Secure Links: Secure-by-Design Communications in IEC 61499 Industrial Control Applications

Abstract

Increasing automation and external connectivity in industrial control systems (ICS) demand a greater emphasis on software-level communication security. In this article, we propose a secure-by-design development method for building ICS applications, where requirements from security standards like ISA/IEC 62443 are fulfilled by design-time abstractions called secure links. Proposed as an extension to the IEC 61499 development standard, secure links incorporate both light-weight and traditional security mechanisms into applications with negligible effort. Applications containing secure links can be automatically compiled into fully IEC 61499-compliant software. Experimental results show secure links significantly reduce design and code complexity and improve application maintainability and requirements traceability.

Tracing security requirements in industrial control systems using graph databases

“…The final stage of design tool integration uses secure links-a secure-by-design tool-for ICS [52] that briefly introduces the idea of integrating secure links and TORUS with a requirements repository. However, we consolidate the concept by demonstrating its practical use with the LPG repository proposed in this article.…”

“…1 that extends the use of the repository by integrating it with design-time and traceability tools to create practical and maintainable ICS security applications. We use a secure-by-design approach called "secure links" presented in [52] to link the CSRS LPG graph requirements to the design and implementation of IEC 61499 applications. Secure links development methodology proposes the abstractions for security requirements repository along with TORUS [49] for tracing requirements in ICS applications.…”

“…In the following subsections, we compare manual requirements extraction effort against the extraction based on security levels using LPGs from the IEC 62443-4-2 combined with CSRS of the systems such as wind turbine discussed in this article and an industrial mixer control system case study presented in [52].…”

“…A formal definition of the IEC 62443-4-2 extended requirement structure is proposed that guides the selection of standard cryptographic primitives required to implement a security requirement according to the desired security level. End-toend security requirements traceability is achieved when the repository is paired with design patterns to capture communication security constraints using secure links [52] and a requirement traceability engine like TORUS [49]. We also present a requirements change process aided by the repository.…”

Investigating Man-in-the-Middle-based False Data Injection in a Smart Grid Laboratory Environment

“…In particular, the integration of cipher suites, as used in the Transport Layer Security (TLS) protocol, is mandated by the IEC 62351 standard to secure end-to-end communication between two connection terminals through secure key exchange, encryption, and authentication [16]. However, traditional process networks usually consist of performancelimited devices, so the trade-off between security and performance can result in critical real-time requirements not being met [17]. An approach which does not actively interfere with the process network is an IDS, which typically monitors network traffic with passive sniffing and detects attack indicators over the monitored network [18].…”