EP3417589A1

EP3417589A1 - Reducing a possible attack on a weak point of a device via a network access point

Info

Publication number: EP3417589A1
Application number: EP17706174.4A
Authority: EP
Inventors: Rainer Falk
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2016-03-31
Filing date: 2017-02-13
Publication date: 2018-12-26
Also published as: WO2017167490A1; CN109076068A; DE102016205321A1; US20190098038A1

Abstract

A method for reducing a possible attack on a weak point of a device via a network access point to a network is proposed, wherein a configuration of the device is analysed in a first step, wherein communication via the network access point is restricted by a network access filter with the aid of a selectable filter rule in a second step if a weak point is detected on the basis of the analysed configuration, in particular a lack of up-to-dateness of the configuration, and wherein the filter rule is topologically applied between the network access point and a main function of the device. A corresponding device and a computer program product are proposed. A type of reverse network admission control principle is therefore applied. In the case of a weak configuration or a configuration which is presumed not to be up-to-date, a field device itself restricts its communication by means of a type of reverse network admission control in order to reduce the attack area.

Description

description

Reduce an attack on a vulnerability of a device via a network access point

Components or devices in industrial environments such as automation systems or control systems often have a long service life. In particular, components with safety-relevant functionality, such as the implementation of an emergency stop for a drive control in critical systems, must be protected against attacks from connected open networks, such as the Internet or a mobile radio network. In particular, the connection to networks should be checked for potential weak points or points of attack. In the case of detected vulnerabilities or points of attack, it is often not possible in practice to ensure a timely correction of, for example, a fault in the configuration of the device. In particular, a configuration may be out of date and require an update. A so-called patching, i. The installation of software updates or the removal of a detected vulnerability is often only possible in dedicated maintenance windows, so that a device is in an outdated configuration for a long period of time.

A so-called Network Admission Control or Trusted Network Connect is known in which a client transmits information about its configuration during a network login. An insecure configured client in which, for example, a patch is missing or a virus scanner is not up-to-date or active can be accessed from the outside, i. from a network, be rejected, or connect to a quarantine network only. The network must provide a corresponding functionality for this.

It is an object of the present invention to ensure a simplified protection of a network connection between a device and a network. This object is solved by the features of the independent claims. Advantageous embodiments are specified in the dependent claims.

The invention relates to a method for reducing an attack on a vulnerability of a device via a network access point to a network,

wherein in a first step a configuration of the device is analyzed,

wherein in a second step in the case of a detected due to the analyzed configuration vulnerability, in particular a lack of timeliness of the configuration, communication via the network access point using a selectable filtering rule is limited by a network access filter, and

wherein the filtering rule is applied topologically between the network access point and a main function of the device.

A configuration of the device is characterized, for example, by a software, configuration or firmware loaded thereon. The timeliness of a software, configuration or firmware version can in particular be a clue to a vulnerability that could be exploited by IT attacks, for example to manipulate a safety-critical functionality of a device. The presence or actuality of a virus scanner also characterizes the configuration. The detected vulnerability may thus be, for example, the lack of a virus scanner.

In particular, the network is an open network, such as the Internet or a mobile network. In particular, the device also uses the open network in addition to a closed corporate network. For example, an app or device manager is used to analyze the configuration of the device. For example, a comparison is made with configuration properties provided for the device, which the device manager can access. If this comparison shows that a configuration is to be classified as critical or unsafe, a filter rule is selected and applied by means of a network access filter. In this case, a filter rule or filter policy can in particular prevent communication of sensitive data via the network access point with the open network. Similarly, the transmission of data from the network, such as control commands from the network to the device, can be prevented via the network access point. Network-based attacks are thus advantageously prevented. It can be a particular

Network connection permanently blocked. An activation then takes place, for example, by an administrator. Such a relatively strict policy can be usefully applied to particularly critical vulnerabilities.

