WO2017186457A1

WO2017186457A1 - Method for path redundancy assessment in a backbone network

Info

Publication number: WO2017186457A1
Application number: PCT/EP2017/057914
Authority: WO
Inventors: Anton Frank; Oliver Schulz
Original assignee: Siemens Aktiengesellschaft
Priority date: 2016-04-29
Filing date: 2017-04-04
Publication date: 2017-11-02
Also published as: DE102016207423A1

Abstract

The invention relates to a network monitoring unit for path redundancy assessment of communication links in a backbone network (500). The network monitoring unit is designed to receive meta-data, signatures and/or time stamps detected at transfer points, to identify a pair of logically redundant communication links using the meta-data, signatures and/or time stamps, to generate information tables (320, 320') for the identified communication links (AC, AC') by merging said meta-data, signatures and/or time stamps, and to evaluate the information tables (320, 320') with respect to correlation (E4) of the meta-data, signatures and/or time stamps.

Description

description

Method for path redundancy evaluation in a backbone network

The invention relates to a method for path redundancy assessment of communication links in a backbone network. The invention further relates to a network monitoring unit and a system for such path redundancy evaluation.

For years is the growing integration of Rechnersys ^¬ temen place in industrial domains. In addition, transmission networks are used over long distances by many different applications in order to utilize the infrastructure efficiently. Such a development can be observed, for example, in the railway sector, where networked interlocking computers at different locations use the same backbone network as the control technology, customer information systems and management systems. The services have different requirements for data transmission in relation to the

Quality of Service (QoS).

In the networking of computer systems, signal technology security responsibility Safety protocols monitor (for example, by EN50159: 2010) the exchange of data over ^¬ transmission error.

Errors such as telegram losses, telegram falsifications, telegram delays etc. must be corrected within certain time requirements. An error correction is usually realized by a telegram repetition and since a repetition takes time, transmission errors can only be tolerated to a certain extent. If this limit is exceeded, the connection ^monitoring (safety protocol) ^{initiates a} safety-related reaction, which results in a restriction of the system function for the entire system. For example this means in a distributed interlocking system effects on the railway technical operation, since the automation ^¬ function is limited. Furthermore, the threat of distributed automation functions is increasing due to cyber attacks, which are becoming increasingly likely from complex infrastructures. The implementation of protection measures in the infrastructure and in the participants is necessary and becomes more complex with the infrastructure structure size. Therefore, in addition to the protective measures and monitoring for attack attempts is mandatory.

In systems with safety signal security, the monitoring of transmission characteristics is crucial to both degrade

To detect QoS characteristics as well as attack attempts. This should give the infrastructure administration hints before it comes to a loss of the system function or even a manipulation of signaling safety. This way, measures can be taken in good time. In addition, reporting of IT security incidents in critical infrastructures is required by the IT Security Act, which requires a certain amount of sensor technology. To meet the highest availability requirements, redundant transmission paths are used via the infrastructure. These are nodes and designed kantendis- junkt, which it says are different Übertra ^¬ supply routes and various network components to Übertra ^¬ for redundant data. A single error thus only affects one of the two redundant transmission paths. A highly available system subscriber has a route redundancy function with which, for example, the payload information to be transmitted is sent identically to the receiver over several transmission paths. Such a transfer function is defined, for example, as a path redundancy layer by the safety protocol RaSTA (DIN VDE V 0831-200). The infrastructure for the redundant transmission can be designed in a number of ways in terms of node and edge disjoint. It is possible to establish a) completely separate infrastructures or b) create node-like access points which transmit redundant data in a common infrastructure by means of a corresponding configuration.

The latter is the more economical option and possible with the hay ^¬ term infrastructure components. If there is a common infrastructure for node- and edge-disjoint transmission, then in addition to the already published techniques for monitoring transmission properties (eg QoS and cyber intrusion detection) there is still the requirement to ensure the property "node and edge disjointness".

If paths or components in the infrastructure fail, remaining parts are reconfigured so that as many logical connections as possible can be made by participants. Thus, it is possible that the said path redundancy function of a safety protocol (e.g., RaSTA) does not disclose the failure of a path because the infrastructure has chosen an alternative path for the connection. However, it may be that this path is no longer node or edge disjoint to a redundant transmission of this safety protocol.

