This disclosure relates generally to communication systems and more specifically to an apparatus and method for traffic filtering in a communication system.
Processing facilities are often managed using process control systems. Example processing facilities include manufacturing plants, chemical plants, crude oil refineries, and ore processing plants. Among other operations, process control systems typically manage the use of motors, valves, and other industrial equipment in the processing facilities.
In some process control systems, components are divided into a hierarchy of levels, referred to as “network levels.” Components in different network levels are typically responsible for performing different types of functions in the process control systems. For example, a conventional process control system could include one or more Level 1 network levels and one or more Level 2 network levels. As particular examples, a Level 1 network level may include controllers and other components used to control the industrial equipment. A Level 2 network level may include servers, personal computers, and other components used to interact with and control the components in the Level 1 network level.
It is often important to protect more critical components of the process control systems (such as components in Level 1 network levels) from virus attacks or other disruptions. One prior approach involves providing separate switches for the more critical components and for the less critical components of the process control system. However, this approach often increases the complexity and cost of the process control system because multiple sets of switches are required.
This disclosure provides an apparatus and method for traffic filtering in a communication system.
In a first embodiment, a method includes receiving traffic through a first interface in a first group of interfaces at a switch. The first group of interfaces is associated with a first virtual network. The method also includes determining that the traffic is destined for a destination associated with a second virtual network. The method further includes forwarding the traffic to a second interface in a second group of interfaces at the switch. The second group of interfaces is associated with the second virtual network. Moreover, the method includes filtering the traffic that is received at the second interface in the second group of interfaces. In addition, the method includes communicating the filtered traffic towards the destination.
In particular embodiments, the first and second virtual networks represent Virtual Local Area Networks associated with different network levels of a process control system. At least one of the network levels includes one or more controllers capable of controlling one or more process elements in a processing facility.
In other particular embodiments, forwarding the traffic to the second interface includes forwarding the traffic to a third interface in the first group of interfaces. The third interface is coupled to the second interface by a cable. The cable could represent a crossover cable.
In a second embodiment, an apparatus includes a plurality of interfaces, including a first group of interfaces associated with a first virtual network and a second group of interfaces associated with a second virtual network. The apparatus also includes a switch fabric capable of transporting traffic between the interfaces. The apparatus further includes a controller capable of determining that traffic received through a first interface in the first group of interfaces is destined for a destination associated with the second virtual network. The controller is also capable of causing the switch fabric to forward the traffic to a second interface in the second group of interfaces. The controller is further capable of filtering the traffic that is received at the second interface in the second group of interfaces. In addition, the controller is capable of causing the switch fabric to forward the filtered traffic to a third interface in the second group of interfaces for communication of the filtered traffic towards the destination.
In a third embodiment, a system includes a plurality of switches capable of facilitating communication between a plurality of endpoints. At least one of the switches includes a plurality of interfaces, including a first group of interfaces associated with a first virtual network and a second group of interfaces associated with a second virtual network. At least one of the switches also includes a switch fabric capable of transporting traffic between the interfaces. At least one of the switches further includes a controller capable of determining that traffic received through a first interface in the first group of interfaces is destined for an endpoint associated with the second virtual network. The controller is also capable of causing the switch fabric to forward the traffic to a second interface in the second group of interfaces. The controller is further capable of filtering the traffic that is received at the second interface in the second group of interfaces. In addition, the controller is capable of causing the switch fabric to forward the filtered traffic to a third interface in the second group of interfaces for communication of the filtered traffic towards the endpoint associated with the second virtual network.
Other technical features may be readily apparent to one skilled in the art from the following figures, descriptions, and claims.
For a more complete understanding of this disclosure, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which:
In this example embodiment, the communication system 100 represents a process control system that includes process elements 102a-102d, endpoints 104a-104f, and switches 106a-106f. The process elements 102a-102d represent components in a processing environment that perform any of a wide variety of functions. For example, the process elements 102a-102d could represent motors, valves, and other industrial equipment in a processing environment. The process elements 102a-102d could represent any other or additional components in a processing environment. Each of the process elements 102a-102d includes any hardware, software, firmware, or combination thereof for performing one or more functions in a processing environment. The process elements 102a-102d could, for example, represent any component, device, or system capable of manipulating, altering, or otherwise processing one or more materials in a processing environment.
