Process installation network intrusion detection and prevention

Abstract

A process communication device includes a process communication interface for communicating on a process communication loop in accordance with a process communication protocol. A controller is coupled to the process communication interface. A rules store is coupled to the controller, and has at least one process communication packet rule that is based on the process communication protocol. The controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule.

What is claimed is: 
     
       1. A process communication device comprising:
 a process communication interface configured to communicate with at least one field device on a process communication loop in accordance with a process communication protocol; 
 a controller coupled to the process communication interface; 
 a rules store coupled to the controller, the rules store having at least one process communication packet rule that is based on the process communication protocol 
 a device description store coupled to the controller, the device description store having at least one device description related to a process variable measured by the at least one field device and wherein the at least one field device is described by the at least one device description stored in the device description store; and 
 wherein the controller applies the at least one process communication packet rule and the at least one device description to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails the at least one process communication packet rule or if the at least one communication packet is not in accordance with the at least one device description for the at least one field device; and 
 a network interface coupled to the controller, wherein the controller is configured to forward the process communication packet through the network interface if the process communication packet passes all process communication packet rules. 
 
     
     
       2. The process communication device of  claim 1 , wherein the process communication protocol is the HART® (Highway Addressable Remote Transducer) protocol. 
     
     
       3. The process communication device of  claim 1 , wherein the protocol imposes a digital signal on a 4-20 mA analog current signal. 
     
     
       4. The process communication device of  claim 1 , wherein the process communication interface is a wired process communication interface. 
     
     
       5. The process communication device of  claim 1 , wherein the process communication interface is a wireless process communication interface. 
     
     
       6. The process communication device of  claim 5 , wherein the process communication interface is also a wired process communication interface. 
     
     
       7. The process communication device of  claim 1 , wherein the controller is configured to decrypt the at least one process communication packet before applying the at least one process communication packet rule. 
     
     
       8. The process communication device of  claim 7 , wherein the process communication device is embodied within a process communication gateway. 
     
     
       9. The process communication device of  claim 1 , wherein at least one process communication packet rule relates an allowable number of packet bytes to a process communication protocol command contained in the packet. 
     
     
       10. The process communication device of  claim 1 , wherein the at least one process communication packet rule includes an allowable command range. 
     
     
       11. The process communication device of  claim 1 , wherein the process communication device is embodied within an access point. 
     
     
       12. A method of providing process communication protection, the method comprising;
 obtaining at least one process communication packet sent from a field device in accordance with a process communication protocol; 
 applying at least one rule against the process communication packet, wherein the at least one rule is based on the process communication protocol; 
 applying at least a second rule against the process communication packet, wherein the at least a second rule is based upon a device description for the field device related to a process variable measured by the at least one field device; and 
 determining an event based on whether the at least one process communication packet passed each of the at least one rule and at least a second rule; and 
 selectively forwarding the at least one process communication packet based on whether the at least one process communication packet passed each of the at least one rule. 
 
     
     
       13. The method of  claim 12 , and further comprising logging the event. 
     
     
       14. A process communication device comprising:
 a process communication interface configured to communicate with at least one process device on a process communication loop in accordance with a process communication protocol; 
 a controller coupled to the process communication interface; 
 a device description store coupled to the controller, the device description store having at least one process communication packet rule that is based on a device description related to a process variable measured by the at least one field device for the at least one process device; and 
 wherein the controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule; and 
 a network interface coupled to the controller, wherein the controller is configured to forward the process communication packet through the network interface if the process communication packet passes all process communication packet rules. 
 
     
     
       15. A method of providing process communication protection, the method comprising;
 obtaining at least one process communication packet in accordance with a process communication protocol, wherein the at least one process communication packet carries communication to or from at least one field device; 
 retrieving a device description from a device description store in a process communication security device which describes the at least one field device related to a process variable measured by the at least one field device; 
 applying at least one rule against the process communication packet, wherein the at least one rule is based the retrieved device description; 
 determining an event based on whether the at least one process communication packet passed each of the at least one rule; and 
 selectively forwarding the at least one process communication packet based on whether the at least one process communication packet passed each of the at least one rule. 
 
     
     
       16. The method of  claim 15 , and further comprising logging the event.