International Telemetering Conference Proceedings / October 23-26, 2000 / Town & Country Hotel and Conference Center, San Diego, California / In this paper we introduce an ad hoc distributed supervisory control and data acquisition (SCADA) system, which covers two types of traffic, a small number of slave stations with stream traffic and much larger number of slave stations with burst traffic. To improve the system’s real-time transmission and channel allocation efficiency, a MAC scheme, named Polled-CSMA, is designed by integrating the merits of polling and CSMA protocols. Extensive analysis shows that this MAC protocol meets the system’s QOS requirements.

Möjligheternas värld är en utställning som ska presenteras på olika mässor. Hjärtat i utställningen är automationsfabriken som är en automatiserad anläggning som ska tillverka leksaksbilar. Automationsfabriken ska invigas på mässan Scanautomatic och ProcessTeknikden 9-11 oktober 2012. Då möjligheternas värld är ett samarbete mellan näringsliv och skola bidrar företag och skolor med hjälp och samarbetar för att projektet ska bli lyckat. Prevas del i projektet är att ta fram ett styrsystem i form av ett MES och SCADA system till fabriken samtatt göra hemsidan där bilar kan beställas och integrera den med styrsystemet. Målet med examensarbetet är att utveckla styrsystemet och ta fram ett HMI genom att använda programvaror från Wonderware. Slutprodukten är i form av kod och objekt, och den funktionalitet de skapar tillsammans. Styrsystemet ska kunna kopplas upp mot fabriken och styra produktionen, förutsatt att övriga delar i projektet levererar det de ska. Arbetet började med att studera fabriken och etablera ett gränssnitt mellan styrsystemet ochPLCn som styr produktionsutrustningen, samt att ta fram ett grundläggande HMI. Sedan har ett simuleringsläge tagits fram med utgångspunk från gränssnittet för att simulera produktionsmiljön. Utifrån den här simuleringsmiljön och ett HMI har sedan funktioner tagits fram en i taget och testats, för att tillsammans senare utgöra den helhet som är styrsystemet. Här finns funktioner som beslutsprocesser för skapandet av nya produktions- och leveransordrar, hämtning av kundordrar, styrning av pick´n place enheten, informationshantering av innehållet i bufferten, samt registrering av alla ordrar och operationer i ett manufacturing execution system (MES). Styrsystemet har slutsligen kopplats samman med databasen där nya kundordrar registreras och genom att använda simuleringsmiljön och det HMI som utvecklats för fabriken har styrsystemet testats med goda resultat där styrsystemet klarar av att hantera hela produktionen från orderingång till leverans. / Möjligheternas värld is an exhibition that will be presented at various fairs. The heart of the exhibition is Automationsfabriken which is an automated facility that will manufacture toy cars. Automationsfabriken will be introduced at the fair Scanautomatic & ProcessTeknik, which takes place 9-11 October 2012. As Möjligheternas värld is a collaboration between industry and school, both businesses and schools are included in the project and work towards the success of the project. Prevas part of the project is to develop a control system in the form of a MES and SCADA system for the factory, to create the website where cars can be ordered, and to integrate the website with the control system. The goal of my thesis job is to develop the control system and to create an HMI using software from Wonderware. The final product is in the form of code and objects, and the functionality they create together. The control system should be able to connect to the factory and manage the production, provided that the other parts of the project are delivered according to the plan. The work began with a study of the factory, and to establish an interface between the control system and the PLC that controls the production equipment, as well as developing a basic HMI. After this was done a simulation environment was developed from the established interface in order to simulate the production environment. Based on this simulation environment and the HMI, functions has been developed one by one and tested in order to later become the whole which is the control system. It features functions such as decision-making for the creation of new production- and delivery orders, retrieval of customer orders, control of the pick´n placeunit, information handling of the content of the buffer, as well as registration of all orders and operations in the manufacturing execution system (MES). Finally the control system was connected to the database containing new customer order, and by using the simulation environment and the developed HMI for the factory the control system could be tested in order to confirm that the control system could handle the entire production from the intake of customer orders to delivery.

Cyber security for industrial control systems (ICS) has been a rapidly growing area of interest and research for the last several years. The lack of an easily distributable platform on which ICS components can be built for use in security testing and result comparison among researchers presents a major issue. This thesis details the use of a virtual testbed environment to build a representative virtual hydroelectric power system (VHPS). The VHPS generates realistic Modbus/TCP network traffic between two separate ICS devices, a Master and a Slave, located on separate VMs. For security testing purposes, a method of session hijacking has been implemented as well as a Function Code Scan attack and a Setpoint Manipulation attack. The virtual environment, the VHPS, and the attacks have been packaged into an LXDE-based Fedora Spin VM for easy distribution.