The endpoints 104a-104f represent components in the communication system 100 that are capable of controlling the operation of the process elements 102a-102d. For example, the endpoints 104a-104d may be capable of directly interacting with and controlling the operation of the process elements 102a-102d. The endpoints 104e-104f may be capable of controlling the operation of the process elements 102a-102d indirectly through the endpoints 104a-104d. Each of the endpoints 104a-104f includes any hardware, software, firmware, or combination thereof for controlling one or more operations in the communication system 100. As particular examples, the endpoints 104a-104d could include or represent embedded controllers such as C200, C300, or C400 controllers from HONEYWELL INTERNATIONAL INC. or Fieldbus interface modules (FIMs). The endpoints 104e-104f could include or represent servers such as PROCESS KNOWLEDGE SYSTEM (PKS) servers from HONEYWELL INTERNATIONAL INC. or ADVANCED CONTROL ENVIRONMENT (ACE) servers from HONEYWELL INTERNATIONAL INC. The endpoints 104e-104f could also include or represent operator stations such as desktop computers, laptop computers, or personal digital assistants.
The switches 106a-106f transport information between various ones of the endpoints 104a-104f. For example, the switch 106a may receive information from the endpoint 104a and transmit the information to the endpoint 104e via the switch 106e. Depending on the layout of the system 100, each of the switches 106a-106f is typically coupled to one or more of the endpoints 104a-104f and/or one or more other switches. Each of the switches 106a-106f includes any hardware, software, firmware, or combination thereof for transporting information in the system 100. The switches 106a-106f could, for example, represent 2950 SERIES switches from CISCO SYSTEMS, INC.
Depending on the function of the endpoints 104a-104f, the endpoints 104a-104f may communicate any suitable information through the switches 106a-106f. The information transported between components in a system is generally referred to as “traffic.” In some embodiments, part of the traffic sent to the endpoints 104a-104d from the endpoints 104e-104f represents control information for controlling the operation of the endpoints 104a-104d. In this way, the endpoints 104e-104f may generally control how the endpoints 104a-104d control the operation of the process elements 102a-102d. Also, the endpoints 104a-104f may use any suitable protocol or protocols for communicating information, such as by using Transmission Control Protocol/Internet Protocol (TCP/IP) or User Datagram Protocol/Internet Protocol (UDP/IP) over Ethernet. In addition, each of the endpoints 104a-104f could be fixed in a specific location or be mobile, and the endpoints 104a-104f could communicate with the switches 106a-106f over wired or wireless connections.
As shown in
In some embodiments, the communication system 100 represents a redundant or fault tolerant network. For example, the communication system 100 could represent a Fault Tolerant Ethernet (FTE) network. An FTE network typically includes two networks that are generally independent of one another, where multiple redundant paths exist between any two of the endpoints 104a-104f. As shown in
In these types of networks, each of the endpoints 104a-104f may be coupled to a pair of the switches 106a-106f via a redundant network 110 (such as two Ethernet networks). In the event that one switch in a pair is lost in the system 100, the other switch in the pair is used to route traffic. This helps to ensure that the endpoints 104a-104f may continue operating normally even when a switch becomes inoperative. Also, switches in each pair are coupled to one another via a crossover cable 112. The crossover cables 112 may represent the only interconnections between the two redundant networks. Among other things, these features help to ensure that at least four redundant paths exist between any two of the endpoints 104a-104f.
