Network Softwarization for IACS Security Applications
Freitas, Miguel Rosado Borges de
MSc Thesis · 2018 · University of Coimbra
Supervisors: Paulo Alexandre Ferreira Simões, Tiago José dos Santos Martins da Cruz
Abstract
Over recent years, Industrial and Automation Control Systems (IACS) adopted in critical infrastructures have become more complex due to the increasing number of interconnected devices. Business goals to improve efficiency and productivity within critical infrastructures have connected the once isolated and trusted (due to obscurity) industrial control systems with external networks. This inter-connectivity disclosed and amplified the weaknesses of traditional IACS protocols, leading to a growing number of cyber-attacks specifically targeting critical infrastructures. Enforcing security policies through the deployment of network intrusion and detection systems, honeypots (security probes) or other security mechanisms (such as uni-directional gateways) is hard to accomplish (and often error prone) in traditional network architectures. The network ecosystem is extremely complex, composed of several multi-vendor physical devices which are statically deployed in the network and configured on a per-device level. In the occurrence of a cyber-attack, the network cannot easily block unwanted traffic or evolve to new topologies. New ICT paradigms such as Software Defined Network (SDN) and Network Function Virtualization (NFV) are showing promising results in the cloud computing domain, providing innovative features for flexible and efficient management, monitoring and control of the network. The first (SDN) by allowing network programmability and protocol abstractions from a logically centralized location (the network controller). The later (NFV) by shifting network packet inspection from physical dedicated hardware to virtualized computational instances running in commercial-off-the-shelf hypervisors. This thesis explores the synergies between SDN and NFV to apply a software defined security approach to IACS. An SDN based architecture is proposed and implemented for the easy deployment of containerized versions of typical IACS security probes. The proposed architecture explores the distributed nature of an SDN controller (ONOS) targeting performance and availability in a multi-tenancy network environment.