Supervisory Control and Data Acquisition (SCADA) systems are responsible for automatic control of several critical infrastructures like power grids. An important requirement of SCADA systems is to provide cryptographic protection of its communications. Many key management schemes have been proposed to provide cryptographic protection. But cryptographic modules are seen as more appropriate solution as it provides cryptographic protection of keys. Recently I has proposed a draft standard SCADA cryptographic module(SCM) which provides direct link security. The goal of this research is joint design of a comprehensive key distribution scheme for SCADA systems, and the architecture of simple SCM to support key distribution and mutual authentication of messages exchanged between any two SCADA entities. Furthermore, unlike the I module, our SCM will be transparent to the type of SCADA communication protocol employed, and will not be restricted to the Bump in the Wire (BITW) mode of operation.

As digitization progresses, operators of energy supply networks are confronted with the IEC 61850 standard. It includes data models and communication protocols for electrical substations. Since these protocols are integral to the critical infrastructure, ensuring fault- free operation is the highest priority. In this work, the communication protocols of the standard were tested for their robustness and safety. Protocol fuzzing was used for this, a procedure in which manipulated packets are sent to a system under test in order to uncover any vulnerabilities. To do this, an original packet was captured and mutated millions of times and sent back into the network. The network was set up in a laboratory specially for these tests. It consists of three intelligent electronic devices, which represent part of a substation system. The devices were configured according to the standard. The standard-compliant functioning of the communication protocols was ensured using proprietary software. The developed fuzzing tool is based on another well-known paper. This was extended with methods of error detection and thus adapted to a black-box approach. No vulnerabilities were found in the analysed intelligent electronic devices.:Abkürzungsverzeichnis VI Abbildungsverzeichnis VIII Tabellenverzeichnis IX Listings X 1 Einleitung 1 1.1 Motivation der Norm IEC 61850 1 2 Grundlagen 3 2.1 Netzwerksicherheit 3 2.1.1 Protokoll-Fuzzing 4 2.2 Energieversorgungsnetz 5 2.2.1 Schaltanlage 6 3 Norm IEC 61850 9 3.1 Datenmodell 10 3.2 Kommunikationsdienste 12 3.2.1 Generic Object Oriented Substation Event (GOOSE) 14 3.2.2 Manufacturing Message Specification (MMS) 15 3.3 System Configuration description Language (SCL) 16 4 Stand der Foschung 17 4.1 Literaturrecherche 17 4.2 Literaturanalyse 18 5 Testanlage 21 5.1 Software 21 5.2 Aufbau 23 5.3 Konfiguration 24 5.4 Testkonzept f¨ur die Funktionspr¨ufung 25 6 Fuzzing-Test 28 6.1 Fuzzer 29 6.1.1 Repository ”61850-Fuzzing“ 29 6.1.2 Anpassung des Fuzzing-Skripts 30 6.2 Durchf¨uhrung und Auswertung 36 7 Zusammenfassung und Diskussion 39 7.1 Ausblick 40 8 Anhang 42 8.1 Teile der Norm IEC 61850 - Kommunikationsnetze und -systeme f¨ur die Automatisierung in der elektrischen Energieversorgung 42 8.2 Tabelle der Literaturanalyse 45 8.3 Listing von target alive 47 8.4 Testbericht des ’Operate‘-Befehls 48 8.5 Anlagenverzeichnis 51 Literatur 52 Eidesstattliche Erklärung 56

Tese de doutoramento. Engenharia Biomédica. Universidade do Porto. Faculdade de Engenharia. 2011

Nearly every aspect of modern life today, from businesses, transportation, and healthcare, depends on the power grid operating safely and reliably. While the recent push for a “Smart Grid” has shown promise for increased efficiency, security has often been an afterthought, leaving this critical infrastructure vulnerable to a variety of cyber attacks. For instance, devices crucial to the safe operation of the power grid are left in remote substations with their configuration interfaces completely open, providing a vector for outsiders as well as insiders to launch an attack. This paper develops the framework for an overlay network of gateway devices that provide authenticated access control and security monitoring for these vulnerable interfaces. We develop a working prototype of such a device and simulate the performance of deployment throughout a substation. Our results suggest that such a system can be deployed with negligible impact on normal operations, while providing important security mechanisms. By doing so, we demonstrate that our proposal is a practical and efficient solution for retro-fitting security onto crucial power system devices.

