Abstract
The primary goal of this dissertation is to combine standardization, industry, and academic approaches to keepup with the evolving threats against Industrial Control Systems (ICS). With all these approaches, balance between
performance and security needs to be established with minimal intervention to their current setups, thus respecting
time-honored/legacy installations.
The introduced security mechanisms presented in this research can find applicability in the compliance of ICSasset owners with the International Electrotechnical Commission (IEC) 62443 set of standards, via novel technological means. The combination of the built-in security features of Software-Defined Networking (SDN) and the
electromagnetic (EM) biometric authentication of devices can cover a wide spectrum of the security requirements
defined in part 3-3 of the IEC 62443 standard. These requirements include the aspects of endpoints, data, applications, and networks. Therefore, it supports the overall concept of defense-in-depth in ICS environments, as that
preliminary has been identified through our full-scale analysis about past industrial cybersecurity incidents.
Based on the above, this dissertation is organized into two parts, with each chapter contributing to the overall
goal of proving the mechanisms that enable proactive and reactive security in ICS via SDN and device biometric
authentication, using digital electrical substations as an example case. The first part of the dissertation presents
contributions in the area of ICS network security. ICS are composed of sensors, actuators, controllers, and conventional computing systems. Their main task is to manage different processes such as industrial plants and power
systems. Finding the appropriate balance between security and performance is a never-ending challenge in this
domain. To this end, this dissertation presents an analysis of past real-life incidents and identified vulnerabilities
in ICS components. Such an analysis results in the creation of attack-type categories and illuminates major challenges towards providing a better security posture. This emphasizes the importance of applying concrete technical
security measures to ICS, as well as the need for standardized approaches. To examine these approaches, this work
presents a framework that supports compliance with the IEC 62443 standards in electrical substation automation
networks using SDN, as a case study for ICS environments. Moreover, the presented work evaluates the harmonious coexistence of SDN-based security and the real-time requirements of modern communication protocols in
digital substation networks. More specifically, with the utilization of a replica of a real-world electrical substation
as a testbed, it is demonstrated that while SDN-based security features naturally introduce additional latency, they
minimally affect the strict network constraints.
The second part of this dissertation discusses the research in the area of side-channel analysis for defensivepurposes based on the electromagnetic (EM) emanations of embedded devices. Those devices find application
in many ICS systems including digital electrical substations. In this part, this research concentrates on two core
problems to advance the security of systems based on side-channel analysis: (a) anomaly detection for all of
the execution states of a target program, and (b) generation of a cryptographic key with the utilization of the
inherently noisy EM signals. The former provides a robust external and non-intrusive detection mechanism even
in the case of environments where the values of Signal to Noise Ratio (SNR) are high. The latter creates the basis
of a modern scheme that protects the network communications of resource-constraint devices in the presence of
sophisticated adversaries. To realize the above two objectives, experiments using both synthetic and real-life data
are performed, demonstrating that even single-instruction code injection attacks can be detected with near-perfect
accuracy in relatively clean environments. Furthermore, with the modification of noise elimination techniques,
highly accurate predictions of code injections are produced, even in settings that have variable levels of SNR.
Then, a novel framework is introduced for generating synthetic EM signals directly from machine code. This
part assists the process of anomaly detection by removing the need for elaborate and error-prone fingerprinting
approaches for all the execution paths of the code running on the examined device. Finally, this dissertation ways
to ensure secure communication even when the end devices are compromised. To achieve this, the Fuzzy Extractor
(FE) method is employed, with the capability of utilizing noisy measurements such as EM signals, to generate
cryptographic keys. This work proves that if an adversary modifies the code on the target device or substitute
the devices with an almost identical one, such an action will result in an invalid key compared to a previous one.
The proposed scheme can be implemented in these environments in the form of a “Bump-in-the-Wire” (BitW)
solution to off-load computationally intensive cryptographic operations from the end-devices, while at the same
time respecting legacy settings, as a balance between performance and security. Overall, this part introduces
security mechanisms that fulfill the requirements of IEC 62443-3-3, addressing the gaps left by the SDN-based
features discussed earlier. These additional security measures complement the SDN framework, ensuring a more
comprehensive compliance with the standard’s network security requirements.