EP3417593A1 - Anordnung zum überprüfen von wenigstens einer firewall-einrichtung und verfahren zum schutz wenigstens eines datenempfängers - Google Patents
Anordnung zum überprüfen von wenigstens einer firewall-einrichtung und verfahren zum schutz wenigstens eines datenempfängersInfo
- Publication number
- EP3417593A1 EP3417593A1 EP17711115.0A EP17711115A EP3417593A1 EP 3417593 A1 EP3417593 A1 EP 3417593A1 EP 17711115 A EP17711115 A EP 17711115A EP 3417593 A1 EP3417593 A1 EP 3417593A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- traffic
- data
- data traffic
- unauthorized
- arrangement
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
- H04L63/0218—Distributed architectures, e.g. distributed firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0245—Filtering by information in the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/40—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection
Definitions
- the invention relates to an arrangement for checking at least one firewall device, which is designed on the basis of predetermined rules for distinguishing between permitted and unauthorized data traffic in the direction of a data receiver and for blocking unauthorized data traffic and for permitting permitted data traffic.
- the invention relates to a method for controlling at least one firewall device, in which the discrimination in a data traffic in the direction of a data receiver based choke ⁇ certain rules between an allowed and an illicit traffic, and unauthorized traffic blocked and permitted data traffic is transmitted.
- Safety-critical systems such as the signal ⁇ network of a railway system or a network within a nuclear power plant, often have special security zones to which no direct data access is possible. Nevertheless, there is an increasing need for remote access to the system elements located in these security zones, for example for remote maintenance. Therefore, there is a desire to network security-relevant systems with conventional IT systems.
- firewall devices In order to allow such secure access to safety-critical installations, firewall devices are known which block unauthorized data traffic in the direction of a data receiver located within a safety-critical installation. Since safety Berei- chen other monitoring requirements are considered in the normal IT field or in the office IT Security, are be ⁇ knew firewall equipment for traffic with data do not adequately receive in a security-relevant area.
- the present invention solves this problem in that the arrangement mentioned at least one detection ⁇ device, which is designed to detect the transmitted by the firewall device data traffic, and at least one evaluation device for checking the detected by the detection device data traffic based on the predetermined Rules is formed has.
- the invention solves the problem in that the transmitted data traffic is detected and checked for existing unauthorized data traffic.
- the solution according to the invention has the advantage that, by checking the data traffic passed through the firewall device, a proof of the function of the firewall device is given and so also an application for security-relevant areas is permitted.
- DE 10 2013 221 955 A1 describes a security gateway with a failure disclosure. In it there will be a review of whether the input and output data from ⁇ a VPN gateway are faulty equal, that encryption does not take place. An analysis of whether the firewall itself was reconfigured by an attack, but this can not be done.
- the inventive solution can be developed further by favorable Fully ⁇ staltitch which are described below.
- the arrangement may comprise at least one switch-off device, which is formed to interrupt the data traffic in the direction of the data receiver and can be activated at least by the off ⁇ values means.
- the switch-off device which can be activated by the evaluation device. Failures of the firewall device can not be cause the Filter ⁇ tion of traffic stops and thus impermissible After ⁇ sent to the data receiver can get.
- the arrangement may have at least one monitoring device connected to the evaluation device, which is designed to monitor an operational readiness of the evaluation device.
- the monitoring device for activating the disconnection device can be configured when the non-operational readiness is detected.
- the shutdown of data traffic to the data receiver is guaranteed, which represents the fulfillment of the so-called "fail close" request.
- the monitoring device can be designed as a unit separate from the evaluation device.
- the monitoring device and the evaluation device are realized on independent hardware components.
- the monitoring device can be designed to trigger a restart of the evaluation device when a non-existent operational readiness is detected. This has the advantage that the security is further increased.
- the monitoring device can be designed, for example, as a so-called watchdog timer, which is reset by the internal processes of the evaluation device at regular intervals. Does this happen Zuschset ⁇ zen not within a predetermined time, a so-called time-out period, an alarm is triggered, which is example ⁇ way central signaled and trigger the shutdown and can interrupt the data traffic to the data receiver.
