EP3970341A1

EP3970341A1 - Method and transmission device for data transmission between two or more networks

Info

Publication number: EP3970341A1
Application number: EP20735082.8A
Authority: EP
Inventors: Christian Bauer; Matthias Lorenz; Hermann Seuschek; Martin Wimmer
Original assignee: Siemens Mobility GmbH
Current assignee: Siemens Mobility GmbH
Priority date: 2019-06-27
Filing date: 2020-06-16
Publication date: 2022-03-23
Also published as: AU2020307905B2; CN113994634A; WO2020260070A1; US20220360558A1; DE102019209342A1; CN113994634B; AU2020307905A1; US11991146B2

Abstract

The invention relates to a method for data transmission between at least one first network (NW1; NW2) and at least one second network (NWA; NWB), wherein a) for at least one data transmission between the at least one first network (NW1; NW2) and the at least one second network (NWA; NWB), at least one connection between the first network (NW1; NW2) and the second network (NWA; NWB) is established and a datum or data are directed by means of a resource allocation unit (H) arranged between said networks, and b) for the establishment of the at least one connection, the resource allocation unit (H) exclusively allocates at least one net access resource (NWA_IF), e.g. network cards or network adapters, which can be coupled to the second net, and a one-way communication unit (NWTap) arranged upstream of the net access resource for establishing a feedback-free data transmission direction.

Description

description

Method and transmission device for data transmission between two or more networks

The invention relates to a method for data transmission between at least one first network and at least one second network.

For secure communication between two or more networks, in particular a security-critical and an open network, such as an industrial control network or operational network and a classic IT network, for example, one-way communication units, such as Data diodes, are used to enable unidirectional data transmission. A data diode with a feedback channel, also known as a bidirectional network guard or security gateway, enables secure data transfer between two information areas with different security levels. A network guard is usually a combination of hardware and software that enables more restrictive data transmission between networks, for example compared to known firewalls:

A bidirectional network guard is usually structured in such a way that two separate unidirectional data streams are implemented using a data diode, the data streams flowing in opposite directions. This allows data to be exchanged in both directions, with the one-way function being guaranteed for each direction or transfer path. For example, with a bidirectional network guard, data can be transmitted from a network with high security requirements to an open network with low security requirements or from a network with low security requirements to a network with high security requirements. In the case of data transfer from the network with low security requirements to the network with high security requirements, an additional check or validation is usually necessary to ensure the integrity and / or security of the network with high security requirements and / or network availability .

A data capture unit (DCU, www.siemens.com/dcu) represents a feedback-free network tap that can be used to implement cost-efficient unidirectional data transfers. Messages can be tapped retroactively via the tap connections of the DCU and unidirectional transmission paths of a network guard can be implemented.

In EP 19163812 a bidirectional network protocol has already been proposed which implements a network guard based on two separate unidirectional transmission links.

It is the object of the present invention, for data exchange between two or more networks, to make data transmission from one network to the other more flexible compared to the prior art mentioned at the beginning.

The object is achieved by the features described in the independent claims. Advantageous developments of the invention are claimed in the dependent claims.

The invention claims a method for data transmission between at least one first network and at least one second network, wherein

a) for at least one data transmission between the at least one first network and the at least one second network, at least one connection is established between the first network and the second network and a data item or data is routed via a resource allocation unit arranged between the said networks, in which

b) the resource allocation unit for establishing the at least one connection, at least one network access resource that can be coupled to the second network, for example a network card / adapter for WLAN and / or Ethernet, physical interfaces / slots, serial interface, CPU etc., and one the one-way communication unit upstream of the network access resource for specifying a non-reactive data transmission direction is exclusively allocated.

The one-way communication unit can be used, for example, by means of an optical data diode or alternatively by means of a passive network tap of a DCU (e.g. data capture unit,

www.siemens.com/dcu).

In other words, one or more connections can be built up from a first network of a possible number of first networks into one or more second networks (ie a 1 to m relationship). In addition, one or more connection (s) can be set up from a second network of a possible number of second networks in one or more first networks (ie an n to 1 relationship). Theoretically, n first and m second networks are conceivable, which can enter into an n to m relationship via the connections established. When using a DCU, four ports are provided for the use of connections between networks. The 1 to n possible first networks preferably have a security requirement to be met, whereas the 1 to m possible second networks have a security requirement to be met that is different from the first networks. As a rule, the first networks have higher security requirements than the second networks. Connections between two networks with the same security requirements are also conceivable. The fact that the at least one connection is established via a one-way communication unit, for example a network tap that can be designed as a data diode, means that the data transmission direction is given. That is, the data transmission can depending on the arrangement and Allocation of the one-way communication unit by the resource allocation unit, either from the first to the second network or from the second to the first network, can be directed unidirectionally and thus without any reaction. The network tap can be integrated into the DCU mentioned above.

