Cryptographic Considerations for Automation and SCADA Systems Using Trusted Platform Modules

Elliptic Curve Cryptography Considerations for Securing Automation and SCADA Systems

Securing critical infrastructures and manufacturing plants in the Industrial-Internet-Of-Things and Industry 4.0 is a challenge today due to the increased number of attacks against automation and SCADA systems. These systems were built without any security considerations in mind, so the evolution towards interconnection and interoperability makes them vulnerable in the context of exposing data to the outside network. Even though new protocols are considering built-in security, the widely spread legacy standard protocols need to be protected. Hence, this paper attempts to offer a solution for securing the legacy insecure communication protocols based on elliptic curve cryptography while fulfilling the time constraints of a real SCADA network. Elliptic curve cryptography is chosen to respond to the low memory resources available for the low level devices of a SCADA network (e.g., PLCs), and also because it can achieve the same level of security as other cryptographic algorithms using smaller sizes for the secure keys. Furthermore, the proposed security methods have the purpose of assuring that the data transmitted between entities of a SCADA and automation system are authentic and confidential. The experimental results showed good timing performance for the cryptographic operations executed on Industruino and MDUINO PLCs, demonstrating that our proposed concept is deployable for Modbus TCP communication in a real automation/SCADA network on existing devices from the industry.

Integrating Elliptic Curve Cryptography with the Modbus TCP SCADA Communication Protocol

SCADA systems monitor critical industrial, energy and other physical infrastructures in order to detect malfunctions, issue alerts and, in many cases, propose or even take remedial actions. However, due to their attachment to the Internet, SCADA systems are, today, vulnerable to attacks such as, among several others, interception of data traffic, malicious modifications of settings and control operations data, malicious modification of measurements and infrastructure data and Denial-of-Service attacks. Our research focuses on strengthening SCADA systems with cryptographic methods and protection mechanisms with emphasis on data and messaging encryption and device identification and authentication. The limited availability of computing power and memory in sensors and embedded devices deployed in SCADA systems make render cryptographic methods with higher resource requirements, such as the use of conventional public key cryptography such as RSA, unsuitable. We, thus, propose Elliptic Curve Cryptography as an alternative cryptographic mechanism, where smaller key sizes are required, with lower resource requirements for cryptographic operations. Accordingly, our approach integrates Modbus, a commonly used SCADA communication protocol, with Elliptic Curve Cryptography. We have, also, developed an experimental set-up in order to demonstrate the performance of our approach and draw conclusions regarding its effectiveness in real SCADA installations.

A Trust-Influenced Smart Grid: A Survey and a Proposal

A compromised Smart Grid, or its components, can have cascading effects that can affect lives. This has led to numerous cybersecurity-centric studies focusing on the Smart Grid in research areas such as encryption, intrusion detection and prevention, privacy and trust. Even though trust is an essential component of cybersecurity research; it has not received considerable attention compared to the other areas within the context of Smart Grid. As of the time of this study, we observed that there has neither been a study assessing trust within the Smart Grid nor were there trust models that could detect malicious attacks within the substation. With these two gaps as our objectives, we began by presenting a mathematical formalization of trust within the context of Smart Grid devices. We then categorized the existing trust-based literature within the Smart Grid under the NIST conceptual domains and priority areas, multi-agent systems and the derived trust formalization. We then proposed a novel substation-based trust model and implemented a Modbus variation to detect final-phase attacks. The variation was tested against two publicly available Modbus datasets (EPM and ATENA H2020) under three kinds of tests, namely external, internal, and internal with IP-MAC blocking. The first test assumes that external substation adversaries remain so and the second test assumes all adversaries within the substation. The third test assumes the second test but blacklists any device that sends malicious requests. The tests were performed from a Modbus server’s point of view and a Modbus client’s point of view. Aside from detecting the attacks within the dataset, our model also revealed the behaviour of the attack datasets and their influence on the trust model components. Being able to detect all labelled attacks in one of the datasets also increased our confidence in the model in the detection of attacks in the other dataset. We also believe that variations of the model can be created for other OT-based protocols as well as extended to other critical infrastructures.

TTAS: Trusted Token Authentication Service of Securing SCADA Network in Energy Management System for Industrial Internet of Things

The vigorous development of the Industrial Internet of Things brings the advanced connection function of the new generation of industrial automation and control systems. The Supervisory Control and Data Acquisition (SCADA) network is converted into an open and highly interconnected network, where the equipment connections between industrial electronic devices are integrated with a SCADA system through a Modbus protocol. As SCADA and Modbus are easily used for control and monitoring, the interconnection and operational efficiency between systems are highly improved; however, such connectivity inevitably exposes the system to the open network environment. There are many network security threats and vulnerabilities in a SCADA network system. Especially in the era of the Industrial Internet of Things, any security vulnerability of an industrial system may cause serious property losses. Therefore, this paper proposes an encryption and verification mechanism based on the trusted token authentication service and Transport Layer Security (TLS) protocol to prevent attackers from physical attacks. Experimentally, this paper deployed and verified the system in an actual field of energy management system. According to the experimental results, the security defense architecture proposed in this paper can effectively improve security and is compatible with the actual field system.

Optimized Authentication System with High Security and Privacy

Authentication and privacy play an important role in the present electronic world. Biometrics and especially fingerprint-based authentication are extremely useful for unlocking doors, mobile phones, etc. Fingerprint biometrics usually store the attributes of the minutia point of a fingerprint directly in the database as a user template. Existing research works have shown that from such insecure user templates, original fingerprints can be constructed. If the database gets compromised, the attacker may construct the fingerprint of a user, which is a serious security and privacy issue. Security of original fingerprints is therefore extremely important. Ali et al. have designed a system for secure fingerprint biometrics; however, their technique has various limitations and is not optimized. In this paper, first we have proposed a secure technique which is highly robust, optimized, and fast. Secondly, unlike most of the fingerprint biometrics apart from the minutiae point location and orientation, we have used the quality of minutiae points as well to construct an optimized template. Third, the template constructed is in 3D shell shape. We have rigorously evaluated the technique on nine different fingerprint databases. The obtained results from the experiments are highly promising and show the effectiveness of the technique.

Approaching OPC UA Publish-Subscribe in the Context of UDP-Based Multi-Channel Communication and Image Transmission

The Open Platform Communication Unified Architecture (OPC UA) protocol is a key enabler of Industry 4.0 and Industrial Internet of Things (IIoT). OPC UA is already accepted by the industry and its presence is expected to reach more and more fields, applications, and hierarchical levels. Advances within the latest specifications are providing the opportunity to extend the capabilities and the applicability of the protocol, targeting better performances in terms of data volumes, speed, availability, footprint, and security. Continuing previous researches focusing on the publish-subscribe (pub/sub) mechanism and real-time constraints, the current study aims to consider higher data-volumes, approach the multi-channel User Datagram Protocol (UDP)-based communication, and analyze the robustness of the developed mechanism in the context of long-term data transmission. Consequently, the research proposes to extend the applicability of the OPC UA in the context of image transmission. Although highly needed, the image transmission after processing is currently beyond the reach of OPC UA or other legacy industrial protocols, being considered as a separate fraction in the industrial environment. The concept and developments are applied considering both the end-of-line industrial manufacturing process in the automotive sector and the car-to-infrastructure communication. Without special hardware constraints, the obtained results are proven to be appreciable, opening various future perspectives for image transmission using OPC UA.