In particular, the filter rule can be provided by the app / device manager. By way of example, an Internet of Things field device is provided with a matched filter specification depending on known vulnerabilities. If an app / device manager can not be reached, a standard filter rule or a filter rule intended for the situation of inaccessibility can be used. An attack or network-based attack is understood as meaning, for example, the reading or manipulation of sensitive data of the device or data intended for the device, or in particular an attack on a security mechanism, such as the deactivation of a security mechanism on the device is implemented. For example, data transmitted from the network via the network access point would thus be processed without security check on the field device or processed the manipulated data. In particular, a faulty transmitted certificate would not be checked or without consequence. An attack is promising if a device has a vulnerability due to a bad or outdated configuration. For this reason, the condition of a device with a weak point should be protected or, in phases with an analyzed vulnerability, the device should be shielded from attacks. A weak point in the context of the present application is a state of the device which potentially does not withstand an attack, or in which one would like to protect the device as a precautionary measure in order to reduce an attack surface. In particular, it is assumed that an attack can be unsuccessful even if there is a weak point.

A main function of the device is the function to be protected, which the device performs in its role within a system. In particular, attacks over the network would affect the main function, causing damage to the device or causing a bad interaction with other devices. A main function can be composed of several functions which the device is to execute within the system. A main function may in particular be a control or monitoring function of a technical system, which is acted upon by actuators or whose current state is determined by sensors.

According to the described method, functionality, in particular the possibility of sending or receiving sensor values or control commands, is restricted, for example, in a non-patched system. It is also advantageously prevented at the same time that existing detected vulnerabilities can be exploited via a network. Thus, a kind of reverse network admission control principle is used. Through a kind of reverse network admission Control limits a field device itself communication with weak or suspected non-current configuration to reduce the attack surface. The method can be realized in an advantageous manner on a terminal such as, for example, a field device or an Internet of Things field device, without any special requirements having to be met on the network side. In particular for devices used in the Internet of Things, Industrial Internet, Cyber Physical Systems or Web of Systems applications, a simple, easily retrofittable solution for reducing network-based attacks on a field device is thus possible.

A client thus recognizes a weak point in its own configuration itself and initiates a restriction of network access itself by means of appropriate filter regulations. The filter rule is applied topologically between the main function of the device and the network access point, ie the client side. The functioning of the network remains unaffected, i. there must be no monitoring of field devices on the server side and also no blocking of data connections and no filtering of data.

According to one embodiment, the device authenticates itself to the network, in particular via a network access

Control procedure. In this case, a method according to the standard IEEE 802. IX can be advantageously carried out.

According to a development, the device authenticates itself to a cloud service, in particular by means of a TLS method using a digital device certificate. Advantageously, the transport layer security method is used, for example to build a web-based secure connection. According to one embodiment, the filter rule is selectable from a number of multiple filter rules. In particular, depending on the detected vulnerability, different filters can be used. In particular, the scope of the limited communication depending on the severity of the detected vulnerability. For example, only certain portions of the network connectivity are restricted when an impact of the vulnerability is known and, for example, completely blocked when effects of a detected vulnerability are still unknown or unpredictable.

According to one embodiment, the network access filter activates one of the filter regulations in accordance with a fixed or changeable assignment rule. In particular, several of the selectable filter regulations can be used.

According to one embodiment, further safety rules of the device are adapted depending on the selected filter specification. For example, depending on the selected Filter Policy, network services may be disabled on the field device. For example, rules for a mandatory access control system such as SELinux, SMACK, or AppArmor can be customized.

The invention further relates to an access device for protection against a vulnerability of a device via a network access point to a network, comprising - a component for analyzing a configuration,

a network access filter for restricting communication via the network access point with the aid of a filtering rule in the case of a weak point identified on the basis of the analyzed configuration,

- The network access filter is provided topologically between the network access point and a main function of the device.

The component and the network access filter can be implemented and executed in software, hardware or a combination of software and hardware. Thus, the steps realized by these units may be stored as program code on a storage medium, especially a hard disk, CD-ROM or a memory module, wherein the individual instructions of the program code are read out and processed by at least one arithmetic unit, comprising a processor.

