Systems and methods for control system security
AssigneesBattelle Energy Alliance, LLC, Virginia Commonwealth University
InventorsCraig G. Rieger, Timothy R. McJunkin, Milos Manic, Kasun Amarasinghe
Life of this patent
Estimating the term…
Abstract
A resilient security agent determines a cyber and/or physical health of a control system by, inter alia, communicating cyber-physical key data through cyber-physical control paths of the system, and determining error introduced by the communication. The resilient security agent may be further configured to verify the integrity of acquired cyber-physical state information. The cyber health of the control system may be evaluated by comparing the acquired cyber state information to one or more cyber state profiles. The physical health of the control system may be evaluated by comparing the acquired physical state information to one or more physical state profiles.
Claims26
A method for securing a control system, comprising:
- generating a state key comprising cyber key data configured to characterize a cyber state of the control system and physical key data configured to characterize a physical state of the control system;
- communicating the state key through the control system, the communicating comprising acquiring validation data corresponding to the state key transmitted through one or more control paths of the control system;
- generating a reconstruction of the state key by use of the acquired validation data;
- and
- determining a cyber-physical health of the control system based on a comparison between the state key and the reconstruction of the state key.
An apparatus for securing a control system, comprising:
- a security agent comprising a processor, the security agent further comprising:
- a key module configured to generate keys, each key comprising cyber seed data configured to characterize a cyber state of the control system and physical seed data configured to characterize a physical state of the control system;
- a communication module configured to send keys through control paths of the control system;
- a reconstruction module configured to determine key errors resulting from communication of the keys through the control paths;
- and
- a security module configured to determine cyber health metrics indicating a cyber health of the control system and physical health metrics indicating a physical health of the control system based on the determined key errors.
A non-transitory storage medium comprising instructions configured for execution by a computing device, the instructions configured to cause the computing device to implement operations for monitoring a cyber-physical health of a control system, the operations comprising:
- generating state keys comprising cyber key data corresponding to an acquired cyber state of the control system and physical key data corresponding to an acquired physical state of the control system;
- communicating the state keys through cyber-physical control paths of the control system, the communicating comprising acquiring validation data corresponding to respective state keys in response to sending the respective state keys through the cyber-physical control paths of the control system;
- determining error metrics for the state keys, the error metrics quantifying error between the state keys and reconstructions of the state keys, the reconstructions generated from the acquired validation data corresponding to the respective state keys;
- and
- determining the cyber-physical health of the control system based on the determined error metrics.
Dependencies are inferred from the claim text.