Abstract

This disclosure describes a method of preventing remote commands, whether issued by people, central control software or AI agents, from driving physical equipment into harmful states, and of stopping an attack that reaches many sites at once. Each piece of remotely controlled equipment, such as a refrigeration case, a heating system, a pump, a charger or a robot, carries a signed set of safe operating limits: the ranges, rates of change and durations within which it may operate, such as a maximum temperature for a freezer or a maximum length for a defrost. A limit guard, independent of the equipment's controller and of the central software, with its own sensor, power and firmware, enforces the limits: it refuses or reverses any setting outside them and, if the equipment drifts outside them, puts the equipment into a declared safe state. A command beyond the limits takes effect only when a person present at the site confirms it through the guard. Commands addressed to many sites are released in stages, first to a few sites and then to the rest after an observation period, and above a declared size need more than one approver. A correlation watcher, independent of the control system, compares commands and equipment states across all sites; when the same unusual command or excursion appears at many sites in a short time, it freezes remote control for the whole fleet and holds every site within its limits until people restore it. Remote control is also withdrawn automatically from equipment whose firmware is no longer current, while local operation continues.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS