Systems and Methods for Control System Security

Abstract

A component security device may be disposed at an interface between a component and a cyber-physical system. The disclosed component security device may be physically and/or electrically coupled between the component and infrastructure of the cyber-physical system, such as a backplane, bus, and/or the like. The component security device may be configured to monitor the component, and selectively isolate the component from the cyber-physical system. Since the component security device is interposed at the interface of the component, the component security device may be capable of isolating the component regardless of whether the component has been compromised (e.g., regardless of whether the component is capable of complying with system commands).

What is claimed is: 
     
         1 . A component security device configured to be interposed between a component of a control system and an integration device, the integration device configured to provide services to connected components, the services including coupling the connected components to a control system network, the component security device comprising:
 a first coupler configured to physically couple with an infrastructure coupler of the integration device, the first coupler comprising first connectors configured to establish electrical connections with corresponding connectors of the infrastructure coupler;   a second coupler configured to physically couple with a component coupler of the component, the second coupler comprising second connectors configured to establish electrical connections with corresponding connectors of the component coupler;   a component manager configured to establish an electrical coupling between the infrastructure coupler and the component coupler, comprising electrically coupling the first connectors of the first coupler to the second connectors of the second coupler; and   a security engine configured to implement a mitigation action at the component security device in response to detection of an anomaly, the mitigation action comprising physically disconnecting the component from the control system network by use of the component manager.   
     
     
         2 . The component security device of  claim 1 , wherein the security engine is configured to implement the mitigation action in response to a command received through one or more of the control system network and an external network. 
     
     
         3 . The component security device of  claim 1 , wherein:
 the integration device is configured to provide network services to the component through an electrical coupling between a communication connector of the infrastructure coupler and a communication connector of the component coupler;   the first coupler comprises a first communication connector configured to establish an electrical connection with the communication connector of the infrastructure coupler;   the second coupler comprises a second communication connector configured to establish an electrical connection with the communication connector of the component coupler; and   the component manager comprises a communication manager configured to establish an electrical coupling between the first communication connector and the second communication connector such that the communication connector of the infrastructure coupler is electrically coupled to the communication connector of the component coupler.   
     
     
         4 . The component security device of  claim 3 , wherein implementing the mitigation action comprises configuring the communication manager to disconnect the electrical coupling established between the communication connector of the component coupler and the communication connector of the infrastructure coupler, comprising interrupting the electrical coupling established between the first communication connector and the second communication connector. 
     
     
         5 . The component security device of  claim 4 , wherein the communication manager is further configured to maintain a connection to the control system network by use of the first communication connector while the component is physically disconnected from the control system network. 
     
     
         6 . The component security device of  claim 4 , wherein the communication manager is further configured to reconnect the component to the control system network in response to a command. 
     
     
         7 . The component security device of  claim 4 , wherein:
 the integration device is configured to supply electrical power to the component through an electrical coupling between a power connector of the infrastructure coupler and a power connector of the component coupler;   the first coupler comprises a first power connector configured to establish an electrical connection with the power connector of the infrastructure coupler;   the second coupler comprises a second power connector configured to establish an electrical connection with the power connector of the component coupler; and   the component manager comprises a power manager configured to establish an electrical coupling between the first power connector and the second power connector such that the power connector of the infrastructure coupler is electrically coupled to the power connector of the component coupler.   
     
     
         8 . The component security device of  claim 7 , wherein implementing the mitigation action further comprises configuring the power manager to disconnect the electrical coupling established between the power connector of the component coupler and the power connector of the infrastructure coupler, comprising interrupting the electrical coupling established between the first power connector and the second power connector. 
     
     
         9 . The component security device of  claim 7 , wherein implementing the mitigation action further comprises configuring the power manager to maintain the electrical coupling between the power connector of the component and the power connector of the infrastructure coupler while the component is physically disconnected from the control system network by the communication manager. 
     
     
         10 . A method for operating a component security device, the component security device configured to be interposed between a component of a control system and an infrastructure coupler of an integration device of the control system, the integration device configured to couple the component to a control system network through a communication connector of an infrastructure coupler, the method comprising:
 providing a first coupler configured to physically couple with the infrastructure coupler, the first coupler comprising first connectors configured to establish electrical connections with corresponding connectors of the infrastructure coupler, including a first communication connector configured to establish an electrical connection with the communication connector of the infrastructure coupler;   providing a second coupler configured to physically couple with a component coupler of the component, the second coupler comprising second connectors configured to establish electrical connections with corresponding connectors of the component coupler, including a second communication connector configured to establish an electrical connection with a communication connector of the component coupler;   establishing an electrical coupling between the first connectors and the second connectors, comprising establishing an electrical coupling between the first communication connector and the second communication connector, thereby electrically coupling the communication connector of the infrastructure coupler to the communication connector of the component coupler; and   implementing a mitigation action at the component security device in response to detection of an anomaly, the mitigation action comprising physically disconnecting the component from the control system network, wherein physically disconnecting the component from the control system network comprises disconnecting the electrical coupling established between the first communication connector and the second communication connector.   
     
