WO2018202299A1

WO2018202299A1 - Plug-type connector with active locking

Info

Publication number: WO2018202299A1
Application number: PCT/EP2017/060631
Authority: WO
Inventors: Rene Graf
Original assignee: Siemens Aktiengesellschaft
Priority date: 2017-05-04
Filing date: 2017-05-04
Publication date: 2018-11-08

Abstract

The invention relates to a plug-type connector having a socket (11) and a plug (12) for active locking and serving to increase the secure functioning of the installation. The invention is characterized in that the socket (11) or the plug (12) have an interface, which can be activated or released only by way of an appropriate software key.

Description

description

The invention relates to a connector with a socket and a plug for the active locking and to increase the safe operation of the system.

Today's industrial plants have very sophisticated security systems to prevent network intrusion. Especially with the "Security in Depth" concept measures are taken at all levels to make it difficult for third parties to access the company or plant network, as this access can eliminate all other measures, including, in particular, access to unused networks Interfaces in the individual devices of the plant, ie both the network components (eg switch) and the terminals (eg memory-programmable controller, PLC) Should an attacker have overcome other measures such as access protection to the buildings or the like and in front of a device with an open network interface, the risk of an attack is very high.

To protect these open, unused network interfaces (ports) of these devices, two main measures are known:

1. Switching off the unused ports: As a rule, this option is only offered by network components such as switches, but not by end devices such as a PLC. In addition, physical access to the device can not prevent a cable from being disconnected from an existing and used port and instead allow the attacker to connect to their device. So that the now missing Ka If not noticed, it can connect another, self-brought network component, so that the logical network connection is maintained, even if the physical connection looks different than before.

2. Mechanical RJ45 locks:

These components look like Ethernet plugs (official name of the type is RJ45), but where no cable is connected. Instead, they have a kind of lock on the back, so they can not be removed from the port without the right key, thus blocking it for a potential attacker. Nevertheless, this method is only partially secure, since the keys are not particularly complicated on the one hand and on the other not sold individually, but as a mass product together with the locks.

More effective protection is not known today, unless the operator is sure that he never needs the ports that are not currently used, so he can seal them with hot glue, for example. However, this measure does not protect the network interfaces used against misuse by unauthorized persons.

Accordingly, the object of the present invention is to provide a connector with an active lock. This object is achieved by a connector with the features of claim 1. Advantageous embodiments and developments, which can be used individually or in combination with each other, are the subject of the dependent claims. According to the invention this object is achieved by a connector with a socket and a plug for active locking and to increase the safe operation of the system. The invention is characterized in that socket or plug have an interface which can only be activated or released by a suitable software key.

The idea of this invention is to design an electromechanical lock for RJ45 sockets, which on the one hand effectively mechanically locks the socket and, on the other hand, triggers a change in status of the lock only by software and corresponding authentication, or carries out its own work. Furthermore, the lock allows active monitoring, so that an unplanned removal by unauthorized persons is detected quickly and reliably.

The core of the invention is the electromechanical locking of a terminal lug of an RJ45 connector, which can only be activated or released by the appropriate software key. The primary use cases are explicit RJ45 locks, but the invention can also be used for actively locking RJ45 plugs, which are wired.

In the industrial environment, however, this construction is too weak to ensure a secure hold in case of vibrations or shocks, so that a so-called retaining collar has been established around the RJ45 socket, which offers a much more stable strain relief. Furthermore, the plug is partially made of metal in the industrial sector and the tab is much more stable and longer, so that it rests on two points and must be pressed down with much more force. The electromechanical RJ45 lock uses the mechanism with the recess of the standard RJ45 socket to be used on all devices. An extension for industrial use can additionally use the retaining collar.

The RJ45 socket thus remains unchanged, but the lock in the form of an RJ45 connector has an active lock, so that the tab with the clamping lug in the locked state can not be moved manually, but only by the drive in the lock itself The drive must not consume any power to maintain the respective state, but only to change the state (open - closed).

This can be achieved advantageously by a so-called half-wave. If the shaft with its flattened side points to the recess of the bush, the lock is open and the flap can be moved. If the shaft is rotated by 180 °, the clamping lug pushed up by the round side of the shaft blocks the lock in the bushing. Another advantage of this solution is that the rotation of the half-wave by 180 ° can always be done in the same direction, which further simplifies both the mechanics and their electrical control.

