RU2747461C2 - System and method of countering anomalies in the technological system - Google Patents

Abstract

FIELD: computer technology for information security of a technological system.

SUBSTANCE: invention relates to the field of computer technology for information security of a technological system. The technical result described below is achieved due to the method of blocking the transmission of data packets in the technological system, consisting of stages at which: a) using the duplication tool, at least one outgoing data packet is intercepted, addressed to an element of the technological system, with the duplication tool being a secure operating system with support for the hypervisor function, running on the element of the technological system; b) over a secure connection, information about the said intercepted data packet is transmitted to the control device by means of duplication; c) the control tool is used to intercept at least one incoming data packet addressed to an element of the technological system, while the control tool is a secure operating system with support for the hypervisor function running on the element of the technological system; d) with the help of the control tool, the transmission of the intercepted incoming data packet to the element of the technological system is blocked if the intercepted incoming data packet does not correspond to the mentioned information received from the duplication tool.

EFFECT: increased information security of a technological system with the ability to counteract anomalies in the technological system.

4 cl, 5 dwg

Description

Technology area

The invention relates to solutions for improving the information security of a technological system, and more specifically to systems and methods for countering anomalies in a technological system.

State of the art

One of the urgent problems of industrial safety is the problem of the safe flow of technological processes (TP). The main threats to the functioning of the TP include unintentional errors or malicious actions in operational management, wear and tear of equipment and units, computer attacks on control systems and information systems, etc.

Automated control systems (ACS) at enterprises control technological systems and also need to ensure the required level of safety. Elements of technological systems, as well as operating systems and firmware that control these elements, are often outdated. Frequent updating of operating systems and firmware is also impossible, because it leads to interruptions in technological processes. In addition, new versions of programs may also contain errors that negatively affect the stability of the functioning of elements of technological systems. In addition, existing outdated, designed to be isolated, ICSs are often connected to computer networks and do not have the means to ensure information security in the event of malicious influences from the outside.

In technological systems, a common problem is the need to use outdated equipment operating over insecure or vulnerable information transfer protocols. This is due to the fact that the service life of equipment in such systems is years or even decades - during this period, the information transfer protocols have time to become outdated, and vulnerabilities are discovered in them. Since the replacement of already operating equipment is a difficult and expensive process (and sometimes impossible), security problems often remain unresolved, and accordingly, vulnerabilities appear in the control systems of technological systems. A typical process control network includes various types of elements. Important elements are control computers (servers and SCADA client stations) and programmable logic controllers (PLCs) that provide direct control of equipment (for example, actuators). SCADA software is fairly easy to update, and PLC firmware update requires the involvement of the hardware manufacturer and is often an extremely difficult problem to solve. In such a situation, attackers have the opportunity to influence the operation of the PLC, which can lead to serious consequences (for example, to the failure of controlled equipment, disruptions of the technological process in the technological system as a whole - up to catastrophic consequences).

To solve the above problems, an approach implemented by the KICS for Networks software of Kaspersky Lab is used, in which the traffic inside the data transmission network in the technological system is analyzed in order to detect anomalies in it. This approach requires a large amount of a priori information about the operation of the PLC (knowledge of various protocols and parameter values used by the PLC), and the detection of anomalies in traffic for complex systems can lead to errors in detecting malicious activity of both the first and second kind.

There are other solutions aimed at ensuring information security of technological systems of an enterprise. One example is the technology proposed in the publication US 20140189860, which describes a method for detecting computer attacks on a technological system by detecting deviations in the functioning of the system from the norm, where various methods are used to detect deviations.

Within the framework of the present invention, an approach is proposed that requires minimal a priori knowledge of the operation of the PLC and makes it possible to reliably detect attempts of unauthorized interference in their work, which increases the security of the technological system. In the solution described below, the secure interaction of SCADA components with the PLC and the use of a secure connection (for example, using cryptographic protection means) make it possible to reliably detect anomalies (and, probably, malicious influences that are not part of the TP and are often aimed at disrupting the TP flow) in the network data transmission and counteract them without accumulating statistical data, checking and filtering network packets by their content (Deep Packet Inspection, DPI), even if some elements of the technological system in the data transmission network operate using insecure data transmission protocols. At the same time, ensuring secure interaction of SCADA components with PLCs is possible even without modifying the SCADA software through the use of virtualization technologies.

