Hunor Sandor

Bela Genge

Piroska Haller

Flavius Graur

Chapter 9 SOFTWARE DEFINED RESPONSE AND NETWORK RECONFIGURATION FOR INDUSTRIAL CONTROL SYSTEMS

Keywords: Industrial control systems, security, software defined networking

The technological shift from isolated industrial control systems to system-of-systems architectures has introduced myriad security challenges. Following popular trends, modern industrial control systems are incorporating technologies such as Industry 4.0, Internet of Things and cloud computing. In these architectures, traditional information and communications hardware and software are glued together with physical components and modern technologies based on IP networks such as software defined networking. The ability of these systems to respond and reconfigure themselves to mitigate faults and attacks is immensely attractive. This chapter proposes a three-tier architecture that implements response and reconfiguration capabilities in an industrial control system. It adopts a software defined network tier for dynamic communications flow (re)configuration and whitelisting, an application tier for the optimal placement of anomaly detection systems and a supervision tier for gluing the three tiers together. The effectiveness and performance of the protection mechanism are demonstrated via use case based qualitative and quantitative assessments.

Introduction

Modern industrial control systems are complex and heterogeneous system of systems that offer the advantages of traditional information and communications hardware and software. The pervasive integration of off-the-shelf information and communications technology in the core of industrial control systems has broadened the palette of features and applications, enabled flexible and efficient infrastructures and decreased provisioning and maintenance costs.

Advancements in industrial control systems have also triggered a new technological revolution that has introduced novel applications and services. Industry 4.0 is a most popular initiative that showcases the progress made in the field of manufacturing [START_REF] Hermann | Design principles for Industrie 4.0 scenarios[END_REF][START_REF] Lee | A cyber-physical systems architecture for Industry 4.0 based manufacturing systems[END_REF]. These systems integrate Internet of Things technologies and the Internet of Services (IoS) to facilitate remote communications between cyber and physical components, and the interactions of human operators with the underlying infrastructure.

While the shift from isolated industrial control system environments to open and complex technological ecosystems provides numerous benefits, it has had a dramatic impact on security [START_REF] Anderson | The Implications of COTS Vulnerabilities for the DoD and Critical U.S. Infrastructures: What Can/Should the DoD Do? P-8031[END_REF]. The integration of traditional information and communications technologies in modern control system architectures has significantly increased the exposure to cyber attacks. In the field of traditional computer systems the effects of cyber attacks are usually limited to the cyber dimension, but in the case of industrial control systems the effects propagate to the physical dimension. As a result, malware infections can impact critical infrastructure assets, causing economic losses and physical damage [START_REF] Cherepanov | BlackEnergy by the SSHBearDoor: Attacks against Ukrainian news media and electric industry[END_REF][START_REF] Hagerott | Stuxnet and the vital role of critical infrastructure operators and engineers[END_REF].

The Industry 4.0 initiative has identified three key challenges related to security and resilience: (i) stability; (ii) data privacy; and (iii) cyber security [START_REF] Drath | Industrie 4.0: Hit or hype?[END_REF]. Therefore, a key requirement in modern industrial control systems is a response and reconfiguration property that can mitigate cyber attacks [START_REF] Combita | Response and reconfiguration of cyber-physical control systems: A survey[END_REF]. The core elements of a response and reconfiguration technique are the detection and isolation of security threats. Implementing these elements requires the deployment of security devices across an industrial control system to support the enforcement of multi-level protection strategies.

This chapter proposes a three-tier security solution that provides semiautomated response and reconfiguration functionality in an industrial control system. The proposed solution comprises: (i) a software defined network (SDN) tier that supports dynamic communications flow (re)configuration and whitelisting; (ii) an application tier that enforces the optimal placement of anomaly detection systems (ADSs); and (iii) a software-assisted human supervision and intervention tier that glues the three tiers together. Several traditional protection mechanisms are integrated and harmonized with the aid of software defined networking, including firewalls, anomaly detection systems and communications flow reconfiguration in response to cyber attacks. To achieve its goal, the proposed solution leverages an optimization strategy that: (i) configures software defined network switches to whitelist permitted communications flows; (ii) minimizes inter-network communications flows to reduce the number of firewall deployments; and (iii) minimizes the number of detection systems that monitor industrial communications. Human operators are an integral part of the solution because they can tune the optimization engine to adjust the reconfiguration results. Indeed, the proposed solution provides comprehensive multi-layer protection via a defense-in-depth strategy.

Related Work

Several researchers have investigated the response and reconfiguration problem for industrial control systems. Combita et al. [START_REF] Combita | Response and reconfiguration of cyber-physical control systems: A survey[END_REF] have provided a detailed categorization of the most significant detection and reconfiguration techniques. They discuss possible attacks on sensors and actuators and list reconfiguration strategies based on game theory. The surveyed approaches perform reconfigurations at the physical process level by adapting control loop configurations. In contrast, the novelty of the proposed methodology is that, instead of tuning control loops, it reconfigures communications paths to mitigate the adverse effects of attacks and failures. Furthermore, the proposed methodology delivers an optimal reconfiguration solution that enforces the basic requirements of industrial communications (e.g., shortest routing path to minimize communications delays) and ensures that every data flow is monitored by an anomaly detection system.

The applicability of software defined networking has been proven in diverse areas ranging from disaster preparedness [START_REF]Software-Defined Networking (SDN) Solution[END_REF] to industrial control (e.g., smart grid [START_REF] Dorsch | Softwaredefined networking for smart grid communications: Applications, challenges and advantages[END_REF]) and the Internet of Things [START_REF] Sandor | Resilience in the Internet of Things: The software defined networking approach[END_REF]. Applications in these areas leverage the technology to enhance communications resilience. Researchers have studied link and node failures in software defined networks [START_REF] Kempf | Scalable fault management for OpenFlow[END_REF] and approaches for improving recovery mechanisms [START_REF] Sharma | Open-Flow: Meeting carrier-grade recovery requirements[END_REF]. Jin et al. [START_REF] Jin | Dynamic scheduling of network updates[END_REF] have developed the Dionysus system that performs consistent network updates in a software defined network environment. Dionysus constructs a graph of network update dependencies and schedules updates by taking into account the performance of network switches.

Several researchers have analyzed the adoption of software defined networks in the industrial sector. The benefits have been demonstrated in a test infrastructure comprising an IEC 61850 based power system [START_REF] Molina | Using software defined networking to manage and control IEC 61850 based systems[END_REF]. Dorsch et al. [START_REF] Dorsch | Softwaredefined networking for smart grid communications: Applications, challenges and advantages[END_REF] have highlighted the advantages and disadvantages of using software defined networks in industrial environments. They acknowledge the benefits related to network management, quality of service optimization and system resilience, but raise serious concerns about the increased risks of cyber attacks against the centralized controllers of software defined networks.

Genge et al. [START_REF] Genge | A hierarchical control plane for software-definednetwork-based industrial control systems[END_REF] have proposed a hierarchical network infrastructure for industrial control systems that leverages software defined networking technology. They engage a network reconfiguration engine that performs traffic optimization to shorten communications paths while maintaining key industrial control communications requirements such as quality of service. The approach has been implemented in a software defined network controller named OptimalFlow. In contrast, this research defines a network optimization problem that focuses on the shortest route objective while considering the industrial control network topology and minimizing the interconnections and communications between segments, thereby minimizing the number of firewall deployments.