Another possible embodiment can dispense with the manually operated tab and moves the clamping lug directly by the rotation of the half-wave. This is advantageous in that no further manual action is necessary to unlock the lock, but this can be pulled out directly from the socket. Especially in connection with the retaining collar can be effectively ensured that a manual opening of the lock is not possible at any time. In general, a mechanical mechanism must be selected which, on the one hand, can maintain its state (open, closed) without voltage supply and, on the other hand, ensures that it can not be released manually from the outside in the absence of voltage.

The drive requires electrical energy, albeit only for the state change. This can be achieved either by a battery or by PoE (Power over Ethernet). In order for the lock to remain operable in the event of an empty battery, it must either be exchangeable from the outside or additional contacts to the external power supply must be present at the back of the lock in order to temporarily supply it with energy.

A third solution could consist only of appropriate contacts for temporary power supply on the back, which can be used for the time of contact parallel to the power supply for wired communication. The PoE solution is clearly the more advantageous option if the network component or the device to be protected with RJ45 socket makes this possible. Theoretically, a permanent, external energy supply is conceivable, but this means additional cabling.

The drive for rotating the half-wave by 180 ° can be done either with a motor or advantageously by a piezo drive, as this is much more compact and energy-saving feasible, especially if no direction change is required. In general, however, it is ensured that the lock can not be removed without authorization, even in the event of a power failure, since it maintains the locked state even without voltage. If in addition a permanent monitoring of the RJ45 lock must be possible, must There may also be a permanent power supply, ie battery, PoE or external connections.

Both for monitoring and for operation, the RJ45 lock has to communicate with its outside world.

Here are essentially two variants distinguishable:

Variant 1: Wireless communication

Here, the technician who is to install or remove the lock must authenticate himself locally to the latter by exchanging a security token with the lock via a suitable device (eg ID card, smartphone), so that this subsequently opens or closes.

For example, Bluetooth or NFC can be used as low energy consumption protocols. The disadvantage of this solution is that the security token can only be changed conditionally, so that it remains on the technician's device and thus creates a potential security hole if the device gets into the wrong hands. In addition, the lock is in the case of an empty battery unresponsive.

Variant 2: Wired communication

The lock itself is in this variant an active participant in the already existing Ethernet, so that on the one hand a permanent monitoring is possible to quickly and reliably detect when the lock was forcibly removed. On the other hand, the lock is opened and closed by the control room via a network. The local technician who is to remove the lock mechanically, for example instead connect another cable, even has no communication technology access to the castle and thus can not open, whereby the ^{security ¬ unit is} significantly increased. This variant thus also allows the use of one-time security tokens {OTP, One-TimePassword), so that even in a man-in-the-middle attack no subsequently usable key can be accessed from ^¬ . In addition, the entire communication between the lock and the control room should be encrypted anyway. Furthermore, hereby each lock can be given an individual key, so that the multiple use of a key is effectively prevented. Nevertheless, the concept allows theoretically equal keys for various ^¬ dene locks to define any group with the same keys, provided this does not contradict the required plant safety.

If the locks themselves are Ethernet terminals and can be communicated with them via network, the locks can also be monitored permanently, so that the removal, even for a short time, is detected by an attacker immediately and including indication of time and place. Thus, the connection of a foreign device to the Anla ^¬ gene network can be reliably prevented.

The internal structure of the advantageous solution of the RJ45 electromechanical lock envisages that both the network and the voltage are picked up at the pins of the RJ45 socket by means of PoE. The integrated power supply generates the necessary voltages for the drive and the microcontroller (] iC). On the latter, the network connection is realized, through which the plug as a network terminal is ^¬ talkable. Since the lock also has an internal network cable, the principle of electromechanical locking can be applied to a fully functioning RJ45 plug, as already mentioned above. As usual, this connector has at its outer end the line to another network participant, but inside the active interlock. He also acts as a network participant. In addition to the monitoring of the unused network ports, this also makes it possible to monitor the devices used, so that the removal of a cable from a network component is both actively prevented and also reliably detected in the event of misuse.