- a program code and a configuration of the evaluation device can be stored in a read-only memory, so that the initial state is restored upon restart and thus a previous manipulation or malfunction of the evaluation device is reversed.
- the data traffic to the data receiver is advantageously interrupted by the switch-off device.
- a restart of the evaluation device can also be performed at regular intervals. and / or detected anomalies in order to further increase the security of the arrangement.
- the evaluation device can additionally have a monitoring function at the input, which ensures that intentionally lengthwise or otherwise modified packets in the data traffic do not impair the function of the evaluation device.
- the data packet length is detected from the off ⁇ values means and on exceeding a
- the arrangement can have at least one test data generator which is designed to generate a test data traffic having unauthorized data traffic in the direction of the data receiver.
- the test data traffic can be reported to the evaluation device by the test data generator and displayed and therefore be expected by the evaluation device, so that no alarm or other protection response must be triggered.
- the test traffic can be inserted, for example, at regular intervals in the data stream to the data, and verify the correct operation of the off ⁇ values facility.
- the detection of the test traffic may reset another watchdog timer of the monitoring device, which triggers an alarm in the event of failure to recognize or miss the expected test traffic and / or activates the shutdown device and thus interrupts the data traffic to the data receiver.
- the invention further relates to a protection device for protecting at least one data receiver belonging to a network with a high security requirement against unauthorized access Data traffic, comprising at least one firewall device, which is designed according to predetermined rules for distinguishing between permitted and unauthorized data traffic towards the data receiver and for blocking unauthorized data traffic and for permitting permitted data traffic.
- the protective device has at least one arrangement according to one of the above embodiments.
- the invention also relates to a network connection between a data transmitter and a data receiver, the data receiver belonging to a network with a high security requirement and the data transmitter sending data traffic to a network of low security requirement.
- the network connection has at least one protection device according to the above embodiment.
- the data traffic to the data receiver can be interrupted if the transmitted data traffic has unauthorized data traffic.
- data traffic to the data receiver can be interrupted if the transmission and checking of the transmitted data traffic does not occur within a predetermined time.
- this watchdog timer function already described above, the proper functioning of the method according to the invention is regularly checked, as also already described above.
- a transmitted test data traffic which allowed data traffic are generated and checked whether the unauthorized traffic is detected.
- data traffic to the data receiver may be interrupted if the unauthorized traffic of the test traffic is not detected within a predetermined time or the test traffic is not generated within a predetermined time.
- This watchdog timer feature detects tampering and automatically stops traffic.
- the data traffic can be transmitted with an end-to-end encryption in order to ensure the integrity of the content of the transmitted data and, if necessary, its confidentiality.
- the decryption takes place in the data receiver, which can additionally check the content for plausibility.
- end-to-end encrypted data the advantage of the solution according to the invention comes into play particularly since such messages can not be used, for example, with known security gateways.
- FIG. 1 shows a schematic representation of an example ⁇ embodiment of a network connection according to the invention.
- a network connection 1 according to the invention runs from a data transmitter 2 to a data receiver 3.
- the network connection 1 comprises an IP network 4 and a protection device 5 according to the invention, which is arranged in front of the data receiver 3 and protects it against unauthorized data traffic.
- the protection device 5 comprises a firewall device 6 and an arrangement 7 according to the invention, which is designed to check the firewall device 6.
- the arrangement 7 according to the invention has a test data generator 8, a distribution means 9, a detection device 10, a shutdown device 11, an evaluation device 12 and a monitoring device 13.
- the data receiver 3 is arranged within a safety zone 14, a safety-critical system 15.
- the safety critical plant 15 is for example a railway technical plant or a power station and the guard region 14 is a region in which an increased Si ⁇ reliability applies traffic.
- the requirements of the IEC 62443-3-3 standard apply to possible remote access from outside to this area.
