An Open Source SCADA Toolkit

(1)

An Open Source SCADA Toolkit

Stanley A. Klein

Open Secure Energy Control Systems, LLC (301) 5654025

(2)

Open Secure Energy Control Systems, LLC. Open Source Secure SCADA Toolkit

Agenda

● Project focus and approach ● Relevant features of IEC61850 ● Toolkit overview (architecture, applications, security features, and development sequence) ● Issues in open source development and use ● Lessons learned ● Sources of further information

(3)

Project Focus and Approach

● Exploit opportunity for electric utility cost, operational, and security improvements provided by new IEC61850 standard for substation automation/SCADA ● Develop 61850 toolkit for secure SCADA infrastructure ● Address electric power industryspecific security issues ● Leverage leading edge open source technologies

(4)

Relevant features of IEC61850

● Object model layered over standard communications ● Named objects replace numbered points ● Standard LAN infrastructure replaces pointtopoint wiring ● Substation Configuration Language (SCL) ● Substation components represented by standardized objects ● Plug and play component discovery ● Standard encryption technology support (WG draft)

(5)

Toolkit Architecture Concepts

● Build around web services SOAP engine as core ● Expand on existing 61850 use of XML technology ● Extend easily to external interfaces (e.g., CIM) ● Support rolebased access control ● Instantiate object model based on SCL configuration ● Translate to MMS and other protocols Support usual SCADA functionality

(6)

Examples of Open Source Leverage

● Screen GUI tools and SVG diagram tools ● SOAP engine and related tools ● Programming languages – GNU C/C++ and Python ● Security tools (Security Enhanced Linux, encryption applications and network protocols, firewall, IDS) ● PSAT ● Numerous other miscellaneous tools and libraries

(7)

OSECS Toolkit Technical Contributions

● Software for naming substation objects ● User GUI for form and onelinediagram status display/control of substation equipment ● SCADA master server Web Services engine ● Server substation model and proxies ● Open Source implementation of MMS protocol ● Configuration and integration of numerous other tools

(8)

Toolkit Intended Applications

● Management tool for 61850 Substation Config Language ● Workstation for equipment maintenance or substation HMI ● Starter or enhanced SCADA for small utilities ● Control system for distributed generation facilities ● Substation and control center security appliances (application firewalls and access control gateways) ● Power System Attack Warning System workstation

(9)

Toolkit Security Function Examples

● Secure OS restricts data flows and contains intrusions ● Role based access control of SCADA objects ● Network encryption and network firewalls ● External data can be "pushed" ● Programmed verification of static settings (e.g., relays) ● Shiftchange GUI allows user login without disruption ● Security violation data collection (intrusion detection)

(10)

Toolkit Development Sequence

● SCL Management Tool Statically instantiate all objects; support name generation ● Tree Browser Tree display only; Dynamic; Communication with devices ● SCADA/Control Center Basic: Dynamic diagrams/forms display selected objects Enhanced: Persistent storage; Predefined procedures ● PSAWS Collect and analyze security violation reports against pre analyzed conditions

(11)

Issues in Open Source Development

● Need to assess scope and activity of user/maintainer community to avoid deadend software ● License types and impacts Academic (BSD, MIT) – Can be incorporated into proprietary software. No impact on business model or architecture. Reciprocal nonGPL (LGPL, MPL, Artistic, others) – Business model must focus on support and ancillary services Reciprocal GPL – Must integrate as “independent works” (via

(12)

Open Source Packaging

● Distribution methods Source (e.g., script files, repository access) Binary and source Tar files (with possible build issues) Binary and source RPM and Deb packages Yum and Aptget installs ● Dependency issues Availability Version compatibility System management compatibility

(13)

Lessons Learned

● 61850 is less mature than originally anticipated (IEC vs IETF) ● Naming convention definition (especially standardized naming) is an issue for electric utilities ● Security policies are difficult for utilities to express

(14)

For More Information

● On the toolkit: http://www.osecs.com ● On open source licensing: http://www.opensource.org or http://www.fsf.org ● On available open source components and tools: http://freshmeat.net http://cheeseshop.python.org/ (Python repository) http://www.pythonware.com/daily/ (Python project news links) Sourceforge.net (not easy to search) General search engines (e.g., Google)

An Open Source SCADA Toolkit