An Open Source SCADA Toolkit

Transcription

1 An Open Source SCADA Toolkit Stanley A. Klein Open Secure Energy Control Systems, LLC (301) This work was supported by the United States Department of Homeland Security

2 Agenda Project focus and approach Relevant features of IEC Toolkit overview (architecture, applications, security features, and development sequence) Issues in open source development and use Lessons learned Sources of further information 2

3 Project Focus and Approach Exploit opportunity for electric utility cost, operational, and security improvements provided by new IEC standard for substation automation/scada Develop toolkit for secure SCADA infrastructure Address electric power industry specific security issues Leverage leading edge open source technologies 3

4 Relevant features of IEC Object model layered over standard communications Named objects replace numbered points Standard LAN infrastructure replaces point to point wiring Substation Configuration Language (SCL) Substation components represented by standardized objects Plug and play component discovery Standard encryption technology support (WG draft) 4

5 Toolkit Architecture Concepts Build around web services SOAP engine as core Expand on existing use of XML technology Extend easily to external interfaces (e.g., CIM) Support role based access control Instantiate object model based on SCL configuration Translate to MMS and other protocols Support usual SCADA functionality 5

6 Examples of Open Source Leverage Screen GUI tools and SVG diagram tools SOAP engine and related tools Programming languages GNU C/C++ and Python Security tools (Security Enhanced Linux, encryption applications and network protocols, firewall, IDS) PSAT Numerous other miscellaneous tools and libraries 6

7 OSECS Toolkit Technical Contributions Software for naming substation objects User GUI for form and one line diagram status display/control of substation equipment SCADA master server Web Services engine Server substation model and proxies Open Source implementation of MMS protocol Configuration and integration of numerous other tools 7

8 Toolkit Intended Applications Management tool for Substation Config Language Workstation for equipment maintenance or substation HMI Starter or enhanced SCADA for small utilities Control system for distributed generation facilities Substation and control center security appliances (application firewalls and access control gateways) Power System Attack Warning System workstation 8

9 Toolkit Security Function Examples Secure OS restricts data flows and contains intrusions Role based access control of SCADA objects Network encryption and network firewalls External data can be "pushed" Programmed verification of static settings (e.g., relays) Shift change GUI allows user login without disruption Security violation data collection (intrusion detection) Power System Attack Warning System (PSAWS) 9

10 Toolkit Development Sequence SCL Management Tool Statically instantiate all objects; support name generation Tree Browser Tree display only; Dynamic; Communication with devices SCADA/Control Center Basic: Dynamic diagrams/forms display selected objects Enhanced: Persistent storage; Pre defined procedures PSAWS Collect and analyze security violation reports against preanalyzed conditions 10

11 Issues in Open Source Development Need to assess scope and activity of user/maintainer community to avoid dead end software License types and impacts Academic (BSD, MIT) Can be incorporated into proprietary software. No impact on business model or architecture. Reciprocal non GPL (LGPL, MPL, Artistic, others) Business model must focus on support and ancillary services Reciprocal GPL Must integrate as independent works (via files, pipes, messages, etc.) or entire project becomes GPL. 11

12 Open Source Packaging Distribution methods Source (e.g., script files, repository access) Binary and source Tar files (with possible build issues) Binary and source RPM and Deb packages Yum and Apt get installs Dependency issues Availability Version compatibility System management compatibility 12

13 Lessons Learned is less mature than originally anticipated (IEC vs IETF) Naming convention definition (especially standardized naming) is an issue for electric utilities Security policies are difficult for utilities to express 13

14 For More Information On the toolkit: On open source licensing: or On available open source components and tools: (Python repository) (Python project news links) Sourceforge.net (not easy to search) General search engines (e.g., Google) 14