The method is preferably computer implemented. In connection with the invention, “computer-implemented” can be understood to mean an implementation of the method in which, in particular, a processor executes at least one method step.

A further development of the invention provides that the at least one first network fulfills a first security requirement and the at least one second network fulfills a second security requirement that is different from the first security requirement.

A further development of the invention provides that a virtual machine is provided for the data transmission between the networks mentioned, which machine reconstructs user data from the data received in the one-way communication unit, the user data being forwarded.

A virtual machine, abbreviated VM, means a software-technical encapsulation of a computer system within an executable computer system. The abstracting layer between a real or host (host) computer system on which the virtual machine is running and the virtual machine is called a hypervisor or virtual machine monitor. Their implementation is purely hardware-based, purely software-based, or a combination of both. The hypervisor generally allows several virtual machines to be operated simultaneously on one physical computer system.

A further development of the invention provides that a validation unit (VE) is provided, which the virtual len machine is / is downstream, the user data being validated on the basis of a predetermined rule, for example for integrity, authenticity, signature, etc. in the validation unit and forwarded if the validation is positive.

A further development of the invention provides that a data lock is provided, which is / is arranged downstream of the validation unit, the data lock preventing the forwarding of the useful data in the event of a negative validation and, if necessary, temporarily storing the useful data.

A further development of the invention provides that the data sluice allows either a user data transfer from the virtual machine to it or a user data transfer from it to the allocated network access resource.

A further aspect of the invention is a transmission device for data transmission between at least one first network and at least one second network, comprising:

a) at least one communication unit which is designed to set up at least one connection between the first network and the second network for at least one data transmission between the at least one first network and the at least one second network and a date or data via a between the said networks are directed to the resource allocation unit, and having

b) the resource allocation unit for establishing the at least one connection, which is designed to exclusively allocate at least one network access resource that can be coupled to the second network and a one-way communication unit upstream of the network access resource for specifying a reaction-free data transmission direction.

A further development of the invention provides that the network access resource is designed for serial data transmission. One property of the method and the transmission device is the exclusive or exclusive allocation of network access resources by the resource allocation unit to a virtual machine. The network access resources - which allow bidirectional communication - are assigned exclusively to the respective virtual machine. Even in the event that an attacker succeeds in controlling the virtual machine (abbreviated: VM) from the second network, he cannot access resources directly from the first network, as there are no incoming resources (neither unidirectional nor bidirectional) connection to the first network. In this case, an attacker is "trapped" in the virtual machine.

The invention enables a total of a little elaborate realization of a bidirectional gateway through a combination of one-way communication units for unidirectional unidirectional transmission or transfer links or - connections and virtualization for a safe and efficient technical implementation of control functions on just one hardware platform.

The Data Capture Unit (DCU) can be used as a hardware platform, whereby, in addition to a network access resource, resources such as a dedicated CPU core can also be exclusively assigned to each VM instance.

Overall, the design variants shown are characterized by:

Secure network connection through incoming and outgoing transfer links or connections, at least partial links of these being implemented via unidirectional coupling using a one-way communication unit.

Efficient technical implementation options through the use of taps instead of classic diodes and the use of virtualization to implement routing, allocation and, if necessary, test functions. A unit or component, in particular a communication unit or network component, can be designed as a hardware component. A component can include a processor.

A processor can in particular be a main processor (Central Processing Unit, CPU), a microprocessor or a microcontroller, for example an application-specific integrated circuit or a digital signal processor, possibly in combination with a memory unit for storing program instructions , etc. act. A processor can, for example, also be an IC (integrated circuit) or a multi-chip module, in particular an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). English Application-Specific Integrated Circuit), a SoC (System on Chip), a graphics processor GPU (Graphics Processing Unit), a processor for evaluating a neural network such as a TPU (Tensor Processing Unit) or a DSP (Digital Signal Processor) . Digital Signal Processor) act. The processor can have one or more computing cores (multi-core). A processor can also be understood to be a virtualized processor or a soft CPU. For example, it can also be a programmable processor that is equipped with configuration steps for executing the method according to the invention or is configured with configuration steps such that the programmable processor implements the features of the method according to the invention or other aspects and partial aspects of the invention. The processor can have a tamper protection to protect against physical manipulation, e.g. Tamper sensors for the detection of physical attacks.