Finally, it should be noted that the majority of studies assume complete software defined network deployment scenarios in which all the switches have built-in support for software defined networking. However, such scenarios are rarely, if ever, encountered in real-world industrial control environments. In fact, deploying such infrastructures would require major investments and architectural changes. Therefore, this research focuses on a more realistic hybrid infrastructure in which software defined network components function alongside traditional network equipment [START_REF] Vissicchio | Opportunities and research challenges of hybrid software defined networks[END_REF].

Proposed Security Solution

This section describes the proposed three-tier security solution that provides semi-automated response and reconfiguration functionality in an industrial control system to combat cyber attacks.

Overview

Given the vast number of recent cyber attacks that have targeted the industrial sector, it is imperative that modern industrial control systems be endowed with the ability to semi-automatically or automatically respond to cyber attacks. A number of technologies have contributed to the security and resilience of communications infrastructures. Significant improvements in protection have been achieved by migrating firewall filtering features into networking equipment such as switches. This enables a network switch to provide valuable defensive functionalities such as enforcing the whitelisting of network traffic flows and dynamically reconfiguring whitelists based on commands received from a central controller.

Software defined networking [START_REF]Open Networking Foundation, Software-Defined Networking (SDN) Definition[END_REF] is a promising advancement in the field of IP networking that has been recently categorized as the "Next Big Technology" [START_REF] Ackerman | Software-defined networking looms as next big technology[END_REF]. It provides the means to create virtual networking devices and services and implement global networking decisions by decoupling the control plane where routing decisions are made from the forwarding plane that sends network packets to their destinations. Software defined networks often rely on OpenFlow to enable communications with remote devices [START_REF] Sharma | Open-Flow: Meeting carrier-grade recovery requirements[END_REF]. OpenFlow ensures remote access to the forwarding plane of a network switch via an open protocol.

Industrial control system response and reconfiguration can be achieved by combining sensing, decision and intervention components. Figure 1 presents the proposed architecture for implementing industrial control system response and reconfiguration. The architecture incorporates three tiers: (i) a communications tier that leverages software defined networking to whitelist traffic based on firewall filtering principles; (ii) an application tier that optimally distributes anomaly detection systems to minimize costs while ensuring effective distributed monitoring of communications flows; and (iii) a human supervisory tier that glues all the layers by receiving anomaly alerts, computing optimal network configurations and deploying the optimal configurations.

Figure 2 presents the conceptual sequence of actions in the proposed protection scheme. The first step involves a human operator who collects the required parameters for initializing the system and computing an optimal network configuration that includes the network topology, flow demands, links, switches and anomaly detection systems. In the next step, the operator, with the help of a reconfiguration engine, computes the optimal network configuration and optimal locations for the anomaly detection systems. The optimal whitelisted flow configurations (i.e., forwarding rules) are then applied to the network topology using a software defined network controller; the anomaly detection systems are positioned manually at the prescribed locations. When the network topology has to be changed -in response to a system enhancement or an anomaly alert -the human operator can intervene and change the parameters in order to recompute the optimal network architecture, which is subsequently deployed.

Communications Tier

The communications tier embodies the basic NIST principles for constructing industrial control system networks [START_REF] Stouffer | Guide to Industrial Control Systems (ICS) Security[END_REF]. Accordingly, it defines security zones isolated by firewalls, thereby permitting only legitimate (i.e., whitelisted) flows to enter specific zones. The proposed protection scheme assumes a hybrid network infrastructure comprising software defined network and traditional network sub-domains.

Unlike communications flows in traditional information technology networks, communications flows in industrial control networks frequently follow established patterns [START_REF] Barbosa | Flow whitelisting in SCADA networks[END_REF]. In the proposed protection scheme, software defined network switches are used to create security zones and apply flow whitelisting. Thus, the network switches are configured to assume two key roles in the network infrastructure: (i) they function as boundary firewalls that isolate security zones and, thus, implement zone entry conduits (ZECs); and (ii) they function as firewalls by implementing traffic whitelisting. The proposed scheme permits dynamic network reconfiguration in response to system maintenance, system extensions and upgrades, as well as emergency situations such as failures and cyber attacks. The principal advantage of the software defined network enabled zone entry conduits compared with traditional firewalls is that they are more flexible and are easily reconfigured using standard, open communications protocols.

From a practical deployment point of view, industrial control network switches are placed in two categories: (i) traditional dedicated network switches; and (ii) software based (software defined) network switches. The first category of switches include commercial ready-to-use single-box switches while the second category of switches are realized by running software defined networking software on computers equipped with multiple network cards. Generally, a software based switch is realized using a server running a Linux operating system and dedicated software (e.g., Open vSwitch) that implements the switch features. In addition to its lower cost, a software based switch can run additional software such as an anomaly detection system. Thus, these switches can be transformed into complex protection units with the ability to whitelist flows at the network layer on one hand and the ability to monitor and report abnormal application/traffic behavior on the other hand.

Application Tier

Protection in the application tier is realized by positioning anomaly detection systems in the network topology, monitoring the behavior of the controlled processes and detecting abnormal events. The ability to implement anomaly detection functionality in software defined network switches greatly increases the flexibility of the security infrastructure by enabling dynamic network reconfiguration -specifically, changing the locations of anomaly detection systems in the network infrastructure. Incorporating an anomaly detection system in a switch enables anomaly-based packet filtering in real time. However, each anomaly detection system can only monitor a selection of flows to avoid congestion and communications delays. An industrial control system typically has continuous sensor data flows that originate at the network edges. The protection mechanisms in the application tier can readily leverage these sensor data flows to enforce security properties.

Several anomaly detection techniques have been proposed for industrial control systems [START_REF] Caselli | Specification mining for intrusion detection in networked control systems[END_REF][START_REF] Kiss | A clustering-based approach to detect cyber attacks in process control systems[END_REF]. A discussion of the properties and applicability of anomaly detection techniques is outside the scope of this research. Instead, an objective of this research is to determine the optimal locations of anomaly detection systems within the network topology in order to enhance communications performance and decrease installation costs.

Supervision Tier

A human operator resides at the center of the supervision tier. The human operator interacts bidirectionally with the communications and application tiers and can (re)configure the network and anomaly detection infrastructures.

Optimal Network Configuration.

The human operator employs an integer linear programming (ILP) tool to obtain the optimal configuration of the industrial control network infrastructure. Note that conventional (i.e., non software defined) segments of the network correspond to static edges between software defined network switches [START_REF] Sandor | Resilience in the Internet of Things: The software defined networking approach[END_REF].

The optimization problem has three objectives: (i) select the shortest routing paths for whitelisted flows; (ii) minimize the number of anomaly detection systems while satisfying the predefined monitoring requirements; and (iii) minimize the number of boundary switches that realize zone entry conduits in each security zone.

In addition to the three optimization objectives, three requirements are defined in the form of constraints: (i) maximum capacity limits of switches, links and anomaly detection systems cannot be exceeded; (ii) each flow must be monitored in every security zone that it traverses; and (iii) anomaly detection systems and boundary switches can only be positioned at allowed locations.

The remainder of this section formally defines the network optimization problem. Let I be the set of flows, J be the set of software defined switches and Z be the set of security zones. Furthermore, let d i denote the demand of flow i (i ∈ I) and u jl denote the capacity of link (j, l) (j, l ∈ J).

