Presentations Power Grid TCIP: Trustworthy Cyber Infrastructure for - PDF document

Trustworthy Cyber Infrastructure for the Presentations Power Grid TCIP: Trustworthy Cyber Infrastructure for Power Quantitative & Qualitative Evaluation Presented by David Nicol TCIP Year 1 Review, December 11, 2006 University of Illinois • Dartmouth College • Cornell University • Washington State University 8 7 Aims and Approaches TCIP is developing technologies to secure a next-generation power grid Our group is: • developing tools and methodologies for evaluating and validating these • developing tools and methodologies for evaluating existing system configuration with respect to best practice recommendations and global policies • studying the sensitivity of the power grid infrastructure to various kinds of cyber attacks University of Illinois • Dartmouth College • Cornell University • Washington State University 88 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Presentations Power Grid Personnel • Graduate Students • PIs/Senior Staff – Scott Bai – Roy Campbell – Tom Overbye – Matt Davis – David Nicol – Chris Grier – Bill Sanders – Hamed Okhravi – Bob Thomas – Sundeep Reddy – Sankalp Singh • Staff – Zeb Tate – Carl Anderson – Vishnu Ranganathan • Undergraduate – Ray Zimmerman – Steve Hanna University of Illinois • Dartmouth College • Cornell University • Washington State University 89 Year 1 Research Accomplishments Simulation – Emulation, transparent integration of IP devices {project,external} servers, routers, clients – Modbus speaking simulators of power grid, and SCADA control center – Algorithms for high speed virtual background network traffic – Cyber-attack models (algorithms/optimizations + implementation) • Random scanning worms, flash-worms, packet reflection, packet redirection Intruder client – New man-in-middle code attack on Modbus timing – Database of co-opted traffic Power Markets – Experimental design + technical support, co-opting auction information System Evaluation – Methodology for analyzing properties of system configuration vis a vis formalized interpretation of best practices – Tool (APT) for analyzing firewall configurations vis a vis formalized global policy Integration – Network simulation/emulation operationally integrated with • Simulated power grid and SCADA • Simulated power auction server • Intruder client – Conceptually integrated with system evaluation University of Illinois • Dartmouth College • Cornell University • Washington State University 90 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Presentations Power Grid Project: RINSE Simulator Traffic from/to external devices trapped and remapped within simulator RINSE links virtual network and devices with physical devices • physical devices have virtual stand-ins University of Illinois • Dartmouth College • Cornell University • Washington State University 91 RINSE Simulator Experimental evaluation of DDoS attack on power grid networking Significant sw engineering - Refactoring - Documentation - Updated revision control Dynamic network display of attacks Malware models - Packet reflection, packet redirection - Dynamic link failure Attack models - Bandwidth consumption optimization Attacker tools - Impeding / subverting flows - Modbus timing attack Scalable proxy - Spyware / botnets - captured traffic database oriented networking RTT Middleman forwarded SCADA Device 3.5 request 3 request 2.5 max 2 ave 1.5 stale reply reply min 1 cache (Modbus master) 0.5 0 (Modbus slave) 2 10 20 40 50 clients University of Illinois • Dartmouth College • Cornell University • Washington State University 92 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Presentations Power Grid RINSE Traffic Models of Attack • Hybrid discrete-continuous model of worm traffic Numerical integration TNI sampling f(I, ε ) i Infection number Optimal execution policy subject to accuracy constraint Validated against detailed Packet-oriented model Very fast execution Optimizations to backbone simulation University of Illinois • Dartmouth College • Cornell University • Washington State University 93 Project: Power Grid Communication/Control Simulation • We are in the process of developing a power grid communication/control simulation that has four distinct parts: 1. The power grid itself is modeled using PowerWorld Simulator, a commercial software package 2. The SCADA system, which is used to monitor and control the power grid 3. The RTUs and IEDs – Measure power grid values, and report these values to SCADA (or other control packages) – Receive SCADA commands and then modify the power grid 4. The communication network, which is simulated using RINSE University of Illinois • Dartmouth College • Cornell University • Washington State University 94 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Presentations Power Grid PowerWorld Simulator • PowerWorld Simulator is a commercial power system analysis package that can simulate power systems in the time frame of minutes to days – This is the time frame in which operator intervention occurs via SCADA, and also some automatic control such as automatic generation control (AGC) • Simulator is currently being modified by PowerWorld to support the millisecond time frame (transient stability) – This is the time frame in which many automatic control actions occur, such as relay operations • Simulator can model power systems of just about any size • Simulator has server-based remote access that provides the necessary hooks to interact with the TCIP simulations University of Illinois • Dartmouth College • Cornell University • Washington State University 95 PowerWorld Simulator Models A relatively small power ten bus (node) grid model will be used in today’s demonstration B 87% VA M 86% B In the future larger models Rock for d VA M with thousands of buses can be used to allow B B 105% 93% MV M VA A simulations with many different players Pe or ia Bloom ingt on Springfield D ecat ur 89% B VA M University of Illinois • Dartmouth College • Cornell University • Washington State University 96 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Presentations Power Grid SCADA System • SCADA stands for Supervisory Control and Data Acquisition • During the first year a SCADA system has been developed to provide human interaction with the power grid. • TCIP SCADA currently uses the Modbus/TCP protocol to query RTUs and other devices such as IEDs. – The use of Modbus/TCP allows the TCIP SCADA to communicate both with simulated and action devices TCIP SCADA one-line diagram human interface University of Illinois • Dartmouth College • Cornell University • Washington State University 97 Simulated RTU and RINSE • During the first year a simulated RTU has been developed. • Simulated RTU is continually measuring (querying) the power system, with periodic data send to the SCADA • SCADA control requests are immediately processed by the RTU and then implemented on the power system – This simulates the action of actual power system control systems such as breakers and generator control systems • All communication between the RTU and SCADA goes through RINSE to simulate the communication system University of Illinois • Dartmouth College • Cornell University • Washington State University 98 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Presentations Power Grid Complete Power Grid Communication/Control Power grid modeled with PowerWorld TCIP SCADA Simulator Modbus/TCP Simulated RINSE RTU(s) • Integration of three distinct simulators – Power generation – SCADA control – Networking • Accomplishments – Sophisticated networking to support integration – Non-trivial modeling of RTU and Modbus protocol – Demonstration of possible cyber-attacks on power grid University of Illinois • Dartmouth College • Cornell University • Washington State University 99 Project : Man-in-Middle Attacks • Modbus protocol requires no time-stamp or sequence number • Subject to man-in-middle attack that offers old data for every master request RTU Request value of network (Modbus slave) Specific register or memory location (Modbus master) Value returned University of Illinois • Dartmouth College • Cornell University • Washington State University 10 0 University of Illinois • Dartmouth College • Cornell University • Washington State University