Transmission device for transmitting data
A transmission device for transmitting data between a first network and a second includes: a first unidirectional transmission unit which is coupled to the first network and is configured to exclusively receive data transmitted from the first network to the transmission device, a second unidirectional transmission unit which is coupled to the second network and is configured to exclusively send data from the transmission device to the second network, and an identification unit which is located between the first unidirectional unit and the second unidirectional unit and which is configured to receive the data received by the first unidirectional transmission unit and to identify anomalies in the received data. The provided transmission device achieves the reliable, optimized identification of anomalies in the first network and increases security in the identification unit against manipulation and against attacks or intrusion attempts from the second network.
1. A transmission device for transmitting data between a first network and a second network, the transmission device comprising:
a first unidirectional transmission unit, which is couplable to the first network and designed to exclusively receive data transmitted from the first network to the transmission device;
a second unidirectional transmission unit, which is couplable to the second network and designed to exclusively send data from the transmission device to the second network;
a detection unit, which is arranged between the first unidirectional transmission unit and the second unidirectional transmission unit and designed to receive the data received by the first unidirectional transmission unit and to detect anomalies in the received data; and
a modeling unit arranged between the first unidirectional transmission unit and the second unidirectional transmission unit, wherein the modeling unit is designed to provide a model on a basis of preconfiguration data comprising a specific network topology of subscribers in the first network, and wherein the modeling unit is designed to make the model available to the detection unit so that the received data could be analyzed by the detection unit,
wherein a unidirectional communication connection in the transmission device exists exclusively from the first network to the second network and communication in the transmission device from the second network to the first network cannot occur.
2. The transmission device as claimed in claim 1 , wherein the first unidirectional transmission unit and the second unidirectional transmission unit are each implemented in hardware at least in the form of a network test access point (TAP) or a unidirectional data diode.
3. The transmission device as claimed in claim 1 , wherein the anomalies detectable by the detection unit comprise a first anomaly type and a second anomaly type, the first anomaly type differing from the second anomaly type.
4. The transmission device as claimed in claim 3 , wherein the first unidirectional transmission unit and the second unidirectional transmission unit are each implemented in software in the form of a unidirectional firewall.
5. The transmission device as claimed in claim 1 , wherein the modeling unit is designed to provide the model by means of preconfiguration data and on a basis of data received from the first network by way of the first unidirectional transmission unit at a specific time and/or on a basis of data received from the first network by way of the first unidirectional transmission unit during a specific period and to make the provided model available to the detection unit.
6. The transmission device as claimed in claim 1 , wherein the detection unit is designed to compare the data received by the first unidirectional transmission unit with the network-specific data of the provided model in order to obtain a comparison result, the detection unit being designed to use the comparison result obtained to deduce whether there is at least one anomaly in the received data.
7. The transmission device as claimed in claim 6 , wherein the transmission device is designed so as, if there is the at least one anomaly in the received data, to use the second unidirectional transmission unit to transmit an error report comprising the detected anomaly to a monitoring unit that is arranged in the second network or is connected thereto.
8. The transmission device as claimed in claim 1 , wherein the detection unit and the modeling unit are each produced in software in the form of a security application.
9. The transmission device as claimed in claim 1 , wherein the transmission device is designed to use a network switch arranged between the first network and the first unidirectional transmission unit to receive the data from the first network, at least one input of the network switch being connected to the first network for the purpose of transmitting data and a mirror port in the form of an output of the network switch being connected to the first unidirectional transmission unit for the purpose of transmitting data.
10. The transmission device as claimed in claim 1 , wherein the transmission device is designed to perform a transmission of data between the first network and the second network in a transmission layer, Layer 2 based on the OSI/ISO layer model.
11. The transmission device as claimed in claim 1 , wherein the first network comprises a control network, in particular a production network or a railway safety network, and the second network comprises a diagnostic network, a local area network or the Internet.
12. The transmission device as claimed in claim 1 , wherein at least the first unidirectional transmission unit, the second unidirectional transmission unit and the detection unit are implemented in a shared package.
13. A transmission device for transmitting data between a first network and a second network, the transmission device comprising:
a first unidirectional transmission unit, which is couplable to the first network and designed to exclusively receive data transmitted from the first network to the transmission device;
a second unidirectional transmission unit, which is couplable to the second network and designed to exclusively send data from the transmission device to the second network;
a detection unit, which is arranged between the first unidirectional transmission unit and the second unidirectional transmission unit and designed to receive the data received by the first unidirectional transmission unit and to detect anomalies in the received data; and
a modeling unit arranged between the first unidirectional transmission unit and the second unidirectional transmission unit, and designed to make a model available on a basis of data received from the first network by way of the first unidirectional transmission unit during a specific period consisting of a learning phase of the transmission device and to make the model available to the detection unit for analyzing the received data from the first network for anomalies in an analysis phase, and
wherein a unidirectional communication connection in the transmission device exists exclusively from the first network to the second network and communication in the transmission device from the second network to the first network cannot occur.
14. The transmission device as claimed in claim 13 , wherein the transmission device comprises a switch for switching on and switching off the learning phase and the analysis phase.