Assume that, if switches j and l are not connected, then u jl = 0. Let u I be the maximum processing capacity of an anomaly detection system and u S be the maximum flow processing capacity of a software defined switch. Let g z j be a binary parameter with value 1 if switch j belongs to security zone z (z ∈ Z). Let r z be a binary parameter with value 1 if an anomaly detection system can be positioned in security zone z. Furthermore, let the binary parameters x A ij and x E ji have values of 1 if the access and egress end-points of flow i are connected to switch j, respectively.

The optimization problem variables are defined as follows. Let t i jl be a binary variable with value 1 if flow i is routed on link (j, l). Let p j be a binary variable with value 1 if switch j can support an anomaly detection system. Let q i j be a binary variable with value 1 if flow i is monitored by an anomaly detection system in switch j. Finally, let f j be a binary variable with value 1 if switch j acts as a boundary firewall that realizes a zone entry conduit.

The objective function to be optimized is defined as follows:

M inimize : α i∈I,j,l∈J

t i jl + β j∈J p j + γ j∈J f j (1)
where α, β and γ are integers that represent the priorities of the three objectives. These parameters can be used by a human operator to tune the optimization problem according to the priorities of the three optimization objectives embodied in Equation ( 1). Specifically, α expresses the importance of selecting the shortest communications path, β expresses the importance of minimizing the number of anomaly detection systems and γ expresses the importance of minimizing the number of zone entry conduits.

The network design problem specified in Equation ( 1) is subject to a series of constraints. Due to space constraints, only the most significant constraints are presented.

The following switch capacity constraint ensures that the maximum number of forwarding rules installed in switch j does not exceed the switch capacity: i∈I,l∈J

t i jl + i∈I x E ji ≤ u S ∀j ∈ J (2)
The following equation expresses the constraint on anomaly detection system capacity:

i∈I d i q i j ≤ u I ∀j ∈ J (3)
The following constraint ensures that the link capacity is not exceeded:

i∈I d i t i jl ≤ u jl ∀j, l ∈ J (4)
The following constraint ensures that an anomaly detection system is positioned in every security zone that requires monitoring:

jl∈J g z j p j ≥ r z ∀z ∈ Z (5)
The following constraint ensures that each flow is monitored as it traverses a security zone if an anomaly detection system in positioned in the zone:

j∈J g z j q i j ≥ jl∈J (g z j + g z l )t i jl r z ∀i ∈ I, z ∈ Z (6)
where is a large integer such that ≥ i∈I,j,l∈J t i jl .

Finally, the following constraint ensures that each flow enters a zone via a zone entry conduit:

g y j g z l t i jl ≤ g z l f l ∀i ∈ I, j, l ∈ J, y, z ∈ Z, y = z (7)
In order to ensure the proper functioning of the optimized infrastructure, the optimization problem incorporates additional constraints such as the selection of continuous flow paths and the selection of a switch for monitoring purposes only if the switch contains an anomaly detection system.

Solving the optimization problem yields: (i) optimal path -list of edges (software defined switch pairs) associated with each flow; (ii) optimal locations -software defined switches for positioning the anomaly detection systems; (iii) anomaly detection system monitoring rules that define the assignment of a flow to an anomaly detection system; and (iv) list of software defined switches with zone entry conduits.

Optimal Network Reconfiguration.

In order to avoid complete network reconfigurations when computing a new optimal solution, the network design problem specified in Equation ( 1) is extended. The extension is designed to ensure: (i) the minimum number of path changes for each flow; (ii) the minimum number of anomaly detection system migrations; and (iii) the minimum number of changes with respect to boundary switches. Three binary parameters, ṫ i jl , ṗj and ḟj , are defined to express the optimal solution of an already-deployed network topology. Consequently, the objective function in Equation ( 1) is redefined as follows:

M inimize : α i∈I,j,l∈J t i jl + β j∈J p j + γ j∈J f j + δ( i∈I,j,l∈J ( ṫ i jl -ṫ i jl t i jl ) + j∈J ( ṗj -ṗj p j ) + j∈J ( ḟj -ḟj f j )) ( 8
)
where the δ parameter expresses the priority of the objective that seeks to maintain the existing configuration.

The selection of the value for δ compared with the values for α, β and γ distinguishes between two cases: (i) when δ is greater than the other priority parameters, the network configuration yields a solution in which the changes are minimized; and (ii) otherwise, the existing configuration is changed to benefit from a more optimal configuration of paths, anomaly detection systems and/or zone entry conduits. Note that the constraints are the same as in the specification of the original optimization problem.

Implementation and Scalability

The OptimalFlow hierarchical software defined network controller [START_REF] Genge | A hierarchical control plane for software-definednetwork-based industrial control systems[END_REF] was employed to implement the proposed protection scheme. OptimalFlow provides a FlowControl unit that: (i) monitors the underlying domain for changes in the network parameter values; (ii) changes the set of installed flows according to the solutions to the optimization problem; and (iii) transparently exposes the edge ports of the software defined network to the upper tiers via a software defined switch that is accessible via the OpenFlow protocol.

The proposed solution was integrated with OptimalFlow by changing the initial optimization problem to the new network optimization problem while retaining the original modules responsible for network parameter monitoring and flow installation. An advantage of OptimalFlow is that it enables the provisioning of hierarchical n-tier systems. Consequently, the solution proposed in this research can be scaled to an n-tier architecture as well. Thus, each security zone in the network topology can be reduced to a software defined network sub-domain that is exposed to an upper level as a software defined network switch. Security zones in the next level are represented by optimallyconnected virtual software defined network switches.

Experimental Results

This section presents the results of the experiments that were conducted to qualitatively and quantitatively assess the performance of the proposed protection scheme. The protection scheme was evaluated using a realistic scenario on an emulated software defined networking infrastructure and simulated industrial data.

The experiments were conducted on a typical industrial network topology. Software defined switches were distributed in security zones structured according to the control system security guide from Tofino Security [START_REF] Byres | Using ANSI/ISA-99 Standards to Improve Control System Security, Version 1.1[END_REF] (see Figure 4). The topology comprised 35 software defined switches connected via 86 physical links that offered redundant communications between two segments. The network topology had thirteen distinct security zones: External Network (X); Corporate Boundary Management (B); Enterprise Network (E); Process Information Network (I); Process Information Management Network (M); Supervisory Networks (J1, J2); Control Networks (C1, C2); and Process Networks (P1, P2).

First, the applicability of the proposed protection scheme to the scenario described above was evaluated using the OptimalFlow software defined network controller. The experiment was conducted using the Mininet network emulator [START_REF] Lantz | A network in a laptop: Rapid prototyping for software-defined networks[END_REF]. The δ > β > γ > α priority parameter configuration was employed and IEC 61850 network traffic was generated using the MATLAB Power System Analysis Toolbox (PSAT) running the IEEE 14-bus process model [START_REF] Milano | Impact of time delays on power system stability[END_REF].

The analysis focused on three use cases: (i) complete network configuration; (ii) partial network configuration in the case of a new flow; and (iii) partial network configuration in the case of link failure.

