Deriving a network policy for an industrial automation network

1. A method, comprising:

receiving, at a device, control logic programmed within at least one controller included within an industrial network;

receiving, at the device, tag configuration data from one or more devices included within the industrial network, wherein the tag configuration data includes a tag name, a tag producer, a tag consumer, a location of a device within the industrial network generating the tag configuration data, a tag type, and a tag value property;

creating, by the device, a tag input/output (“I/O”) mapping table based upon, at least in part, the tag configuration data;

discovering, by the device, a network topology of the industrial network;

automatically deriving, by the device, a network policy for the industrial network based upon the discovered network topology, the control logic, and the tag input/output mapping table, wherein the network policy derived by the device accounts for at least a required Quality of Service (QoS) and traffic patterns in the industrial network, wherein deriving the network policy includes at least one of deriving a QoS policy for the industrial network, and deriving a security policy for the industrial network; and based on the derived network policy, configuring, by the device, one or more network elements in the industrial network, monitoring, by the device, network activity in the industrial network, and stopping any traffic from passing through the industrial network unless the traffic matches the derived network policy.

2. The method as in claim 1 , further comprising:

determining, by the device, at least one of a traffic pattern, a bandwidth requirement, and a latency constraint on the industrial network.

3. The method as in claim 1 , further comprising:

determining abnormal behavior of the industrial network based upon, at least in part, the network policy.

4. An apparatus, comprising:

one or more network interfaces to communicate within an industrial network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to:

receive control logic programmed within at least one controller included within the industrial network;

receive tag configuration data from one or more devices included within the industrial network, wherein the tag configuration data includes a tag name, a tag producer, a tag consumer, a location of a device within the industrial network generating the tag configuration data, a tag type, and a tag value property;

create a tag input/output (“I/O”) mapping table based upon, at least in part, the tag configuration data;

discover a network topology of the industrial network;

automatically derive a network policy for the industrial network based upon the discovered network topology, the control logic, and the configuration associated with one or more devices in the industrial network, wherein the network policy derived by the device accounts for at least a required Quality of Service (QoS) and traffic patterns in the industrial network, wherein deriving the network policy includes at least one of deriving a QoS policy for the industrial network, and deriving a security policy for the industrial network; and based on the derived network policy, configuring one or more network elements in the industrial network, monitor network activity in the industrial network, and stop any traffic from passing through the industrial network unless the traffic matches the derived network policy.

5. The apparatus as in claim 4 , wherein the process when executed is further operable to:

determine at least one of a traffic pattern, a bandwidth requirement, and a latency constraint on the industrial network.

6. The apparatus as in claim 4 , wherein the process when executed is further operable to:

determine abnormal behavior of the industrial network based upon, at least in part, the network policy.

7. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

receive control logic programmed within at least one controller included within an industrial network;

receive tag configuration data from one or more devices included within the industrial network, wherein the tag configuration data includes a tag name, a tag producer, a tag consumer, a location of a device within the industrial network generating the tag configuration data, a tag type, and a tag value property;

create a tag input/output (“I/O”) mapping table based upon, at least in part, the tag configuration data;

discover a network topology of the industrial network;

automatically derive a network policy for the industrial network based upon the discovered network topology, the control logic, and a tag configuration associated with one or more devices in the industrial network, wherein the network policy derived by the device accounts for at least a required Quality of Service (QoS) and traffic patterns in the industrial network; wherein deriving the network policy includes at least one of deriving a QoS policy for the industrial network, and deriving a security policy for the industrial network; and

based on the derived network policy, configure one or more network elements in the industrial network, monitor network activity in the industrial network, and stop any traffic from passing through the industrial network unless the traffic matches the derived network policy.

8. The tangible, non-transitory, computer-readable media as in claim 7 , wherein the software when executed is further operable to:

determine at least one of a traffic pattern, a bandwidth requirement, and a latency constraint on the industrial network.

9. The tangible, non-transitory, computer-readable media as in claim 7 , wherein the software when executed is further operable to:

determine abnormal behavior of the industrial network based upon, at least in part, the network policy.