Recovery Measure against Disabling Reassembly Attack to DNP3 Communication

Sungmoon KWON; Hyunguk YOO; Taeshik SHON

doi:10.1587/transinf.2016ICP0026

Recovery Measure against Disabling Reassembly Attack to DNP3 Communication

Sungmoon KWON, Hyunguk YOO, Taeshik SHON

Full Text Views

0

Cite this

Summary :

In the past, the security of industrial control systems was guaranteed by their obscurity. However, as devices of industrial control systems became more varied and interaction between these devices became necessary, effective management systems for such networks emerged. This triggered the need for cyber-physical systems that connect industrial control system networks and external system networks. The standards for the protocols in industrial control systems explain security functions in detail, but many devices still use nonsecure communication because it is difficult to update existing equipment. Given this situation, a number of studies are being conducted to detect attacks against industrial control system protocols, but these studies consider only data payloads without considering the case that industrial control systems' availability is infringed owing to packet reassembly failures. Therefore, with regard to the DNP3 protocol, which is used widely in industrial control systems, this paper describes attacks that can result in packet reassembly failures, proposes a countermeasure, and tests the proposed countermeasure by conducting actual attacks and recoveries. The detection of a data payload should be conducted after ensuring the availability of an industrial control system by using this type of countermeasure.

Publication: IEICE TRANSACTIONS on Information Vol.E100-D No.8 pp.1790-1797

Publication Date: 2017/08/01

Publicized: 2017/05/18

Online ISSN: 1745-1361

DOI: 10.1587/transinf.2016ICP0026

Type of Manuscript: Special Section PAPER (Special Section on Information and Communication System Security)

Category: Industrial Control System Security

Authors

Sungmoon KWON
  Ajou University
Hyunguk YOO
  Ajou University
Taeshik SHON
  Ajou University

Keyword

industrial control system, DNP3, reassembly, availability

Cite this

Copy

Sungmoon KWON, Hyunguk YOO, Taeshik SHON, "Recovery Measure against Disabling Reassembly Attack to DNP3 Communication" in IEICE TRANSACTIONS on Information, vol. E100-D, no. 8, pp. 1790-1797, August 2017, doi: 10.1587/transinf.2016ICP0026.
Abstract: In the past, the security of industrial control systems was guaranteed by their obscurity. However, as devices of industrial control systems became more varied and interaction between these devices became necessary, effective management systems for such networks emerged. This triggered the need for cyber-physical systems that connect industrial control system networks and external system networks. The standards for the protocols in industrial control systems explain security functions in detail, but many devices still use nonsecure communication because it is difficult to update existing equipment. Given this situation, a number of studies are being conducted to detect attacks against industrial control system protocols, but these studies consider only data payloads without considering the case that industrial control systems' availability is infringed owing to packet reassembly failures. Therefore, with regard to the DNP3 protocol, which is used widely in industrial control systems, this paper describes attacks that can result in packet reassembly failures, proposes a countermeasure, and tests the proposed countermeasure by conducting actual attacks and recoveries. The detection of a data payload should be conducted after ensuring the availability of an industrial control system by using this type of countermeasure.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2016ICP0026/_p

Copy

@ARTICLE{e100-d_8_1790,
author={Sungmoon KWON, Hyunguk YOO, Taeshik SHON, },
journal={IEICE TRANSACTIONS on Information},
title={Recovery Measure against Disabling Reassembly Attack to DNP3 Communication},
year={2017},
volume={E100-D},
number={8},
pages={1790-1797},
abstract={In the past, the security of industrial control systems was guaranteed by their obscurity. However, as devices of industrial control systems became more varied and interaction between these devices became necessary, effective management systems for such networks emerged. This triggered the need for cyber-physical systems that connect industrial control system networks and external system networks. The standards for the protocols in industrial control systems explain security functions in detail, but many devices still use nonsecure communication because it is difficult to update existing equipment. Given this situation, a number of studies are being conducted to detect attacks against industrial control system protocols, but these studies consider only data payloads without considering the case that industrial control systems' availability is infringed owing to packet reassembly failures. Therefore, with regard to the DNP3 protocol, which is used widely in industrial control systems, this paper describes attacks that can result in packet reassembly failures, proposes a countermeasure, and tests the proposed countermeasure by conducting actual attacks and recoveries. The detection of a data payload should be conducted after ensuring the availability of an industrial control system by using this type of countermeasure.},
keywords={},
doi={10.1587/transinf.2016ICP0026},
ISSN={1745-1361},
month={August},}

Copy

TY - JOUR
TI - Recovery Measure against Disabling Reassembly Attack to DNP3 Communication
T2 - IEICE TRANSACTIONS on Information
SP - 1790
EP - 1797
AU - Sungmoon KWON
AU - Hyunguk YOO
AU - Taeshik SHON
PY - 2017
DO - 10.1587/transinf.2016ICP0026
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E100-D
IS - 8
JA - IEICE TRANSACTIONS on Information
Y1 - August 2017
AB - In the past, the security of industrial control systems was guaranteed by their obscurity. However, as devices of industrial control systems became more varied and interaction between these devices became necessary, effective management systems for such networks emerged. This triggered the need for cyber-physical systems that connect industrial control system networks and external system networks. The standards for the protocols in industrial control systems explain security functions in detail, but many devices still use nonsecure communication because it is difficult to update existing equipment. Given this situation, a number of studies are being conducted to detect attacks against industrial control system protocols, but these studies consider only data payloads without considering the case that industrial control systems' availability is infringed owing to packet reassembly failures. Therefore, with regard to the DNP3 protocol, which is used widely in industrial control systems, this paper describes attacks that can result in packet reassembly failures, proposes a countermeasure, and tests the proposed countermeasure by conducting actual attacks and recoveries. The detection of a data payload should be conducted after ensuring the availability of an industrial control system by using this type of countermeasure.
ER -