- the data transmitter 2 is located outside the security zone 14 of the safety-critical installation 15 in an area with a lower security requirement than in the area
- the network connection 1 according to the invention between the data transmitter 2 and the data receiver 3 is used, for example, for remote maintenance of the safety-critical system 15.
- the firewall device 6 is arranged in the data traffic in the direction of the data receiver 3 in front of the data receiver 3.
- the firewall device 6 differentiates between permitted and unauthorized data traffic on the basis of predetermined rules, whereby the unauthorized data traffic for protecting the data receiver is blocked by the firewall device 6 and thus filtered out.
- the remaining, permitted data traffic is allowed through and can reach the data receiver 3.
- the data traffic 16 here in the exemplary embodiment contains end-to-end encrypted data 17 for the data.
- the permitted data traffic comprises data 17 which may be sent from one or more permitted IP addresses to exactly one or more permitted IP addresses at the data receiver 3.
- the surfaces protocol elements erforderli- for transmission are unencrypted on to ⁇ start and end of the data 17 to ensure standards-compliant About ⁇ transmission over the IP network 4, and additionally encrypted inside the data 17.
- the predetermined rules based If the firewall device 6 distinguishes between permitted and unauthorized data traffic, this means that permissible IP addresses for the data transmitter 2 and the data receiver 3 are here.
- the firewall device 6 therefore allows only permitted data traffic in the direction of the data receiver 3 if configured correctly the security zone 14 too.
- the firewall device 6 may have been inadmissibly altered, for example by a hostile attack, so that it also allows unauthorized data traffic through. Such an error case of the firewall device 6 is possible and should therefore be prevented according to the invention.
- the inventive arrangement 7 is provided between the firewall device 6 and the data receiver 3, which checks the correct functioning of the firewall device 6.
- the data traffic 18 transmitted by the firewall device 6 is first detected by the detection device 10 within the arrangement 7.
- the detection device 10 is embodied, for example, as a listening device, a so-called tap, which overhears the transmitted data traffic 18 without any reaction.
- the overheard transmitted Since ⁇ data traffic 18 is checked by the detection means connected to the evaluation device 10 12th During the check by the evaluation device 12, it is checked that the transmitted data traffic 18 contains no unauthorized data traffic. If unauthorized traffic, ie unauthorized IP sender addresses or unauthorized IP destination addresses, port numbers, etc. are detected, only one Malfunction of the firewall device 6 be the cause. In such an error case, the evaluation device 12 activates the shutdown device 11 via a corresponding shutdown signal 19.
- the shutdown device 11 is designed to interrupt the data traffic in the direction of the data receiver 3 and ar ⁇ processed analogously as a switch that interrupts the data traffic to the data receiver 3 when it is activated.
- the switch-off signal 19 from the evaluation device 12 is open ⁇ ensures that a detected in the transmitted data 18 illicit traffic does not reach the data receiver 3 and the safety zone fourteenth
- the evaluation device 12 is designed in the exemplary embodiment of the figure so that it is only configured locally and has no additional bidirectional network connection. Thus, the possibilities of attack against the evaluation device 12 are minimized and the reliability is increased by the erfindungsge ⁇ Permitted arrangement. 7
- the monitoring device 13 is connected to the evaluation device 12, which is formed on a hardware independent of the evaluation device 12.
- the monitoring device 13 has a first watchdog timer 20, which is reset by the evaluation device 12, for example, by their internal processes, at regular intervals. If the evaluation device 12 as example ⁇ by a hostile attack inoperable, the watchdog timer 20 is not reset and reaches a predetermined so-called time-out time. Upon reaching this time-out period, an alarm is triggered 21 and in addition the shutdown signal output 19 to the ⁇ From switching means 11 of the evaluation 12th Thereby, the error occurs, the evaluation device 12 leads to the interruption of the data traffic in the direction of the data receiver 3 and thus advantageous way ⁇ enough, to a safe state.
- the alarm 21 (not shown) which ensures uniform ⁇ critical plant 15 triggered, for example in a control center.
- a restart takes place automatically in the evaluation device 12 in the embodiment illustrated by way of example in the figure in order to restore the security of the system.
