One-Way Link SCADA Monitoring via Transmit and Receive Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SCADA systems are vulnerable to cyber-attacks due to external connections, allowing hackers to potentially control monitored facilities.
Innovation Solution
Implementing a one-way link between the SCADA system and the monitored facility, using a transmit proxy to collect data from sensors and actuators and a receive proxy to mirror this data for processing, preventing any data transmission back to the facility, thus preventing hacker control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SCADA systems are connected to external networks for monitoring purposes, then monitoring capability is improved, but security vulnerability increases
Solution Approach 1:
The system is divided into three separate components: sensors/actuators in the facility, a one-way communication link, and a SCADA system. This segmentation isolates the facility from external networks while enabling monitoring through the unidirectional data flow from facility to SCADA system.
Solution Approach 2:
A one-way communication link acts as an intermediary between the facility and the SCADA system. This intermediary allows data to flow from the facility to the SCADA system while blocking any reverse communication, thus enabling monitoring capability while preventing security vulnerabilities from external network connections.
2Reliability
If one-way link is implemented to prevent hacker access, then security is improved, but bidirectional communication capability is lost
Solution Approach 1:
Instead of allowing bidirectional communication and trying to secure it, the system inverts the approach by implementing a one-way link that only allows data flow from the facility to the SCADA system. This inversion naturally provides security while the system adapts to this unidirectional constraint for its monitoring function.
Data Source
Figure 1
Figure 2
AI summary
An apparatus for monitoring a process, comprising a one-way link (36); a transmit proxy (34), which is configured to collect data indicative of physical attributes associated with the process from a plurality of sensors (26), and to transmit the collected data over the one-way link (36); and a receive proxy (44), which is coupled to the one-way link (36) so as to receive and mirror the data collected by the transmit proxy so as to provide the mirrored data to a computer(46) for processing, wherein the transmit proxy is configured to communicate with the sensors using a predetermined monitoring protocol, and wherein the receive proxy is configured to emulate the predetermined monitoring protocol in communication with the computer.