behavior and work mode. Therefore, it provides the method of the automatic asset importance identification in OT environment, and then identify vulnerability and update time after identifying the criticality of the assets from the instruction and work mode sides.

INTRODUCTION OF OT SYSTEM

An OT system, also referred to as an Industrial Control System (ICS) , is configured to implement automatic control of industrial processes. An OT system can be a wind power system, a car manufacturing plant, a pharmaceutical factory, a municipal sewage treatment system, and the like.

OT utilizes hardware and software to achieve detection or control by directly monitoring and/or controlling physical devices, processes and events in an enterprise. An OT system uses a computer to monitor or change the physical state of a system.

Examples of an OT system include: supervisory control and data acquisition (SCADA) system, distributed control system (DCS) , computer numerical control (CNC) system (including computerized mechanical tools) , and scientific equipment (such as digital oscilloscopes) .

Fig. 1 is a schematic diagram of OT systemaccording to an embodiment of the disclosure. As shown in FIG. 1, the OT system 10 may comprise: industrial controller 101,

field device

102a, 102b,

industrial host

100a, 100b, 100c,

security device

104a, 104b and network switching and routing device105. The industrial controller 101 coupled to

field device

102a, 102b, and the industrial controller 101 coupled to the

industrial host

100a, 100b, 100c by network switching and routing device 105. The industrial controller 101 also coupled to the industrial host 100a, 100b, 100c by security device 104a, 104b; wherein the industrial controller 101 may comprise, but is not limited to, a programmable logic controller (PLC) , and a programmable automation controller (PAC) ; wherein a field device may comprise such as a sensor 102a, and a motor 102b, wherein the sensor 102a may obtain field data such as temperature, humidity, pressure and liquid flow rate under the control of the industrial controller 101, and the motor 102b can drive motion under the control of the industrial controller 101; wherein an industrial host may comprise such as an engineer station (ES) 100a, an operator station (OS) 100a, a human machine interface (HMI) , a database server 100b, and an application server 100c; wherein at least one security device may comprise such as a firewall 104a, and a server 104b for intrusion detection, wherein the security fire-protection device may comprise such as the firewall 104a and the server 104b for intrusion detection may also form an intrusion detection system (IDS) to implement intrusion detection of the OT system 10; wherein a network switching and routing device 105 may comprise such as an industrial switch and an industrial router, wherein these network switching and routing devices 105 may constitute an industrial Ethernet to interconnect the internal devices of the OT system 10. In this OT systems, assets could include the industrial controller 101, the

field device

102a, 102b, the

industrial host

100a, 100b and 100c,

security device

104a, 104b and network switching and routing device 105.

A typical architecture of the OT system is described above as an example. Those skilled in the art may realize that the architecture of the OT system may be changed based on a specific application environment or deployment difference, and the embodiment of the invention is not limited hereto.

For example, a security software (it can also called as a security system) can be deployed in the

security device

104a, 104b in OT system. The security software can also be implemented in computer hardware or the combination of software and hardware. Security software is used to monitor the assets in factories, as a result, understanding, managing, controlling, and mitigating risk of assets of organization (for example, owner of factory) . Security software probes the assets actively and passively to identify the asset type, for example, firewall, switch, Programmable Logic Controllers (PLC) , Remote Terminal Units (RTUs) , Human-Machine Interfaces (HMIs) , etc. Security software is used to monitor and analyze behavior by analyzing the network communication traffic among assets, identify the network behavior to identify the vulnerabilities of the assets, collect the security alert and event to the assets to calculate the likelihood of being attacked.

Fig. 2 is a flow chart of a methodfor hardening assets according to an embodiment of the disclosure.

In step ofS202, collecting communication traffic among the assets to identify instruction property.

For example, theinstruction property can indicate a behavior of the assets, for example, sending a controlling instruction, implementing a controlling instruction or collecting data instruction. Thebehavior of the assets can include aprocess in a hostexecuted by a configuration file.

In an embodiment, the method can also include determining instruction property of assets is based on a control field in communication traffic between the assets, wherein the instruction property indicates the instruction is a control instruction, an execution instruction, or a data instruction.

