Abstract:Industrial control systems (ICS) like supervisory control and data acquisition (SCADA) systems play a crucial role in monitoring and controlling various process industries in national critical infrastructures. They are connecting to internet and highly inter-connected corporate networks for sharing the field data to third party heterogeneous systems like enterprise resource planning, third party SCADA systems etc. Even though it helps to share the data for monitoring and control of systems, it also opens the doors for cyber-attacks. It needs to strengthen the cyber security of these SCADA systems. There are various components in SCADA systems which requires to build security in these components. Generally, most of the SCADA systems uses MODBUS communication protocol for scanning the PLC devices to acquire the field data. The communication protocol security is one of the main components which was little addressed. The MODBUS protocol was developed without security in mind because security aspect was not a concern in closed environments of industrial control systems. It is highly vulnerable to cyber-attacks. There are some methods already developed by scholars to implement security in MODBUS protocol, but the existing methods modified the MODBUS frame formats. Hence, they are not suitable to the existing legacy systems because they do not support interoperability between various industry manufacturer’s products. Another critical problem in existing methods is all the required security features were not implemented in a single method which would satisfy the security features like integrity, confidentiality, non-repudiation, authorization and authentication. In this paper, we designed and developed a new method by developing Secure Modbus Gateway Server and Client modules to provide secure data transfer between data acquisition servers and PLCs. In this methodology, the modules were developed using RSA and AES algorithms for achieving confidentiality and non-repudiation, SHA algorithm to provide integrity of the message. These modules also support authorization and authentication features. The time stamp in the Modbus frame was also included and transmitted to prevent replay attacks. The advantages of these modules/methodology are, it supports all required features for secure data transfer like integrity, confidentiality, non-repudiation, authorization and authentication. They also provide time stamp, frame filtering and exception response alarm triggering features. These modules also support interoperability and they can be easily installed in existing legacy systems. We measured performance metrics like attack resilience rate (ARP), attack penetration rate (APR) and overheads. This method protects the ICS system for 97% of attacks. The overhead on protocol was also calculated and it is found that 3.5% extra delay in round trip time which is very minor and can be tolerated in exchange of the important security benefits offered.

Assisting the Configuration of Intelligent Safety Gateway

SRE: Semantic Rules Engine for the Industrial Internet-Of-Things Gateways

Conflict Analysis and Resolution of Safety and Security Boundary Conditions for Industrial Control Systems

Designing Actively Secure, Highly Available Industrial Automation Applications

Model-based automated and guided configuration of embedded software systems

IoT Security and Safety Testing Toolkits for Water Distribution Systems

Security of IT/OT Convergence: Design and Implementation Challenges

Model-Based Safety and Security Engineering

An IIoT-Based Networked Industrial Control System Architecture to Secure Industrial Applications

Techniques for Enhancing Security in Industrial Control Systems

Standard specification-based intrusion detection for hierarchical industrial control systems

A novel method to build knowledge graph models for the configuration and operation design of smart and connected industrial products

A model-based approach for self-adaptive security in CPS : Application to smart grids

Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid

Towards Automating the Integration of Legacy IEDs into Edge-Supported Internet of Smart Grid Things

A Security Posture Assessment of Industrial Control Systems Based on Evidential Reasoning and Belief Rule Base

Design and Development of Secure Data Transfer Modules in Industrial Control Systems

Designing a Smart Gateway for Data Fusion Implementation in a Distributed Electronic System Used in Automotive Industry

A Name-Based Secure Communication Mechanism for Smart Grid Employing Wireless Networks.

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

On the Security of IO-Link Wireless Communication in the Safety Domain