The essence of the invention

The present invention is intended to counter anomalies in a process system.

The technical result of the present invention is to implement the declared purpose.

According to one of the embodiments, a method is provided for blocking the transmission of data packets in a technological system, which consists of the steps: using the duplicating means, at least one outgoing data packet addressed to an element of the technological system is intercepted; over a secure connection, transmitting information about said intercepted data packet by means of duplication to means of control; using the control means intercepting at least one incoming data packet addressed to an element of the technological system; with the help of the control means, the transmission of the intercepted incoming data packet to the element of the technological system is blocked if the intercepted incoming data packet does not correspond to the said information received from the duplicating means.

According to another particular embodiment, a method is proposed, in which the replication means is a secure operating system with support for a hypervisor function, running on an element of the technological system.

According to another particular embodiment, a method is proposed in which an element of a technological system is a SCADA component.

According to another particular embodiment, a method is proposed in which an element of a technological system is a programmable logic controller.

According to another particular embodiment, a method is proposed, in which the control means is a secure operating system with support for a hypervisor function, running on an element of the technological system.

According to another particular embodiment, a method is proposed, in which the monitoring means is located topologically sequentially with the element of the technological system to which the intercepted data packet is addressed, and in front of the said element.

According to another particular embodiment, a method is proposed, in which the control means is located on the element of the technological system to which the intercepted data packet is addressed.

Brief Description of Drawings

Additional objects, features and advantages of the present invention will be apparent from a reading of the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1a schematically depicts an example of a technological system.

FIG. 1b schematically depicts a particular example of the implementation of a technological system.

FIG. 2 shows an example of the implementation of the proposed system for countering anomalies in the technological system.

FIG. 3 shows an example of the implementation of the proposed method for countering anomalies in a technological system.

FIG. 4 shows an example of a general purpose computer system that enables the present invention to be implemented.

Description of embodiments of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The essence recited in the description is nothing more than specific details provided to assist a person skilled in the art in a comprehensive understanding of the invention, and the present invention is defined only within the scope of the appended claims.

Let's introduce a number of definitions and concepts that will be used in describing the embodiments of the invention.

Control object is a technological object to which external influences (controlling and / or disturbing) are directed in order to change its state, in a particular case, such objects are a device (for example, an electric motor) or a technological process.

Technological process (TP) is a process of material production, which consists in a sequential change in the states of a material entity (subject of labor).

Process Control is a set of methods used to control technological parameters in the production of the final product.

Process Variable (PV) is the current measured value of a certain part of the TP, which is observed or controlled. The process parameter can be, for example, a sensor measurement.

External influence - a way of changing the state of an element to which the influence is directed (for example, a vehicle element), in a certain direction, while the impact from the vehicle element to another vehicle element is transmitted as a signal.

The state of a control object is a set of its essential properties, expressed by the parameters of states, changed or held under the influence of external influences, including control actions from the control subsystem.

A state parameter is one or several numerical values characterizing an essential property of an object; in a particular case, a state parameter is a numerical value of a physical quantity.

The formal state of the control object is the state of the control object that corresponds to the technological map and other technological documentation (if we are talking about TP) or the traffic schedule (if we are talking about a device).

Controlling action - purposeful (the purpose of action is to influence the state of the object) legitimate (provided for by TP) external influence from the control subjects of the control subsystem on the control object, leading to a change in the state of the control object or retention of the state of the control object.

Disturbing impact - purposeful or non-purposeful illegitimate (unforeseen by TP) external impact on the state of the control object, including from the side of the control subject.

Anomaly is the occurrence of a disturbing effect in a technological system.

A control subject is a device that directs a control action to a control object or transfers control action to another control subject for transformation before directing it to an object.

A multilevel management subsystem is a set of subjects of management, which includes several levels.

A cyber-physical system is an information technology concept that implies the integration of computing resources into physical processes. In such a system, sensors, equipment and information systems are connected throughout the entire value chain, which extends beyond a single enterprise or business. These systems interact with each other using standard protocols to predict, feed back, and adapt to change. Examples of a cyber-physical system are the technological system, the industrial Internet of things.

