Transmission device for transmitting data and detecting anomalies
A transmission device for transmitting data between a first network and a second network is provided. The transmission device includes a first network port for coupling to the first network and a second network port for coupling to the second network, and the transmission device further includes: a first detection unit which is connected to the first network port and is configured to receive data transmitted by the first network via the first network port and to detect anomalies with respect to the received data, and a second detection unit which is connected to the second network port and is configured to receive data transmitted by the second network via the second network port and to detect anomalies with respect to the received data. The provided transmission device leads to an optimized detection of anomalies in the first and the second network, thereby increasing security during data transmission between the first and the second network.
1. A transmission device for transmitting data between a first network and a second network, wherein the transmission device has a first network port for coupling to the first network and a second network port for coupling to the second network and also comprises:
a first detection unit which is connected at the first network port and is configured to receive data transmitted from the first network via the first network port and to detect anomalies in the received data; and
a second detection unit which is connected at the second network port and is configured to receive data transmitted from the second network via the second network port and to detect anomalies in the received data;
wherein the first detection unit is configured to transmit a first detection signal at least to the second detection unit when anomalies are detected in the received data, and the second detection unit is configured to transmit a second detection signal at least to the first detection unit when anomalies are detected in the received data.
2. The transmission device as claimed in claim 1 , wherein the transmission device is configured to execute the first detection unit and the second detection unit in a parallel manner.
3. The transmission device as claimed in claim 1 , wherein the anomalies detected by the first detection unit comprise a first anomaly type and the anomalies detected by the second detection unit comprise a second anomaly type, wherein the first anomaly type differs from the second anomaly type.
4. The transmission device as claimed in claim 3 , wherein the first detection unit is configured to detect the first anomaly type if, on the basis of the data received from the first network, it is possible to derive at least one new end point and/or a discrepancy of a network topology in the first network, and the second detection unit is configured to detect the second anomaly type if, on the basis of the data received from the second network, it is possible to derive at least one attack on the second detection unit from the second network) via the second network port.
5. The transmission device as claimed in claim 1 , wherein the transmission device is configured to receive the data from the first network via a network switch arranged between the first network and the first network port, wherein at least one input of the network switch is connected to the first network for the purpose of transmitting data and a mirror port in a form of an output of the network switch is connected to the first network port for the purpose of transmitting data.
6. The transmission device as claimed in claim 1 , wherein the transmission device also comprises a first CPU, in which the first detection unit is implemented, and a second CPU, in which the second detection unit is implemented.
7. The transmission device as claimed in claim 1 , wherein the transmission device is configured to provide the second network with a routing table comprising a plurality A of IP addresses of subscribers from the first network.
8. The transmission device as claimed in claim 1 , wherein the transmission device is configured to provide the second network with at least one particular IP address of a particular subscriber from the first network.
9. The transmission device as claimed in claim 1 , wherein the transmission device is configured to transmit data between the first network and the second network in a data link layer, layer 2 according to an OSI/ISO layer model.
10. The transmission device as claimed in claim 1 , wherein the first detection unit and the second detection unit each comprise an intrusion detection system.
11. The transmission device as claimed in claim 1 , wherein the first network comprises a control network, and the second network comprises a diagnostic network, a local network, or Internet.
12. The transmission device as claimed in claim 1 , wherein the transmission device is partially or completely in a form of a unidirectional data diode, a firewall, or a gateway.
13. The transmission device as claimed in claim 12 , wherein the gateway is arranged between the first detection unit and the second detection unit, and an input of the first detection unit is connected to an external network switch and an output of the first detection unit is connected to the gateway, wherein the gateway is also configured to communicate with the first detection unit using an internal IP address of the first detection unit, wherein an input of the second detection unit is connected to the gateway and an output of the second detection unit is connected to the second network.
14. The transmission device as claimed in claim 1 , wherein at least the first detection unit, the second detection unit, the first network port and the second network port are implemented in a common housing.