As a result, the availability of signaltech ^¬ cally safe operation reduced because individual errors in the infrastructure now redundant connections relate simultaneously (no stochastic independence of errors).

In distributed automation systems in which a transmission service is used as a provision, it is often difficult to compare the data transmission requirements with their actual characteristics.

The object is to provide a method with which a path redundancy evaluation of communication links can be can be evaluated so that conclusions can be drawn as to the availability of the signaling function or

According to the invention a method according to claim 1, a network surveillance unit according to claim 7, a Datener ^¬ sensing unit according to claim 10 and a system according to ^¬ demanding 11 is provided.

The inventive method for path redundancy assessment of two logically redundant communication links comprises: identifying the communication links using metadata of data packets transmitted over the communication links, generating information tables for the communication links by merging the metadata, and evaluating the information tables for correlation of the transmission characteristics.

The network monitoring unit presented according to the invention is designed for route redundancy assessment of communication links in a backbone network. The Netzwerküberwa ^¬ monitoring unit is further formed, at transfer points detected metadata, signatures, and / or time stamp to receive and identify a pair of logically redundant communication links using the metadata, signatures, and / or time stamp information tables for the identified communication links by merging the metadata signatures and / or to create timestamps and to evaluate the information tables relating to correlation of the metadata, signatures and / or timestamps.

If the transmission characteristics are correlated, the paths of the communication connections are not stochastically independent and thus not redundant in terms of availability. In a preferred embodiment, the communication links are partially in a backbone network between associated transfer points of the backbone network and do not include a common transfer point. The procedure in the preferred embodiment, determines the transmission characteristics using metadata, signatures, and / or timestamps of data packets transmitted over the communication links. Furthermore, the method may comprise: acquiring the metadata, signatures and / or time stamps by the data acquisition units assigned to the transfer points.

Thus, in a preferred embodiment, the determination of the transmission properties can be realized.

The collected metadata, signatures, and / or timestamps may be transmitted to a network monitoring unit that performs the path redundancy assessment.

Thus, in a preferred embodiment, the path redundancy score can be realized.

The method may further comprise: comparing the determined correlation to at least one threshold value and evaluating the path redundancy based on the comparison result or the comparison results.

The threshold value makes it easy to distinguish between sufficient and insufficiently redundant communication links.

The threshold value may be a previously determined correlation value.

This means that path failures can be detected.

The particular transmission characteristics may include latency fluctuations and / or telegram balances.

These are easily determinable transmission properties. The present invention presented data acquisition unit is designed for feedback-free data acquisition and includes: a read-in element for reading data packets, a memory unit for storing read data packets, a data packet processing unit for determining Zeitstem ^¬ peln, metadata and / or signatures of the data packets and a transmission unit for transmitting the specific ^¬ time stamp, metadata and / or signatures to a network monitoring unit. The data acquisition unit determines the metadata by means of telegram filters using header information of the data packets and / or the signatures using process data as well as a time stamp indicating a read-in time. The inventively presented system for Wegredundanzbe ^¬ evaluation of communication links in a backbone network comprises a network monitoring ^¬ unit according to the invention and data acquisition units, which are assigned to the transfer points of the network, between which the communication tion compounds exist.

The data acquisition units are constructed according to the invention and further adapted to carry the metadata signatures and timestamps to the network surveillance unit to be ^¬.

The above-described characteristics, features and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments which will be described in connection with the drawings. They show by way of example and schematically:

FIG. 1 shows a network in a backbone network with a system according to the invention,

FIG. 2 shows a data acquisition unit according to the invention,

Figure 3 shows the data acquisition unit in detail and Figure 4 is a network surveillance unit according to the OF INVENTION ^¬ dung. FIG. 1 shows a network in a backbone network 500 with a system according to the invention.

The backbone network 500 comprises nodes 400 connected via edges 410 and a network monitoring unit 300, in short NMU: Network Monitoring Unit, which is connected to at least one of the nodes 400. The backbone network 500 connects process computers 100 at various locations A, B, C, D by means of the nodes 400. Some of the nodes 400 are embodied as transition points to location networks of the respective process computers 100.