Four flows, Flows 1-4, were defined for the first use case. Figure 4 shows the optimal configuration. The optimizer minimized the number of anomaly detection systems and zone entry conduits by reducing the number of communications switches used to route flows. On the other hand, switches were selected to ensure the shortest routing path. Obviously, the solution involved a trade-off between the shortest routing path and the minimum numbers of anomaly detection systems and zone entry conduits. For example, Flow 2 was routed on a path comprising six links whereas the shortest path only required five links along Switches 10-11-14-20-28-35. This is because the optimizer selected Switch 19 for provisioning an anomaly detection system and as a zone entry conduit. Therefore, the optimizer reduced the number of provisioned anomaly detection systems and zone entry conduits by routing Flow 2 through Switch 19.

In the second use case, a new flow, Flow 5, was added to the network topology and the optimal network configuration was recomputed. Note that the initiallyconfigured flows and the anomaly detection system and zone entry conduit locations were not modified. This was achieved by setting the δ parameter to be larger than the β, γ, α parameters in Equation [START_REF] Combita | Response and reconfiguration of cyber-physical control systems: A survey[END_REF]. Figure 4 shows the results of the optimization and the routing of Flow 5.

In the third use case, the physical link between Switches 8 and 14 was made to fail by assigning it a capacity of zero. This action automatically triggered the recomputation of the optimal configuration using OptimalFlow. The optimal solution re-routed Flows 1 and 5 on Switches 8, 9 and 14. Subsequently, routing rules were deleted on the link between Switches 8 and 14. The rest of the configuration was not affected because δ was selected to be greater than the other priority parameters.

The optimization and software defined network deployment times were 0.91 s and 1.17 s for the first use case, 1.11 s and 0.76 s for the second use case and 1.18 s and 0.46 s for the third use case, respectively. These results demonstrate that, even if the optimization times are increased slightly when performing network reconfiguration during the second and third use cases, the software defined network times are considerably low. Thus, the total number of reconfiguration operations are also reduced significantly.

Next, the effects of network reconfiguration on industrial traffic were investigated. The experiment involved the execution of a MATLAB Power System Analysis Toolbox instance and an IEC 61850 server on the host attached to Switch 33. The traffic was monitored using an IEC 61850 client on the machine attached to Switch 16 and by positioning two traffic capturing units, one on the link between Switches 16 and 18 and the other on the link between Switches 16 and 1. In the next step, Flow 3 was re-routed from the link between Switches 16 and 18 to the path involving Switches 16, 17 and 18.

Figure 5 shows the effects of flow re-routing on the traffic monitored at the network segments of interest. Note that the throughput on the link between Switches 16 and 17 was initially around 4.5 KB/s while there was no traffic on the link between Switches 16 and 18. After the re-routing was triggered (after 16 seconds), the traffic throughput exhibited slight changes. During the re-routing, no data was transferred in Flow 3 for a short time period (around 200 ms). This corresponds to the time required to delete the forwarding rules for the failed link and to install new rules for the alternative links. This time period is always shorter than the total software defined network deployment time because it does not cover the communications and processing overhead between OptimalFlow and the software defined network controller. After the re-routing was completed, a temporary increase in the traffic was observed due to the TCP re-transmissions required to recover the lost packets.

Finally, the effects of parameter value changes on the optimization time were investigated. The experiments measured the optimization times for the two topologies presented in Figures 3 and4 for different numbers of flows. The AIMMS optimization tool [START_REF]Advanced Analytics, Prescriptive Analytics and Supply Chain Management[END_REF] was executed on a laptop with an Intel i7 quad core processor, 8 GB RAM and an SSD hard drive. Each configuration was repeated five times. Table 1 presents the optimization times for various parameter values and scenarios for the different configurations. The experimental results demonstrate that the number of flows and the complexity of the topology impact the optimization time. In both the topologies, increasing the number of flows significantly increases the optimization time. Furthermore, increasing the complexity of the topology (i.e., numbers of software defined switches, links and security zones) also increases the optimization time. Nonetheless, the optimization time never exceeded one minute even in the worst-case scenario and was under ten seconds in the majority of cases.

Note that the optimization time can be reduced further by solving the reduced optimization problem specified in Equation [START_REF] Combita | Response and reconfiguration of cyber-physical control systems: A survey[END_REF] and by partitioning the network to leverage the ability of OptimalFlow to solve hierarchical optimization problems. The combination of these strategies enhances the applicability of the proposed network configuration strategy in real industrial control environments. However, current software defined networking technologies -and, thus, the proposed methodology itself -may not be applicable in scenarios involving time-critical communications where network packets need to be delivered within 10 to 20 ms. Further research is needed to speed up the methodology for network reconfiguration in industrial control environments with tight timing constraints.

Conclusions

This research has proposed a novel three-tier protection architecture that endows industrial control systems with response and reconfiguration capabilities to cope with failures and cyber attacks. The communications tier, which leverages software defined networking, enables dynamic flow configuration, reconfiguration and whitelisting; the application tier incorporates a distributed anomaly detection infrastructure; and the supervision tier, which incorporates a human in the loop, controls and synchronizes all three tiers. The protection solution is obtained by optimizing industrial control network flows and the numbers and locations of anomaly detection systems and software defined firewalls. The applicability of the proposed architecture is demonstrated by implementing it using the OptimalFlow hierarchical software defined network controller and conducting qualitative and quantitative assessments involving three use cases.

Future research will focus on developing a more efficient optimization algorithm. Additionally, heuristics will be identified and incorporated in the algorithms to reduce the computational time and enhance their application in industrial control environments with large infrastructures and tight timing constraints.

Figure 1 .

 1 Figure 1. Architecture of the proposed three-tier protection scheme.

Figure 2 .

 2 Figure 2. Conceptual diagram of the action sequences in the proposed architecture.

Figure 3

 3 Figure 3 presents an example software defined network enabled topology with security features. In the topology, Switches 8 and 9 incorporate zone entry conduits for Zones 2 and 3, respectively; Zone 1 does not have a zone entry conduit because it has only exiting flows. Switches 1, 2, 3, 5, 7, 8, 9 and 12 serve as whitelisting firewalls; the remaining switches are present for redundancy purposes and to enable the insertion of additional communications flows.The proposed scheme permits dynamic network reconfiguration in response to system maintenance, system extensions and upgrades, as well as emergency situations such as failures and cyber attacks. The principal advantage of the software defined network enabled zone entry conduits compared with traditional firewalls is that they are more flexible and are easily reconfigured using standard, open communications protocols.From a practical deployment point of view, industrial control network switches are placed in two categories: (i) traditional dedicated network switches; and (ii) software based (software defined) network switches. The first category of switches include commercial ready-to-use single-box switches while the second category of switches are realized by running software defined networking software on computers equipped with multiple network cards. Generally, a software based switch is realized using a server running a Linux operating system

Figure 3 .

 3 Figure 3. Example software defined network enabled topology with security features.

Figure 4 .

 4 Figure 4. Experimental architecture with an SDN enabled topology.

  (a) Traffic between Switches 16 and 17. (b) Traffic between Switches 16 and 18.

Figure 5 .

 5 Figure 5. Effects of re-routing network traffic.

Table 1 .

