Microkernel Security Gateway for Industrial Control Field Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern industrial control system field devices, such as those in SCADA systems, are vulnerable to cyber-attacks due to their increased use of commercial hardware and software, and existing security measures like microkernel-based architectures primarily focus on confidentiality rather than availability and integrity, which are critical for securing these devices.
Innovation Solution
A device with a software-verified microkernel is placed in-line between a Master Telemetry Unit and a field device, providing secure partitioning of memory into communication, security, and field device interface address spaces, with authentication and authorization mechanisms using challenge-response processes and Bloom Filters to ensure only authorized operations are executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If modern field devices use commercial hardware and software to improve functionality and reduce cost, then device complexity and versatility increase, but vulnerability to cyber attacks increases
Solution Approach 1:
The system is divided into distinct segments: the field device running commercial software, the security gateway acting as an intermediary, and the control network. The security gateway implements a microkernel-based architecture that segments memory into protected address spaces, isolating security-critical operations from potential attacks on the field device
Solution Approach 2:
A security gateway is introduced as an intermediary component between the field device and the control network. This gateway runs a security-hardened operating system with microkernel architecture and acts as a trusted mediator that filters and validates all communications, protecting the field device from direct exposure to network threats while maintaining full functionality
2Reliability
If microkernel-based architectures are implemented to improve security, then system security is enhanced, but focus remains primarily on confidentiality rather than availability and integrity
Solution Approach 1:
The security gateway is designed to provide multiple security functions simultaneously: authentication and authorization of users, encryption and decryption of data, digital signature verification, and integrity checking of communications. This multi-functional approach ensures confidentiality, availability, and integrity are all addressed within a single security infrastructure
Solution Approach 2:
The system implements challenge-response authentication mechanisms where the security gateway actively verifies user credentials and operation requests before granting access. This feedback loop ensures that only authenticated users can execute operations, and the system continuously monitors and validates communications to maintain security
3Reliability
If security measures are added to protect field devices, then security is improved, but device complexity increases
Solution Approach 1:
Security functions are extracted from the field device itself and relocated to a separate security gateway. The field device can remain relatively simple while the security gateway handles all complex security operations including authentication, authorization, encryption, and integrity verification. This extraction reduces complexity at the field device level while maintaining robust security
Solution Approach 2:
The security gateway maintains separate address space copies for different security domains (unencrypted address space, encrypted address space, signature address space). This copying approach allows the system to enforce security policies without modifying the fundamental structure of the field device, reducing complexity while maintaining security
4Reliability
If authentication and authorization mechanisms are implemented, then system integrity is improved, but processing time and operational complexity increase
Solution Approach 1:
User authentication is performed in advance before any operations are executed. The security gateway establishes authenticated sessions and pre-validates user credentials, so that during normal operation, authenticated users can execute commands without repeated authentication delays. Authorization checks are also performed preliminarily to ensure rapid execution of approved operations
Data Source
AI summary
A device, method, and system for processing communications for secure operation of industrial control system field devices, includes: a processing device to be placed in-line between a Master Telemetry Unit (MTU) and a field device. A software verified microkernel includes instructions for the processing device to provide a secure partitioning of memory between a communication network interface address space, a security cell address space, and a field device interface address space. The security cell address space includes instructions to: receive communication messages from the MTU via the communication network interface address space; authenticate a user identification of each communication message; verify that an operation requested in each message is authorized for the user identification; and send each communication message having an authenticated user identification and a verified operation to the field network interface address space for communication with the field device.