VAC: A Software Approach to Resilient SCADA Automation

Johnson, Jordan; Weber, Brian; Smith, Jared; Hathhorn, Chris; Irminger, Philip; Norem, Savannah; Guerra, Jennifer; Dawson, Joel; McDaniel, Tyler

doi:10.1109/ISGT50606.2022.9817462

Title: VAC: A Software Approach to Resilient SCADA Automation

Full Record
Other Related Research

Abstract

To better secure critical infrastructure, especially power systems, this paper introduces a virtual SCADA automation controller. The automation controller is a gateway into a power subsystem, making it a valuable target for cyber-attacks that could cut it off from the control center and cause a loss of view and control. To prevent this, the Virtual Automation Controller (VAC) is a backup device that mirrors the capabilities of the physical controller. It can communicate via Modbus and DNP3 and is containerized so it can be deployed on a variety of platforms. Furthermore, it utilizes software-defined networking to quickly disconnect a failed automation controller and preserve its state for forensics. The VAC gives system operators time to replace the failed controller and prevents dangerous and costly damage to power systems. The VAC is compared against the SEL 3505-3 RTAC and shown to have the necessary features to act as a failover controller.

Authors:

Johnson, Jordan ^[1]; Weber, Brian ^[1];

^[1];

^[1]; Norem, Savannah ^[1]; Guerra, Jennifer ^[1];

^[1]; McDaniel, Tyler ^[1]

ORNL

Publication Date:: 2022-04-01

Research Org.:: Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)

Sponsoring Org.:: USDOE

OSTI Identifier:: 1881161

DOE Contract Number:: AC05-00OR22725

Resource Type:: Conference

Resource Relation:: Conference: Innovative Smart Grid Technologies 2022 (ISGT) - Washington, District of Columbia, United States of America - 2/21/2022 10:00:00 AM-2/24/2022 10:00:00 AM

Country of Publication:: United States

Language:: English

Citation Formats


                    Johnson, Jordan, Weber, Brian, Smith, Jared, Hathhorn, Chris, Irminger, Philip, Norem, Savannah, Guerra, Jennifer, Dawson, Joel, and McDaniel, Tyler. VAC: A Software Approach to Resilient SCADA Automation.  United States: N. p., 2022. 
        Web.  doi:10.1109/ISGT50606.2022.9817462.

Copy to clipboard


                    Johnson, Jordan, Weber, Brian, Smith, Jared, Hathhorn, Chris, Irminger, Philip, Norem, Savannah, Guerra, Jennifer, Dawson, Joel, & McDaniel, Tyler. VAC: A Software Approach to Resilient SCADA Automation.  United States.  https://doi.org/10.1109/ISGT50606.2022.9817462

Copy to clipboard


                    Johnson, Jordan, Weber, Brian, Smith, Jared, Hathhorn, Chris, Irminger, Philip, Norem, Savannah, Guerra, Jennifer, Dawson, Joel, and McDaniel, Tyler. 2022.  
        "VAC: A Software Approach to Resilient SCADA Automation".  United States.  https://doi.org/10.1109/ISGT50606.2022.9817462.  https://www.osti.gov/servlets/purl/1881161.

Copy to clipboard


                    
@article{osti_1881161,

  title        = {VAC: A Software Approach to Resilient SCADA Automation},

  author       = {Johnson, Jordan and Weber, Brian and Smith, Jared and Hathhorn, Chris and Irminger, Philip and Norem, Savannah and Guerra, Jennifer and Dawson, Joel and McDaniel, Tyler},

  abstractNote = {To better secure critical infrastructure, especially power systems, this paper introduces a virtual SCADA automation controller. The automation controller is a gateway into a power subsystem, making it a valuable target for cyber-attacks that could cut it off from the control center and cause a loss of view and control. To prevent this, the Virtual Automation Controller (VAC) is a backup device that mirrors the capabilities of the physical controller. It can communicate via Modbus and DNP3 and is containerized so it can be deployed on a variety of platforms. Furthermore, it utilizes software-defined networking to quickly disconnect a failed automation controller and preserve its state for forensics. The VAC gives system operators time to replace the failed controller and prevents dangerous and costly damage to power systems. The VAC is compared against the SEL 3505-3 RTAC and shown to have the necessary features to act as a failover controller.},

  doi          = {10.1109/ISGT50606.2022.9817462},

  url          = {https://www.osti.gov/biblio/1881161},
  journal      = {},
number       = ,

  volume       = ,

  place        = {United States},

  year         = {2022},

  month        = {4}

}

Copy to clipboard

Conference:

View Conference (0.20 MB)

https://doi.org/10.1109/ISGT50606.2022.9817462

Other availability

Please see Document Availability for additional information on obtaining the full-text document. Library patrons may search WorldCat to identify libraries that hold this conference proceeding.