 1 Optimization times for various parameter values and scenarios.

	Flows

Optimization Time (s) Topology in Figure 3 Topology in Figure 4 Min Avg

				Max	Min	Avg	Max
	10	0.09	0.12	0.17	1.59	1.71	1.75
	30	0.52	0.66	1.17	5.67	6.51	7.63
	50	1.47	1.71	2.05	9.70	10.28	18.89
	100	4.34	4.67	6.44	30.47 48.28	56.06

Acknowledgement

This research was supported by a Marie Curie FP7 Integration Grant within the 7th European Union Framework Programme (Grant No. PCIG14-GA-2013-631128).


Eniye Tebekaemi

Edward Colbert

Duminda Wijesekera

DETECTING DATA MANIPULATION ATTACKS ON THE SUBSTATION INTERLOCKING FUNCTION USING DIRECT POWER FEEDBACK

Keywords: Smart grid, substation, interlocking function, attack detection 1

Any form of deliberate physical or cyber activity that attempts to undermine the control mechanisms that maintain the key goals of reliability, efficiency and safety of a physical system can be considered to be an attack on the system. Indeed, an attack can be as subtle as a configuration change that prevents the optimal operation of a power system.

This chapter describes an approach that enhances the security of the interlocking function in a power distribution substation by using the power flow behavior of the physical system during switching events as direct power feedback. The approach detects potential over-thenetwork data modification attacks on the interlocking function using out-of-bounds sensor measurements. The direct power feedback adds an extra layer of security and redundancy to existing power substation interlocking function protection mechanisms.

Introduction

When smart grids become operational, power substations will be expected to support bidirectional power flows between distributed energy sources, storage facilities and power consumers. Substations use switchgear to maintain the appropriate flow of power, protect equipment and provide redundancy during power source and equipment failures. Interlocking functions in substations prevent improper operations of switchgear by maintaining information about their operational states and permissible state transitions from their current states to the next states. This ensures correct switching sequences and prevents switch operations that could violate the integrity of the substations. Due to the significant role played by the interlocking function in the safe and reliable operation of power systems, any attack that compromises the state information and state transition integrity of an interlocking function can have disastrous consequences.

The interlocking function implemented in intelligent electronic devices (IEDs) in an IEC 61850 based power substation relies exclusively on Generic Object Oriented Substation Event (GOOSE) status messages between switchgear controllers in order to maintain the state information of all the switchgear in the substation, This reliance on GOOSE status messages is potentially a single point of failure for the interlocking function. Moreover, it fails to provide the substation with the required resilience to cyber-physical attacks.

This chapter examines the unique physical system behavior characteristics in response to switchgear events and extracts useful consequent system behavior attributes in order to specify a method that uniquely identifies switchgear events and to provide a cyber-physical security solution that integrates these observations into traditional cyber security controls. The physical system behavior is an important, but often neglected, part of cyber-physical security research. Indeed, understanding and considering the physical behavior of a power substation plays a key role in designing a resilient security solution.

Related Work

Peripheral information from sensor measurements is often used to monitor the state and behavior of cyber-physical systems. However, little work has been done on integrating this information in intrusion detection systems. Colbert et al. [START_REF] Colbert | A processoriented intrusion detection method for industrial control systems[END_REF] have developed a process-oriented method for intrusion detection in industrial control systems. Data from critical elements in a physical system are collected by sensors and used to estimate the system state. Control operations sent over the network are intercepted by the intrusion detection system and evaluated using the estimated system state and system guard conditions. An alert is raised when a control operation violates the guard conditions based on the estimated system state.

Koustandria et al. [START_REF] Koutsandria | A hybrid network IDS for protective digital relays in the power transmission grid[END_REF] have developed a hybrid control network intrusion detection system. Expected communications patterns and the limitations of a physical system are leveraged to detect a wide range of attacks. The system, which is designed for protective digital relays in power transmission grids, detects attacks using packet sequences, time gaps between packets and the measured current in relays. Every packet and communications flow are evaluated against the expected packet sequence, maximum allowed time delay and measured current in the relay. An attack is detected when any of these constraints are violated or a circuit breaker activation request is received when the measured current is less than the cut-off current.

Mitchell et al. [START_REF] Mitchell | Adaptive intrusion detection of malicious unmanned air vehicles using behavior rule specifications[END_REF] have created a behavioral-rule-based intrusion detection system for unmanned air vehicles. A set of system (physical) behavior rules and system state transformation rules are employed to identify attacks. The detection system comprises monitor nodes (sensors and actuators) that monitor other nodes (sensors and actuators) or a neighboring system (unmanned air vehicle) that monitors another trusted system (unmanned air vehicle). The monitoring system evaluates the behavior of the monitored system against a set of predefined system behavior and transition rules, and identifies a violation as a potential attack.

Sawada et al. [START_REF] Sawada | A fallback control study of networked control systems for cybersecurity[END_REF] and Harshe et al. [START_REF] Harshe | Design and implementation of a security framework for industrial control systems[END_REF] have proposed cyber-physical system security solutions that use local (backup) controllers, which kick in when remote (central) controllers are compromised or are unavailable. The central controllers usually optimize the networked control system to yield high performance while the local controller guarantees the minimum performance requirements of the logical subsystem. The security solutions continuously evaluate control signals received from the central controller against the physical system and switches to the backup controller when a violation is observed.

A security solution for a cyber-physical system must be designed to comprehend and respond to the unique process behavior of the system. The solutions discussed above do not directly address data manipulation attacks on a power substation interlocking process, but they do provide a useful starting point for reasoning about the security of cyber-physical systems.

Substation Interlocking

Switchgear implement protection and control functions that are triggered in response to system guard conditions, automation and optimization functions or by human intervention. Substations are equipped with switchgear devices that are independently controlled and perform functions such as fault isolation, sectionalization, and over-current and over-voltage protection. The types of switchgear used in substations include isolator switches, contactor switches, earthing switches and circuit breakers.

Substation Switching

The IEC 61850 Standard recommends that switchgear be triggered by intelligent electronic devices that implement circuit breaker (XCBR) or circuit switch (XSWI) logical nodes at the process level. In turn, the circuit breaker and circuit switch logical nodes are controlled by intelligent electronic devices that implement protection and control functions such as time over-voltage protection (PTOV), instantaneous over-current protection (PIOC) and switch controller (CSWI). The first letter of a logical node name is used as a group identifier for logical nodes with similar functions. For example, the first "I" in "IHMI" (human-machine interface) identifies IHMI as belonging to interface group I.

Figure 1 shows a typical example of the operation sequence of an IEC 61850 substation interlocking function discussed in [START_REF] Pan | Research on interlocking CILO based on IEC 61499/62351[END_REF]. Human experts create interlocking rules and feed them to the system via the human-machine interface (IHMI). In Message 1, the interlocking function (CILO) imports the rules, validates the state of all the switchgear devices (via Messages 3, 4 and 8), and waits for a request from the switch controller (CSWI). In Message 2, the human controller issues a switch OPEN command to the switch controller and, in turn, the switch controller requests the interlocking function to check if the execution of the command violates an interlocking rule. In Message 6, the interlocking function responds with an allow if no rule is violated and a forbid otherwise. In Message 7, the switch controller proceeds with a switch OPEN command if an allow response was received by instructing the circuit breaker/circuit switch (XCBR/XSWI) to OPEN. In Message 9, the circuit breaker/circuit switch notifies the switch controller about the failure or success of the operation and, in turn, the switch controller notifies the human-machine interface of success or failure. Finally, in Message 8, the circuit breaker notifies the interlocking function of the state change if any. As described in [START_REF] Pan | Research on interlocking CILO based on IEC 61499/62351[END_REF], GOOSE update messages are protected with a keyed-hash message authentication code (HMAC). From time to time, the circuit breaker and circuit switch are expected to send status messages to the interlocking function to ensure that the state information maintained by the interlocking function correctly reflects that of the physical switchgear devices.

