Sandia Corporation

Michael Berg

Abraham Anthony Clements

John Mulder

Jorge Mario Urrea

Joshua Jacob

Jonathan Roger Van Houten

Jennifer M Depoy

Moses Daniel Schwartz

Michael Aaron King

Jason Trent

The various technologies presented herein relate to the determination of unexpected and/or malicious activity occurring between components communicatively coupled across a backplane. Control data, etc., can be intercepted at a backplane where the backplane facilitates communication between a controller and at least one device in an automation process. During interception of the control data, etc., a copy of the control data can be made, e.g., the original control data can be replicated to generate a copy of the original control data. The original control data can continue on to its destination, while the control data copy can be forwarded to an analyzer system to determine whether the control data contains a data anomaly. The content of the copy of the control data can be compared with a previously captured baseline data content, where the baseline data can be captured for a same operational state as the subsequently captured control data.

PLC backplane analyzer for field forensics and intrusion detection

A monitoring device for monitoring transactions on a bus includes content-addressable memory ('CAM') and a response policy unit. The CAM includes an input coupled to receive a bus transaction tag based on bus traffic on the bus. The CAM stores data tags associated with rules of a security policy to compare the bus transaction tag to the data tags. The CAM generates an output signal indicating whether one or more matches occurred. The response policy unit is coupled to the CAM to receive the output signal from the CAM and to execute a policy action in response to the output signal.

Content-addressable memory based enforcement of configurable policies

Growing community of inventors

Albuquerque, NM, United States of America

Michael Berg