PLC access control: a security analysis

The Industrial Control System (ICS) is a public facility that provides services to lots of users; thus, its security has always been a critical factor in measuring its availability. Recently, a new type of attack on ICS has occurred frequently, which realizes the extortion of users by invading the information domain and destroying the physical domain. However, due to the diversity and unavailability of an ICS control logic, the targets of such attacks are usually limited to PCs and servers, leaving more disruptive attack methods unexplored. To contribute more possible attack methods to strengthen the immunity of ICS, in this paper, we propose a novel ransomware attack method named Industrial Control System Automatic Ransomware Constructor (ICS-ARC). Compared to existing ICS ransomware, ICS-ARC can automatically generate an International Electrotechnical Commission (IEC) compliant payload to compromise the Programmable Logic Controller (PLC) without a pre-known control logic, dramatically reducing adversary requirements and leaving room for error. To evaluate the attack capability of ICS-ARC, we built a tap water treatment system as the simulation experiment target for verification. The experimental results determine that ICS-ARC can automatically generate malicious code without the control logic and complete the attack against target PLCs. In addition, to assist the related research on future attacks and defenses, we present the statistical results and corresponding analysis of PLC based on Shodan.

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

The Programmable Logic Controller (PLC) is located at the junction of the virtual network and physical reality in the Industrial Control System (ICS), which is vulnerable to attacks due to its weak security. Specifically, firmware tampering attacks take the firmware under the PLC operating system as the primary attack target. The firmware provides the bridge between PLC’s hardware and software, which means tampering against the firmware can be more destructive and harmful than other attacks. However, existing defense and forensics methods against firmware tampering attacks are asymmetrical, which directly leads to the proliferation of such attacks and the difficulty of forensic tracing. How to accurately, quickly, and efficiently conduct forensics for such attacks is an urgent problem. In this paper, we designed and implemented a reliable detection method based on Joint Test Action Group (JTAG) and memory comparison—Aye, which can detect mainstream firmware tampering attacks reliably. To determine the effectiveness and reliability of Aye, we selected a widely used PLC to observe Aye’s performance in defense and forensics by simulating the two latest PLC firmware tampering attack methods. The experimental results show that Aye can effectively defend against firmware tampering attacks, helping improve the efficiency and accuracy of such attack detection and forensics.

In recent years, more and more researchers were contributed to the research for the security of ICS (Industrial Control System) with the emphasis on the safety of ICS. As a lure for attackers, honeypots provide the researchers with great assistance of industrial security research, and also plays a certain role in the protection of industrial system security. Honeypot is designed to a vulnerable system with the purpose of luring attackers to compromise it. Simultaneously, it also collects valuable data from attackers under the ground, then researchers will extract useful information from the data and then convert it to threat intelligence, which can be used to found attackers' behaviors or strategies and protect realistic systems. The honeypot for ICS need not only meet the needs of traditional information control technology, such as cost and maintainability, but also meet the needs of ICSs, such as timing and decision strategies. The research focuses on the design and implementation of high interactive honeypot for ICSs. It puts forward a method, which improves the interaction of the ICSs' honeypot from two aspects-HMI (Human Machine Interface) and industrial protocols' simulation. At the same time, we designed and implemented a virtual and high interactive honeypot and deployed it which is based on the improved conpot project to simulate SIEMENS S7-400 series' PLCs (Programmable Logic Controllers).

Industrial control systems (ICS) are required to be operated safely under cyberattacks. Fallback control is necessary for the safe operation of ICS. As one of fallback control systems, we develop a resilient third-party monitoring system. This system consists of Programmable Logic Controllers (PLCs) for normal control and for fallback control. The normal PLC controls field devices, and the fallback PLC takes over the control after the normal PLC is attacked. The fallback control of this paper is the control takeover of a robot arm control system. To quickly transition to this fallback control, it is necessary to incorporate a supervisor function to manage each PLC function in an integrated manner. This paper aims to propose a modeling method of ICS functions and its analysis method to ensure that the supervisor can work properly under cyberattacks. For modeling, we use UPPAAL, specializing in formal verification by timed automata. We implement the models of each PLC and supervisor on UPPAAL. To quantitatively analyze whether the supervisor can really realize the incident response during cyberattacks, we give the specifications necessary for fallback control to the supervisor model using Timed Computation Tree Logic (TCTL) and verify its feasibility.