Interlocking Function Operation

The IEC 61850 Standard refers to substation automation functions as logical nodes. The interlocking function logical nodes (LNs), which are implemented at the station level or bay level, contain the rules that govern all valid switchgear Table 1. Valid configurations of the switchgear devices in the testbed.

Configuration CS1 CS2 CB IS ES

1 0 0 0 0 0 2 0 1 0 0 0 3 0 1 1 0 0 4 0 1 1 1 0 5 0 0 0 0 1 6 0 0 0 1 1 7 0 0 1 0 1 8 0 0 1 1 1 9 1 0 0 0 0 10 1 0 1 0 0 11 1 0 1 1 0
configurations, the current states of switchgear devices and the transition sequences. Based on the interlocking rules imported from the human-machine interface, the interlocking function generates the valid configuration table and transition sequences.

In the testbed used in this research, a single bay substation was implemented using two power sources. The testbed consisted of five switchgear devices, one earthing switch (ES), two contactor switches (CS1 and CS2), one isolator switch (IS) and one circuit breaker (CB). The interlocking function had the eleven valid switchgear configurations shown in Table 1. A zero indicates that a switchgear is in the OPEN position and a one indicates that the switchgear is the CLOSE position.

Algorithm 1 : Validate switch controller request.

RETURN temp 14: end procedure

The behavior of the interlocking function is described using the validate switch controller request algorithm (Algorithm 1). The algorithm is executed whenever a new request is received. In Line 4 of the algorithm, the interlocking function checks for the number of switchgear devices affected by the request, Line 5 obtains the current switchgear configuration and Line 6 computes the new configuration based on the change request. In Line 7, the interlocking function checks that the request does not violate any interlocking rules and returns either TRUE or FALSE. If the number of switchgear devices that would be affected by the request is no more than one and the new configuration is valid, then the interlocking function returns TRUE to the switch controller, implying that the change is allowed. If multiple switchgear devices are affected by the request, then the algorithm proceeds to Line 11 and invokes the transition sequence function. The transition sequence specifies the order in which the switchgear affected by the change request should be implemented. An execution interval of 1 ms to 10 ms is typically allowed for concurrent switchgear operations.

Substation Communication Protocols

IEC 61850 specifies the use of the generic object oriented substation event (GOOSE) and sampled value (SV) protocols for power substation communications. GOOSE and SV are fast data transfer protocols that execute in the data link layer and are used in the substation local-area network to control, report events and transmit measured values.

GOOSE Protocol.

The GOOSE protocol specified in the IEC 61850-8-1 Standard is a multicast/broadcast protocol that uses a publisher-subscriber communications model for sending and receiving data between intelligent electronic devices. Bay-level intelligent electronic devices use the GOOSE protocol to report switch state changes (ON and OFF). The GOOSE protocol uses the status number (StNum) and sequence number (SqNum) to distinguish between state change events and re-transmissions. StNum starts from one and is incremented for every state change (OPEN or CLOSE) event. SqNum, which starts from zero, indicates re-transmissions of a previous notification. For example, the first status change in the switchgear has StNum = 1 and SqNum = 0. The switchgear keeps broadcasting its state information at time intervals less than 60 s until a new state is recorded. For each re-transmission, StNum remains the same but SqNum is incremented.

SV Protocol.

The SV communications protocol defined in IEC 61850-9-2 is a multicast/broadcast protocol that uses a publisher-subscriber communications model to receive data streams of sampled values from sensors in a substation. The SV protocol is primarily used to send voltage and current measurements obtained from current and voltage sensors to all the subscribing intelligent electronic devices. The protocol uses the sample count (SmpCnt) field in the SV protocol data unit to indicate every new sample and the sample rate (SmpRate) to specify the number of samples per second. SmpCnt is incremented for every new sample and there are no re-transmissions.

Attack Description

The interlocking function translates switchgear configuration rules into a valid configuration table as shown in Figure 1. A valid configuration is a vector that indicates the permitted state of all the switchgear devices at a given instant. The valid configuration table is the collection of all possible valid configurations.

Let s be the number of switchgear devices in a substation and let C ∈ {0, 1} s correspond to all possible switchgear configurations. Let C be a valid configuration and n be the total number of valid configurations. Then, the valid configuration table T is the set:

T = { C 1 , C 2 , • • • , C n } (1)
A state change request τ i+1 is allowed to change the interlocking function configuration state from C i to C j if and only if:

F : C i × τ i+1 ⇒ C j ∈ T ( 2
)
where F is the transition mapping function and 1 ≤ i, j ≤ n, i = j. Whenever a change request is successfully executed by a circuit breaker or circuit switch, a status update message is sent to the interlocking function, which updates its current configuration state from C i to C j . Process level communications are time-critical because IEC 61850 requires a delay of no more than 4 ms in the transmission of GOOSE and SV messages. This requirement hinders the implementation of an encryption-based security solution. IEC 61850 does not recommend the encryption of GOOSE and SV messages and mandates that encryption-based message integrity checks may be used for GOOSE only if they meet the 4 ms time requirement. Intelligent electronic devices in the process local-area network depend on the timestamps, StNum and SqNum for GOOSE messages, and SmpCnt for CV messages to detect data manipulations. Tebekaemi and Wijesekera [START_REF] Tebekaemi | Designing an IEC 61850 based power distribution substation simulation/emulation testbed for cyber-physical security studies[END_REF] have demonstrated a successful GOOSE attack when the attacker has physical access to the process local-area network. Attacks on SV messages are more difficult to detect when the SmpRate has a high value because it is harder to predict the next SmpCnt value.

Scenario 1: Dropped Update Message: This scenario assumes that the attacker has access to the process local-area network at the substation and can block GOOSE update messages to the interlocking function. When a status change request is received by the switch controller, it queries the interlocking function to validate the request. The interlocking function validates the request against the current system state C i and instructs the switch controller to execute the request. The switch controller executes the request and broadcasts its new status, which is blocked by the attack. Since no update message is received by the interlocking function, it still believes that the system is in state C i instead of the new state C j . The current state of the interlocking function no longer reflects the actual state of the physical system. Although the interlocking function and physical system may still have valid configurations, any new change request results in F using the wrong input C i instead of C j . Scenario 2: Corrupt Update Message: This scenario assumes that the attacker has access to the process local-area network and can modify GOOSE update messages, inject new GOOSE packets or arbitrarily send GOOSE update messages. The attacker may be able to deceive the interlocking function to believing that an update has occurred and that its current state should be updated, causing the interlocking function to update its current state to C j while the system remains in C i . Scenarios 1 and 2 poison the configuration state of the interlocking function. If the malicious update is a valid configuration state, then no flag is raised and the attack goes unnoticed by the intelligent electronic device. The result could be disastrous if an attacker can successfully place the interlocking function in an invalid state. For example, according to Table 1, CS1 and CS2 cannot be in the CLOSE position at the same time. Assuming that the bay is disconnected autonomously for maintenance purposes, both CS1 and CS2 must be OPEN before ES can be in the CLOSE position. The interlocking function configuration table is poisoned to show that both CS1 and CS2 are OPEN and, thus, the interlocking function proceeds to validate an ES CLOSE request when either CS1 or CS2 is in the CLOSE position. Executing the request increases the current astronomically because the voltage is suddenly reduced to approximately zero -this could damage equipment and cause a fatal accident. Row 14 in Table 2 shows that such a request increases the current to 850 times its nominal value.