In one aspect of operation, the switches 106a-106f in the system 100 include at least one “split switch.” A split switch represents a single physical switch that functions as multiple switches. In these embodiments, a split switch may be coupled to both a Level 1 network level and a Level 2 network level. In some embodiments, the split switch supports a Virtual Local Area Network (VLAN) or other virtual network for the Level 1 network level and a separate VLAN or other virtual network for the Level 2 network level. In particular embodiments, the split switch creates a VLAN for the Level 1 network level and uses an FTE community VLAN for the Level 2 network level. Among other things, this allows the split switch to maintain a separation between the traffic in the Level 1 network level and the traffic in the Level 2 network level. A cable is used to connect the VLANs, and the split switch uses this cable to transport traffic between the VLANs.
The split switch is also configured to provide traffic filtering at an ingress to the Level 1 VLAN. For example, the split switch could use one or more access lists to allow traffic for specific TCP or UDP ports to pass into the Level 1 VLAN. The access lists could also allow additional traffic to pass that is needed to maintain the system 100, such as Address Resolution Protocol (ARP) broadcast traffic, multicast test messages, and Network Timing Protocol (NTP) traffic. All other traffic could be blocked and prevented from entering into the Level 1 VLAN. In particular embodiments, the access lists in the split switch are customizable or variable, depending on the type of traffic required by the components in the Level 1 network level.
By using the virtual networks and the filtering function, the split switch is virtually divided into two switches (one for the Level 1 network level and another for the Level 2 network level), where traffic filtering is provided for at least one of the virtual switches. In this way, the split switch may effectively protect the components in the Level 1 network level from disruption while still allowing control and other necessary traffic into the Level 1 network level. Also, the split switch may provide this protection without requiring the use of multiple physical switches, which may help to reduce the complexity and cost of the system 100. Additional details about a split switch are shown in
Although
In this example, the switch 200 includes multiple interfaces 202, a switch fabric 204, a controller 206, and a memory 208. The interfaces 202 facilitate communication between the switch 200 and various external components. For example, the interfaces 202 may be coupled to one or more endpoints and/or one or more other switches via network cables. The interfaces 202 represent any suitable structure or structures for facilitating communication with external components, such as RJ-45 jacks capable of receiving Ethernet cables.
The switch fabric 204 facilitates the transfer of information between various external components coupled to the switch 200. For example, the switch fabric 204 could transport information between various ones of the interfaces 202. In this way, the switch fabric 204 may receive information through one interface 202 and provide that information for communication through one or more other interfaces 202. The switch fabric 204 includes any suitable structure or structures for transporting information between interfaces 202.
The controller 206 is coupled to the switch fabric 204. The controller 206 controls the overall operation of the switch 200. For example, the controller 206 could control the switch fabric 204, thereby controlling the routing of information between the interfaces 202. The controller 206 could also perform various operations to support the creation or use of multiple VLANs or other virtual networks. The controller 206 could further perform various operations to support traffic filtering to block or pass traffic to or from one or more of the virtual networks. In addition, the controller 206 could perform other functions, including multicast policing and enforcing broadcast storm limits (such as by using or enforcing 1 mbit/sec limits). The controller 206 includes any hardware, software, firmware, or combination thereof for controlling the switch 200.
The memory 208 is coupled to the controller 206. The memory 208 stores and facilitates retrieval of information used by the controller 206 to control the operation of the switch 200. For example, the memory 208 could store one or more control programs executed by the controller 206. The memory 208 could also store one or more access lists, which are used by the controller 206 to provide traffic filtering. The memory 208 could further store one or more spanning trees, which are used to route information in the communication system 100. In addition, the memory 208 could store information used to support the use of multiple virtual networks. The memory 208 includes any suitable volatile and/or non-volatile storage and retrieval device or devices, such as random access memory (RAM), read-only memory (ROM), flash memory, or any other or additional type of memory.
