Method for providing restricted access to hardware component interfaces of a network device
A method for providing restricted access to hardware component interfaces of a network device by one or more software components of the network device, wherein an access to a hardware component interface requested by a software component is permitted by a mandatory access control, MAC, mechanism implemented as part of the network device's operating system on the basis of a MAC security policy including access rights defined as access relations between software component security labels assigned to software component types and hardware component interface security labels assigned to hardware component interface types.
1. A method for providing restricted access to hardware component interfaces of a network device by one or more software components of the network device, wherein an access to a hardware component interface requested by a software component is permitted by a mandatory access control, MAC, mechanism implemented as part of the network device's operating system on the basis of a MAC security policy comprising access rights defined as access relations between software component security labels assigned to software component types and hardware component interface security labels assigned to hardware component interface types,
wherein the hardware component interfaces of the network device include at least one internal network interface to an internal control network and at least one external network interface to an external network,
wherein a first security label is assigned to the at least one internal network interface, a second security label is assigned to the at least one external network interface, and the first security label and the second security label are different, and
wherein no software component is allowed simultaneous access to both the first security label and the second security label.
2. The method according to claim 1 , wherein the restricted access to a requested hardware component interface by a requesting software component permitted by the MAC mechanism provides a non-reactive unidirectional dataflow.
3. The method according to claim 1 , wherein the access relations indicate access types of access to the hardware component interfaces by the software components permitted according to the access rights of the MAC security policy.
4. The method according to claim 3 , wherein the access types of the access relations comprise:
a read only, RO, access type,
a write only, WO, access type,
a read and write, RW, access type,
a client mode access type, and
a server mode access type.
5. The method according to claim 1 , wherein the software components comprise applications including:
control applications,
real-time control applications,
safety applications,
device status applications,
configuration applications and
data validation applications.
6. The method according to claim 1 , wherein the hardware component interfaces further comprise:
IO interfaces,
memory interfaces, and
configuration interfaces.
7. The method according to claim 1 , wherein the hardware component interface types comprise:
a configuration type,
a device intern type,
a control network type,
a real-time control type,
a safety control type, and
an open network type.
8. The method according to claim 1 , wherein the software component, SWC, types comprise:
a control network domain,
an open network domain,
a domain intern domain,
a control domain,
a real-time control domain,
a safety control domain,
an external communication domain and
a device intern cross domain.
9. The method according to claim 1 , wherein the MAC security policy is stored in a file system of the network device loaded during booting of the network device's operating system.
10. The method according to claim 1 , wherein the MAC security policy is compiled into the operating system kernel of the device's operating system.
11. The method according to claim 1 , wherein the operating system comprises a non-real time operating system or a real time operating system.
12. A network device with restricted access to its hardware component interfaces, the network device comprising:
an operating system, OS, kernel implemented in a processor of the network device and including a mandatory access control, MAC, mechanism adapted to control access to the hardware component interfaces of the network device by one or more software components of the network device on the basis of a MAC security policy comprising access rights defined as access relations between software component security labels assigned to software component, SWC, types and hardware component interface security labels assigned to hardware component interface, HWCI, types,
wherein the hardware component interfaces of the network device include at least one internal network interface to an internal control network and at least one external network interface to an external network,
wherein a first security label is assigned to the at least one internal network interface, a second security label is assigned to the at least one external network interface, and the first security label and the second security label are different, and
wherein no software component is allowed to access the first security label at the same time as the second security label.
13. The network device according to claim 12 , wherein the hardware component interfaces of the network device comprise:
at least one of IO interfaces,
network interfaces,
memory interfaces and
configuration interfaces.
14. The network device according to claim 12 , wherein the network device comprises:
a programmable logic controller, PLC,
an IoT gateway or
a control device.