Proposed Solution

Electrical equipment exhibits unique physical attribute properties when triggered by ON/OFF commands; the properties manifest themselves as transients, steady state changes, and amplitude and frequency changes in the voltage and current waveforms. Observations of disturbances in the voltage and current waveforms can provide direct power feedback pertaining to physical-and cybercontrolled events. It is possible to monitor and detect ON/OFF events involving electrical equipment and trace the events to the originating equipment using their transient states, steady states or frequency changes of the measured voltages and currents [START_REF] Jin | Robust adaptive event detection in non-intrusive load monitoring for energy aware smart facilities[END_REF][START_REF] Rababaah | Electric load monitoring of residential buildings using goodness of fit and multi-layer perceptron neural networks[END_REF]. Similar techniques have been used to detect and locate faults in power systems [START_REF] Al-Mohammed | An adaptive fault location algorithm for power system networks based on synchrophasor measurements[END_REF][START_REF] Nayak | A fault detection technique for a series-compensated line during power swing[END_REF][START_REF] Riera-Guasp | Advances in electrical machine, power electronics, and drive condition monitoring and fault detection: State of the art[END_REF].

Current and voltage sensors are used in substations to provide information about the voltage and current of the supplied electric power, which is used to drive substation functions such as voltage/voltage-ampere reactive (VAR) control, frequency control, power quality control, and over-voltage and over-current protection. Current and voltage sensors give information about the portions of the system that are energized. Intelligent electronic devices use this information to determine switchgear positions (OPEN or CLOSE) at any instant. Switchgear events are also observable via the electrical waveforms they generate; switching a device ON or OFF generates transients that appear as spikes in its waveform and steady state amplitude changes as shown in Figure 2 (note that p.u. = measured value/nominal value). Monitoring switchgear events provides useful information about the times when events occur and the originating switchgear devices, which help detect illegal switchgear manipulations.

Switchgear Event Detection

Event detection algorithms compare the measured value of a signal to a reference value; when a significant difference is detected, an event of interest is declared to have occurred. In order to increase the accuracy of event detection in a power signal, a change event is computed based on the properties of the signal over a time frame called the event detection window. This helps reduce the effects of noise in the signal and the false event detection ratio.

In the initial simulated testbed, the electrical noise was normally distributed, which may not be the case in an actual substation. The detection algorithm employed was a simple mean change detector that compared the detection window w i against the pre-event window w indicates the occurrence of an event, where μ is the mean value, x i and y i are sample points of the DC component of the signal and ξ is a predetermined threshold value.

i-1 . If n = |w|, w i = x 1 , x 2 , • • • , x n and w i-1 = y 1 , y 2 , • • • , y n , then: | n i=1 x i -n i=1 y i n | > ξ (3)
Voltage and current signals usually contain noise caused by imperfections in electrical equipment and devices, thermal conditions, electrostatic interference, electromagnetic interference, radio frequency interference and cross-talk. Noise in measured signals can cause detection systems to increase the number of false positives or completely misdetect events. To address the effects of noise, the sensitivity of the detection system (threshold) must be set to achieve a high detection rate (e.g., 100%) given the noise level and the lowest possible false positive rate within an acceptable response time. A more sensitive threshold enables the system to detect minor events and respond quickly, but with less accuracy; in contrast, a less sensitive threshold causes the system to miss minor events and respond slowly, but with better accuracy.

This research assumes that the measured voltage and current signals contain noise, and employs the change detection method described in [START_REF] Jin | Robust adaptive event detection in non-intrusive load monitoring for energy aware smart facilities[END_REF]. Specifically, the noise e i is assumed to be a continuous white Gaussian process so that x i = x i + e i and y i = y i + e i . The detection threshold ξ = χ 2 α,k-1 is a chisquare goodness of fit test with a confidence interval of (100-α)% and detection sensitivity factor k. An event is detected when:

n i=1 (x i -y i ) 2 y i > ξ (4)
Algorithm 2 : Check for modified GOOSE updates. end if 11: end procedure changes in the waveforms and obtains the direct power feedback for switchgear events. The security controller uses GOOSE and SV messages, which function as two independent sources, to validate the correct states of switchgear devices.

Algorithm 2 describes the high-level behavior of the proposed interlocking function security controller. The algorithm is invoked whenever a GOOSE update message (updateMessage) is received from a switchgear (circuit breaker or circuit switch). In Line 2, the security controller checks if the update message is a retransmission or a new event notification. If the update message is a new event notification, then the security controller obtains the power feedback information from the SV messages in Line 2. In Line 3, the most recent measurements from the sensors are obtained and are used to estimate the current states of the switchgear devices. In Lines 4 and 5, the GOOSE update message and the power feedback information are compared to check if the reported event is consistent and is within the same time frame. The GOOSE update and SV feedback messages arrive at the interlocking function at slightly different times, so the time values are approximate and a check is performed to see if both messages arrive within an acceptable time frame. An inconsistency in the reported event or time frame implies that there is a high probability that the GOOSE update message has been modified. Algorithm 3, which runs continuously as a background process, checks for changes in voltage and current waveforms indicated by the SV messages. In Line 3, if a significant change is detected, the security controller proceeds to obtain the change information in Line 4. The reported change is checked in Line 5 to ascertain if the event is the result of a state change and returns TRUE if the event is caused by a switchgear. If the event is the result of a switchgear operation and no GOOSE update message is received, then there is a high probability that the update message has been blocked.

Implementation and Results

Power substations have bays that connect feeders to power sources. Each bay has switchgear that implement the bay-level protection and control func-Algorithm 3 : Check for missing GOOSE updates. end while 10: end procedure tions. The IEC 61850 Standard does not have a preference regarding where the interlocking function should be implemented (i.e., station level or bay level); instead, it leaves the decision to substation designers. At the station level, the interlocking function has to maintain the state and configuration information of switchgear in all the bays in the substation. Thus, for a substation with n bays and x switchgear devices per bay, the interlocking function maintains n × x switchgear states with 2 nx possible switchgear configurations. The configuration table grows rapidly as n and x increase, and can easily overwhelm the intelligent electronic device.

The proposed solution relies on SV messages received by the interlocking function from merging units. SV messages transmitted as multicast packets provide a continuous stream of currents and voltages sampled at high rates. In the case of a substation with multiple bays, the interlocking function has to process the continuous streams of multicast packets from all the merging units distributed across the bays in the substation. This can cause congestion in the station local-area network and may also lead to the failure of the network interface controller of the intelligent electronic device with the interlocking function. For these reasons, it is recommended that the interlocking function be implemented at the bay level and, in fact, the proposed solution is designed for a bay-level interlocking function.