Save / Share:

Export Metadata

Save to My Library

Similar records in OSTI.GOV collections:

Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid

Conference Mohan, Sathya; Ravikumar, Gelli; Govindarasu, Manimaran - 2020 IEEE/PES Transmission and Distribution Conference and Exposition (T&D)

Cyber-physical system (CPS) security for the smart grid enables secure communication for the SCADA and wide-area measurement system data. Power utilities world-wide use various SCADA protocols, namely DNP3, Modbus, and IEC 61850, for the data exchanges across substation field devices, remote terminal units (RTUs), and control center applications. Adversaries may exploit compromised SCADA protocols for the reconnaissance, data exfiltration, vulnerability assessment, and injection of stealthy cyberattacks to affect power system operation. In this paper, we propose an efficient algorithm to generate robust rule sets. We integrate the rule sets into an intrusion detection system (IDS), which continuously monitors the DNP3more »« less
https://doi.org/10.1109/td39804.2020.9299960

Full Text Available
HC-NIDS: signatures and simulations for detecting cyber-attacks aiming to cause damage against cyber-physical energy systems

Software

Physical device safety is typically implemented locally using embedded controllers, while operations safety is primarily performed in control centers. Safe operations can be enhanced by correct design of device-level control algorithms, and protocols, procedures and operator training at the control-room level, but all can fail. Moreover, these elements exchange data and issue commands via vulnerable communication layers. In order to secure these gaps and enhance operational safety, we believe monitoring of command sequences must be combined with an awareness of physical device limitations and automata models that capture safety mechanisms. One way of doing this is by leveraging specification-based intrusionmore »« less
View Software
Modeling DNP3 Traffic Characteristics of Field Devices in SCADA Systems of the Smart Grid

Conference Yang, Huan; Cheng, Liang; Chuah, Mooi Choo

In the generation, transmission, and distribution sectors of the smart grid, intelligence of field devices is realized by programmable logic controllers (PLCs). Many smart-grid subsystems are essentially cyber-physical energy systems (CPES): For instance, the power system process (i.e., the physical part) within a substation is monitored and controlled by a SCADA network with hosts running miscellaneous applications (i.e., the cyber part). To study the interactions between the cyber and physical components of a CPES, several co-simulation platforms have been proposed. However, the network simulators/emulators of these platforms do not include a detailed traffic model that takes into account the impactsmore »« less
https://doi.org/10.1109/MSCPES.2017.8064535

Full Text Available
Modeling DNP3 Traffic Characteristics of Field Devices in SCADA Systems of the Smart Grid

Conference Yang, Huan; Cheng, Liang; Chuah, Mooi Choo

In the generation, transmission, and distribution sectors of the smart grid, intelligence of field devices is realized by programmable logic controllers (PLCs). Many smart-grid subsystems are essentially cyber-physical energy systems (CPES): For instance, the power system process (i.e., the physical part) within a substation is monitored and controlled by a SCADA network with hosts running miscellaneous applications (i.e., the cyber part). To study the interactions between the cyber and physical components of a CPES, several co-simulation platforms have been proposed. However, the network simulators/emulators of these platforms do not include a detailed traffic model that takes into account the impactsmore »« less
https://doi.org/10.1109/MSCPES.2017.8064535

Full Text Available
Attacking the IEC-61131 Logic Engine in Programmable Logic Controllers in Industrial Control Systems

Conference Ali qasim, Syed; Ayub, Adeen; Johnson, Jordan; ...

In industrial control systems (ICS), programmable logic controllers (PLCs) directly monitor and control a physical process such as nuclear power plants, gas pipelines, and water treatment. They are equipped with a control logic written in IEC-61131 languages (e.g., ladder logic and structured text) that defines how a PLC should control a physical process. A PLC's control logic is a usual target of a cyberattack to sabotage a physical process. For instance, Stuxnet targets a control logic of a Siemens S7-300 PLC to damage a nuclear facility's centrifuges. The existing attacks in the literature generally focus only on injecting malicious controlmore »« less
Full Text Available

Similar Records