As shown in
In these embodiments, the switch 200 supports the use of multiple virtual networks and segregates the virtual networks' traffic. For example, the switch 200 may route traffic from one interface 202 of a subset only to another interface 202 in that same subset. In this way, traffic within a virtual network typically stays within the virtual network, unless the traffic is sent over the cable 212 to an interface 202 associated with another virtual network. Also, the switch 200 supports traffic filtering for at least one of the virtual networks. As an example, if subset 210a is associated with a Level 1 network level and subset 210b is associated with a Level 2 network level, the controller 206 could perform traffic filtering for any traffic entering the interface 202 coupled to the cable 212 in subset 210a. In this way, the switch 200 provides traffic filtering for the Level 1 network level, which may help to protect the components of the Level 1 network level from disruptions caused by viruses or other sources.
In particular embodiments, the switch 200 includes twenty-four interfaces 202. The first two interfaces 202 may represent uplinks into a Level 2 network level. The next ten interfaces 202 may represent links into a Level 1 network level. The following two interfaces 202 may represent the interfaces 202 that are coupled using the cable 212. The last ten interfaces 202 may represent links into the Level 2 network level. Also, other interfaces could be supported in the switch 200, such as when multiple Gigabit Interface Converter (GBIC) uplinks to the Level 2 network level are supported. In addition, the spanning tree in the switch 200 could be configured to prevent the blocking of traffic between the subsets 210a-210b of interfaces 202.
Although
The switch 200 receives traffic from a first network level VLAN at step 302. This may include, for example, the switch 200 receiving traffic from a component in a Level 2 network level via a first interface 202 in a subset 210b associated with the Level 2 network level. The traffic may be destined for a component in the first network level VLAN or in a second network level VLAN.
The switch 200 determines whether the traffic is destined for a component in the first network level VLAN or the second network level VLAN at step 304. This may include, for example, the controller 206 examining a destination address associated with the received traffic. This may also include the controller 206 determining if the identified destination address is associated with a component in the first network level VLAN.
If the traffic is destined for a component in the first network level VLAN, the switch 200 forwards the received traffic to the component in the first network level VLAN at step 306. This may include, for example, the switch fabric 204 sending the traffic received over the first interface 202 in the subset 210b to a second interface 202 in the same subset 210b. This may also include the switch 200 forwarding the received traffic towards the destination component via the second interface 202 in the subset 210b.
If the traffic is destined for a component in the second network level VLAN, the switch 200 sends the received traffic over the crossover cable 212 to the second network level VLAN at step 308. This may include, for example, the switch fabric 204 sending the traffic from a second interface 202 in subset 210b to a first interface 202 in subset 210a. The subset 210a could be associated with a Level 1 network level.
The switch 200 identifies the type of received traffic at step 310 and an interface associated with the received traffic at step 312. This may include, for example, the controller 206 determining if the received traffic represents unicast traffic, broadcast traffic, multicast traffic, or NTP traffic. This may also include the controller 206 identifying a TCP or UDP port within the source or destination address of the received traffic.
The switch 200 performs traffic filtering and determines if the identified traffic type and interface are acceptable at step 314. This may include, for example, the controller 206 determining if the identified traffic type represents ARP broadcast traffic, multicast test messages, or NTP traffic. This may also include the controller 206 determining if the identified traffic type represents unicast traffic and the identified TCP or UDP port falls within a range of acceptable ports.
If the identified traffic type and interface are acceptable, the switch 200 forwards the traffic to one or more components in the second network level VLAN at step 316. This may include, for example, the switch fabric 204 sending the traffic from the first interface 202 in the subset 210a to one or more second interfaces 202 in the subset 210a. Otherwise, if the identified traffic-type or interface is not acceptable, the switch 200 blocks the traffic from the second network level VLAN at step 318. This may include, for example, the switch 200 failing to forward the traffic to any components in the second network level VLAN and removing the traffic from any internal buffers.
Although
In some embodiments, the various functions performed by or within the switch 200 are implemented or supported by a computer program that is formed from computer readable program code and that is embodied in a computer readable medium. The phrase “computer readable program code” includes any type of computer code, including source code, object code, and executable code. The phrase “computer readable medium” includes any type of medium capable of being accessed by a computer, such as read only memory (ROM), random access memory (RAM), a hard disk drive, a compact disc (CD), a digital video disc (DVD), or any other type of memory.