In step ofS204, determining a status property of the assets according to configuration file of the assets.

The status property of the assets can include asset role, asset work mode or asset criticality score. For example, the asset roles can refer to operator station100a that receive controlling instructions or engineer station 100a that send controlling instructions. The asset roles also can refer to PLC 101 or database server 100b etc. In summary, the asset role can define a function of an asset. That is, the asset role refer to an asset with a certain function.

The configuration file of the assets can refer to a software in the assets that are configured for implementing a function. For example, the configuration file of assets can instruct the device to monitoring a temperature in manufacture process.

In step ofS206, determining an assets role according to the identified instruction property and the status property of the assets.

The identified instruction property indicate, for example, network behavior of assets. The status property of the assets indicate, for example, character in a time frame.

In step ofS208, determining an asset work mode according to the identified instruction property from communication traffic among the assets.

For example, the asset work mode can include simulation mode, maintenance mode, implement mode. For example, the asset work mode of asset role can include a server that sending a controlling instruction in the implement mode, and a PLC that collecting data instruction in maintenance mode or in simulation mode.

In an embodiment, it can determine the asset work mode based on a configuration file of the asset and/or communication traffic among the assets.

In step ofS210, calculating an asset criticality score in a time frame according to the determined asset work mode and the assets role to determine whether harden the assets.

The asset criticality score define influence of hardening the assets for production. For example, the asset criticality score is5 based on that an asset is in implement mode time frame for the asset that is sending controlling instruction. For example, the asset criticality score is 4 based on that the asset is in implement mode time frame for the asset that is sending data instruction. For example, the asset criticality score is 3 based on that the asset is in simulation mode time frame for the asset that is sending data instruction. For example, the asset criticality score is 2 based on that the asset is in maintenance mode time frame for the asset that is sending controlling instruction. For example, the asset criticality score is 1 based on that the asset is in maintenance mode time frame for the asset that is sending data instruction. For example, the asset criticality score is 0 based on that the asset is in maintenance mode time frame for the asset that does not sending data.

Here, a specific example is given. Security software collects communication traffic among engineer station 100a and industry controller 101to identify instruction property. Then, the software determines a status property of the industry controller 101 according to configuration file of the industry controller 101. Then, the software determines that the industry controller 101 send a controlling instruction according to the identified instruction property and the status property of the assets. Then, the software determines the industry controller 101 is in maintenance mode according to the identified instruction property from communication traffic among the assets. Then, the software calculates an asset criticality score as 2 score in a certain time frame to determine the software can harden the industry controller 101 in that time.

In step ofS212, calculating the assets risk score based on security of OT system.

Thesecurity risk scoreis calculated based on security events, vulnerability and original risk assessment. For example, a security software can monitor and collect the security events of the assets, wherein the event includes alert, notification and warning. A security software can identify and collect the vulnerability status of the assets. A security software also can gets risk assessment results coming from the security expert conducting threat and risk assessment. For example, identifying and evaluating risks for assets that could be affected by cyberattacks has already been conducted by security experts.

In an embodiment, calculating the assets risk score based on security of OT system; wherein the security includes security event of OT system and vulnerability of the assets, wherein the vulnerability of the assets includes unpatched program or service, misconfiguration of security policy, account and password. Other vulnerabilities are listed as follow:

In step ofS214, calculating time period of hardening the assets based on the asset critical score and the asset risk score.

In an embodiment, the system can be fixed in the maintenance mode. For example, the vulnerabilities of system can be hardened in the maintenance mode. The vulnerabilities of system can also be hardened in the simulation mode.

The time period of hardening the assets can be in certain time frame of maintenance mode or simulation mode.

In step ofS216, providing a hardening plan for the assets according to time period of hardening the assets.

For example, it can make a schedule of patching and updating the assets according to the asset criticality score. It can providea hardening plan to fix the vulnerability. For example, it can fix the vulnerability immediately for the asset with high asset criticalityscore.