Chapter 23 - Policies, Access Control, and Formal Methods

A stability test chamber simulates specific environmental conditions and tests a product or material in the manufacturing stage. The tested product or material is then analyzed about its shelf-life estimation related to the state and durability of the product for a certain period. The main parameter that must control accurately is temperature. Programmable Logic Controller (PLC) as an industrial computer control system has been widely used. In this paper, the temperature control system was designed based on PLC and supervisory control and data acquisition (SCADA). The PLC and SCADA would indirectly control the heater. The PLC was feeded from the temperature sensor for real-time temperature inside the test chamber. Received temperature value, compared to the temperature set point. The validation and verification of controlled temperature inside the chamber were also investigated. The system was designed on a miniaturized chamber using commercial PLC and SCADA, Stepper motor, slide regulator, heater, and the temperature sensor PT100. The temperature test point for validation and verification was performed at 35 °C, 45 °C, and 55 °C. The result showed that The PT100 successfully had an excellent response to the temperature test point. The correction value for temperature is as high as 0.6 °C with a deviation of 1 %.

The characteristics and applications of the system for welding machines based on SCM , based on PLC control system and PC-based industrial control system was introduced. It has certain significance to the design of welding machine control system.

Multiple input/output Programmable Logic Controller (PLC) module for educational purposes is fabricated because of current PLC Kit that was unable to enhance learners theoretical understanding and hands-on skill especially for programming, wiring, design of circuit and problem solving. The available PLC Kit comes with a casing which learners struggling in comprehend the theoretical knowledge, cabling connection between input components, PLC modules and output components respectively. Newly designed PLC modules are developed and fabricated with additional input and output devices, cost effective and user friendly. Moreover, this module come with multiple Input/Output (I/O) devices such as push buttons (normally open), DC motor (24V), DC relay (24V), DC solenoid piston cylinder (24V) and DC light (24V) and able to interfacing with different kinds of PLC controller produced by Matsushita, Omron, Siemens and etc. Through conducted surveyed, it is found that on average of 93.20% agreed that newly developed Multiple I/O PLC module is user friendly, safe and attractive to be used while 95.70% participants agreed that there are enhancements in theoretical understanding and hands-on skill aspect in their learning process.

Control systems are used in a number of different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation. Failure of these control systems because of malware or other faults would be catastrophic for critical infrastructure and would result in significant losses. Adverse operating conditions, such as those found in networked control systems, exacerbate the likelihood of vulnerability to malware attacks. The prospect of severe adversarial assaults such as buffer overflow, conventional faults, and especially stealthy Ladder Logic Bombs is a serious cause of concern in Industrial Control Systems (ICS) with novel attacks such as Struxnet. Decoupled at-distance Electromagnetic spectrum-based monitoring of faults and malware is more robust and can likely be integrated into Industrial Control System frameworks. Our failure analysis and Machine Learning (ML) modeling approach is fundamentally different from traditional methods in that we propose a Hybrid Quantum Artificial Intelligence-based Electromagnetic (EM) Spectral domain-based analysis approach that is completely decoupled from the controller processor and can predict PLC fault/malware conditions, including stealth Ladder Logic Bombs and buffer overflow attacks. Further, robust Supervisory Control Systems (SCSs) that interface with programmable logic controllers (PLCs) are essential components of Industrial Control Systems (ICSs) that handle critical infrastructure. Modern industrial control systems, on the other hand, are made up of densely linked Internet of Things (IoT) nodes. Because of their networked nature, supervisory control systems are also susceptible to widespread cyberattacks. As a result, in the case of a coordinated attack on IoT control systems, the dependability of Supervisory control decision-making procedures is jeopardized and need to be decoupled from the attacks. This work also develops a Fuzzy inference Engine-based supervisory monitoring technology based on the characteristics of the Hybrid Quantum AI-based analysis of the EM spectrum to reduce industrial plant downtime and false alarms by localizing adversarial attacks/faults, risk severity levels, and impacted nodes, as well as having dependability and malware immunity in networked Industrial control systems. The Hybrid QAI technique improved prediction accuracy by up to 88 percent when identifying different control system viruses and defects in 6-stage pipelined processors. The Fuzzy inference engine in the Mamdani Inference System architecture has been found to reduce the risk of false alarms and downtime.

