Honeywell International Inc.

Ganesh Patilba Gadhe

Eric D Knapp

Kevin McMurdie

Virgil Mehalek

Doug Swain

Seth G Carpenter

Eric T Boice

David Young

Peter G Viscarola

Scott J Noone

Brian Polcyn

David J Brummet

Andrew W Kowalczyk

Christopher W Barr

Ken Dietrich

Steven Louie Ypma

Kenneth Wayne Dietrich

Andrew Kowalczyk

A method, apparatus and computer program product for detecting malicious content and predicting cyberattacks are described herein. In the context of a method, the method receives a hash query comprising a file hash based on one or more files. The method queries a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files. The method also generates and outputs a file security analysis based on the attack correlation information items for authorization of the one or more files.

Mapping an attack tree and attack prediction in industrial control and IIoT environment using hash data analytics

Method, apparatus and computer program product for detecting vulnerability in an industrial control system, predicting maintenance in an industrial control system, and defining authorization rules for peripheral devices based on peripheral device categorization are described herein.

Methods and apparatuses for defining authorization rules for peripheral devices based on peripheral device categorization

Method, apparatus and computer program product for detecting vulnerability and predicting maintenance in an industrial control system are described herein.

Methods and apparatuses for vulnerability detection and maintenance prediction in industrial control systems using hash data analytics

This disclosure provides a system and method for deploying and configuring a cyber-security protection solution using a portable storage device. The portable storage device may include a memory storing instructions to be executed by a computing device. When executed, the instructions may cause the computing device to implement a cyber-security protection solution that is configured to scan a second storage device and determine whether the second storage device is usable in a protected environment.

System and method for deploying and configuring cyber-security protection solution using portable storage device

A blockchain-based network arrangement includes member nodes joined by a multicast network including a trusted node configured for creating at least one cryptographic key and for distributing copies of the cryptographic key over the multicast network as a multicast blockchain transmission to other member nodes. A requesting node outside the member nodes is configured for initiating a smart contract containing its blockchain address and for sending the smart contract as a request for group access with an address of the trusted node. The trusted node is configured for receiving the smart contract and a decides to accept or reject the smart contract, and records the decision in the blockchain by updating the smart contract. An accept decision results in a member node sending the cryptographic key to the requesting node.

Blockchain-based secured multicast communications

A method includes detecting a connection attempt from a device, quarantining the device to prevent the device from substantially interacting with a host system, and determining whether the device requires verification while the device is quarantined. The method also includes, in response to determining that the device requires verification, presenting at least one authorization challenge to a user while the device is quarantined. The at least one authorization challenge requests that the user provide at least one specified response. The method further includes, in response to determining that the device requires verification, determining whether the user correctly provided the at least one specified response while the device is quarantined, granting access to the device in response to determining that the user correctly provided the at least one specified response, and continuing to quarantine the device in response to determining that the user did not correctly provide the at least one specified response.

Apparatus and method for preventing unintended or unauthorized peripheral device connectivity by requiring authorized human response

An apparatus includes at least one processor configured to determine whether a blockchain identifies a valid smart contract indicating that communication with a specified node is permitted. In response to determining that the blockchain does identify the valid smart contract, the at least one processor is configured to establish a secure communication session with the specified node. In response to determining that the blockchain does not identify the valid smart contract, the at least one processor is configured to generate a new smart contract associated with the specified node, establish the secure communication session with the specified node in response to user approval of the new smart contract, and not establish the secure communication session with the specified node in response to user rejection of the new smart contract.

Apparatus and method for using blockchains to establish trust between nodes in industrial control systems or other systems

This disclosure provides for patch monitoring and analysis, such as in an industrial process control and automation system. A method includes discovering at least one connected device by a risk manager system, including a software module for the connected device and installed patch information for the software module. The method includes identifying current patch information for the software module by the risk manager system. The method includes populating a patch definition file according to the device, the software module, the installed patch information, the current patch information, by the risk manager system. The method includes analyzing the patch definition file. The method includes producing an output based on the analysis by the risk manager system, the output including the software module, the installed patch information, the current patch information, and the status of the software module with respect to the installed patch information.

Patch monitoring and analysis

A method of analyzing cyber-security risks in an industrial control system (ICS) including a plurality of networked devices includes providing a processor and a memory storing a cyber-security algorithm. The processor runs the cyber-security algorithm and implements data collecting to compile security data including at least vulnerability data including cyber-risks (risks) regarding the plurality of networked devices by scanning the plurality of devices, processing the security data using a rules engine which associates a numerical score to each of the risks, aggregating data including ranking the risks across the plurality of networked devices and arranging the risks into at least one logical grouping, and displaying the logical grouping(s) on a user station.

Growing community of inventors

Phoenix, AZ, United States of America

Ganesh Patilba Gadhe