This thesis describes a virtual Supervisory Control and Data Acquisition (SCADA) laboratory. This virtual laboratory was built using virtual devices that simulate industrial processes, emulate control system ladder logic functionality, and utilize control system communication protocols. Human machine interfaces (HMIs) were developed for distribution and testing, and commercially available HMIs were implemented. In addition to virtual devices and HMIs, attacks were implemented against this virtual system. Uses for this laboratory include both SCADA security research and pedagogy. The laboratory serves research purposes, as it utilizes industry standard SCADA communication protocols as well as commercial HMIs, and is capable of interfacing with physical SCADA equipment, and is also capable of producing volumes of industrial control system traffic. It also serves pedagogical purposes as several laboratory exercises were developed in conjunction with the simulators to demonstrate the workings of cyber-physical security in a classroom environment.

SCADA (Supervisory Control and Data Acquisition) control systems are widely used to control critical processes in various economically and safety critical commercial industries. SCADA control systems are often vulnerable to attacks due to previous industry reliance on security by obscurity to protect control systems. There is a need for an architecture which can log the communications traffic in the SCADA networks. In this work a forensic network traffic data logger retrofit solution for MODBUS and DNP3 network appliances is presented. The data logger uses a bump-in-wire configuration to capture the network transactions, timestamp, cryptographically sign, encrypt and store the network transactions. The data logger is developed to run on embedded and virtual machine platforms. Thus, a retrofit forensic network traffic data logger logs the network traffic in a SCADA control system efficiently without affecting the normal functionality of the control system and the logger data supports post incident forensics analysis.

This is a master’s thesis project entitled “Secure reprogramming of network connected devices”. The thesis begins by providing some background information to enable the reader to understand the current vulnerabilities of network-connected devices, specifically with regard to cyber security and data integrity. Today supervisory control and data acquisition systems utilizing network connected programmable logic controllers are widely used in many industries and critical infrastructures. These network-attached devices have been under increasing attack for some time by malicious attackers (including in some cases possibly government supported efforts). This thesis evaluates currently available solutions to mitigate these attacks. Based upon this evaluation a new solution based on the Trusted Computing Group (TCG’s) Trusted Platform Modules (TPM) specification is proposed. This solution utilizes a lightweight version of TPM and TCG’s Reliable Computing Machine (RCM) to achieve the desired security. The security of the proposed solution is evaluated both theoretically and using a prototype. This evaluation shows that the proposed solution helps to a great extent to mitigate the previously observed vulnerabilities when reprogramming network connected devices. The main result of this thesis project is a secure way of reprogramming these network attached devices so that only a valid user can successfully reprogram the device and no one else can reprogram the device (either to return it to an earlier state, perhaps with a known attack vector, or even worse prevent a valid user from programming the device). / Avhandlingen börjar med att ge lite bakgrundsinformation för att läsaren att förstå de nuvarande sårbarheten i nätverksanslutna enheter, särskilt när det gäller IT-säkerhet och dataintegritet. Idag övervakande kontroll och datainsamlingssystem använder nätverksanslutna programmerbara styrsystem används allmänt i många branscher och kritisk infrastruktur. Dessa nätverk anslutna enheter har under ökande attacker under en tid av illvilliga angripare (inklusive i vissa fall eventuellt regeringen stöds insatser). Denna avhandling utvärderar för närvarande tillgängliga lösningar för att minska dessa attacker. Baserat på denna utvärdering en ny lösning baserad på Trusted Computing Group (TCG) Trusted Platform Modules (TPM) specifikation föreslås. Denna lösning använder en lätt version av TPM och TCG:s pålitliga dator (RCM) för att uppnå önskad säkerhet. Säkerheten i den föreslagna lösningen utvärderas både teoretiskt och med hjälp av en prototyp. Utvärderingen visar att den föreslagna lösningen bidrar i stor utsträckning för att minska de tidigare observerade sårbarheter när omprogrammering nätverksanslutna enheter.  Huvudresultatet av denna avhandling projektet är ett säkert sätt omprogrammering dessa nätverksanslutna enheter så att endast ett giltigt användarnamn framgångsrikt kan omprogrammera enheten och ingen annan kan programmera enheten (antingen att återställa den till ett tidigare tillstånd, kanske med en känd attack vector, eller ännu värre förhindra en giltig användare från programmering av enheten).