The Internet of Things (English Internet of Things, IoT) is a computing network of physical objects ("things") equipped with built-in technologies for interacting with each other or with the external environment. The Internet of Things includes technologies such as wearable devices, electronic vehicle systems, smart cars, smart cities, industrial systems, and more.

The Industrial Internet of Things (IIoT) is a subcategory of the Internet of Things that also includes consumer-oriented applications such as wearable devices, smart home technologies, and self-driving cars. The hallmarks of both concepts are devices with integrated sensors, machines and infrastructure that transmit data over the Internet and are controlled by software.

A technological system (TS) is a functionally interconnected set of control subjects of a multi-level control subsystem and a control object (TP or device), which implements a change in the state of the control object through a change in the states of control subjects. The structure of the technological system is formed by the main elements of the technological system (interconnected subjects of management of the multilevel subsystem of management and the object of management), as well as the connections between these elements. In the case when the object of control in the technological system is a technological process, the ultimate goal of control is: through a change in the state of the control object, change the state of the object of labor (raw materials, workpieces, etc.). In the case when the object of control in the technological system is a device, the ultimate goal of control is to change the state of the device (vehicle, space object). The functional relationship of vehicle elements implies the relationship between the states of these elements. In this case, there may not be a direct physical connection between the elements, for example, there is no physical connection between the actuators and the technological operation, but, for example, the cutting speed is functionally related to the spindle speed, despite the fact that these state parameters are not physically connected.

The state of the subject of control is a set of its essential properties, expressed by the parameters of states that are changed or retained under the influence of external influences.

The essential properties (respectively, the essential parameters of the state) of the subject of control are the properties that directly affect the essential properties of the state of the control object. In this case, the essential properties of the control object are properties that have a direct impact on the controlled factors (accuracy, safety, efficiency) of the vehicle functioning. For example, the compliance of the cutting modes with the formally specified modes, the movement of the train in accordance with the schedule, the keeping of the reactor temperature within the permissible limits. Depending on the controlled factors, the parameters of the state of the control object and, accordingly, the parameters of the states of the control subjects, which exert a control effect on the control object, are selected.

A hypervisor (virtual machine monitor) is a program that creates an environment for the operation of other programs (including other hypervisors) by simulating computer hardware, managing these tools and guest operating systems operating in this environment.

By means of a file analysis system for malware in a virtual machine, in the present invention we mean real devices, systems, elements, groups of elements implemented using hardware, such as application-specific integrated circuits (ASICs) or programmable gate arrays ( field-programmable gate array, FPGA) or, for example, in the form of a combination of software and hardware, such as a microprocessor system and a set of software instructions, as well as on neurosynaptic chips. The functionality of these system means can be implemented exclusively hardware, as well as in the form of a combination, where part of the functionality of the system is implemented by software, and part by hardware. In some implementations, some or all of the means may be executed on a processor of a general purpose computer (eg, as shown in FIG. 4). In this case, the elements (each of the means) of the system can be implemented within the framework of a single computing device, or spaced between several interconnected computing devices.

FIG. 1a schematically depicts an example of a technological system 100, which includes elements 105 and 110, where the elements of the vehicle: a control object 105; control subjects 110, forming a multi-level control subsystem 120; horizontal ties 130a and vertical ties 130b. Control subjects 110 are grouped into levels 140.

FIG. 1b schematically shows a particular example of the implementation of the technological system 100 '. The control object 105 'is a TP or a device, control actions are sent to the control object 105', which are generated and implemented by an automated control system (ACS) 120 ', three levels 140' are distinguished in the ACS, consisting of control subjects 110, interconnected as horizontal horizontal links (links within the level, not shown in the figure), and vertical vertical links 130b '(links between levels). Relationships are functional, i.e. in general, a change in the state of the subject of control 110 at one level causes a change in the states of the associated control subjects 110 at this level and other levels. Information about a change in the state of the subject of control is transmitted in the form of a signal along horizontal and vertical links established between the subjects of control, i.e. information about a change in the state of the considered subject of management is an external influence in relation to other subjects of management 110. Levels 140 'in ACS 120' are allocated in accordance with the appointment of subjects of management 110. The number of levels may vary. For physical connection of TS elements (105, 110) and TS 100 subsystems, wired networks, wireless networks, integrated circuits are used; for logical communication between TS elements (105, 110) and TS 100 subsystems, Ethernet, industrial Ethernet, industrial networks are used. At the same time, industrial networks and protocols are used of various types and standards: Profibus, FIP, ControlNet, Interbus-S, DeviceNet, P-NET, WorldFIP, LongWork, Modbus, etc.

