Security Information Architecture for Automation and Control Networks
Resumo
O atual nível de automação e o livre acesso as implementações de sistemas críticos estão aumentando as vulnerabilidades de segurança em redes de automação e controle empregadas no sector de energia elétrica. Este trabalho é da opinião que a integração entre o gerenciamento baseado em políticas e mecanismos de controle de acesso caminha lado a lado na busca por uma solução mais eficaz na luta contra as ameaças de segurança. Este artigo introduz uma arquitetura modular baseada em XACML e que é aplicada a redes de automação e controle utilizadas na indústria de energia elétrica. Essa arquitetura de segurança é descrita e seus componentes são analisados individualmente e testados em um ambiente real de produção. Este artigo também descreve as dificuldades encontradas, resultados e fornece novas perspectivas sobre controle de acesso quando aplicada a redes de infraestruturas industriais críticas.Referências
Aboba, B., Bluck, L., Vollbercht, J., Carlson, J., Levkowetz, H. (2004) “Extensible Authentication protocol (EAP)”, RFC 3748, July.
CEPEL. (2004) “SAGE”, http://www.sage.cepel.br.
Cigré. (2008), http://www.cigre.org.
CHESF. (2008) “Companhia Hidro Elétrica do São Francisco”, http://www.chesf.gov.br.
CRUTIAL. (2008) “CRitical UTility InfrastructurAL resilience”, http://crutial.cesiricerca.it/
FreeRADIUS. (2008) “The FreeRADIUS Project”, http://www.freeradius.org.
IEC 61850. (2002) “Communication networks and systems in substations”, IEC, February.
IEC/TS 61850-6. (2007) “Power systems management and associated information exchange - Data and communications security - Part 6: Security for IEC 61850”, June.
IEEE. (2001) “Standards for Local and Metropolitan Area Networks: Port based Network Access Control”, IEEE Standard 802.1X-2001, June.
He X., Wang G., Zhao J. (2005) "Research on the SCADA /EMS System Data Warehouse Technology", In: Proceedings of Transmission and Distribution Conference and Exhibition: Asia and Pacific, IEEE Power Engineering Society, China.
Helfrich, D., Ronnau, L., Frazier, J., Forbes, P. (2006) “Cisco Network Admission Control, Volume I: NAC Framework Architecture and Design”, Cisco Press.
ITI. (2008) “TCIP: Trustworthy Cyber Infrastructure for the Power Grid Center”, http://www.iti.uiuc.edu/tcip/index.html.
JRadius. (2008) “The Open Source Java RADIUS”, http://coova.org/wiki/index.php/JRadius.
Kent, S., Atkinson, R. (1998) “Security Architecture for the Internet Protocol”, RFC 2401, November.
Microsoft. (2007) “Network Access Protection Platform Architecture”, http://microsoft.com/technet/network/nap/naparch.mspx.
OASIS. (2003) “LDAP profile for distribution of XACML policies (Working draft 01)”, October.
OASIS. (2005) “eXtensible Access Control Markup Language (XACML) Version 2.0”, February.
Open1x. (2008) “Open Source Implementation for 802.1X”, http://open1x.sourceforge.net.
OpenLDAP. (2008) “OpenLDAP community developed LDAP software”, http://www.openldap.org.
Rigney, C., Willens, S., Rubens, A., Simpsom, W. (2000) “Remote Authentication Dial in User Service (RADIUS)”, RFC 2865, June.
SUN. (2008) “XACML’s Implementation”, http://sunxacml.sourceforge.net.
Strassner, J. (2004) “Policy-Based Network Management: Solutions for the Next Generation”, Morgan Kaufmann Publishers.
Ward, S., O’Brien. J., et al. (2007) “Cyber Security Issues for Protective Relays”, In: Proceeding of IEEE Power Engineering Society General Meeting, June.
Westerinen, A., et al. (2001) “Terminology for Policy-Based Management”, RFC 3198, November.
CEPEL. (2004) “SAGE”, http://www.sage.cepel.br.
Cigré. (2008), http://www.cigre.org.
CHESF. (2008) “Companhia Hidro Elétrica do São Francisco”, http://www.chesf.gov.br.
CRUTIAL. (2008) “CRitical UTility InfrastructurAL resilience”, http://crutial.cesiricerca.it/
FreeRADIUS. (2008) “The FreeRADIUS Project”, http://www.freeradius.org.
IEC 61850. (2002) “Communication networks and systems in substations”, IEC, February.
IEC/TS 61850-6. (2007) “Power systems management and associated information exchange - Data and communications security - Part 6: Security for IEC 61850”, June.
IEEE. (2001) “Standards for Local and Metropolitan Area Networks: Port based Network Access Control”, IEEE Standard 802.1X-2001, June.
He X., Wang G., Zhao J. (2005) "Research on the SCADA /EMS System Data Warehouse Technology", In: Proceedings of Transmission and Distribution Conference and Exhibition: Asia and Pacific, IEEE Power Engineering Society, China.
Helfrich, D., Ronnau, L., Frazier, J., Forbes, P. (2006) “Cisco Network Admission Control, Volume I: NAC Framework Architecture and Design”, Cisco Press.
ITI. (2008) “TCIP: Trustworthy Cyber Infrastructure for the Power Grid Center”, http://www.iti.uiuc.edu/tcip/index.html.
JRadius. (2008) “The Open Source Java RADIUS”, http://coova.org/wiki/index.php/JRadius.
Kent, S., Atkinson, R. (1998) “Security Architecture for the Internet Protocol”, RFC 2401, November.
Microsoft. (2007) “Network Access Protection Platform Architecture”, http://microsoft.com/technet/network/nap/naparch.mspx.
OASIS. (2003) “LDAP profile for distribution of XACML policies (Working draft 01)”, October.
OASIS. (2005) “eXtensible Access Control Markup Language (XACML) Version 2.0”, February.
Open1x. (2008) “Open Source Implementation for 802.1X”, http://open1x.sourceforge.net.
OpenLDAP. (2008) “OpenLDAP community developed LDAP software”, http://www.openldap.org.
Rigney, C., Willens, S., Rubens, A., Simpsom, W. (2000) “Remote Authentication Dial in User Service (RADIUS)”, RFC 2865, June.
SUN. (2008) “XACML’s Implementation”, http://sunxacml.sourceforge.net.
Strassner, J. (2004) “Policy-Based Network Management: Solutions for the Next Generation”, Morgan Kaufmann Publishers.
Ward, S., O’Brien. J., et al. (2007) “Cyber Security Issues for Protective Relays”, In: Proceeding of IEEE Power Engineering Society General Meeting, June.
Westerinen, A., et al. (2001) “Terminology for Policy-Based Management”, RFC 3198, November.
Publicado
01/09/2008
Como Citar
FEITOSA, Eduardo; OLIVEIRA, Luis; LINS, Bruno; JUNIOR, Ademir; MELO, Rodrigo; SADOK, Djamel; CARMO, Ubiratan.
Security Information Architecture for Automation and Control Networks. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 8. , 2008, Gramado.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2008
.
p. 17-30.
DOI: https://doi.org/10.5753/sbseg.2008.20885.