The process computer 100 are ausgebil ^¬ det as redundant and concurrent computer pairs 100, 100 ^λ at locations A, B, C and D. Each computer of a same pair of a site is logically independent connected to another computer of a pair in another location. It consists in the illustrated example, a logical connection from the process computer 100 at location A to the process computer 100 at the location C, and, in addition lo ^¬ cally redundant, there are a logical connection from the process computer 100 ^λ at the location A to the process computer 100 ^λ at the location C. Ent ^¬ speaking in the illustrated example logical connections of process computers 100, 100 ^λ at the site B to process computers 100, 100 ^λ at the site D. The connections include the transfer points in or out of the backbone network.

The transition points are data acquisition units 200, shortly DCU for English: Data Capture Unit, assigned, comprising a pas ^¬ sive Mitleseelement 210th The read-through element 210 is also referred to as tap.

A Mitleseelement 210 is a hardware device that ei ^¬ ne possibility is, to data packets over the Transfer points flow passively, ie in the sense of signaling safety, without feedback. The Mitle ^¬ seelement in the example includes at least three ports: ei ^¬ NEN input 211, an output 213 and a monitor port 212. Data packets are received at the input 211 and output at the output 213 unchanged. A tap is inserted between input 211 and output 213, which provides copies of the data packets at monitor port 212. Other components of the data acquisition units have no technical possibility to influence the original data bits due to the construction of the taps.

As shown in Figures 2 and 3, the data acquisition units ^¬ 200 further include a storage unit 220 and Einhei- th 230, 240, 250 for the determination of signatures (SG), metadata (MD) and time stamps (TS). Certain (SG), metadata (MD) and time stamps (TS) are transmitted to the network monitoring unit 300 via an output 260 connected to the backbone network 500.

The units 230, 240, 250 can be realized by a single data processing unit.

The unit 250 adds a time stamp TS to data packets.

The unit 240 is, for example, a telegram filter of the header information IP, TH of the data packets used to detect telegram loss and telegram insertion. By way of example, the unit 240 is designed in FIG. 3 to replace the IP header and transport header information IP, TH with the metadata MD, the metadata MD telegram loss or telegram insertion being related.

The unit 230 determines the signatures SG, for example, using process data PD of the data packets. The unit 230 is formed by way of example in Figure 3, to replace the pro ^¬ process data PD by the signature SG. The data acquisition unit 200 is removed in an execution ^¬ for example from the data packets and an Ethernet header EH and a cyclic redundancy CRC. The feedback-free reading of data telegrams has the advantage that for secure signaling data transmissions no special considerations in the safety case guidance must be provided. FIG. 4 shows a network monitoring unit 300 according to an ^exemplary embodiment of the invention. The Netzwerküberwa ^¬ monitoring unit 300 identified in step Sl communication ^¬ compounds AC, AC ^λ between redundant computer pairs 100, 100 ^λ at locations A, C. This may, for example, under INTENT of the transmission characteristics and / or knowledge of the communication links AC, AC carried ^λ , Then, in step S2, the network monitoring unit 300 generates for each of the connections AC, AC ^λ an information table 320 by merging the time stamps TS, metadata MD and / or sig nals SG. The information tables 320, 320 are ^λ in

Step E4 evaluated on a correlation E4 of the compounds out. Furthermore, from the information table 320 Pa ^¬ ketverlust El, El packet insertion E2, E2 and ^λ E3 connection delay, E3 determined ^λ of the compounds AC, AC ^λ.

The mapping of user data of a data packet to timestamp, meta-information and / or signature increases the efficiency in the evaluation of transmission properties. Very little bandwidth is needed between the data acquisition units and the network monitoring unit and the search for meta information of a transmitted data packet in the network monitoring unit is accelerated.

1 shows a system with a redundant function and the same computer running pair 100, 100 at a location ^λ A is re ^¬ alisiert which each holds a link to another redundant computer pair 100, 100 ^λ in a different location C. In this case, there is a connection of process computer 100 at site A to process computer 100 at location C and a redundant connection over which identical payload data are transmitted, from process computer 100 ^λ at location A to process computer 100 ^λ at location C. There is in each case a redundant local network at the two locations A, C of the redundant computer 100, 100 ^λ available. The locations A, C are connected via the backbone network 500 to each other, which connects over disjoint transition points of each of the two re ^¬ dundanten local networks at the locations A, C to each other. Per configuration ensures that within the backbone network 500, the data of the redundant I ^¬ th local networks node and is transmitted kantendisj oint. As a result, different partial paths in the backbone network 500 result in different latency fluctuations, which are caused by different utilization rates. The data acquisition unit 200 may be configured such that they identified or each data packet to a computing nerve heiress ^¬ tion with timestamps and metadata (eg time to live, data length, source and destination address) capture and form a signature on the supplied ^¬ impaired user data. This process takes place on both sides of the backbone network 500 to be monitored.

