Stealthy Deception Attacks on Water SCADA Systems

Transcription

1 Stealthy Deception Attacks on Water SCADA Systems Saurabh Amin 1 Xavier Litrico 2 Alexandre M. Bayen 1 S. Shankar Sastry 1 1 University of California, Berkeley 2 Cemagref, Unité Mixte de Recherche G-EAU TRUST Spring Conference Washington DC, October 29, 2009

2 Outline Recapitulation from last year The Gignac Water SCADA System Modeling of Cascade Canal Pools Attacks on PI Control Limits on Stability and Detectability

3 Recapitulation from last year The Gignac Water SCADA System Modeling Dimensions of Cascade of securecanal control Pools Problems Attacks ofon interest PI Control Limits Outline Recapitulation from last year The Gignac Water SCADA System Modeling of Cascade Canal Pools Attacks on PI Control Limits on Stability and Detectability

4 Recapitulation from last year The Gignac Water SCADA System Modeling Dimensions of Cascade of securecanal control Pools Problems Attacks ofon interest PI Control Limits Attacks to Control Systems. Attacks can disrupt Set points: man-in-the-middle substitutions, Control: tuning parameter substitutions Process value readings: value substitutions, Communication: latency impact via DoS attack, Process disruption: disrupt connection to plant. Multilayer Control Structure (Tatjewski, 08)

5 Recapitulation from last year The Gignac Water SCADA System Modeling Dimensions of Cascade of securecanal control Pools Problems Attacks ofon interest PI Control Limits Operational Goals and Security Attributes. Operational Goals Maintain safe operational mode - Limit the probability of undesirable behavior, Meet production demands - Keep certain process values within prescribed limits, Maximize production profit. Security attributes Mode of attack - Availability, integrity, confidentiality, Signature of attack - Targeted, resource constrained, random, Time of attack.

6 Recapitulation from last year The Gignac Water SCADA System Modeling Dimensions of Cascade of securecanal control Pools Problems Attacks ofon interest PI Control Limits Control System Theory. Theory linear, nonlinear, adaptive, robust, networked, fault-tolerant, distributed,... Practice PID (more than 80% of engineering practice) Model predictive control (widely accepted mediator between PID and PhD control) Which tools to use To analyze of resiliency or defenses under malicious attacks? Our answer: Use any and all, but be grounded

7 Recapitulation from last year The Gignac Water SCADA System Modeling Dimensions of Cascade of securecanal control Pools Problems Attacks ofon interest PI Control Limits Main goals of our work since last year For SCADA systems From attacker s viewpoint: Provide intuition about best deception attack signatures that are most effective and least detectable. We define such attacks as stealthy attacks. From defender s viewpoint: Synthesize controllers that improve robustness margins with safety and cost as operational goals under a class of deception attack models.

8 Recapitulation from last year The Gignac Water SCADA System Modeling Dimensions of Cascade of securecanal control Pools Problems Attacks ofon interest PI Control Limits Roadmap for secure water SCADA

9 Outline Recapitulation from last year The Gignac Water SCADA System Modeling of Cascade Canal Pools Attacks on PI Control Limits on Stability and Detectability

10 The Gignac Water Distribution System. The Gignac Project Built in 18XX, located near Montpellier, France Irrigates 2800 Hc of land by 50 km of primary, 270 km of secondary canals Used as experimental testbed for modeling and control methods Equipped with level and velocity sensors, and motorized gates with local slave controllers SCADA system architecture: centralized base station that communicates with field devices

11 The Gignac Water Distribution System

12 Communication system at GIGNAC SCADA

13 Hacking SCADA Wireless is Easy: PNNL

14 SCADA Communication System.

15 Attack on Local Slave Controller.

16 Stealing Water by Compromising Level Sensors.

17 Stolen Solar Panels.

18 SCADA Supervisory Interface Under Physical Attack.

19 Other Cyber Attacks on Water SCADA Systems. Tehama colusa canal incident Maroochy water breach incident Harrisburg water filtering plant incident

20 Outline Recapitulation from last year The Gignac Water SCADA System Modeling of Cascade Canal Pools Attacks on PI Control Limits on Stability and Detectability