In an embodiment, the security software can provide a hardening plan with priority for the assets according to time period of hardening the assets.

In summary, the method can determine assetsstatus by collecting communication traffic among the assets and configuration file of the assets; and calculate asset criticality score at least according to the asset status, wherein the assets status can include asset role and asset work mode.

The method provides advantages as follows: it can calculate the update and patch priority and importance according to the asset critical status such as control instructions which are more meticulous and accurate to understand the asset roles. Further, it calculates the time frame dimension of simulation, maintenance, and implement mode as a factor of calculating the update and patch priority. Further, it recommends the remediation priority arrangement of updating and patching time to the organization instead of just informing patch. Further, it conducts the update and patch without affecting the important production process to ensure the most availability principle in OT.

Fig. 3 is an apparatus300 for hardening assets in OT system including collection module 302 for collecting communication traffic among the assets to identify instruction property; first determination module 304 for determininga status property of the assets according to configuration file of the assets; second determination module 306 for determining the assets roles according to the identified instruction property and the status property of the assets; third determination module 308 for determining asset work modes according to the identified instruction property from communication traffic among the assets; and calculation module 310 for calculating an asset criticality score in a time frame according to the determined asset work mode and the assets role to determine whether harden the assets.

FIG. 4 is a computer device 400 for hardening assets in OT system according to an embodiment of the disclosure. The computer device comprises a memory 402 and a processor 404, wherein an application executable by the processor is stored in the memory 402 for causing the processor 404 to perform the method.

Further, it also provides a computer-readable storage medium characterized in that computer-readable instructions are stored therein for performing the method.

Further, it also provides a computer program product is characterized in that the computer program product is tangibly stored on a computer-readable medium and includes computer-readable instructions that, when executed, cause at least one processor to perform the above steps in the method for hardening assets in OT system.

It should be noted that not all the steps and modules in the above-mentioned processes and structure diagrams are required, and certain steps or modules may be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The division of each module is only functional division for ease of description. In actual implementation, one module can be divided into multiple modules, the functions of multiple modules can also be realized by one module, and these modules can be in the same device and can also be in different devices.

The hardware modules in various embodiments may be implemented mechanically or electronically. For example, a hardware module may comprise a specially designed permanent circuit or logic device (such as a dedicated processor, like an FPGA or ASIC) for performing certain operations. A hardware module may also comprise a programmable logic device or circuit temporarily configured by software (for example, comprising a general-purpose processor or other programmable processors) for performing certain operations. Whether to adopt a mechanical method, or a dedicated permanent circuit, or a temporarily configured circuit (for example, configured by software) for the hardware module can be decided based on cost and time considerations.

The invention also provides a machine-readable storage medium storing instructions for causing a machine to perform the method as described herein. Specifically, a system or device equipped with a storage medium may be provided, a software program code for realizing the functions of any of the above embodiments is stored on the storage medium, and a computer (or CPU or MPU) of the system or device is made to read out and execute the program code stored in the storage medium. In addition, some or all of the actual operations may be performed by an operating system or the like operating on a computer based on instructions of the program code. The program code read out from the storage medium may also be written into a memory arranged in an expansion board inserted into the computer or written into a memory arranged in an expansion unit connected to the computer, and then some or all of the actual operations are executed by a CPU or the like installed on the expansion board or the expansion unit based on the instructions of the program code, so as to achieve the functions of any of the above-described embodiments.

The storage medium for providing the program code can be implemented as floppy disk, hard disk, magneto-optical disk, optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW) , magnetic tape, non-volatile memory card and ROM. Alternatively, the program code may be downloaded from a server computer or cloud through a communication network.

The above description is only the preferred embodiments of the invention and is not intended to limit the protection scope of the invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the invention shall fall within the protection scope of the invention.

It should be noted that not all the steps and modules in the above-mentioned processes and system structure diagrams are required, and certain steps or modules may be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structures described in the foregoing embodiments may be physical structures or logical structures, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities or may be implemented by certain components in multiple independent devices together.