Implementation

Tebekaemi and Wijesekera [START_REF] Tebekaemi | Designing an IEC 61850 based power distribution substation simulation/emulation testbed for cyber-physical security studies[END_REF] have designed and implemented a substation simulation testbed. Certain modifications were made to this testbed to support the substation interlocking function discussed in this chapter. Figure 3 shows a schematic diagram of the modified testbed with three virtual machines (VMs) running on a VMware ESXi server and a MacBook Pro computer.

Power System (VM1). The substation was simulated on the Intel core i7

MacBook Pro computer with a 2.5 GHz processor, 16 GB RAM and 512 GB SSD. The substation was a single-bay step-down station created with Matlab/Simulink that incorporated two contactor switches (CS1 and CS2), a groun- ding/earthing switch (ES), an isolator switch (IS) and a circuit breaker (CB). Voltage and current measurements were obtained from three sensors installed at different locations in the bay.

Virtual Intelligent Electronic Devices. The following virtual intelligent electronic devices were incorporated in the modified testbed:

Merging Unit and Switchgear Controller (VM1):

The merging unit and switchgear controller were implemented as standalone C/C++ applications based on the IEC 61850 Standard. These applications also ran on VM1 (Ubuntu 14.04.4LTS with two core processors, 2 GB RAM and 20 GB HDD). The merging unit and switchgear controller communicated with the simulated substation using UDP ports. The merging unit collected sampled measurements from all three sensors, timestamped them and broadcasted the values using the SV protocol. The switchgear Algorithm 4 : Interlocking rules.

Bay Controller IED (VM2):

The bay controller intelligent electronic device was implemented as a C/C++ application based on the IEC 61850 Standard that executed on VM2 (Ubuntu 14.04.4LTS with two core processors, 2 GB RAM and 20 GB HDD). The bay controller intelligent electronic device comprised five switch controller logical nodes (CSWI CS1, CSWI CS2, CSWI ES, CSWI CB and CSWI IS), each corresponding to a switchgear device in the substation.

Interlocking IED (VM2):

The interlocking intelligent electronic device comprised five interlocking function logical nodes (CILO CS1, CILO CS2, CILO ES, CILO CB and CILO IS), each of which maintained the state information of the corresponding switchgear device in the testbed. The interlocking intelligent electronic device executed the data manipulation detection algorithms and maintained the switchgear configurations and transition rules. The interlocking rules specified in Algorithm 4 were implemented in the interlocking intelligent electronic device based on Table 1.

Attacks.

The following attacks were executed on the testbed: Blocked GOOSE Update: This attack requires access to the process local-area network and blocks GOOSE update messages from reaching their destinations. The attack was simulated by configuring the controllers not to send update messages after a state change operation.

Modified GOOSE Update: This attack requires access to the process local-area network. GOOSE update messages are broadcast in plaintext to all the subscribing intelligent electronic devices. The TCPDump tool was used to capture network traffic and replay it unmodified using the TCPReplay tool. Modified network traffic was transmitted using the Scapy traffic manipulation tool.

Results

The simulation was first executed with the interlocking function security controller deactivated. The interlocking intelligent electronic device used the GOOSE StNum, SqNum and timestamp fields to detect replay attacks. However, if StNum, SqNum and timestamp were modified to mimic a new update message, it was possible to successfully modify the configuration state of the interlocking intelligent electronic device. In the case of missing and blocked update messages, the interlocking intelligent electronic device had no way of detecting the events and easily entered an inconsistent state. When the security controller was activated, the modified replay attacks and the missing update messages were detected. The security controller always validated the GOOSE update messages with the power feedback SV messages to ensure that the GOOSE update messages were valid. Also, by continuously listening to changes in the physical system, the security controller was able to detect configuration changes observed by the power feedback SV messages but not reported by the GOOSE update messages.

Table 4 summarizes the performance of the interlocking function with and without the security controller. The times (in ms) were measured from the instant the control operation was initiated by the switch controller to the instant the interlocking intelligent electronic device updated its configuration state.

Conclusions

Interlocking is a critical substation automation function that ensures the safety of human lives and power equipment, and the reliability and resilience of power systems. As a result, interlocking functions are high value targets for malicious entities. However, power systems have tight timing requirements that prevent the use of cryptographic techniques and tools to protect network traffic and data. This requires the design and implementation of other protection mechanisms for power systems.

This chapter has presented a novel method for detecting data manipulation attacks on interlocking functions in power distribution substations. The method relies on knowledge about the behavior of the physical system and integrates it in conventional intrusion detection mechanisms. The method is applicable to other power system components and functions that involve automated switching functions, including distribution bus networks and ship power systems. The research also demonstrates that integrating knowledge about the physical behavior of a cyber-physical system in cyber security controls is vital to enhancing system reliability and resilience.

Figure 1 .

 1 Figure 1. IEC 61850 CILO-controlled switchgear operation [8].

1 :

 1 procedure validateCSWIRequest(request)

Figure 2 .

 2 Figure 2. Transient and steady state voltage during switch CLOSE operations.

Figure 3 .

 3 Figure 3. Implementation schematics of the substation testbed.

Table 2 .

 2 Voltage and current measurements during switchgear ON/OFF operations.

	Device Position Type Sensor 1 Sensor 2 Sensor 3
	CS	ON	V	1.001	1.001	0.465
			A	0.528	0.525	1.229
		OFF	V	0.195	0.195	0.09
			A	0.103	0.102	0.24
	CB	ON	V	1.001	1.001	0.465
			A	0.529	0.525	1.229
		OFF	V	1	0.102	0.047
			A	0.107	0.053	0.125
	IS	ON	V	1.001	1.001	0.465
			A	0.528	0.525	1.229
		OFF	V	1	1	0.009
			A	0.066	0.012	0.023
	ES	ON	V	0	0	0
			A	850	0	0
		OFF	V	1.001	1.001	0.465
			A	0.528	0.525	1.229

Table 4 .

 4 Performance of the interlocking function with and without security.

		No Security	Security	Security
			(No Noise)	(Noise)
	Replay
	Modified Replay	×
	Missing Update	×
	Time (ms)	1.351	1.446	57.955

The detection threshold can be pre-computed and fixed if the noise level is expected to be the same; alternatively, it can be computed dynamically during system operation if the noise level is expected to change.

Switchgear State Identification

The switchgear state detection process involves the determination of sections of the bay that are energized based on the sensor measurements. The sensor measurements are mapped using the switchgear state truth table (Table 3) to identify which switchgear devices are in the CLOSE and OPEN positions. The switchgear truth table is preconfigured and contains the combination of high and low voltage and current values measured by all the sensors in the testbed that map to the ON or OFF states of switchgear in the substation. The switchgear state identification serves two purposes: (i) to attribute a detected event to the originating switchgear; and (ii) to validate the state of the physical system during the interlocking function request validation operation. Table 2 shows the measured values of each switch when it is the CLOSE and OPEN positions. The information in this table is used to generate the switchgear event truth table shown in Table 3. The event truth table is used to predict which switchgear devices are in the CLOSE and OPEN positions based on the sensor measurements. In the event truth table, a zero indicates that the measured value from a given sensor is low while a one indicates that the value is high.

Interlocking Function Security Controller

Switchgear status update information is sent from the circuit breaker or circuit switch to the interlocking function in the form of GOOSE packets over the process local-area network. The IEC 61850 Standard also allows sampled voltage and current measurements to be sent from the merging units to intelligent electronic devices via the process local-area network in the form of SV packets. The interlocking function security controller uses the SV messages to detect