Cybersecurity Test and Evaluation Facilities at Texas A&M

Transcription

1 Cybersecurity Test and Evaluation Facilities at Texas A&M Dr. Karen L. Butler-Purry, Bo Chen Department of Electrical and Computer Engineering Nishant Pattanaik Department of Computer Science Dr. Ana Goulart Department of Engineering Technology and Industrial Distribution Smart Grid Workshop, April 21, 2015

2 Background and Motivation Smart grids are potentially vulnerable to cybersecurity events Innovative smart grid technologies involve bidirectional communication Numerous access points (e.g., WAMS, AMI, internet, public telecommunications network) Lack of cybersecurity awareness in most early SCADA system designs (e.g., off-theshelf software, operating systems, protocols) Need for a cyber-physical system testbed Create cyber-physical system environment Understand the impact of cybersecurity events Allow researchers to perform studies on protecting and mitigating cyber attack events Smart Grid Conceptual Model (Source: [1]) [1] "Report to NIST on the Smart Grid Interoperability Standards Roadmap," Electric Power Research Institute (EPRI), Palo Alto, CA,

3 Capability and Applications of CPS Testbed Capabilities needed Cyber-physical system What component models? Transient and Real-time analysis? Data visualization What level of Interoperability and Scalability Applications to be analyzed Testing, verification, and validation for new advanced IEDs and control methods Vulnerability evaluation of current and new communication protocols, protection, and control methods Testing, verification, and validation of Mitigation strategies Training and education [1] A. Hahn, A. Ashok, S. Sridhar, and M. Govindarasu, "Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid," IEEE Trans. on Smart Grid, vol. 4, pp , [2] Bo Chen; Butler-Purry, K.L.; Goulart, A.; Kundur, D., "Implementing a real-time cyber-physical system test bed 3 in RTDS and OPNET," North American Power Symposium (NAPS), 2014, vol., no., pp.1,6, 7-9 Sept. 2014

4 Testbed Capabilities and Applications 4

5 Testbed Architecture RTDS Power system and control simulation Data acquisition and communication NI LabVIEW and PXI Controller and Protection-in-loop Data acquisition and communication OPNET Communication system simulation Real World Devices IEDs Networking devices (switch, router, etc.) Attack PC Cyber attack software Testbed Architecture of the Real-Time Cyber-Physical System Testbed 5

6 Power Systems RTDS Simulate power systems and controls in real time 50 microsecond time step Hardware-In-The-Loop Controllers Protective Relays Amplifiers Modular design RSCAD Expandable capabilities User-friendly interface to RTDS hardware Modeling libraries Power system Control system Protection and automation Small time step for power electronics PSS/E & MATLAB/Simulink integration Modeling Power Systems in the Real Time CPS Test Bed 6

7 Controller/Protection Implementation RTDS RSCAD supports various controller implementation Interface with external controllers and IEDs Protection (protective relay) Power system controllers (SVC, FACTS, exciter, governor, PSS, distributed generation, etc.) NI PXI Interface with RTDS through analogue and digital I/O Customer-defined controls and protections Wide area control Overcurrent protection Control Center Applications Customer-defined applications Modeled in LabVIEW with MATLAB interface Real-Time applications modeled in ETAP Test SEL relay via IEC interface and electrical interface [1] Implementation of Overcurrent Relay logic in NI PXI [2] MATLAB Script inside LabVIEW [3] [1] [2] Karen L. Butler-Purry, Hung-Ming Chou, "Real-Time Rapid Embedded Power System Control Prototyping simulation Test-Bed Using LabVIEW and RTDS", in LabVIEW, InTech, [3]

8 Communication Systems OPNET Simulate communication networks System-In-The-Loop (SITL) Allow to develop a hybrid system by connecting to real networks Attack PC can connect to each real and simulated node RTDS and NI PXI RTDS GTAI/O, GTDI/O GTNET (IEC Sampled Values, GOOSE, etc.) NI PXI FPGA (Field-Programmable Gate Array) Industrial Communications Protocols (DNP3, Modbus TCP, etc.) Communication Options RTDS (GTAI/O, GTDI/O) + NI PXI + IEDs + OPNET RTDS (GTNET) + NI PXI + IEDs + OPNET Modeling Communication Systems in the Real Time CPS Test Bed 8

9 Example Case Study: Impact Analysis of Cyber Attacks MITM attack can disrupt the original link between an IED and the SCADA, and develop another link An attacker can eavesdrop, delay, or manipulate the packets In this case study, the attack PC will inject tripping signal to open BRK1 Man-In-The-Middle Attack 11 Bus Power Transmission System Modeled in the Test Bed 9

10 Case Study: Man-In-The-Middle Attack 10

11 Questions? Acknowledgements Work presented in collaboration with Dr. Deepa Kundur and team at University of Toronto. This work was supported in part by NSF grants EECS and EEC