According to one embodiment, the network access filter of the access device is integrated into the device. According to one embodiment, the component is integrated into the device. Thus, the access device can be realized on the field device in an advantageous manner.

According to one embodiment, the network access filter is formed separately from the device. According to one embodiment, the component is formed separately from the device. Thus, for example, the access device may be provided as a ballast component to the device. The ballast component is thus arranged topologically between the device and the network. According to a development, the component has a local interface or a network interface to the device or a communication interface to a virtual double of the device. The invention further relates to a computer program product with a computer program having means for carrying out the method described above when the computer program is executed on a program-controlled device.

A computer program product, such as a computer program means may, for example, be used as a storage medium, e.g.

Memory card, USB stick, CD-ROM, DVD, or even in the form of a downloadable file provided by a server in a network or delivered. This can be done, for example, in a wireless communication network by transmitting a corresponding file with the computer program product or the computer program means. As program Controlled device is in particular a control device, such as a microprocessor for a smart card or the like in question. The invention will be explained in more detail by means of embodiments with the aid of the figures. It shows a schematic representation of an access device integrated in a field device according to a first embodiment of the invention; a schematic representation of an access device separately to a field device according to a second embodiment of the invention;

FIG. 3 shows a flowchart of a method for reducing a possibility of attacking a weak point of a device via a network access point according to a further exemplary embodiment of the invention.

In the figures, functionally identical elements are provided with the same reference numerals, unless stated otherwise.

FIG. 1 schematically shows an implementation of the invention according to a first exemplary embodiment of the invention in an Internet of Things or IoT environment. In this case, an IoT field device 100 is provided which has a drive control as the main function 103. The main function 103 communicates via the Internet with a cloud service IoT data management platform 301. For example, the field device requests data from the cloud service, which are processed by the main function 103 for purposes of optimizing the drive control. The field device 100 authenticates itself on the one hand to the network via a network access control method, in short NAC, for example according to the 802. IX standard, and also authenticates itself to the cloud service, for example according to the Transport Layer Security Protocol, TLS. Protocol, and a TLS Client authentication or use of a digital device certificate. The communication between the field device 100 and the network 300 takes place via a network interface 10 or a so-called network interface.

The field device 100 according to the first exemplary embodiment of the invention has a network access filter 101 with a plurality of assigned filter instructions 1, 2, 3 or filter rules or so-called filter policies. The network access filter 101 or network access filter is associated with a component 102 for analyzing a configuration of the field device 100. The analysis of the configuration includes, for example, the testing of the software configuration and firmware configuration. In particular, an up-to-dateness of the configuration is monitored. For example, once it detects that the most recent update has not been installed, after a selection policy 9 of the network access filter 101 is configured to activate one of the filtering rules 1, 2, 3. The selection policy 9 can specify uniform filter rules to be activated for different analysis results. In particular, depending on the detected configuration status, a specific filter rule is proposed and activated by the selection policy 9. In this implementation, an access device 200 is provided which includes the field device 100 and the network access filter 101 and thus provides an integrated solution for restricting network connectivity by a field device itself. A client thus recognizes a vulnerability in its own configuration itself and derives a limitation a network access by appropriate filter regulations itself. The filter rule is applied topologically between the main function 103 of the device 100 and the network access point 10, that is to say on the client side. The functioning of the network remains unaffected, ie there must be no monitoring of field devices on the server side and no blocking of data connections or filtering of data. The second embodiment is illustrated schematically in FIG. In contrast to the first exemplary embodiment, here the network access filter 101 is formed separately from the device 100. An access device 200 comprises the network access filter 101 and the component 102 for analyzing the configuration of the device 100. Both are provided externally to the field device 100. The network access point 10 to the network 300 is provided on the access device 200 in this example. Between this network access point 10 and the

Main function 103 of field device 100 again finds the selected filter rule 1, 2, 3 application, ie client-side. The access device 200, in particular the component 102 for analyzing the configuration, can determine the current configuration status of the field device 100 in different ways. For example, a separate local interface, such as a service interface, in particular RS232, SPI, I2C or USB, is used. Alternatively, a network interface 10b of the field device 100, which does not lead directly to the network 300, but first to an interface 10a of the access device 200, can be used. For example, an OPC UA server or a

HTTP / CoAP server or an SNMP server on the IoT field device 100 used.

