Solving the Grid Defender’s Dilemma: Tamper Protection for Distributed Cyber-Physical Systems

Jason Reeves, Sean Smith

2015

Abstract

Embedded devices installed as part of the smart grid rollout present a major dilemma for grid defenders, because they are soft targets that could allow an attacker to access critical assets (generators, control centers, etc.) deeper in the utility’s network. While both physical tampering and intrusion protection are large, well-studied fields, state-of-the-art protection schemes suffer from several flaws: They are not powerful enough to respond properly to different tamper events, their severe responses can lead to reduced grid availability, and they often require more setup resources than a utility operator can provide. To protect these networks, we present TEDDI (Tamper Event Detection on Distributed Infrastructure), a distributed, sensor-based tamper protection architecture for embedded devices on utility networks. TEDDI uses data gathered from across the network to make more-informed and more-accurate tamper decisions, and can customize its response based on the event it sees. It can also be configured and installed quickly, without needing a large base of knowledge beforehand. In this paper, we lay out the TEDDI architecture, and discuss how TEDDI solves the grid defender’s dilemma better than current work.

References

  1. Atmel Corporation (2015). Atmel Trusted Platform Module. Available at: http://www.atmel.com/products/se curity-ics/embedded/default.aspx (Accessed 2 March 2015).
  2. Berthier, R. and Sanders, W. (2013). Monitoring advanced metering infrastructures with Amilyzer. In Cybersecurity of SCADA and Industrial Control Systems.
  3. Cao, P., Badger, E., Kalbarczyk, Z., Iyer, R., and Slagell, A. (2015). Preemptive intrusion detection: Theoretical framework and real-world measurements. In Symposium and Bootcamp on the Science of Security.
  4. Desai, A. (2013). Anti-counterfeit and anti-tamper implementation using hardware obfuscation. Master's thesis, Virginia Polytechnic Institute and State University.
  5. Dragone, S. (2013). Physical security protection based on non-deterministic configuration of integrated microelectronic security features. In The First International Cryptographic Module Conference.
  6. Frey, B. (2003). Extending factor graphs so as to unify directed and undirected graphical models. In Proceedings of the Nineteenth Conference on Uncertainty in Artificial Intelligence.
  7. IBM (2011). IBM 4765 PCIe Data Sheet. Available at: htt p://www-03.ibm.com/security/cryptocards/pciecc/pdf /PCIe Spec Sheet.pdf (Accessed 2 March 2015).
  8. Organization for the Advancement of Structured Information Standards (2013). eXtensible Access Control
  9. Markup Language (XACML) Version 3.0. Available
  10. at: http://docs.oasis-open.org/xacml/3.0/xacml-3.0-co
  11. re-spec-os-en.pdf (Accessed 2 March 2015).
  12. Pearl, J. (1988). Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference. Morgan Kauffman.
  13. Peterson, D. (2013). Why Crain / Sistrunk vulns are a big deal. Digital Bond. Available at: http://www.digitalb ond.com/blog/2013/10/16/why-crain-sistrunk-vulns-a re-a-big-deal/ (Accessed 2 March 2015).
  14. Reeves, J. and Smith, S. W. (2014). Tamper event detection on distributed devices in critical infrastructure. In ICMC 2014: The Second International Cryptographic Module Conference.
  15. Roblee, C., Berk, V., and Cybenko, G. (2005). Large-scale autonomic server monitoring using process query systems. In IEEE International Conference on Autonomic Computing.
  16. Smith, R. (2014). U.S. risks national blackout from smallscale attack. Wall Street Journal. Available at: http: //online.wsj.com/news/articles/SB100014240527023 04020104579433670284061220 (Accessed 2 March 2015).
  17. Smith, S. W., Palmer, E., and Weingart, S. (1998). Using a high-performance, programmable secure coprocessor. In Second International Conference on Financial Cryptography.
  18. Smith, S. W. and Weingart, S. (1999). Building a high-performance, programmable secure coprocessor. Computer Networks, 31(1999):831-860.
  19. Solomakhin, R. V. (2010). Predictive YASIR: High security with lower latency in legacy SCADA. Master's thesis, Dartmouth College.
  20. Sousan, W. L., Zhu, Q., Gandhi, R., and Mahoney, W. (2013). Smart grid tamper detection using learned event patterns. In Pappu, V., Carvalho, M., and Pardalos, P., editors, Optimization and Security Challenges in Smart Power Grids, Energy Systems, pages 99- 115. Springer Berlin Heidelberg.
  21. Tygar, J. D. and Yee, B. (1994). Dyad: A system for using physically secure coprocessors. In Technological Strategies for the Protection of Intellectual Property in the Networked Multimedia Environment.
  22. Valdes, A. and Skinner, K. (2001). Probabilistic alert correlation. In Recent Advances in Intrusion Detection.
  23. Wang, Y. and Hauser, C. (2011). An evidence-based Bayesian trust assessment framework for criticalinfrastructure decision processing. In Fifth Annual IFIP Working Group 11.10 International Conference on Critical Infrastructure Protection.
  24. Zonouz, S., Khurana, H., Sanders, W., and Yardley, T. (2014). RRE: A game-theoretic intrusion response and recovery engine. IEEE Transactions on Parallel and Distributed Systems, 25(2):395-406.
  25. Zonouz, S., Rogers, K., Berthier, R., Bobba, R., Sanders, W., and Overbye, T. (2012). SCPSE: Securityoriented cyber-physical state estimation for power grid critical infrastructures. IEEE Transactions on Smart Grid, 3(4):1790-1799.
Download


Paper Citation


in Harvard Style

Reeves J. and Smith S. (2015). Solving the Grid Defender’s Dilemma: Tamper Protection for Distributed Cyber-Physical Systems . In Proceedings of the 12th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2015) ISBN 978-989-758-117-5, pages 309-316. DOI: 10.5220/0005549503090316


in Bibtex Style

@conference{secrypt15,
author={Jason Reeves and Sean Smith},
title={Solving the Grid Defender’s Dilemma: Tamper Protection for Distributed Cyber-Physical Systems},
booktitle={Proceedings of the 12th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2015)},
year={2015},
pages={309-316},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005549503090316},
isbn={978-989-758-117-5},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 12th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2015)
TI - Solving the Grid Defender’s Dilemma: Tamper Protection for Distributed Cyber-Physical Systems
SN - 978-989-758-117-5
AU - Reeves J.
AU - Smith S.
PY - 2015
SP - 309
EP - 316
DO - 10.5220/0005549503090316