The upper level (the level of supervisory control and data acquisition, SCADA) is the level of dispatch and operator control, includes at least the following control subjects 110 ': controllers, control computers, human-machine interfaces , HMI) (in Fig. 1b are shown within one SCADA control subject). The level is intended for tracking the states of vehicle elements (105 ', 110'), receiving and accumulating information about the state of vehicle elements (105 ', 110') and, if necessary, adjusting them.

The middle level (CONTROL level) is the level of controllers, it includes at least the following control subjects: programmable logic controllers (PLC, English programmable Logic Controller, PLC), counters, relays, regulators. Control subjects 110 '' of the "PLC" type receive information from control subjects of the "control and measuring equipment" type and control subjects 110 "" of the "sensors" type about the state of the control object 105 '. Control subjects of the "PLC" type develop (create) a control action in accordance with the programmed control algorithm on the control subjects of the "executive mechanisms" type. The executive mechanisms directly implement it (applied to the control object) at the lower level. An actuator is a part of an executive device (equipment).

The lower level (Input / Output level) is the level of such control subjects as: sensors and sensors, instrumentation (instrumentation) that monitor the state of the control object 105 ', as well as actuators. The actuators directly affect the state of the control object 105 'to bring it into line with the formal state, i.e. a state corresponding to a technological assignment, a technological map or other technological documentation (if we are talking about a TP) or a movement schedule (if we are talking about a device). At this level, signals from control subjects 110 "" of the "sensor" type are coordinated with the inputs of control subjects of the middle level, and the control actions generated by control subjects 110 "" of the "PLC" type are coordinated with control subjects 110 "" of the "executive mechanisms" that implement them. An actuator is a part of an actuator. The actuator moves the regulator in accordance with the signals from the regulator or control device. Actuators are the last link in the automatic control chain and generally consist of blocks:

- amplification devices (contactor, frequency converter, amplifier, etc.);

- an actuator (electric, pneumatic, hydraulic drive) with feedback elements (position sensors of the output shaft, signaling of end positions, manual drive, etc.);

- a regulating body (valves, valves, dampers, dampers, etc.).

Depending on the conditions of use, the actuators may be structurally different from each other. The main blocks of executive devices usually include executive mechanisms and regulating bodies.

In a particular example, the actuator is generally referred to as an actuator.

The listed subjects of management (110 ', 110' ', 110' ') of various levels are elements of the technological system (hereinafter referred to as the elements of the TC).

FIG. 2 displays the structure of the system for countering anomalies in the technological system.

In general, the upper-level TS elements 110 '(computers on which SCADA components or engineering terminals are installed) are combined into a separate secure data transmission network using systems and methods known from the prior art. In addition, the upper-level TC elements 110 'send data packets (for example, containing technological process commands and command parameters) to the middle-level TC elements 110' '(in the general case, programmable logic controllers). Due to the fact that technological processes are designed for tens of years, the elements of mid-level TS 110 '' are generally less protected and often outdated, that is, they work using outdated unprotected data transfer protocols, and also have known vulnerabilities. It is assumed that the IP addresses of the mid-level TS 110 '' (for example, PLCs) are known. An attacker, in order to interfere with the operation of the PLC, needs to send information packets to the IP address of the PLC. Thus, the problem solved by the present invention is reduced to determining which packages are "trusted" and which are "untrusted". In general, a trusted data packet is a data packet sent by one TS element, for example, an upper-level TS element 110 ', to another TS element, for example, a middle-level TS element 110' '. Within the framework of the present invention, it is permissible to assume that data packets originating from said secure data transmission network are trusted. Trusted packets must be delivered to mid-level TS elements 110 ''.