The novelty of the invention clearly lies in the active, electromechanical locking of an RJ45 lock (or in general an RJ45 plug), since so far only manually and purely mechanically closed constructs are known. The drive requires no energy for locking to hold its state and is designed to be very energy-efficient to change it, so that a power supply is possible by the device in whose port the lock is inserted (Power over Ethernet, PoE). Due to the additional communication capability of the lock / plug as an active network participant in addition to the defined control by a control room and the secure detection of the removal of a lock or plug is guaranteed, so that unauthorized manipulation of network components and network terminals is effectively prevented. The variance of the keys is very limited in purely mechanical locks. The variance of keys in the digital world, however, is infinite, so opening a foreign lock with your own key can be considered impossible. The necessary technology is used in the IT world to secure emails, websites or online banking. In a particularly advantageous embodiment of the connector according to the invention, provision can be made for the socket and plug to be fixedly inserted into one another via a clamping nose placed on a tab and a matching recess by means of a connection technique.

In a further specific continuation of the inventive concept, it can be provided that the plug is an RJ45 plug and the socket is an RJ45 socket.

In a special embodiment of the method according to the invention, it can be provided that the bushing has a retaining collar.

In a particularly advantageous embodiment of the connector according to the invention, it may be provided that the cut parts have an active electromechanical lock.

In a particularly advantageous embodiment of the connector according to the invention, it may be provided that the interface has an active electromechanical lock in the form of a rotatable half-wave.

In a further specific continuation of the inventive concept, it can be provided that the interface is to be moved into the locked state by a drive.

In a special embodiment of the method according to the invention, it can be provided that the drive is connected to a power supply and a microcontroller.

In a particularly advantageous embodiment of the connector according to the invention, it may be provided that the open state of the connector is formed in the form that the rotatable half-wave is formed with a flattened side in the direction of the recess. In a further special continuation of the inventive concept, it can be provided that upon rotation of the rotatable half-wave through 180 °, a round side of the rotatable half-wave, the clamping nose is to be pressed into the recess.

In a further embodiment of the invention, it can be provided that the plug is a network device.

The connector according to the invention has a socket, in particular special an RJ45 socket on, as well as a matching Ste cker. The socket is formed as a frame with an open side, which releases a blind hole-like recess. At the upper or lower edge of the Buchsenumraung egg ne recess is arranged, in which a clamping lug a fle xible tab of the plug engages to form a very simple strain relief. The tab is pre-bent so that it points slightly upwards and does not rest on a flat plane of the plug housing form fit. If the tab is pressed manually downwards onto the plug, the clamping nose lowers and the plug can be pulled out of the socket. In addition, a rotatable half-wave is positioned on the plug, which space the tab in the closed state of the connector from the housing of the plug. In the open state of the connector, the rotatable half-wave is rotated in the direction of the connector housing, so that the tab can be manually pressed down and the plug can be removed from the socket. The socket thus remains unchanged, but the connector has an active lock on which the tab with the clamping lug in the locked state can not be moved manually, but only by the drive in the lock itself. This drive must not consume power to the respective State, but only to change the state. The rotation of the rotatable half-wave by 180 ° can preferably always be done in the same direction, whereby both the mechanics and their electrical control wei ter is simplified. Further advantages and embodiments of the invention will be explained in more detail using an exemplary embodiment and with reference to the drawing. Showing:

Figure 1 is a schematic representation of a known from the art combination of an RJ45 socket RJ45 connector.

2 shows a schematic illustration of a connector according to the invention with an RJ45 plug and an RJ45 socket in the closed state; 3 shows a schematic illustration of a plug connector according to the invention with an RJ45 plug and an RJ45 socket in the open state;

4 shows a schematic representation of a connector according to the invention, including the power supply for driving the active locking.

Fig. 1 shows a known from the prior art connector. The known connector has a socket 1, in particular an RJ45 socket, and a matching plug 2. The socket 1 is formed as a frame 3 with an open side 4, which releases a blind hole-like recess 5. At the upper or lower edge of the Buchsenumraung a recess 6 is arranged, in which a clamping lug 7 of a flexible tab 8 of the plug 2 engages to form a very simple strain relief. The tab 8 is pre-bent, so that it points slightly upwards and does not rest on a flat plane 9 of the plug housing 10 in a form-fitting manner. If the flap 8 is manually lowered pressed on the connector 2, the clamping nose 7 lowers and the plug 2 can be pulled out of the socket 1.

