Certification Cycles of Train Cyber Gateway

Abstract

The Critical Infrastructure Protection (CIP) is a classic example of system of systems (SoS) management. We pay special attention to interdependencies among systems within SoS. The article deals with the requirements for the cyber gateway at the train transportation management system. More and more telemetry and remote control through communication systems are used on the track because of the technological development. The train at cyberspace acts as an end network that is connected to the operating center network via an open public network. The gateway must then meet the requirements of the railway infrastructure as well as the cyber infrastructure. We deal with the integration of various requirements for the train gateway into one verification and certification cycle in this paper. The requirement integration is important because, in the first it is necessary to ensure coherence and consistency between different requirements. The second reason is to speed up possible re-certification. A recertification is necessary because gateway adaptation or installation in a new environment. The European project certMILS deals with the issue of re-certification.

Control of Security of Cyber Train Gateway

“…Mobile communication gateways must follow a wide range of standards and rules, determined areas of their de-ployment. In the case of a train, the list of standards within the certification cycle is detailed in the article [14].…”

“…The MCG [14] was developed according to standard IEC 62443-4-1 [19]. A risk analysis was carried out within the given network context of MCG as one of the first tasks.…”

Security certification experience for industrial cyberphysical systems using Common Criteria and IEC 62443 certifications in certMILS

“…Often artifacts developed for safetycritical development can be re-used for IEC 62443-4-1. For instance, certMILS partner Q-Media is using an internal certification framework to cover simultaneously EN 50126, IEC 61375, prTS 50701 and IEC 62443 [15]. A gap analysis between IEC 62443 and IEC 61508 has been done in [16].…”

“…Moreover, some functional requirements explicitly reused assurance provided by the separation kernel. The functional requirements were mainly in the functional groups for restricted data flow and resource availability [15].…”

Security Certification of Cyber Physical Systems for Critical Infrastructure based on the Compositional MILS Architecture

“…For the certification, the separation kernel helps to fulfil certain IEC 62443-4-2 functional requirements, reusing assurance provided by the separation kernel, mainly in the IEC 62443 functional groups CR5 restricted data flow and CR7 resource availability, as well as CR3 system integrity [16]. In Table 2, evaluation arguments for some CR5/CR7 group functional requirements are shown across the pilots: The MILS platform's separation kernel is referred to as "MILS separation kernel" or "separation layer".…”