- the evaluation device 12 has a read-only memory 22 which contains a program code and a configuration of the evaluation device 12. When restarting, the evaluation device 12 of this program code and configuration from the storage 22 rather is read, so that the output state of the evaluating device so ⁇ a previous tampering or malfunction of the evaluation unit 12 is made undone restored and 12.
- the data traffic is interrupted by the switch-off device 11 and is released again only after withdrawal of the switch-off signal 23 by the watchdog timer 20.
- the restart of the evaluation device 12 is performed automatically at regular intervals and in the event of detected anomalies.
- test data generator 8 is provided according to the invention.
- the test data generator 8 generates at regular intervals one or more defined test data in test data traffic 24.
- the test data traffic 24 is fed by means of the distribution means 9, which is for example a switch, into the transmitted data traffic 18 in the direction of the data receiver 3.
- the test traffic 24 contains unauthorized traffic that reaches the detector 10. Thereby, the proper func ⁇ on the detection device 10 and the evaluation device 12 are checked.
- the test data generator 8 is connected directly to the evaluation device 12 and outputs a test data signal 25 when the test data traffic 24 has been fed into the transmitted data traffic 18. 12, expects the Ausnceeinrich ⁇ processing the test as supplied illicit traffic in transmitted data 18 and therefore does not trigger
- the test data traffic 24 is generated, for example, at regular intervals by the test data generator 8 in order to check the correct function of the evaluation device 12.
- the recognition of the test data traffic 24 by the evaluation device 12 resets another watchdog timer 26 of the monitoring device 13. If the test data traffic 24 is not recognized by the evaluation device 12 within a defined time-out time of the watchdog timer 26, the alarm 21 is triggered and additionally or alternatively a shutdown signal 27 is transmitted to the shutdown device 11, by the the traffic to the data receiver 3 is interrupted.
- the evaluation device 12 can largely escape an attack from the outside because it is only connected to the data traffic via the detection device 10 and this only by a unidirectional, readout tap. Even if the evaluation device 12 is deactivated by a suitable data traffic, the monitoring device 13 would trigger the shutdown device 11 via the watchdog timers 20 and 26. If by attack the evaluation device 12 would be deactivated, this is already noticeable in the next test data traffic 24, which also causes the activation of the shutdown device 11. By means of the arrangement 7 according to the invention, a defective configuration change of the firewall device 6 is detected because a transmitted unauthorized data traffic is detected and blocked by the shutdown device 11.
- the end-to-end encrypted data 17 can also be transferred via the inventive network ⁇ compound. 1
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
Description
Claims
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE102016205983.1A DE102016205983A1 (de) | 2016-04-11 | 2016-04-11 | Anordnung zum Überprüfen von wenigstens einer Firewall-Einrichtung und Verfahren zum Schutz wenigstens eines Datenempfängers |
PCT/EP2017/055805 WO2017178165A1 (de) | 2016-04-11 | 2017-03-13 | Anordnung zum überprüfen von wenigstens einer firewall-einrichtung und verfahren zum schutz wenigstens eines datenempfängers |
Publications (1)
Publication Number | Publication Date |
---|---|
EP3417593A1 true EP3417593A1 (de) | 2018-12-26 |
Family
ID=58347329