In the above embodiments, a hardware unit may be implemented mechanically or electrically. For example, a hardware unit may comprise a permanent dedicated circuit or logic (such as a dedicated processor, like an FPGA or ASIC) for performing corresponding operations. A hardware unit may also comprise a programmable logic or circuit (such as a general-purpose processor or other programmable processors) which can be temporarily configured by software to perform corresponding operations. The specific implementation method (a mechanical method, or a dedicated permanent circuit, or a temporarily configured circuit) can be decided based on cost and time considerations.

While the present technique has been described in detail with reference to certain embodiments, it should be appreciated that the present technique is not limited to those precise embodiments. Rather, in view of the present disclosure which describes exemplary modes for practicing the invention, many modifications and variations would present themselves, to those skilled in the art without departing from the scope and spirit of this invention. The scope of the invention is, therefore, indicated by the following claims rather than by the foregoing description. All changes, modifications, and variations coming within the meaning and range of equivalency of the claims are to be considered within their scope.

Claims

A method for hardening assets in OT system, characterized in that,

collecting (S202) communication traffic among the assets to identify instruction property;

determining (S204) a status property of the assets according to configuration file of the assets;

determining (S206) the assets roles according to the identified instruction property and the status property of the assets;

determining (S208) asset work modesaccording to the identified instruction property from communication traffic among the assets; and

calculating (S210) an asset criticality score in a time frame according to the determined asset work mode and the assets role to determine whether harden the assets.
The method according to any one of claims 1, characterized in that,

calculating (S212) the assets risk score based on security of OT system;

wherein the security includes security event of OT system and vulnerability of the assets, wherein the vulnerability of the assets includes unpatched program or service, misconfiguration of security policy, account and password.
The method according to any one of claims 1-2, characterized in that,

calculating (S214) time period of hardening the assets based on the asset critical score and an asset risk score.
The method according to any one of claims 1-3, characterized in that,

providing (S216) a hardening plan for the assets according to time period of hardening the assets.
The method according to any one of claims 1-3, characterized in that, .

providing a hardening plan with priority for the assets according to time period of hardening the assets.
The method according to any one of claims 1-5, characterized in that, the hardening of the assets includes update of the program in the assets, update of the security policy of the assets, account management of the assets, and port management of the assets.
The method according to any one of claims 1-6, characterized in that:

the asset is an OT asset; and

the OT assets are computer hardware, computer software, or a combination of both.
Anapparatus (300) for hardening assets in OT system, characterized in that, the apparatus includes:

collection module (302) , for collecting communication traffic among the assets to identify instruction property;

first determination module (304) , for determininga status property of the assets according to configuration file of the assets;

second determination module (306) , for determining the assets roles according to the identified instruction property and the status property of the assets;

third determination module (308) , for determining asset work modes according to the identified instruction property from communication traffic among the assets; and

calculation module (310) , for calculating an asset criticality score in a time frame according to the determined asset work mode and the assets role to determine whether harden the assets.
The apparatus according to the claim 8, characterized in that, the apparatus further includes:

calculation module, for calculating the assets risk score based on security of OT system;

wherein the security includes security event of OT system and vulnerability of the assets, wherein the vulnerability of the assets includes unpatched program or service, misconfiguration of security policy, account and password.
The apparatus according to the claim 8, characterized in that, the apparatus further includes:

calculation module, for calculating time period of hardening the assets based on the asset critical score and an asset risk score.
The apparatus according to the claim 8, characterized in that, the apparatus further includes:

providing module, providing a hardening plan for the assets according to time period of hardening the assets.
Acomputer device (400) for hardening assets in OT system, comprising a memory (402) and a processor (404) , wherein an application executable by the processor is stored in the memory (402) for causing the processor (404) to perform the method according to any one of claims 1-7.
A computer-readable storage medium characterized in that computer-readable instructions are stored therein for performing the method according to any one of claims 1-7.
A computer program product is characterized in that the computer program product is tangibly stored on a computer-readable medium and includes computer-readable instructions that, when executed, cause at least one processor to perform the steps in the method for hardening assets in OT system according to any one of claims 1-7.