The invention further relates to a computer program product that can be loaded directly into a programmable computer, comprising program code parts that are suitable for the Carry out steps of a computer-implemented method according to the invention.

A computer program product, such as a computer program means, for example, can be provided or delivered as a storage medium or data carrier such as a memory card, USB stick, CD-ROM, DVD or also in the form of a downloadable file from a server in a network be produced.

The devices, devices, units or devices, modules and computer program (products) can be designed according to the developments / embodiments of the aforementioned method and their further developments / embodiments and vice versa.

Embodiments of the method according to the invention and the transmission device are shown by way of example in the drawings and are explained in more detail with reference to the following description. Show it:

Fig. 1 is a schematic representation of an inventive

Transmission device that is suitable for data transmission between two or more networks.

Fig. 2 is a schematic representation of a further Ausfüh approximate form of the transmission device according to the invention;

FIG. 1 shows an embodiment of the transmission device according to the invention which is suitable for data transmission between two or more networks.

Via a first transmission or transfer path or connection marked with a dashed line, a data item or several data from a first, for example, NW1 of possible several first networks NW1, NW2 to NWn, which preferably meets a high security requirement, can be entered e.g. a system network (e.g. with system components C) in a second network e.g. NWB of possible several second networks NWA, NWB to NWZ, which preferably meets a lower security requirement than the first network, e.g. an open network (monitoring network with a monitoring unit e.g. M), be transmitted. Conversely, a data transfer takes place from one piece of data or from several data from one of the possible second networks, for example NWB, into one of the possible first networks, for example NW1, via a second transmission path marked with a solid line.

Several such transmission links are conceivable in each case. In the example, a transmission link is used by a proxy, e.g. Psec of the first network via a network access resource NW_IF e.g. a network card for Ethernet and / or WLAN or a serial interface and via a network tap of a transmission device NG, also referred to as Network Guard, to a resource allocation unit H, also referred to as a hypervisor. From the resource allocation unit, the transmission path is further forwarded via a network access resource NW_IF to a proxy e.g. Pop of the second network led. Conversely, a transmission path from the proxy Pop can be routed to the proxy Psec via the units or components mentioned. Here, the date or the data are passed unidirectionally over the transmission links or paths.

The Network Guard implements and controls the unidirectional transmission paths between a first and a second network. The Network Guard comprises the following units / components, which can be designed in terms of hardware, firmware and / or software: a. Network tap NWTap

(at least) two non-reactive network taps that enable communication or data transmission to closed data connections can only read but not write / change.

b. Network access unit NW_IF or -Interface, the first network interface (bidirectional) being connected to the proxy Psec from the first network.

c. Another network access unit NW_IF, the second network interface (bidirectional) being connected to the proxy Pop from the second network.

d. A virtual machine VM

a first virtual machine, via which an incoming or outgoing data transfer is controlled depending on the data transfer direction (unidirectional). The virtual machine VM can reconstruct the actual user data from the recorded raw data - as described below under Proxy Psec or Pop. In this example, a transferred file is reconstructed in this step. Incoming network packets of the protocol are recognized and processed further. An advantageous embodiment according to the invention provides that packets that do not comply with the protocol are recognized (these can provide information on possible attacks to which one must react accordingly - for example via alarms and subsequent actions as part of intrusion detection and / or prevention procedure)

e. Hypervisor H

a hypervisor, which regulates the resource management on the Network Guard. As described below, network interfaces and possibly also CPU (cores) are exclusively or exclusively assigned to the virtual machines by the hypervisor.

The proxy Psec is a system component which initiates outgoing data transfers from the first network and receives incoming data transfers and processes or further derives. The component usually has a dedicated network port which is exclusively connected to the network guard, as shown in the figures.

Since the network tap cannot act as a communication partner (as it is purely passive and free of reaction), the transfer path between proxy Psec and network tap is designed to be strictly unidirectional, which can be ensured via a hardware property. As an alternative to the network tap, an optical data diode can also be used to transmit the date / data in a purely unidirectional manner. A unidirectional protocol such as UDP or the protocol described in the patent application EP 19163812 mentioned above can be used. The communication of the proxy Psec is read via the network tap (intercepted) and recorded without any reaction. These "raw data" are then passed on to the virtual machine VM.