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP17711115.0A Withdrawn EP3417593A1 (de) | 2016-04-11 | 2017-03-13 | Anordnung zum überprüfen von wenigstens einer firewall-einrichtung und verfahren zum schutz wenigstens eines datenempfängers |
Country Status (6)
Country | Link |
---|---|
US (1) | US11044231B2 (de) |
EP (1) | EP3417593A1 (de) |
CN (1) | CN109076071B (de) |
AU (1) | AU2017249589B2 (de) |
DE (1) | DE102016205983A1 (de) |
WO (1) | WO2017178165A1 (de) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE102016215243A1 (de) | 2016-08-16 | 2018-02-22 | Siemens Aktiengesellschaft | Anordnung mit einer technischen Anlage sowie Verfahren zu deren Betrieb |
US20200314066A1 (en) * | 2019-03-29 | 2020-10-01 | Cloudflare, Inc. | Validating firewall rules using data at rest |
Family Cites Families (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020129355A1 (en) * | 2001-03-01 | 2002-09-12 | Mike Velten | Method and system for monitoring an apparatus for a computer |
US7315537B2 (en) * | 2001-09-25 | 2008-01-01 | Siemens Aktiengesellschaft | Method for the transmission of data in a packet-oriented data network |
US7734752B2 (en) * | 2002-02-08 | 2010-06-08 | Juniper Networks, Inc. | Intelligent integrated network security device for high-availability applications |
US6898632B2 (en) * | 2003-03-31 | 2005-05-24 | Finisar Corporation | Network security tap for use with intrusion detection system |
US7076393B2 (en) * | 2003-10-03 | 2006-07-11 | Verizon Services Corp. | Methods and apparatus for testing dynamic network firewalls |
US7421734B2 (en) | 2003-10-03 | 2008-09-02 | Verizon Services Corp. | Network firewall test methods and apparatus |
US20050268331A1 (en) * | 2004-05-25 | 2005-12-01 | Franck Le | Extension to the firewall configuration protocols and features |
ES2354632T3 (es) * | 2006-06-03 | 2011-03-16 | B. BRAUN MEDIZINELEKTRONIK GMBH & CO. KG | Dispositivo y procedimiento para la protección de un aparato médico y de un paciente tratado con dicho aparato, contra influencias peligrosas procedentes de una red de comunicaciones. |
CN100514921C (zh) | 2007-01-31 | 2009-07-15 | 华为技术有限公司 | 一种网络流量异常检测方法和*** |
US7929449B2 (en) * | 2008-05-30 | 2011-04-19 | International Business Machines Corporation | System, method and program for determining failure in network communication |
US20100005263A1 (en) * | 2008-07-04 | 2010-01-07 | Huawei Technologies Co., Ltd. | Information backup method, firewall and network system |
EP2154827A1 (de) | 2008-08-14 | 2010-02-17 | Alcatel Lucent | Ein selbst-wiederherstellendes Netzwerkelement |
CN102420767B (zh) * | 2011-12-15 | 2014-07-02 | 北京星网锐捷网络技术有限公司 | 转发路径切换方法、装置及网络设备 |
DE102013214522A1 (de) * | 2013-07-25 | 2015-01-29 | Siemens Aktiengesellschaft | Überwachung einer Filterfunktionalität einer Netzwerkfiltereinrichtung |
DE102013216847B4 (de) | 2013-08-23 | 2023-06-01 | Siemens Mobility GmbH | Verfahren, Vorrichtung und System zur Überwachung einer Sicherheits-Netzübergangseinheit |
DE102013219698A1 (de) * | 2013-09-30 | 2015-04-02 | Siemens Aktiengesellschaft | Filtern eines Datenpaketes durch eine Netzwerkfiltereinrichtung |
DE102013221955A1 (de) | 2013-10-29 | 2015-05-21 | Siemens Aktiengesellschaft | Sicherheitsrelevantes System |
CN104252398A (zh) * | 2013-12-04 | 2014-12-31 | 深圳市华傲数据技术有限公司 | 一种数据防火墙***修复数据方法和*** |
-
2016
- 2016-04-11 DE DE102016205983.1A patent/DE102016205983A1/de not_active Withdrawn
-
2017
- 2017-03-13 US US16/092,468 patent/US11044231B2/en active Active
- 2017-03-13 AU AU2017249589A patent/AU2017249589B2/en not_active Expired - Fee Related
- 2017-03-13 CN CN201780022816.6A patent/CN109076071B/zh active Active
- 2017-03-13 WO PCT/EP2017/055805 patent/WO2017178165A1/de active Application Filing
- 2017-03-13 EP EP17711115.0A patent/EP3417593A1/de not_active Withdrawn
