Caching-based Multicast Message Authentication in Time-critical Industrial Control Systems

Abstract

Attacks against industrial control systems (ICSs) often exploit the insufficiency of authentication mechanisms. Verifying whether the received messages are intact and issued by legitimate sources can prevent malicious data/command injection by illegitimate or compromised devices. However, the key challenge is to introduce message authentication for various ICS communication models, including multicast or broadcast, with a messaging rate that can be as high as thousands of messages per second, within very stringent latency constraints. For example, certain commands for protection in smart grids must be delivered within 2 milliseconds, ruling out public-key cryptography. This paper proposes two lightweight message authentication schemes, named CMA and its multicast variant CMMA, that perform precomputation and caching to authenticate future messages. With minimal precomputation and communication overhead, C(M)MA eliminates all cryptographic operations for the source after the message is given, and all expensive cryptographic operations for the destinations after the message is received. C(M)MA considers the urgency profile (or likelihood) of a set of future messages for even faster verification of the most timecritical (or likely) messages. We demonstrate the feasibility of C(M)MA in an ICS setting based on a substation automation system in smart grids.

A novel hybrid cybersecurity scheme against false data injection attacks in automated power systems

“…IEC 62351 recommends different authentication and encryption algorithms to secure the channels between publisher and subscriber of GOOSE and SV messages [11]. For instance, references [12][13][14][15] provide IT-based solutions for securing GOOSE and SV messages. In [12,13], light weight message authentication code (MAC) algorithms are proposed to secure the GOOSE messages, whereas [14,15] introduce caching-based MAC and Less-online/More-offline MAC signatures with reduced computational complexities to secure GOOSE and SV messages.…”

“…For instance, references [12][13][14][15] provide IT-based solutions for securing GOOSE and SV messages. In [12,13], light weight message authentication code (MAC) algorithms are proposed to secure the GOOSE messages, whereas [14,15] introduce caching-based MAC and Less-online/More-offline MAC signatures with reduced computational complexities to secure GOOSE and SV messages. These cyber security algorithms do not however deal with the case of an attack on the end device itself (i.e., when the end devise is compromised).…”

A novel hybrid methodology to secure GOOSE messages against cyberattacks in smart grids

“…However, in 8,10 it was proved that the digital signatures result in high computational delays and hence not suitable for time critical GOOSE messages with stringent 3 ms timing requirements. Recently published IEC 62351-6 standard proposed light weight message authentication code (MAC) algorithms to secure the GOOSE messages [11][12][13] . Authors in 14 introduced cachingbased MAC and less-online/more-offline MAC signatures which further reduces computational delays.…”