     
         11 . The method of  claim 10 , further comprising implementing the mitigation action in response to receiving a command through one or more of the control system network and an external network. 
     
     
         12 . The method of  claim 10 , further comprising maintaining a connection to the control system network through the first communication connector while the component is physically disconnected from the control system network. 
     
     
         13 . The method of  claim 10 , wherein:
 the integration device is configured to supply electrical power to the component through an electrical coupling between a power connector of the infrastructure coupler and a power connector of the component coupler;   providing the first coupler further comprises providing a first power connector configured to establish an electrical connection with the power connector of the infrastructure coupler;   providing the second coupler further comprises providing a second power connector configured to establish an electrical connection with the power connector of the component coupler; and   establishing the electrical coupling between the first connectors and the second connectors comprises establishing an electrical coupling between the first power connector and the second power connector, thereby electrically coupling the power connector of the infrastructure coupler to the power connector of the component coupler.   
     
     
         14 . The method of  claim 13 , wherein implementing the mitigation action further comprises one of:
 physically disconnecting the electrical coupling established between the first power connector and the second power connector, thereby disconnecting the component from electrical power supplied by the integration device; and   maintaining the electrical coupling established between the first power connector and the second power connector while the component is physically disconnected from the control system network.   
     
     
         15 . The method of  claim 10 , further comprising maintaining a connection to the control system network by use of the first communication connector while the component is physically disconnected from the control system network. 
     
     
         16 . A non-transitory computer-readable storage medium comprising instructions configured to cause a processor to perform operations at a component security device, the component security device configured to be interposed between a component of a control system and an infrastructure coupler of an integration device of the control system, the integration device configured to couple the component to a control system network through a communication connector of an infrastructure coupler, the operations comprising:
 establishing an electrical coupling between a first coupler of the component security device and a second coupler of the component security device, wherein:
 the first coupler comprises first connectors configured to establish electrical connections with corresponding connectors of the infrastructure coupler, including a first communication connector configured to establish an electrical connection with the communication connector of the infrastructure coupler, 
 the second coupler comprises second connectors configured to establish electrical connections with corresponding connectors of a component coupler, including a second communication connector configured to establish an electrical connection with a communication connector of the component coupler, and 
 establishing the electrical coupling between the first coupler and the second coupler comprises electrically coupling the first communication connector to the second communication connector thereby establishing an electrical coupling between the communication connector of the infrastructure coupler and the communication connector of the component coupler; and 
   implementing a mitigation action in response to detection of an anomaly, the mitigation action comprising physically disconnecting the component from the control system network, wherein physically disconnecting the component from the control system network comprises disconnecting the electrical coupling established between the first communication connector and the second communication connector.   
     
     
         17 . The non-transitory computer-readable storage medium of  claim 16 , the operations further comprising implementing the mitigation action in response to receiving a command through one or more of the control system network and an external network. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 16 , the operations further comprising maintaining a connection to the control system network through the first communication connector while the component is physically disconnected from the control system network. 
     
     
         19 . The non-transitory computer-readable storage medium of  claim 16 , wherein:
 the integration device is configured to supply electrical power to the component through a power connector of the infrastructure coupler;   the first coupler comprises a first power connector configured to establish an electrical connection with the power connector of the infrastructure coupler;   the second coupler comprises a second power connector configured to establish an electrical connection with a power connector of the component coupler; and   establishing the electrical coupling between the first coupler and the second coupler comprises establishing an electrical coupling between the first power connector and the second power connector, thereby electrically coupling the power connector of the infrastructure coupler to the power connector of the component coupler.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 19 , wherein implementing the mitigation action further comprises one of:
 physically disconnecting the electrical coupling established between the first power connector and the second power connector, thereby disconnecting the component from electrical power supplied by the integration device; and   maintaining the electrical coupling established between the first power connector and the second power connector while the component is physically disconnected from the control system network.   
     
     
         21 . The non-transitory computer-readable storage medium of  claim 16 , the operations further comprising maintaining a connection to the control system network by use of the first communication connector while the component is physically disconnected from the control system network.