Also Published As
Publication number | Publication date |
---|---|
DE102016205983A1 (de) | 2017-10-12 |
US11044231B2 (en) | 2021-06-22 |
CN109076071A (zh) | 2018-12-21 |
AU2017249589A1 (en) | 2018-10-04 |
AU2017249589B2 (en) | 2021-07-29 |
WO2017178165A1 (de) | 2017-10-19 |
CN109076071B (zh) | 2021-10-12 |
US20190166097A1 (en) | 2019-05-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3001884B1 (de) | Verfahren, vorrichtung und system zur überwachung einer sicherheits-netzübergangseinheit | |
EP2577903B1 (de) | Verfahren und system zur manipulationssicheren übertragung von steuerdaten | |
DE19952527C2 (de) | Verfahren und Transaktionsinterface zum gesicherten Datenaustausch zwischen unterscheidbaren Netzen | |
DE102011002706B4 (de) | Vorrichtung und Verfahren zum Schutz eines Sicherheitsmoduls gegen Manipulationsversuche in einem Feldgerät | |
EP3417593A1 (de) | Anordnung zum überprüfen von wenigstens einer firewall-einrichtung und verfahren zum schutz wenigstens eines datenempfängers | |
DE10312699A1 (de) | Nichtinvasives Testen von Netzwerkschnittstellen-Fehlercodes für ein Sicherheitsnetzwerk | |
EP3688958B1 (de) | System und verfahren zum geschützten übertragen von daten | |
DE4113959A1 (de) | Ueberwachungseinrichtung | |
EP2954534B1 (de) | Vorrichtung und verfahren zur erkennung von unbefugten manipulationen des systemzustandes einer steuer- und regeleinheit einer kerntechnischen anlage | |
EP1986062B1 (de) | Steuervorrichtung und Steuerverfahren für ein elektrisches Haushaltsgerät | |
DE102004015616B4 (de) | Sicherheitssystemsteuerung zur Verwendung in einer Prozessumgebung, Prozesssteuerungssystem sowie entsprechendes Steuerungsverfahren | |
WO2015062812A1 (de) | Sicherheitsrelevantes system mit supervisor | |
EP2839601B1 (de) | Feldbus-datenübertragung | |
EP3246778B1 (de) | Vorrichtung zum auslesen von daten aus einem sicherheitskritischen steuergerät | |
WO2014191179A1 (de) | Verfahren und vorrichtung zum filtern eines datenpaketes | |
AT507122B1 (de) | Verfahren zum betrieb einer transaktionsbasierten ablaufsteuerung | |
WO2020254106A1 (de) | Filter, anordnung und betriebsverfahren für eine anordnung | |
EP1962246A1 (de) | Sicherheitsvorrichtung und Sicherheitsverfahren mit mehreren Verarbeitungsstufen | |
EP3839668A1 (de) | Integritätsüberwachungssystem und verfahren zum betreiben eines integritätsüberwachungssystems sowie eine integritätsüberwachungseinheit | |
EP0909692B1 (de) | Verfahren zum Abschotten sicherheitsrelevanter Datenverarbeitungsanlagen gegen Beeinflussungen aus anderen Datennetzen sowie hierzu geeignete Einrichtung | |
EP3047610B1 (de) | Verfahren zum erfassen von in einem rechner-netzwerk mit mindestens einem rechner ausgesendeten daten und daten-erfassungsanordnung | |
EP3661830B1 (de) | Konzept zum überwachen eines an ein stellwerk eingehenden netzwerkverkehrs | |
DE202016103460U1 (de) | Kommunikationsteilnehmer eines Feldbussystems und Feldbussystem | |
EP3311546A1 (de) | Einrichtung und verfahren zum kontrollieren einer datenübertragung in einem datennetzwerk |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: UNKNOWN |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE |
|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20180919 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
DAV | Request for validation of the european patent (deleted) | ||
DAX | Request for extension of the european patent (deleted) | ||
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
17Q | First examination report despatched |
Effective date: 20191203 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
INTG | Intention to grant announced |
Effective date: 20210514 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20210925 |