Plant communication network

Abstract

An embodiment of the disclosure provides a communication network having a plurality of end devices protected by multilayer switches that receive data packets in different formats for transmission to the end devices, translate received data packets to a common data format for inspection to determine if they pose a security threat, and if they do not pose a threat, forward the data packets to their end device destinations.

1 . A multilayer switch comprising:
 a plurality of communication ports for receiving and transmitting data packets in different data formats;   a data format translator that receives data packets configured in different data formats via the ports and reconfigures the data to a common data format;   an application aware engine that receives data packets in the common format and inspects content of the received packets at a plurality of OSI layers to determine if they represent a security threat; and   a wire speed packet switch that directs packets, which the application aware engine determines do not represent a security threat, to their destinations;   wherein the switch is configured to:
 identify a subset of end devices comprised in a network to which it is connected that cooperate to perform tasks responsive to the inspected content of the received data packets; 
 generate a connectivity model for the devices in the subset that determines a portion of the physical and corresponding logical topology of the network over which the devices communicate between themselves; and 
 define a virtual bus characterized by routing and security rules that control communication between the devices in the subset of devices responsive to the portion of the physical and logical topology. 
   
     
     
         2 . A plant communication network comprising:
 a plurality of end devices; and   a plurality of multilayer switches according to  claim 1  that are connected to and direct transmission of data packets between the end devices.   
     
     
         3 . A multilayer switch comprising:
 a plurality of communication ports for receiving and transmitting data packets in different data formats;   a data format translator that receives data packets configured in different data formats via the ports and reconfigures the data to a common data format;   an application aware engine that receives data packets in the common format and inspects content of the received packets at a plurality of OSI layers to determine if they represent a security threat; and   a wire speed packet switch that directs packets, which the application aware engine determines do not represent a security threat, to their destinations;   wherein the switch is configured to autonomously initiate a programming pause for a network to which it is connected during which a function in the network that may interfere with or be interfered by programming the switch is disabled.   
     
     
         4 . A plant communication network comprising:
 a plurality of end devices; and   a plurality of multilayer switches according to  claim 3  that are connected to and direct transmission of data packets between the end devices.