PLC protection system based on verification separation

Abstract

Supervisory control and data acquisition systems (SCADAs) play an important role in supervising and controlling industrial production with the help of programmable logic controllers (PLCs) in industrial control systems (ICSs). A PLC receives the control information or program from a SCADA to control the production equipment and feeds the production data back to the SCADA. Once a SCADA is controlled by an attacker, it may threaten the safety of industrial production. The lack of security protection, such as identity authentication and encryption for industrial control protocols, increases the potential security risks. In this paper, we propose a PLC protection system combined with a monitor between a SCADA and a PLC and a physically separated monitoring station. By using the PLC protection system, identity verification and command verification are separated, and both the identity of the operator and the corresponding commands are recorded. Experiments show that even if the SCADA is controlled by an attacker, our system could still protect the PLC in the field and record the identity of the key command operator, which facilitates the tracing and forensics of malicious activities.