Each data packet to be detected is therefore registered twice, upon entry and exit from the backbone network 500. The network monitoring unit 300 assumes the further processing of all the data included (each consisting of time stamp of the reading time, meta information and / or signature of the user data). In the network monitoring unit 300, an evaluation of the transmission properties takes place.

For each logical connection between two process computers 100 or 100 ^λ are used in the network monitoring unit 300, at least one, preferably two, more preferably three or more of the following functions executed / reviews which disclose substantial transfer characteristics and mög ^¬ Liche weak points of the underlying backbone network 500:

The difference between the time stamp (at the time of passage through egg ^¬ nes Mitlesepunktes), the latency between the read along ^¬ points (and in the example above, the latency of the back- bone network). The difference in latency to a sequence packet gives the latency jitter.

If there is no correspondence of the data acquisition unit at the transfer point from the backbone network to the ^signal from the data acquisition unit at the transfer point in the backbone network within a predetermined time frame, this is a transfer error between the data acquisition units, which is also referred to as telegram loss and quality of service (QoS). The telegram balance is negative.

Is there a particular at the transfer point from the backbone network signature no particular within the predetermined time frame at the transfer point in the backbone network, matching signature, it is a data packet, wel ^¬ ches not from the monitored local networks originates. This is also called telegram insertion. The Tele ^¬ gram balance is positive. If the subnets are monitored completely and no data packets are allowed outside the monitoring, this indicates an intrusion attempt.

If there is a temporally close connection in the telegram balance due to telegram insertion and telegram loss, packets are apparently falsified during their transmission. This is potentially an attack. If a redundant data stream with identical user data exists, a further evaluation of the transmission properties can be realized: the correlation of the transmission properties of the two redundant data streams.

Unless it is a node and kantendiskunkte Übertra ^¬ supply is, the correlation (eg latency) ge ^¬ ring. However, if the backbone network, because of a reconfiguration, routes the data streams over common nodes or edges, the correlation increases significantly because the

Impacts of the network on both streams equal impact ^¬ ken.

The utilization of the backbone network typically varies as there are many transfers of data across the network. If the load fluctuation relates to the redundant data links in a correlated manner, it can be detected, logged, and / or reported by the network monitoring unit independently of a network management of the backbone network.

Correlation of the transmission properties is an index of the stochastic independence of the compounds. A high correlation indicates low stochastic independence, a low correlation to stochastically independent compounds. Since the stochastic independence of logical connections is a necessary criterion for increasing reliability / availability while taking advantage of Redun ^¬ impedance and a result of backbone network technology, this property can be violated, monitoring is useful and beneficial.

The invention relates to the overall architecture for monitoring a backbone network for certain transmission characteristics, system components and related methods. Specifically, the inventive method for Wegredun ^¬ danzbewertung provides improvement in network diagnostics for monitoring for correlated data streams consisting of availability should be stochastic independent from each other.

The application of the cross-correlation function to the transmission properties of two redundant, logical data streams directly connects them. From this an added value and information gain is generated, which does not result from the consideration of the individual connections. With the aid of the method according to the invention, it is possible to draw conclusions about properties and the configuration of the underlying transmission network.

It can use the properties of a data connection, regardless of the diagnostic capabilities of the participants, increased probability of error and IT security attacks of ^¬ are fenbart.

One aspect of this invention is in evaluating the correlation of redundant data streams over a transmission network. Redundant data transfers must be made in order to increase the availability of nodes and margins.