Due to the functional principle of the network tap, this section of the route is strictly unidirectional and non-reactive. The actual user data is therefore embedded in a Network Guard protocol. E.g. a file transfer take place.

The proxy Pop is a system component that can act in the same way as the proxy Psec for incoming data transfers and accordingly initiates data transfer into the second network and receives and further processes or forwards outgoing data transfers. The component is set up in the same way as the proxy Psec, i.e. has a corresponding dedicated connection to the Network Guard. The Proxy Pop can request the transferred data from the virtual machine VM. This can be done push-based or pull-based. This section is usually implemented bidirectionally.

The main protection goals for industrial plants, in the example one of the first networks, are usually the availability and the integrity of the plant (correct, defined system behavior). In the case of a connection to an open network, in the example of one of the second networks, a strictly unidirectional outgoing connection offers a high degree of security, which corresponds to the level of ner physical network separation is comparable. A unidirectional outgoing data transfer (the dashed connection in FIG. 1) can therefore usually be maintained permanently on its own.

The protection goals mentioned are exposed to a risk, in particular due to the incoming connection (in FIG. 1 the continuous transfer route). As in the case of application level firewalls, it is also important here to monitor incoming transfers more precisely, i.e. only to a limited extent (e.g. with regard to data types and content of transfers and time availability).

Data is transmitted between at least one first network NW1 or NW2 and at least one second network NWA or NWB, with

a) at least one connection between the first network and the second network is established for at least one data transmission between the at least one first network and the at least one second network (see above all the dashed transfer path) and a date or data via a between the named networks arranged Res sourcenzuteilungseinheit H are directed,

in which

b) the resource allocation unit H exclusively allocates at least one network access resource NWA_IF, which can be coupled to the second network, for setting up the at least one connection to specify a non-reactive data transmission direction.

FIG. 2 shows an embodiment variant which takes up these requirements and additionally controls incoming connections. For this purpose, the system structure from Figure 1 is expanded by the following units or components:

Validation unit VE: this takes over the tasks of filtering incoming data transfers. Data transfers that come in via the virtual machine VM are sent to the validation unit VE transferred via host-internal communication and analyzed by this using a predetermined rule. Only the data transfers that meet the rule are accepted and can later be forwarded towards Proxy Secure. Examples of such a rule for checking or validation are: o Signature validation for firmware and software

updates

o Virus scans

o Message checking: similar to "deep packet

Inspection "approaches of application level fire walls are rule-based only allowed selective requests / commands,

o integrity

o authenticity

Data lock Gl / M:

This takes over the functionality of a lock computer. This controls the connection to the validation unit VE and thus has control over the establishment or interruption of the entire incoming transfer path (from the second to the first network). I.e. the proxy Psec, together with the data lock Gl / M, controls whether the connection is switched or interrupted. This allows maintenance access to be temporarily activated in a controlled manner from the first network.

Figure 2 shows a further embodiment of the invention. The Proxy Pop is connected via a serial connection

Interface S as an embodiment of a network access resource NW_IF. This makes it more difficult for attackers to carry out attacks on the Network Guard (or the hypervisor, for example) via standard network interfaces. The connection of the Proxy Pop is usually maintained via a network access resource NW_IF. This variant offers the advantage that outgoing transfers can be carried out at a higher transfer rate (since a serial interface has lower transfer rates compared to Ethernet Interfaces). This is particularly advantageous if a specific implementation requires a higher amount of data transfer from the first network to the second network and less and / or less data has to be transferred from the second network to the first network.

Although the invention has been illustrated and described in more detail by the preferred exemplary embodiment, the invention is not restricted by the examples disclosed and other variations can be derived therefrom by the person skilled in the art without departing from the scope of the invention.

The processes or procedures described above can be implemented using instructions that are available on computer-readable storage media or in volatile computer memories (hereinafter referred to collectively as computer-readable memories). Computer-readable memories are, for example, volatile memories such as caches, buffers or RAM as well as non-volatile memories such as removable data carriers, hard disks, etc.

