DCS Security Manager Bootstrap Protocol
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial process control and automation systems are vulnerable to illicit access and use due to the use of commercial off-the-shelf (COTS) networking components, which lack secure communication mechanisms, leading to security challenges and potential network breaches.
Innovation Solution
The implementation of a method and apparatus that establishes multiple communication channels between DCS nodes and a security manager, including a non-secure and a secure channel, to receive security credentials and policies, allowing secure communication and transitioning to secure communication at a designated activation time, utilizing bootstrap protocol extensions and canned policies to maintain network availability and protect communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If commercial off-the-shelf (COTS) networking components are used in DCS, then system cost and ease of operation are improved, but security vulnerability increases
Solution Approach 1:
A security manager is introduced as an intermediary component that mediates all security-related operations between DCS nodes and external entities. The security manager handles authentication, authorization, and security policy enforcement, isolating the vulnerability of COTS components while maintaining their ease of operation. The security manager acts as a protective layer that enables COTS components to be used without directly exposing the system to security risks.
2Adaptability or versatility
If multiple communication channels (secure and non-secure) are established, then security flexibility is improved, but device complexity increases
Solution Approach 1:
The communication infrastructure is segmented into distinct secure and non-secure channels, each with specific purposes. The secure channel (using TLS/SSL) handles sensitive operations like authentication and security policy distribution, while the non-secure channel handles routine data exchange. This segmentation allows the system to maintain security flexibility by choosing appropriate channels for different operations, while the underlying complexity is managed by the security manager which abstracts the channel selection logic from individual DCS nodes.
3Ease of operation
If security credentials are transmitted over non-secure channel, then ease of operation is improved, but security risk increases
Solution Approach 1:
Security credentials are transmitted over the non-secure channel only during the initial setup phase before the secure channel is established. The system performs preliminary authentication and credential distribution when the risk is acceptable (controlled environment), then immediately transitions to using the secure channel for all subsequent communications. This preliminary action allows easy initial configuration while mitigating long-term security risks through the subsequent establishment of encrypted communication paths.
Data Source
Figure 1
Figure 2~5
Figure 3
AI summary
A method includes receiving (304), at a first distributed control system (DCS) node (202) over a network, information associated with a security manager (208). The method also includes establishing (306, 310) multiple communication channels between the first DCS node and the security manager over the network using the information, where the communication channels include a non-secure channel and a secure channel. The method further includes receiving (308) security credentials from the security manager at the first DCS node over the non-secure channel and receiving (312) a security policy and an activation time from the security manager at the first DCS node over the secure channel. In addition, the method includes transitioning (316) the first DCS node to communicate with a second DCS node over the network using the security policy at the activation time.