CPS-SPC 15 @ Denver CO

MiniCPS: A toolkit for security research

on CPS Networks
DANIELE A NTONIOLI (SUTD) N ILS O LE T IPPENHAUER (SUTD)

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 1
 Hi!

Personal:
I DANIELE A NTONIOLI
I SUTDs ISTD PhD (Prof N.O. T IPPENHAUER)
SCy-Phy group:
I Applied CPS security research

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 2
 Why MiniCPS: Cyber-Physical Systems

CPS are:
I Complex
I Critical
I Connected

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 3
 Why MiniCPS: Cyber-Physical Systems

CPS are:
I Complex
I Critical
I Connected
CPS information may be difficult to:
I Obtain
I Prove
I Share

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 3
 Why MiniCPS: Cyber-Physical Systems

CPS are:
I Complex
I Critical
I Connected
CPS information may be difficult to:
I Obtain
I Prove
I Share
CPS research requires different expertises:
I Electronics, Automation
I Networking, Computer Science
I Physics. . .

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 3
 Why MiniCPS: SWaT testbed

Pure Water: 5 US gallons/min, 6.0 7.0 pH, minimum

conductivity of 10 S/cm3
Recovered Water: 70% processed water, 50% dirty recirculation
October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 4
 Why MiniCPS: SWaT network

SCADA Historian

HMI

HMI
HMI

Switch L1 Network

Process 1 Process 2 Process n

PLC PLC PLC PLC PLC PLC

PLC1a PLC1b

L0 Network
PLC2a PLC2b

L0 Network
... PLCna PLCnb

L0 Network
Remote IO Remote IO Remote IO

...
RIO RIO RIO
Sensor Sensor
Sensor
42.42 42.42 42.42

Actuators Sensors Actuators Sensors Actuators Sensors

Wired and Wireless links.

Ethernet/IP, Common Industrial Protocol.
October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 5
 MiniCPS: Vision

Research Environment:
I Reproducible
I Extensible
I Shareable

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 6
 MiniCPS: Vision

Research Environment:
I Reproducible
I Extensible
I Shareable
Targeted to Cyber-Physical Systems:
I Network communications
I Control logic
I Physical layer interaction

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 6
 MiniCPS: Vision

Research Environment:
I Reproducible
I Extensible
I Shareable
Targeted to Cyber-Physical Systems:
I Network communications
I Control logic
I Physical layer interaction
Dont reinvent the wheels. . .
I But: "Stand on the Shoulders of Giants"
I Eg: linux, python, mininet, git

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 6
 MiniCPS: Diagram

Network
Component Component
Logic Logic
Physical Layer
API
Physical Layer
Simulation

(C)yber Network Emulator

(P)hysical Process Simulation, State API
(S)ystem Control Logic Simulation

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 7
 MiniCPS: What is Mininet

Network
Component Component
Logic Logic
Physical Layer
API
Physical Layer
Simulation

Network-in-a-box emulator:
I Reproduce (complex) topologies
I Generating real packets using real protocols

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 8
 MiniCPS: What is Mininet

Network
Component Component
Logic Logic
Physical Layer
API
Physical Layer
Simulation

Network-in-a-box emulator:
I Reproduce (complex) topologies
I Generating real packets using real protocols
One Linux kernel, multiple devices:
I Lightweight virtualization
I Each device is a container

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 8
 MiniCPS: What is Mininet

Network
Component Component
Logic Logic
Physical Layer
API
Physical Layer
Simulation

Network-in-a-box emulator:
I Reproduce (complex) topologies
I Generating real packets using real protocols
One Linux kernel, multiple devices:
I Lightweight virtualization
I Each device is a container
SDN/OpenFlow development

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 8
 MiniCPS: Physical Layer API

Network
Component Component
Logic Logic
Physical Layer
API
Physical Layer
Simulation

Database to represent the (physical) state:

I Abstract low-level details (SQL query)
I Use high level semantic functions: get, set

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 9
 MiniCPS: Physical Layer API

Network
Component Component
Logic Logic
Physical Layer
API
Physical Layer
Simulation

Database to represent the (physical) state:

I Abstract low-level details (SQL query)
I Use high level semantic functions: get, set
Compatibility layer:
I Programming Language agnostic
I Support different storage back-ends

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 9
 MiniCPS: SWaT example

L1 network emulation
plc1.py plc2.py plc3.py
PLC PLC PLC

LIT101 LIT301
Grid FIT101 MV101
Sensor Sensor

42.42 42.42

P_101 FIT201
Sensor

42.42

Sensor

42.42

Physical process
Simulation script

Control strategy:
I Sensors: level (LIT), flow (FIT)
I Actuators: motorized valve (MV) and pump (P)
I PLC1 takes decision with the aid of PLC2 and PLC3
I Physical process simulation updates the state
Network:
I Realistic addresses (CIDR, MAC, ports)
I Replicate services: web-servers, ENIP client/server
I Optional Attacker and SDN Controller
October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 10
 MiniCPS: SWaT example II

SCADA Historian

HMI

HMI
HMI

L1 Network

Process 1
1a. Write '0' to 1b. Write '1' to PLC PLC

PLC valve tag PLC valve tag

PLC1a PLC1b

L0 Network
2. Write '1' to Remote IO

RIO valve tag

RIO
Attacker
Sensor

42.42

3. High current analog signal

Actuators Sensors

Passive and Active ARP poisoning MITM attacks

SDN Controller for ARP poisoning Detection and Mitigation
October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 11
 MiniCPS: Conclusions

MiniCPS is a CPS research platform:

I Reproducible
I Extensible
I Shareable
MiniCPS is used to investigate issues in real testbeds:
I MITM attacks (ettercap)
I Ethernet/IP reverse-engineering (scapy)
I SDN controllers development (pox)

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 12
 MiniCPS: Conclusions

MiniCPS is a CPS research platform:

I Reproducible
I Extensible
I Shareable
MiniCPS is used to investigate issues in real testbeds:
I MITM attacks (ettercap)
I Ethernet/IP reverse-engineering (scapy)
I SDN controllers development (pox)
Contribute:
I http://scy-phy.github.io/index.html
I https://github.com/scy-phy/minicps

Thank You!
Q&A

October 26, 2015 MiniCPS: A toolkit for security research on CPS Networks 12