It may be advantageous to set forth definitions of certain words and phrases used throughout this patent document. The term “couple” and its derivatives refer to any direct or indirect communication between two or more elements, whether or not those elements are in physical contact with one another. The term “application” refers to one or more computer programs, sets of instructions, procedures, functions, objects, classes, instances, or related data adapted for implementation in a suitable computer language. The terms “include” and “comprise,” as well as derivatives thereof, mean inclusion without limitation. The term “or” is inclusive, meaning and/or. The phrases “associated with” and “associated therewith,” as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like. The term “controller” means any device, system, or part thereof that controls at least one operation. A controller may be implemented in hardware, firmware, software, or some combination of at least two of the same. The functionality associated with any particular controller may be centralized or distributed, whether locally or remotely.
While this disclosure has described certain embodiments and generally associated methods, alterations and permutations of these embodiments and methods will be apparent to those skilled in the art. Accordingly, the above description of example embodiments does not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of this disclosure, as defined by the following claims.
Number | Name | Date | Kind |
---|---|---|---|
5394402 | Ross | Feb 1995 | A |
5617421 | Chin et al. | Apr 1997 | A |
5963556 | Varghese et al. | Oct 1999 | A |
6195351 | Hiscock et al. | Feb 2001 | B1 |
6216167 | Momirov | Apr 2001 | B1 |
6249883 | Cassidy et al. | Jun 2001 | B1 |
6308282 | Huang et al. | Oct 2001 | B1 |
6356553 | Nagami et al. | Mar 2002 | B1 |
6430621 | Srikanth et al. | Aug 2002 | B1 |
6526052 | Rijhsinghani et al. | Feb 2003 | B1 |
6556575 | Denio et al. | Apr 2003 | B1 |
6560236 | Varghese et al. | May 2003 | B1 |
6563832 | Stuart et al. | May 2003 | B1 |
6690668 | Szczepanek et al. | Feb 2004 | B1 |
6718379 | Krishna et al. | Apr 2004 | B1 |
6728780 | Hebert | Apr 2004 | B1 |
6735198 | Edsall et al. | May 2004 | B1 |
6798775 | Bordonaro et al. | Sep 2004 | B1 |
6807176 | Egbert et al. | Oct 2004 | B1 |
7089345 | Lynn | Aug 2006 | B1 |
7099336 | Kalkunte et al. | Aug 2006 | B2 |
7170895 | Wirth et al. | Jan 2007 | B2 |
7218639 | Matsufuru | May 2007 | B2 |
7313613 | Brooking et al. | Dec 2007 | B1 |
7460542 | Bhatia | Dec 2008 | B2 |
7483374 | Nilakantan et al. | Jan 2009 | B2 |
20020027908 | Kalkunte et al. | Mar 2002 | A1 |
20020046357 | Huang et al. | Apr 2002 | A1 |
20020167902 | Foster et al. | Nov 2002 | A1 |
20030081625 | Matsufuru | May 2003 | A1 |
20030165140 | Tang et al. | Sep 2003 | A1 |
20030223378 | Ishwar et al. | Dec 2003 | A1 |
20040210623 | Hydrie et al. | Oct 2004 | A1 |
20050138149 | Bhatia | Jun 2005 | A1 |
20050138432 | Ransom et al. | Jun 2005 | A1 |
20050271065 | Gallatin et al. | Dec 2005 | A1 |
20070078667 | Chand et al. | Apr 2007 | A1 |
20070110078 | De Silva et al. | May 2007 | A1 |
20090046734 | Cheriton et al. | Feb 2009 | A1 |
Number | Date | Country |
---|---|---|
2 433 576 | Jul 2002 | CA |
WO 0079758 | Dec 2000 | WO |
WO 03073283 | Sep 2003 | WO |
Number | Date | Country | |
---|---|---|---|
20070140237 A1 | Jun 2007 | US |