In another variant, communication of the field device 100 with an app or device manager 302 is overheard. A vulnerability is always detected if no communication of the field device with an app or Device Manager 302 could be detected for a given period of time. Indirectly, it is concluded that a configuration is not up-to-date enough and may have weak points. After the field device 100 has contacted the app or device manager 302, it is concluded that the configuration is current and there is no vulnerability. As a result, for example, a default restricted communication, especially for a definable period of time. Alternatively, a current configuration of a field device can also be queried by a virtual double or virtual twin or digital twin assigned to the field device 100.

A method for reducing a possibility of attacking a weak point of a device according to a further exemplary embodiment of the invention will be explained with reference to the flowchart in FIG. In step S01, the process is started. In step S02, a filtering rule is applied, which is applied by default for a phase in which the device is examined for vulnerabilities. This initial filter rule only allows the actuality of a software or firmware configuration to be checked. To do this, we communicate with the App / Device Manager of the Internet of Things network. This happens in step S1. Depending on the result of the analysis, which is determined in step S11, either in the case of a non-current configuration, a restricted filter rule is activated in step S2 or, in the case of a proper configuration, a regular filter rule operation is activated in step S2a. During operation of a field device, the method can be carried out repeatedly. In particular, after a waiting phase S3, the configuration is checked again.

Although the invention has been further illustrated and described in detail by the embodiments, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Claims

claims

1. A method for reducing a vulnerability of a device (100) via a network access part (10) to a network (300),

wherein in a first step (S1) a configuration of the device (100) is analyzed,

wherein in a second step (S2) in the case of a weak point recognized due to the analyzed configuration, in particular a lack of timeliness of the configuration, communication via the network access point (10) by means of a selectable filtering rule (1) by a network access filter (101) is restricted, and

- wherein the filter rule (1) topologically between the network access point (10) and a main function of the device (100) is applied.

2. The method of claim 1, wherein the device (100) is authenticated to the network (300), in particular via a network access control method.

3. The method of claim 1 or 2, wherein the device (100) authenticates to a cloud service, in particular by means of a TLS method using a digital device certificate.

4. The method according to any one of the preceding claims, wherein the filter rule (1) from a number of a plurality of filter provisions (1,2,3) is selectable.

5. The method of claim 4, wherein the network access filter (10) according to a fixed or changeable assignment prescription one of the filter provisions (1,2,3) activated.

6. The method according to any one of the preceding claims, wherein further depending on the selected filter rule (1,2,3) further safety rules of the device are further adapted.

An access device (200) for protection against an attack on a vulnerability of a device (100) via a network access point (10) to a network (300)

a component (102) for analyzing a configuration, - a network access filter (101) for restricting communication via the network access point (10) by means of a filtering rule (1) in the case of a weak point recognized on the basis of the analyzed configuration,

- wherein the network access filter (101) topologically between the network access point (10) and a main function of the device (100) is provided.

The access device (200) of claim 7, wherein the network access filter (101) is integrated with the device (100).

The access device (200) of claim 7 or 8, wherein the component (102) is integrated with the device (100).

The access device (200) of claim 7, wherein the network access filter (101) is formed separately from the device (100).

11. Access device (200) according to claim 7, 8 or 10, wherein the component (102) is formed separately from the device (100).

12. Access device (200) according to one of claims 7 to 11, wherein the component (102) has a local interface or a network interface to the device (100) or a communication interface to a virtual double of the device (100).

A computer program product comprising a computer program comprising means for performing the method of any one of claims 1 to 6 when the computer program is executed on a program controlled device