Many operational Industrial Control Systems (ICSs) were designed and deployed years ago with little or no consideration of security issues arising from an interconnected world. It is well-known that attackers can read and write sensor and actuator data from Programmable Logic Controllers (PLCs) as legacy ICS offer little means of protection. Replacing such legacy ICS is expensive, requires extensive planning and a major programme of updates often spanning several years. Yet augmenting deployed ICS with established security mechanisms is rarely possible. Legacy PLCs cannot support computationally expensive (i.e., cryptographic) operations while maintaining real-time control. Intrusion Detection Systems (IDSs) have been employed to improve security of legacy ICS. However, attackers can avoid detection by learning acceptable system behaviour from observed data. In this paper, we present LASARUS, a lightweight approach that can be implemented on legacy PLCs to reduce their attack surface, making it harder for an attacker to learn system behaviour and craft useful attacks. Our approach involves applying obfuscation to PLC data whenever it is stored or accessed which leads to a continuous change of the target surface. Obfuscation keys can be refreshed depending on the threat situation, striking a balance between system performance and protection level. Using real-world and simulated ICS data sets, we demonstrate that LASARUS is able to prevent a set of well-known attacks like random or replay injection, by reducing their passing rate significantly—up to a 100 times.

Many industrial control systems (ICS) are reliant upon programmable logic controllers (PLCs) for their operations. As ICS and PLCs are increasingly targeted by cyber-attacks, research facilitating the resiliency of their physical processes is imperative. This paper proposes an approach which leverages PLC containerization, input/output (I/O) multiplexing, and orchestration to respond to cyber incidents and ensure continuity of critical processes. A proofof-concept capability was developed and evaluated on live ICS testbed environments. The experimental results indicate the approach is viable for control applications with soft real-time requirements.

Access control is an important part of security in software, such as business applications, since it determines the access of users to objects and operations and the constraints of this access. Business and access control models are expressed using different representations. In addition, access control rules are not generally defined explicitly from access control models. Even though the business model and access control model are two separate modeling abstractions, they are inter-connected as access control is part of any business model. Therefore, the first goal is to add access control models to business models using the same fundamental building blocks. The second goal is to use these models and define general access control rules explicitly from these models so that the connection between models and their realizations are also present. This paper describes a new common representation for business models and classes of access control models based on the Resource---Event---Agent (REA) modeling approach to business models. In addition, the connection between models and their represented rules is clearly defined. We present a uniform approach to business and access control models. First, access control primitives are mapped onto REA-based access control patterns. Then, REA-based access control patterns are combined to define access control models. Based on these models, general access control rules are expressed in Extended Backus---Naur Form.

With the increasingly strict requirement for computer system security, access control models have become more complex. Existing models, such as discretionary access control (DAC) model, mandatory access control (MAC) model, role based access control (RBAC) model, and attribute based access control (ABAC) model, all have advantages and disadvantages regarding practicability and security. In addition, there is an inherent security risk in these access control models. The models merely control the access permission, but ignore the verification for the identity credibility of the entities involved in the access. With the proposal of trusted computing and the application of trusted platform, it is possible to implement, on stand-alone computers, the verification of identity credibility for the entities involved in the access. In this paper, we analyze the authorization and access decision policy of the RBAC model and the ABAC model. The characteristics of the trusted computing, which can ensure the identity credibility of the entities involved in the access, is also considered. Based on the above analysis, we establish a trusted computing based enhanced access control (TCBEAC) model, which can be deployed on stand-alone computers for common users.

With the trend of Industry 4.0, the communication established by Ethernet is becoming more and more common in the Industrial Control System (ICS), and it brings not only pros but also cons like vulnerabilities from information technology. Furthermore, most devices in the ICS are not ready for cyberattacks, and it opens up opportunities for attackers. We generalized a procedure of attacking an Ethernet-enabled ICS and implemented it to the real industrial system we obtained. The procedure gets the information and access of the devices in the ICS, like identifying the manufacturer of Programmable Logic Controllers (PLCs) and overwriting the configuration of PLCs.