Method and System for Securing SCADA and Industrial Control Software through Secure-Write Operations

A method for securing write operations in an industrial control system, comprising:

• generating, by a secure write module of a SCADA system, a secure write instruction based on a predefined set of approved operations;
• transmitting the secure write instruction to a programmable logic controller (PLC);
• receiving, by an instruction decoder of the PLC, the secure write instruction;
• verifying, by the instruction decoder, a format and integrity of the secure write instruction;
• decoding the secure write instruction to extract an operation and associated parameters;
• determining, by an instruction validator of the PLC, whether the operation is within a list of approved operations stored in a local secure memory of the PLC;
• validating, by the instruction validator, the associated parameters against permitted parameters stored in the local secure memory;
• executing the secure write instruction by a CPU of the PLC upon successful validation;
• and
• controlling a field device through an input/output module of the PLC based on the executed secure write instruction.

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor of a programmable logic controller (PLC), cause the PLC to perform operations comprising:

• receiving a secure write instruction from a SCADA system, the secure write instruction generated based on a predefined set of approved operations;
• verifying a format and integrity of the secure write instruction;
• decoding the secure write instruction to extract an operation and associated parameters;
• determining whether the operation is within a list of approved operations stored in a local secure memory;
• validating the associated parameters against permitted parameters stored in the local secure memory;
• executing the secure write instruction upon successful validation;
• and
• controlling a field device through an input/output module of the PLC based on the executed secure write instruction.