Rockwell Automation Technologies Incorporated

Bryan L Singer

David Dale Brandt

Brian Alan Batke

Michael A Bush

Ramdas M Pai

Steven J Scott

Craig D Anderson

John C Wilkinson

Glenn B Schulz

Selectively enabling communication of dual protocol packets from a source device directed to a service of an object class at target devices is provided. Steps can include providing an access control database including an entry correlating a source device, an object class and a service of the object class; from a source device, receiving a dual protocol packet including a frame and a field according to a first network communication protocol and an encapsulated packet of a second network communication protocol; obtaining from the frame, an identification of the source device; obtaining from the encapsulated packet, an identification and a service of an object class to which the encapsulated packet is directed; comparing the identification of the source device, the identification and service of the object class, and the entry of the access control database; and selectively transmitting the dual protocol packet as a function of the comparison.

Firewall method and apparatus for industrial systems

Method and apparatus for use with systems including networked resources where communication between resources is via dual packet protocols wherein a first protocol includes a frame that specifies a destination device/resource and a data field and the second protocol specifies a final destination device/resource and includes a data field, where the second packets are encapsulated in the first protocol packet frames, the method including specifying access control information for resources, for each first protocol packet transmitted on the network, intercepting the first protocol packet prior to the first protocol destination resource, examining a subset of the additional embedded packet information to identify one of the intermediate path resources and the final destination resource, identifying the access control information associated with the identified at least one of the intermediate path resources and the final destination resource and restricting transmission of the first protocol packet as a function of the identified access control information.

The invention includes a method including the steps of specifying access control information for resources, for each first protocol packet transmitted on the network, intercepting the first protocol packet prior to a first protocol destination resource, examining embedded packet information to identify at least one of the intermediate path resources and the final destination resource, identifying the access control information associated with the identified at least one of the intermediate path resources and the final destination resource and restricting transmission of the first protocol packet as a function of the identified access control information.

Growing community of inventors

Alabaster, AL, United States of America

Bryan L Singer