In general, the system comprises at least one backup means 210 and at least one control means 220.

Duplication tool 210 is generally a secure operating system with support for a hypervisor function, and is intended to be installed on a TS element (in a particular case, on an upper-level TS element 110 '). A protected operating system with support for the hypervisor function allows running existing operating systems and applications of 110 'upper-level TS elements in a virtual environment. Due to the use of virtualization technology, it becomes possible to add new properties for the components of SCADA systems operating on the elements of the upper-level TS 110 ', without modifying the software of SCADA applications.

In the general case, the duplication means 210 installed on the upper-level TS element 110 'intercepts outgoing data packets that come from applications running in the guest operating system running in the virtual environment and from the guest operating system itself, and are addressed to other TS elements ( e.g. mid-level elements 110 ''). Capturing data packets is generally possible using virtualization techniques known from the prior art. In one embodiment, the duplicator also determines the IP address of the middle tier 110 '' TC element to which the outgoing data packet is directed.

Each duplicator 210 establishes secure connections (depicted for one duplicator 210 in FIG. 2) with all monitors 220 existing on the data network and communicates to monitors 220 information about each outgoing packet of data that has been intercepted. The information can contain both the intercepted outgoing data packet itself in its original or transformed form (for example, after encryption or packaging), and its checksum (for example, MD5 or CRC), as well as additional information obtained by the duplicator 210 as a result of intercepting the outgoing packet data. In one implementation, the duplicator 210 uses known cryptographic security techniques when transmitting data to controls 220. In yet another implementation, the duplicator 210 can further transform or encrypt intercepted outgoing data packets or encryption by the duplicator 210.

In one embodiment, if the IP address of the middle-level TS element 110 '' has been determined, to which the outgoing data packet is directed, the duplicator 210 over a secure connection transmits information about the intercepted outgoing packets to the controllers 220 that are in the same network (or subnetwork) of data transmission with the middle layer TS element 110 '', to which the outgoing data packet is directed.

In one implementation, the outgoing data packet that was intercepted by the duplicator 210 is not sent further to the data network, but remains in the hypervisor's memory. In this case, after receiving confirmation from the control means 220 about the receipt of information about the intercepted data packet, the duplicating means 210 sends the intercepted outgoing data packet, which is stored in the hypervisor's memory, to the data transmission network in its original unchanged form. In another implementation, for example, when delays in the transmission of data packets are unacceptable (real-time operation of the TS), the intercepted outgoing packet is sent by the duplicator 210 to the data network immediately, simultaneously with the information transmitted over the secure connection to the monitor 220.

As a rule, modern ACS can have several components of SCADA systems operating on the elements of the upper level 110 'TS located in different data transmission networks. In this exemplary implementation, each such network includes a duplication means 210 that performs the above-described actions to intercept outgoing data packets and transmit information about them to controls 220.

The control means 220 is generally executed on the TC element 110. In one embodiment, the control means 220 is executed on the upper-level TC element 110 '. In another embodiment, the control means 220 is executed on the mid-level TC element 110 ''. In one implementation, the monitor 220 is topologically located in the data network so that it intercepts all data packets addressed to the elements of the TS 110. In one embodiment, the monitor 220 operates (runs) on an existing element of the TS 110, for example, on an element of the TS middle layer 110 '' or high-level TOC element 110 ', where the control 220 is an executable application or service. In yet another embodiment, control 220 is a secure operating system with hypervisor functionality and is designed to be installed on mid-level vehicle element 110 ''. In another embodiment, the control device 220 is installed on an additional mid-level vehicle element 110 '', which is intended only for the operation of the control device 220.

As described above, the monitor 220 receives information about the intercepted outgoing packets from the duplicators 210 over a secure connection. After receiving the information about the intercepted outgoing packets, the monitor 220 sends an acknowledgment to the duplicate devices 210 that this information has been received. In addition, the monitor 220 intercepts incoming data packets that are addressed to the mid-level TS elements 110 '' over the data network. Interception of incoming data packets is generally possible using virtualization techniques known from the prior art. In yet another implementation, interception is possible without using virtualization methods, for example, using a socket opened in the raw (or minimally processed) data mode (RAW mode).