The functions or steps described above can be present in the form of at least one set of instructions in / on a computer-readable memory. The functions or steps are not tied to a specific set of instructions or to a specific form of instruction set or to a specific storage medium or to a specific processor or to specific execution schemes and can be implemented through software, firmware, microcode, hardware, processors, integrated circuits etc. can be run alone or in any combination. A wide variety of processing strategies can be used, for example serial processing by a single processor or multiprocessing or multitasking or parallel processing, etc. The instructions can be stored in local memories, but it is also possible to store the instructions on a remote system and access them via the network. The transmission device can have one or more processors. The term "processor", "central signal processing", "control unit" or "data evaluation means" includes processing means in the broadest sense, for example servers, universal processors, graphics processors, digital signal processors, application-specific integrated circuits (ASICs), programmable logic circuits such as FPGAs, discrete analog or digital circuits and any combinations thereof, including any other processing means known to those skilled in the art or developed in the future. Processors can consist of one or more devices or devices or units. If a processor consists of several devices, these can be designed or configured for parallel or sequential processing or execution of instructions.

Claims

1. A method for data transmission between at least one first network (NW1; NW2) and at least one second network (NWA; NWB), wherein

a) for at least one data transmission between the at least one first network (NW1; NW2) and the at least one second network (NWA; NWB) at least one connection between the first network (NW1; NW2) and the second network (NWA; NWB) is set up and a date or data are routed via a resource allocation unit (H) arranged between the said networks,

in which

b) the resource allocation unit (H) exclusively allocates at least one network access resource (NWA_IF) that can be coupled to the second network and a one-way communication unit (NWTap) upstream of the network access resource to specify a reaction-free data transmission direction for establishing the at least one connection.

2. The method according to the preceding claim, characterized in that the at least one first network fulfills a first security requirement and the at least one second network fulfills a second security requirement that is different from the first security requirement.

3. The method according to any one of the preceding claims, characterized in that a virtual machine (VM) for the data transmission between said networks is provided which reconstructs user data from the data received in the one-way communication unit, the user data being forwarded.

4. The method according to the preceding claim, characterized in that a validation unit (VE) is provided which is / is downstream of the virtual machine, the useful data using a predetermined rule validated in the validation unit and forwarded in the event of positive validation.

5. The method according to the preceding claim, characterized in that a data lock (Gl / M) is provided which is or is downstream of the validation unit (VE), wherein the data lock interrupts or prevents the forwarding of the useful data in the event of a negative validation and, if necessary, the Intermediate storage of user data.

6. The method according to the preceding claim, characterized in that the data lock permits a transmission of useful data routed via the virtual machine from the virtual machine to it and / or a transmission of useful data from it to the assigned network access resource.

7. Transmission device (NG) for data transmission between at least one first network (NW1; NW2) and at least one second network (NWA; NWB), comprising:

a) at least one communication unit (box on the left in the NWGuard), which is designed for at least one data transmission between the at least one first network (NW1; NW2) and the at least one second network (NWA; NWB) at least one connection between the first Network (NW1; NW2) and the second network (NWA; NWB) is set up and a date or data are routed via a resource allocation unit (H) arranged between said networks, and

b) the resource allocation unit (H) for establishing the at least one connection, which is designed to exclusively allocate at least one network access resource (NWA_IF) that can be coupled to the second network and a one-way communication unit pre-assigned to the network access resource for specifying a feedback-free data transmission direction .

8. Transmission device according to the preceding claim, characterized in that the at least one first network factory satisfies a first security request and we ^¬ nigstens a second network satisfies a safety requirement compared to the first other second security requirement.

9. Transfer device according to one of the preceding claims, characterized by a virtual machine (VM) for data transmission between said networks, which is designed to reconstruct payload data from the data received in the Einwegkommunikati ^¬ onseinheit data, where forwarded at the user data can.

10. Transmission device according to the preceding claim, characterized by a validation unit (VE), which is arranged downstream of the virtual machine, wherein the user data can be validated using a predetermined rule in the validation unit and forwarded in the event of a positive validation.

11. Transfer device according to the preceding claim, characterized by a data lock (Gl / M), which is the Va ^¬ lidierungseinheit (VE) arranged downstream, wherein the data ^¬ lock with negative validation, the forwarding of the user data interrupt or stop and, optionally, the user data caching can .

12. Method according to the preceding claim, characterized in that the data lock a routed via the virtual machine user data transmission and / or a Nutzda ^¬ tenübertragung by it for zuteilten network access resource permits.

13. Transmission device according to one of the preceding claims 7 to 12, characterized in that the Netzzu ^¬ access resource is designed for serial data transmission.

14. Computer program product which can be loaded into a programmable computer, comprising program code parts which are used for this are suitable to carry out the steps of the method according to a preceding method claims.