Advanced malware attacks against industrial control systems (ICSs) such as Stuxnet, TRISIS, and CrashOverride have proven that even air gapped networks are at risk to infiltration. For information technology (IT) systems emulated computer systems are commonly used to perform controlled cybersecurity experiments in a contained virtual environment. In order to extend the same capability to operational technology (OT) networks emulation models for programmable logic controllers (PLCs) are needed. PLCs are specialized digital computers used for the autonomous operation and safety systems within critical infrastructure. Therefore, when emulating PLCs specific considerations should be made to ensure representative physical and digital response characteristics. These considerations are typically not considered when emulating VMs for IT networks due to differences in functionality and uses.

PLC emulation enables high fidelity cybersecurity and physical effect modeling of OT networks, such as the instrumentation and control (I&C) systems in nuclear power plants, without hardware-in-the-loop (HITL) integration. In a HITL setup, a physical PLC is integrated into the digital network being tested. Experiments that use PLCs as HITL are expensive, difficult to scale, and change relative to the emulated systems. Running an experiment on an entire I&C system architecture, which may include dozens of devices, can become impractical if HITL is used for every digital device on the network. A PLC emulation methodology, thus, provides a practical path forward to study the current cybersecurity posture of OT networks for critical infrastructure and aid in the design of secure architectures for future designs.

Overall, the objective of this work is to develop and validate a PLC emulation methodology to dramatically reduce the cost of high-fidelity OT network emulation without compromising specific functionality. The emulation methodology will be implemented into an ongoing effort at the University of New Mexico’s Institute for Space and Nuclear Power Studies to develop an emulytic^TM^ platform for PWR plants funded by DOE’s Nuclear Engineering University Program (NEUP) in collaboration with Sandia National Laboratories.

The developed PLC emulation methodology is validated to support cybersecurity analyses of OT networks for critical infrastructure. This emulation methodology identifies and characterizes key physical and digital signatures for the PLCs of interest. The obtained and displayed digital signatures include the network response, traffic, and software version, while the selected physical signatures include the actuation response time and sampling rate. An extensive validation analysis is performed to characterize the signatures of the real, hardware-based PLC and the emulated PLC. These signatures are then compared to highlight differences and quantify the parameters that can be changed to optimize the emulation fidelity.

*Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.*

SAND2019-14367 A


Emulation Methodology of Programmable Logic Controllers for Cybersecurity Applications

Division / Sponsors: 
Power Division & Nuclear Engineering Division (NED)

Power Conference
Paper Proceedings: https://asmedigitalcollection.asme.org/POWER/POWER2020/volume/83747

International Conference on Nuclear Engineering
Paper Proceedings: https://asmedigitalcollection.asme.org/ICONE/ICONE2020/volume/83761

POWER-ICONE - Virtual Conference

Supporting the need among researchers worldwide for additional online and multimedia content, ASME now offers the ASME Conference Video Collection. This platform will collect and provide long-term access to conference presentation videos, encompassing all technology areas within ASME's technical conference and events program. About 30,000-40,000 engineers across all mechanical engineering and related disciplines participate in ASME conferences each year. This includes authors of approximately 6,000 to 8,000 technical papers published by ASME, the majority of whom also submit video presentations for our virtual conferences. The video collection will be available as an add-on to existing product packages or as a separate subscription.