Devices and tags for Process Control

A process control device is a device that is used to automate the industrial process at an enterprise (for example, a programmable logic controller).

A tag is a process parameter transmitted in the industrial network (for example, a controlled temperature). The values of tags are transmitted by devices over specific protocols.

Kaspersky Industrial CyberSecurity for Networks supports the use of various types of devices and protocols for Process Control.

After installation of the application, the application uses the original modules for processing application-layer protocols based on Deep Packet Inspection technology. You can update protocol processing modules by installing updates.

To describe the logical connections between devices, supported protocols and tags, you need to create a hierarchical tree structure from these elements. You can generate a tree of devices and tags in the following ways:

• Manually add assets, protocols (when adding assets or when changing the settings of assets), and tags.
• Add tags from the detected tag storage.
• Import tags and devices from data files.

After adding tags to the tree, you can specify the necessary tags in Process Control rules.

The application only monitors the values of tags specified in Process Control rules.

You can monitor the values of tags in the table of registered events or view them in online mode in the Tags section.

The settings of a process control device or tag are displayed in the Application Console on the Process control tab. The settings editor area appears in the lower part of the tab when adding or modifying a process control device or tag.

Settings of Process Control devices

The following settings may be defined for process control devices:

• Device type is the type of device from the list of supported device types for Process Control in Kaspersky Industrial CyberSecurity for Networks. The supported types of devices are listed in the drop-down list.
• Host Name is the name that is displayed in the list of process control devices.
• System commands – settings for tracking system commands for a device.

  The System commands bar presents the following elements:

  • The Total field displays the total number of system commands for the selected protocols.
  • The Monitored field displays the number of monitored system commands that will cause the application to register events if detected.
  • The Select system command link opens the Monitored system commands window in which you can select the system commands to monitor from the list.
• Protocol – the utilized protocol. The drop-down list shows the available protocols for the specified device type whose traffic you can monitor.

  When the Modbus TCP protocol is selected, the Change the places of machine words in 32-bit values check box appears on the right of the drop-down list. You can use this check box to enable or disable support for an inverted sequence of machine words in 32-bit data values over the Modbus TCP protocol.

  When the IEC 60870-5-101 protocol is selected, the Advanced settings link appears on the right of the drop-down list. This link opens the Advanced settings window in which you can configure the following protocol settings:

  • Two-byte ASDU address. This check box enables or disables two-byte addressing mode for application service data units (ASDU). If this mode is disabled, one-byte addressing is used.
  • Originator. This check box enables or disables the use of an additional byte for the originator's address in a data block ID.
  • Block size for channel address. This drop-down list lets you select the number of bytes in a link-level address block.
  • Block size for object address. This drop-down list lets you select the number of bytes in an address block of an information object.
• Address – depending on the selected protocol, this lets you specify the IP address and port, MAC address of the device, or the domain ID (for the IEC 61850: GOOSE protocol).

You can add additional protocols and addresses for a device by using the Add protocol and Additional address of the device buttons. To remove additional protocols and addresses, use the buttons on the left of the names of settings.

Settings of tags

The following settings are available for tags:

• Main settings:
  • Tag name – displayed name of the tag.
  • Data type – type of tag data.
  • Description – additional information about the tag.
  • Unit of measure – unit of measurement for the process parameter represented by the tag.
  • ID – sequential number of the tag. A tag ID is assigned automatically.
• The following settings determine the boundaries of values depending on the selected tag's data type:
  • Scalable tag – determines the tag scaling limits in the fields for entering the minimums and maximums for input and output values.
  • Maximum string length – determines the number of characters for a tag with a string data type.
• The following settings determine tag data depending on the protocol:
  • Area
  • Memory area
  • Tag address
  • ASDU address
  • Block number
  • Bit
  • Bank number
  • Bit count
  • Group
  • Index
  • Local identifiers (LID)
  • Runtime identifier (RID)
  • DB number
  • Application
  • POU instance
  • Variable offset
  • Tag MSD ID
  • Project MSD version

In the editor area, the mandatory settings are highlighted.

To receive data on process parameters from devices that support protocols of the IEC 60870-5-104 standard, the corresponding tag data types must be used in Kaspersky Industrial CyberSecurity for Networks. For information about the correspondence between types of application service data units (ASDU) in protocols of the IEC 60870-5-104 standard and tag data types in Kaspersky Industrial CyberSecurity for Networks, please refer to the Knowledge Base on the Kaspersky website.

Page top