Advertisement

SDN-Enabled Virtual Data Diode

  • Miguel Borges de Freitas
  • Luis Rosa
  • Tiago CruzEmail author
  • Paulo Simões
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11387)

Abstract

The growing number of cyber-attacks targeting critical infrastructures, as well as the effort to ensure compliance with security standards (e.g. Common Criteria certifications), has pushed for Industrial Automation Control Systems to move away from the use of conventional firewalls in favor of hardware-enforced strict unidirectional gateways (data diodes). However, with the expected increase in the number of interconnected devices, the sole use of data diodes for network isolation may become financially impractical for some infrastructure operators.

This paper proposes an alternative, designed to leverage the benefits of Software Defined Networking (SDN) to virtualize the data diode. Besides presenting the proposed approach, a review of data diode products is also provided, along with an overview of multiple SDN-based strategies designed to emulate the same functionality. The proposed solution was evaluated by means of a prototype implementation built on top of a distributed SDN controller and designed for multi-tenant network environments. This prototype, which was developed with a focus in performance and availability quality attributes, is able to deploy a virtual data diode in the millisecond range while keeping the latency of the data plane to minimal values.

Keywords

Data diode Unidirectional gateways Software Defined Networks Industrial and automation control systems 

Notes

Acknowledgements

This work was partially funded by the ATENA H2020 Project (H2020-DS-2015-1 Project 700581) and Mobiwise P2020 SAICTPAC/0011/2015 Project.

References

  1. 1.
    Barbosa, R.: Anomaly detection in SCADA systems: a network based approach. Ph.D. thesis, University of Twente (2014).  https://doi.org/10.3990/1.9789036536455
  2. 2.
    Berde, P., Gerola, M., et al.: ONOS: towards an open, distributed SDN OS. In: Proceedings of the Third Workshop on Hot Topics in Software Defined Networking - HotSDN 2014, pp. 1–6 (2014).  https://doi.org/10.1145/2620728.2620744
  3. 3.
    FoxIT: Fox DataDiode Data Sheet (2018). https://www.fox-it.com/datadiode/downloads/
  4. 4.
    FoxIT: Fox IT FAQ. Online (2018). https://www.fox-it.com/datadiode/faq/
  5. 5.
  6. 6.
    Heo, Y., et al.: A design of unidirectional security gateway for enforcement reliability and security of transmission data in industrial control systems. In: International Conference on Advanced Communication Technology (2016).  https://doi.org/10.1109/ICACT.2016.7423372
  7. 7.
    Jeon, B.S., Na, J.C.: A study of cyber security policy in industrial control system using data diodes. In: 18th International Conference on Advanced Communication Technology (ICACT), p. 1, January 2016.  https://doi.org/10.1109/ICACT.2016.7423373
  8. 8.
    Jones, D.W.: RS-232 data diode - Tutorial And Reference Manual. Technical report, United States (2006)Google Scholar
  9. 9.
    Mckay, M.: Best practices in automation security (2012).  https://doi.org/10.1109/CITCON.2012.6215678
  10. 10.
    Mraz, R.: Data Diode Cybersecurity Implementation Protects SCADA Network and Facilitates Transfer of Operations Information to Business Users. Presentation (2016)Google Scholar
  11. 11.
    Okhravi, H., Sheldon, F.T.: Data diodes in support of trustworthy cyber infrastructure. In: Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research, CSIIRW 2010, pp. 23:1–23:4. ACM, New York (2010).  https://doi.org/10.1145/1852666.1852692
  12. 12.
    Oktian, Y.E., et al.: Distributed SDN controller system: a survey on design choice. Comput. Netw. 121, 100–111 (2017).  https://doi.org/10.1016/j.comnet.2017.04.038CrossRefGoogle Scholar
  13. 13.
    Open NF: OpenFlow Switch Specification Version 1.5.1 (Protocol v. 0x06) (2015). https://www.opennetworking.org/wp-content/uploads/2014/10/openflow-switch-v1.5.1.pdf
  14. 14.
    Owl Cyberdefense: Learn About Data Diodes. Online (2018)Google Scholar
  15. 15.
    Peterson, D.G.: Air Gaps Dead, Network Isolation Making a Comeback. Online. http://www.digitalbond.com/blog/2011/07/19/air-gaps-dead-network-isolation-making-a-comeback/
  16. 16.
    Scott, A.: Tactical data diodes in industrial automation and control systems. Technical report, United States (2015)Google Scholar
  17. 17.
    Stouffer, K.A., et al.: NIST SP 800–82 rev2. Guide to Industrial Control Systems (ICS) Security: SCADA Systems, DCS, and Other Control System Configurations Such As Programmable Logic Controllers (PLC). Technical report, USA (2015)Google Scholar
  18. 18.
    Sun, Y., Liu, H., Kim, M.S.: Using TCAM efficiently for IP route lookup. In: 2011 IEEE Consumer Communications and Networking Conference, CCNC’2011, pp. 816–817 (2011).  https://doi.org/10.1109/CCNC.2011.5766609
  19. 19.
    Waterfall Security: Unidirectional security gateways vs. comparing costs. Technical report, Israel, Firewalls (2012)Google Scholar
  20. 20.
    Waterfall Security: Unidirectional Security Gateways (2018). https://static.waterfall-security.com/Unidirectional-Security-Gateway-Brochure.pdf
  21. 21.
  22. 22.
    Waterfall Security: Waterfall WF-500 product datasheet. Product Datasheet (2018). https://waterfall-security.com/wp-content/uploads/WF-500-Data-Sheet.pdf

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Miguel Borges de Freitas
    • 1
  • Luis Rosa
    • 1
  • Tiago Cruz
    • 1
    Email author
  • Paulo Simões
    • 1
  1. 1.Department of Informatics Engineering, Centre of Informatics and SystemsUniversity of CoimbraCoimbraPortugal

Personalised recommendations