In general, the monitor 220 compares the information about the intercepted outgoing packets received from the backup means 210 over the secure connection with the intercepted incoming packets that are addressed to the middle-level TS elements 110 '' over the data network.

In an embodiment, when the intercepted outgoing data packets are sent to the data network by means of duplication 210 concurrently with information about the intercepted outgoing data packets over a secure connection, the monitor 220 compares the received information with the intercepted incoming data packets over a time interval (e.g., 1s). If an incoming data packet is intercepted, information about which has not been received from the backup means 210 during the mentioned interval, the monitoring means 220 detects an anomaly in the technological system.

In an embodiment, when the intercepted outgoing data packets are sent to the data network by the duplication means 210 after receiving an acknowledgment from the monitor 220 for receiving information about the intercepted outgoing data packets over a secure connection, the monitor 220 compares the intercepted incoming packets with the received information. If an incoming data packet is intercepted for which information has not been received from the back-up means 210, the control means 220 detects an anomaly in the process system.

Information about the detected anomaly can be transmitted by the control tool 220 to the components of SCADA systems operating on the elements of the upper level vehicle 110 'for informing and further taking measures to eliminate the detected anomaly in the technological system.

In one embodiment, if the monitoring means 220 is located in the data network topologically sequentially with the middle-level TS element 110 '' and in front of the middle-level TS element 110 '', if an anomaly is detected in the technological system, the monitoring means 220 does not transmit the intercepted incoming packet data further into the data transmission network, thus counteracting the possible consequences of the arisen anomaly in the technological system. The middle-level TS element 110 '' in this example of implementation does not receive the intercepted incoming data packet, which prevents the disturbing effect on the middle-level TS element 110 ''.

In another embodiment, the monitoring means 220 may be located in the data network on the same middle-level TS element 110 '' to which the intercepted incoming data packet is addressed. In this case, the control means 220, as described above, counteracts the possible consequences of the arisen anomaly in the technological system.

An example of the application of the described invention is described below. There is a building that is equipped with an automated access system to the premises, a gym, a swimming pool, at least a ventilation system and a fire extinguishing system. ACS and SCADA components are located in the building data network in a protected environment (or in a protected subnetwork), but communicate with the programmable logic controllers that control the listed systems via said data network. In addition, building workers and visitors can access the same data network. Such data transmission networks exist in practice quite often, since they are built without due regard for information security in the design or with savings in material costs.

Obviously, third parties may send data packets to the network that are not from SCADA components and may be received by programmable logic controllers, which is an anomaly within the scope of the present invention.

Thus, the installation of said means of the system described in the present invention makes it possible to warn of the anomalies mentioned. Thus, the duplication tools 210 installed on the SCADA components intercept outgoing data packets and transmit them to the controls 220. Thus, the controls 220 intercept and compare all incoming data packets addressed to the programmable logic controllers, which makes it possible to identify an anomaly (if the packet data was sent to the data transmission network, for example, not from the SCADA component) and in one of the implementation options (in the case of blocking the incoming data packet) counteracts it.

FIG. 3 shows an example of the implementation of the proposed method for countering anomalies in a technological system.

At the initial stage 310, with the help of the duplication means 210, launched on the upper-level TC element 110 ', at least one outgoing data packet is intercepted, addressed to the middle-level technological system element 110' '. In one implementation, the duplicator 210 is a secure operating system with hypervisor functionality. In yet another embodiment, the top-level TC item 110 'is a SCADA component. Capturing data packets is generally possible using virtualization techniques known from the prior art.

Then, at step 320, information about the intercepted data packet is transmitted by means of duplication 210 to the means of control 220, launched on the element of the middle level TS 110 '', via a secure connection. In one embodiment, the monitoring means 220 is located topologically sequentially with the middle TOC element 110 '', to which the intercepted data packet is addressed, and in front of said middle TOC element 110 ''. The duplicator 210 establishes a secure connection with all monitors 220 existing in the data network and communicates to the monitors 220 information about each outgoing data packet that has been intercepted. In one implementation, control 220 is a secure operating system. In another embodiment, the monitoring means 220 is located in the same data network as the middle-level TOC element 110 '' to which the intercepted data packet is addressed. Control 220 is generally a secure hypervisor-enabled operating system designed to be installed on mid-level vehicle element 110 ''.

