EGIFM - EXTENDABLE GATEWAY AND INDUSTRIAL FIREWALL FOR MODBUS

In Ukraine, December 2015, took place one successful cyberattack on a power grid. Hackers were able to compromise the information systems of three energy distribution companies leaving about 230 thousand people without electricity for several hours. Industrial equipment used in factories, refineries, power plant stations and in other automation facilities have a service life of tens of years. In many working power plants and other automation devices and infrastructures designed in the 80's are still being used. Supervisory Control and Data Acquisition(SCADA) systems are based on standard industrial protocols to control and gather data from the on-field devices (sensors, stations, drives, robots, controllers, etc.). With the spreading of the Internet in industrial facilities, new technologies and possibilities have arisen, gluing together the robustness of the automation equipment with the remote control and visualization offered by the internet, enhancing SCADA systems and allowing remote monitorization and control of different infrastructures. Together with the technologies came more advanced threats aimed at the devices and SCADA systems connected to the internet. SCADA systems can become a point of vulnerability when connected to a cyber environment and current security solutions are not designed nor targeted for protecting these industrial infrastructures Modern industrial equipment is controlled using protocols designed decades ago that do not implement any security features. One of the most used protocols in industrial equipment is Modbus. Our solution, EIGFM addresses the Modbus vulnerabilities that permitted the attack by filtering and encrypting the packages with little changes on the network and equipment, especially on software level. We have tested our device showing the power consumption is lower than 3W and that it is capable of filtering Modbus packets based on a configurable ruleset.2015年12月，乌克兰发生一起针对电网的成功网络攻击。黑客成功入侵三家能源分销公司的信息系统，导致约23万人遭遇数小时断电。 工厂、炼油厂、电厂及其他自动化设施中使用的工业设备使用寿命长达数十年。当前许多运行中的电厂及其他自动化设备与基础设施，仍采用上世纪80年代的设计并持续投入使用。 监控与数据采集（Supervisory Control and Data Acquisition, SCADA）系统基于标准工业协议，用于管控现场设备（传感器、站点、驱动器、机器人、控制器等）并采集其数据。随着互联网在工业设施中的普及，新技术与新应用场景应运而生——将自动化设备的可靠性与互联网提供的远程控制、可视化功能相融合，优化了SCADA系统，实现了对各类基础设施的远程监控与管控。 伴随技术发展而来的，还有针对联网工业设备与SCADA系统的更高级威胁。SCADA系统接入网络空间后，可能成为脆弱攻击点，而现有的安全解决方案并非为防护这类工业基础设施而设计。当前工业设备多采用数十年前设计的协议进行管控，此类协议未内置任何安全特性。工业设备中使用最广泛的协议之一便是Modbus。 我们提出的解决方案EIGFM，针对可被攻击利用的Modbus协议漏洞，通过在网络与设备端（尤其是软件层面）进行小幅改动，实现数据包过滤与加密。我们已对该设备开展测试，结果显示其功耗低于3W，且可基于可配置规则集完成Modbus数据包的过滤。