In Fig. 2, an inventive connector in the closed state is shown with a socket 11, in particular a RJ45 socket on, and a mating connector 12, in particular an RJ45 connector. The bush 11 is formed as a frame 13 with an open side 14, which releases a blind hole-like recess 15. There is a recess at the top or bottom edge of the socket framing

16, in which a clamping lug 17 of a flexible tab 18 of the plug 12 engages to form a very simple strain relief. The tab 18 is pre-bent so that it points slightly upwards and does not rest on a flat plane 19 of the plug housing 20 in a form-fitting manner. If the tab 18 is manually pressed down on the plug 12, the clamping lug 17 lowers and the plug 12 can be pulled out of the socket 11. In addition, a rotatable half-shaft 21 is positioned on the plug 12, which spaced the tab 18 in the closed state of the connector from the housing of the plug.

Fig. 3 shows a connector according to the invention with a plug 12 and a socket 11 in the open state. In the open state of the connector, the rotatable half-shaft 21 is rotated in the direction of the plug housing 20, so that the tab 18 can be manually pressed down and the plug 12 can be removed from the socket 11. The socket 11 thus remains unchanged, but the connector has an active lock, wherein the tab 18 with the clamping lug

17 can not be moved manually in the locked state, but only by the drive in the lock itself. This drive may not consume power to maintain the respective state, but only to change the state. The rotation of the rotatable half-wave 21 through 180 ° can preferably always take place in the same direction, as a result of which both the mecha- nik as their electrical control is further simplified.

In Fig. 4, an inventive connector including the power supply for driving the active locking is shown in the closed state. On the rotatable half-wave 21, a drive 22 is arranged, which is connected to a microcontroller 23. Both the drive 22 and the microcontroller 23 are connected to a power supply 24. In addition, the microcontroller 23 is also a

Network connection 25 realized by which the plug 12 is addressed as a network terminal.

The connector according to the invention is characterized by the fact that with this electromechanical plug-in connector a complete security solution was created which monitors not only existing network connections, but above all the open ports in installations or distribution rooms, which represent a high security risk with regard to unauthorized access , The application is not limited to industrial plants, but affects the entire IT world with all data centers worldwide, since there is a risk that unauthorized persons gain physical access to the network components and connect to them via open ports.

LIST OF REFERENCE NUMBERS

1 socket

2 plugs

3 framing

4 open side

5 blind hole-like recess

6 recess

7 clamping nose

8 flexible tab

9 flat level

10 connector housing

11 socket

12 plugs

13 framing

14 open page

15 recess

16 recess

17 clamping nose

18 flexible tab

19 flat level

20 connector housing

21 rotatable half-wave

22 drive

23 microcontrollers

24 power supply

25 network connection

Claims

claims

1. Connector with a socket (11) and a plug (12) for the active locking and to increase the plant security, characterized in that socket (11) or plug (12) have an interface, which can only by a suitable software key to to activate or to solve.

2. Connector according to claim 1, characterized in that socket (11) and plug (12) via a on a tab (18) placed clamping nose (17) and a matching recess (16) by means of a connecting technique firmly into each other are.

3. Connector according to claim 1 or 2, characterized in that the plug (12) is a RJ45 plug and the socket (11) is an RJ45 socket.

4. Connector according to one of claims 1 to 3, characterized in that the bush (11) has a retaining collar. 5. Connector according to one of claims 1 to 4, characterized in that the interface has an active electromechanical lock.

6. Connector according to claim 5, marked thereby, that the interface has an active electromechanical lock in the form of a rotatable half-wave (21).

7. Connector according to claim 5 or 6, character- ized in that the interface is to be moved in the locked state by a drive (22). Connector according to claim 7, characterized in that the drive (22) with a Stromversorgun (24) and a microcontroller (23) is connected. 9. Connector according to one of claims 5 to 8, characterized in that the open state of the connector is formed in the form that the rotatable half-wave (21) is formed with a flattened side in the direction of the recess (16).

Connector according to claim 9, characterized in that upon rotation of the rotatable half-wave (21) by 180 ° a round side of the rotatable half-wave (21) the clamping nose (17) is to be pressed into the recess (16).

11. Connector according to one of claims 1 to 10, characterized in that the plug (12) is a network device.