Next, at step 330, the monitor 220 intercepts at least one incoming data packet. Interception of incoming data packets is generally possible using virtualization techniques known from the prior art.

Next, at step 340, the monitoring means 220 detects an anomaly in the technological system if the intercepted incoming data packet does not match the said information received from the duplicating means 210. To determine the match, the monitoring means 220 compares the information about the intercepted outgoing packets received from means of duplication 210 on a secure connection with intercepted incoming packets, which are addressed to the elements of the middle layer 110 '' via the data network. At the same time, using the control means 220, the transmission of the intercepted incoming data packet to the TS element of the middle level 110 '' is blocked, which counteracts the detected anomaly in the technological system. Otherwise, if the anomaly is not detected (the incoming data packet is intercepted, information about which was received from the duplication means 210), it returns to step 330.

In one embodiment, if an anomaly is detected and the transmission of a data packet is blocked, the method continues and returns to step 330.

FIG. 4 shows an example of a general-purpose computer system, a personal computer or server 20, containing a central processing unit 21, a system memory 22, and a system bus 23 that contains various system elements, including memory associated with the central processing unit 21. The system bus 23 is implemented as any bus structure known from the prior art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interfacing with any other bus architecture. System memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains basic procedures that transfer information between the elements of the personal computer 20, for example, at the time of loading the operating room. systems using ROM 24.

The personal computer 20, in turn, contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31, such as CD-ROM, DVD -ROM and other optical media. The hard disk 27, the magnetic disk drive 28, and the optical drive 30 are connected to the system bus 23 via the hard disk interface 32, the magnetic disk interface 33, and the optical drive interface 34, respectively. Drives and corresponding computer storage media are non-volatile storage media for computer instructions, data structures, program modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that other types of computer storage media 56 are possible that are capable of storing data in a computer readable form (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36, where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38 and program data 39. The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40, manipulator " mouse "42). Other input devices may be used (not shown): microphone, joystick, game console, scanner, etc. Such input devices are conventionally connected to the computer system 20 through a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, etc. ...

The personal computer 20 is capable of operating in a networked environment using a network connection with other or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the entity. the personal computer 20 shown in FIG. 4. In a computer network, there may also be other devices, such as routers, network stations, peer-to-peer devices, or other network nodes.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, personal computer 20 is connected to local network 50 via a network adapter or network interface 51. When using networks, personal computer 20 may use a modem 54 or other means of providing communication with a wide area network, such as the Internet. Modem 54, which is an internal or external device, is connected to the system bus 23 via a serial port 46. It should be noted that the network connections are only exemplary and are not required to reflect the exact configuration of the network, i. E. in fact, there are other ways of establishing a connection by technical means of communication of one computer with another.

In conclusion, it should be noted that the information given in the description are examples and do not limit the scope of the present invention defined by the claims. One skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (8)

1. A method of blocking the transmission of data packets in a technological system, which consists of the stages at which: a) using the duplication means intercept at least one outgoing data packet addressed to an element of the technological system, while the duplication means is a secure operating system with support for the hypervisor function running on the technological system element; b) through a secure connection, the duplicating means are transmitted to the control means information about the intercepted data packet; c) using the control means intercepting at least one incoming data packet addressed to an element of the technological system, while the control means is a secure operating system with support for the hypervisor function, launched on the element of the technological system; d) with the help of the control means, the transmission of the intercepted incoming data packet to the element of the technological system is blocked if the intercepted incoming data packet does not correspond to the mentioned information received from the duplicating means. 2. The method of claim 1, wherein the process system element is a programmable logic controller. 3. A method according to claim 1, wherein the monitoring means is located topologically sequentially with the technological system element to which the intercepted data packet is addressed, and in front of said element. 4. The method according to claim 1, wherein the control means is located on an element of the technological system to which the intercepted data packet is addressed.

Images