Optimization of trust system placement for power grid security and compartmentalization

Abstract

This article proposes a robust mathematical method to strategically place trust nodes to compartmentalize a timecritical SCADA network. The trust nodes combine firewall and intrusion detection technology to provide communication network security for protection, control, and SCADA systems. The mathematical technique optimizes the placement of the trust nodes based on the timing requirements of existing systems and the number of trust nodes that are available in the system given constraints, which may arise due to budgetary limitations or the restrictions of existing utility hardware. The intent is to create a planning tool to allow utility system operators to determine the best locations to place trust nodes to increase system security given limited resources and/or hardware constraints. The operational requirements of the environment are translated into a mathematical model. Mixed integer linear programming is used to process this model in search of an optimal solution. Because the problem is provably NP-Hard, a heuristic is also given to quickly find good, but not optimal, solutions. Experiments show promise for the proposed techniques.

Distributed specification-based firewalls for power grid substations

“…The authors of [13] design a distributed firewall protection device called Crucial Information Switches (CIS) for access control, but the authors do not cover traffic analysis in the protected network. In [14], the authors combine the firewall and intrusion detection functionalities into a trust node placed into the SCADA network and provide a heuristic algorithm to optimize the placement of trust nodes. However, the scope does not cover the solution for internal attacks in the substations.…”