Although the invention has been further illustrated and described in detail by way of preferred embodiments, the invention is not limited to the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Reference sign list

100, 100 ^λ process computer pair

200 data acquisition unit

210 tap

211 entrance

212 monitor connection

213 exit of the tap

220 storage unit

230 signature determination unit

240 packet filter unit

250 time stamp unit

260 Output of the data acquisition unit

300 network monitoring unit

310 storage unit

320, 320 ^λ information ^tables

400 nodes of the backbone network

410 edges

500 backbone network

A, B, C, D locations

TS timestamp

SG signature

MD metadata

IP IP header

TH transport header

PD process data

CRC cyclic checksum

EH Ethernet header

AC, AC ^X connections between sites A and C

SI connection identification

S2 information table generation

S3 evaluation

El, Ε1 ^λ packet loss

E2, E2 ^λ packet insertion

E3, Ε3 ^λ connection delay

E4 connection correlation

Claims

claims

A method for path redundancy evaluation of two logically redundant communication links (AC, AC ^λ ), comprising: identifying (Sl) the communication links using metadata of data packets transmitted over the communication links (AC, AC ^λ ), generating (S2) information tables (320 , 320 ^λ ) for the communication links (AC, AC ^λ ) by merging the metadata and evaluating the information tables (320, 320 ^λ ) with respect to correlation (E4) of the transmission characteristics.

2. The method of claim 1, wherein the communication links (AC, AC ^λ ) at least partially in a backbone network (500) between associated transfer points of the backbone network (500) and do not include a common Überga ^¬ dunk, wherein determining the Transmission ^properties using metadata (MD), signatures (SG) and / or time stamps (TS) of the data packets, and the method further comprises: acquiring the metadata (MD),

Signatures (SG) and / or time stamp (TS) by the associated transfer points associated data acquisition units (200).

The method of claim 2, further comprising: transmitting the acquired metadata (MD), signatures (SG), and / or timestamps (TS) to a network monitoring unit (300) that performs path redundancy assessment.

4. The method according to any one of the preceding claims, further comprising: comparing the determined correlation value with at least one barrier and evaluating the path redundancy based on the comparison result or the comparison result ^¬ se.

5. The method of claim 4, wherein the threshold value is a predetermined correlation value.

6. The method according to any one of the preceding claims, wherein the particular transmission characteristics comprise latency fluctuations and / or telegram balances.

7. Network monitoring unit (300) for Wegredundanzbewer ^¬ tion of communication links, wherein the network monitoring unit (300) is adapted to receive transfer points metadata (MD), signatures (SG) and / or timestamp (TS) to receive and a pair of logically redundant Identify communication links using the metadata (MD), signatures (SG) and / or timestamps (TS), information tables (320, 320 ^λ ) for the identified communication links (AC, AC ^λ ) by merging the metadata (MD), Generate signatures (SG) and / or time stamp (TS) and the information tables (320, 320 ^λ ) respect

Correlation (E4) of metadata (MD), signatures (SG) and / or timestamps (TS).

8. Network monitoring unit (300) according to claim 7, wherein the communication links at least partially in one

Backbone network (500) with transfer points to other networks, the pair of logically redundant communication links between the transfer points of the backbone network (500) exists and no common

Transfer point includes.

9. Network monitoring unit (300) according to claim 7 or 8, wherein the network monitoring unit (300) is designed to carry out a method according to one of claims 4 to 6 ren.

10. Data acquisition unit (200) for non-reactive, since ^¬ tenerfassung comprising: a Mitleseelement (210) for monitoring of data packets, a memory unit (220) for storing mitgelesener data packets, a data packet processing unit (230, 240, 250) for determining time stamps (TS), metadata (MD) and / or signatures (SG) of the data packets and a transmission unit for transmitting the particular ones Time stamp (TS), metadata (MD) and / or signatures (SG) to a network monitoring unit (300), wherein the metadata

(MD) by telegram filter (240) using header information (IP, TH) of the data packets and / or the Signatu ^¬ Ren (SG) using process data (PD) and TS

(250) using a timestamp containing a

Mitlesezeit indicates to be determined.

A system for routing redundancy assessment of communication links in a backbone network (500) having a network monitoring unit (300) according to any of claims 7 to 9 and claim 10 associated with the handover points of the backbone network (500) between them municip ^¬ munication exist, wherein the data acquisition units (200) are formed, the metadata (MD), signatures (SG) and / or time stamp (TS) to the network surveillance unit to transmit ^¬.