Robert Dawson Thesis (PDF 1MB)
Total Page:16
File Type:pdf, Size:1020Kb
Secure Communications for Critical Infrastructure Control Systems by Rob Dawson Bachelor of Science (Computer Science) (University of Queensland) – 1997 Thesis submitted in accordance with the regulations for the Degree of Masters of Information Technology Information Security Institute Faculty of Information Technology Queensland University of Technology Wednesday 1st October, 2008 Keywords SCADA security, control system security, key management, critical infrastructure, reductionist security proof, provable security, key establishment protocols, risk modelling i ii Abstract In March 2000, 1 million litres of raw sewage was released into the water system of Maroochy Shire on Queensland’s sunshine coast. This environmental disaster was caused by a disgruntled ex-contractor using a radio transmitter to illicitly access the electronically controlled pumps in the control system. In 2007 CNN screened video footage of an experimental attack against a electrical generator. The attack caused the generator to shake and smoke, visually showing the damage caused by cyber attack. These attacks highlight the importance of securing the control systems which our critical infrastructures depend on. This thesis addresses securing control systems, focusing on securing the communications for supervisory control and data acquisition (SCADA) systems. We review the architectures of SCADA systems and produce a list of the system constraints that relate to securing these systems. With these constraints in mind, we survey both the existing work in information and SCADA security, observing the need to investigate further the problem of secure communications for SCADA systems. We then present risk modelling techniques, and model the risk in a simple SCADA system, using the ISM, a software tool for modelling information security risk. In modelling the risk, we verify the hypothesis that securing the communications channel is an essential part of an effective security strategy for SCADA systems. After looking at risk modelling, and establishing the value of securing communications, we move on to key management for SCADA systems. Appropriate key management techniques are a crucial part of secure communications, and form an important part of the contributions made in this work. We present a key management protocol that has been designed to run under the constraints specific to SCADA systems. A reductionist security proof is developed for a simplified version of the protocol, showing it is secure in the Bellare Rogaway model. iii iv Contents Front Matter i Keywords . i Abstract . iii Table of Contents . v List of Figures . ix List of Tables . xi Declaration . xiii Previously Published Material . xv Acknowledgements . xvii 1 Introduction 1 1.1 Problem . 1 1.2 Research Aims . 2 1.3 Rationale/Background . 3 1.4 Structure and Contributions . 3 1.5 Scope . 4 2 Background 7 2.1 SCADA . 8 2.2 SCADA Architecture . 8 2.2.1 Remote Telemetry Unit . 10 2.2.2 Master Stations . 10 2.2.3 Human Machine Interface (HMI) . 10 2.2.4 Historian . 10 2.2.5 Communication Channels . 11 Master-RTU Communication . 11 RTU-RTU Communication . 11 Other Communication . 12 2.2.6 SCADA Communication Constraints . 12 2.3 Information Security . 13 2.3.1 Risk Management . 13 2.3.2 Risk Modelling . 16 2.3.3 Secure Communications . 17 v 2.3.4 Cryptography . 17 Public Key Cryptography . 17 Stream Ciphers . 17 Block Ciphers . 18 Message Authentication Code . 19 Authenticated Encryption . 19 Summary ................................... 20 2.3.5 Key Management . 20 Protocol Diagrams . 21 Shared Secrets . 22 Diffie Hellman . 22 MQV Protocol . 23 2.3.6 Protocol Verification Techniques . 24 Formal Verification . 24 Reductionist Security Proofs . 24 2.4 SCADA Security . 25 2.4.1 Approaches to Addressing Risks . 25 2.4.2 SCADA Security Groups and Standards . 26 DNP3/IEC 60870-5 . 26 ISA99..................................... 27 AGA12.................................... 27 IEEE ..................................... 28 2.4.3 Related Work . 28 µTESLA and Secure Network Encryption Protocol . 28 2.5 Concluding Remarks . 29 3 Risk Modelling of SCADA Systems 31 3.1 Risk Modelling . 32 3.1.1 Threat and Threat Source . 32 3.1.2 Threat Events . 33 3.1.3 Threat Propagation . 33 3.1.4 Threat Network . 33 3.1.5 Countermeasures . 34 3.1.6 Risk Measures . 34 3.2 Security Modelling Software . 35 Implementation Details . 39 Data Entry Interface . 40 3.3 System of Concern . 40 3.3.1 Threat Environment . 40 3.3.2 Countermeasures Modelled . 43 3.4 Threat Networks Modelled . 43 3.4.1 Illicit access to the communications channel . 45 3.4.2 Secure Communications with Illicit Access to Communications Channel 46 vi 3.4.3 All Modelled Hazards With No Countermeasures . 47 3.4.4 All Modelled Hazards with Secure Communications . 48 3.4.5 All Modelled Hazards With a Full Suite of Countermeasures . 49 3.4.6 All Hazards with All Countermeasures Except Secure Communications . 49 3.5 Observations on Threat Networks . 51 3.6 Effect of Securing Communications . 53 3.7 Concluding Remarks . 53 4 SCADA Key Management 55 4.1 Relationship to Existing Work . 56 4.1.1 Existing Protocols . 56 ISO 11770-2 . 56 Sandia..................................... 57 IPSec ..................................... 57 Kerberos . 58 4.2 Key Establishment Requirements . 59 4.2.1 Entity Authentication . 60 4.2.2 Key Freshness . 60 4.2.3 Key Authentication . 60 4.2.4 Key Integrity . 60 4.2.5 Mutual Key Confirmation . 60 4.3 Proposed Architecture . 60 4.3.1 Design . 61 4.3.2 Key Distribution Centre . 62 4.3.3 Trust Relationships . 62 4.3.4 Secure Communication Channels . 62 4.3.5 Use of Keys . 63 4.4 Proposed SCADA Key Management Protocol (SKMP) . 63 4.4.1 Node-KDC Key . 63 4.4.2 Node-Node Key Establishment . 64 Time Based Freshness . 64 State Based Freshness . 64 Nonce Freshness . 64 Modification to 11770-2 Mechanism 9 . 65 Use of Text Messages and Encryption Primitive . 66 Proposed Protocol . ..