21 Cascade of Canal Pools. Frequency domain model of canal cascade Control input variables: Upstream and downstream discharge, Controlled variable: the downstream water level, Frequency domain input-output relationship for pool i: y i (s) = G i (s)µ i (s) + G i (s)[µ i+1 (s) + p i (s)] G i (s) and G i (s) are infinite dimensional transfer functions belonging to the Callier-Desoer algebra

22 Reduced Order Model for Adversary. Low frequency approximation Transfer functions G i (s) and G i (s) can be approximated by an Integrator Delay (ID) model G i (s) = exp ( τ is), G i (s) = 1 A i s A i s whereτ i is the propagation delay of the i th canal pool (in s) and A i is the backwater area (in m 2 ) Classically used to design PI controllers Multi-pool representation of canal is obtained as y = Gµ + Gp.

23 Outline Recapitulation from last year The Gignac Water SCADA System Modeling of Cascade Canal Pools Attacks on PI Control Limits on Stability and Detectability

24 Local Upstream Control of Avencq Cross Regulator.

25 PI Controller for Local Upstream Control. Integrator-delay model of single pool y 1 (s) = G 1 (s)µ 1 (s) + G 1 (s)[µ 2 (s) + p 1 (s)] G 1 (s) = exp ( τ 1 s)/a 1 s and G 1 (s) = 1/A 1 s. Measured variable: water level upstream of the gate, Control action variable: Gate opening ) K 1 (s) = 0 and K 2 (s) = k p (1 + 1 T i s : k p proportional gain, T i integral time Tracking errorǫ 1 = r 1 y 1 ǫ 1 = (1 + G 1 (s)k 2 (s)) 1 [r 1 G 1 (s)p 1 (s)] for local u.s. Disturbance rejection is characterized by modulus of transfer function.

26 Robust PI Tuning Rules. Robustness margins: Gain margin G db and Phase margin Θ directly related to the time-domain performance of the closed-loop system Tuning Rules π 2 ( ) π k p = k u 8 10 G/20 sin 180 Θ +π 2 10 G/20 T i = T ( ) u π 2π 10 G/20 tan 180 Θ +π 2 10 G/20 with Θ<90(1 10 G/20 ) The ultimate cycle parameters by ATV method (Astrom and Hagglung) k u = 4A 1 πτ 1, T u = 4τ 1

27 Hacking Level Sensor at Avencq: Simulation

28 Performance of Local PI Controller: Simulation

29 Stealthily Hacking Level Sensor: Simulation

30 Performance of Local PI Controller: Simulation

31 Hacking Level Sensor at Avencq: Real Experiment

32 Hacking Level Sensor at Avencq: Real Experiment

33 Extension to decentralized, multivariable PI controllers Compensating effect of water withdrawal at the boundaries by manipulating sensor readings, Such that the multivariable controller does not react to actual perturbation.

34 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Outline Recapitulation from last year The Gignac Water SCADA System Modeling of Cascade Canal Pools Attacks on PI Control Limits on Stability and Detectability

35 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Modeling deception attacks as switched hyperbolic systems Remote Controller Upstream Gate Control Signal u k y k = h L k Water level measurement h 0 k Canal Reach Q l k Canal Bed h L k w k l L For regulatory control of an open channel, switching from 1. Intermittent offtake withdrawals. 2. Certain deception/dos attacks on sensor and control data.

36 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Stability of linearized flow dynamics in open channels Regulatory switching of multi-mode underflow sluice gates controlling the flow of water in a cascade of canals For horizontal m-cascaded canals with frictionless walls and rectangular cross-section ( ) ( ) ( ) ( ) Hi Vi H t + i Hi 0 V i g V s =. i V i 0

37 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Stability of linearized flow dynamics in open channels Regulatory switching of multi-mode underflow sluice gates controlling the flow of water in a cascade of canals For horizontal m-cascaded canals with frictionless walls and rectangular cross-section ( ) ( ) ( ) ( ) Hi Vi H t + i Hi 0 V i g s =. V i 0 V i Under constant boundary conditions, each canal attains a uniform steady state ( H i, V i ). Using v i (x, t) = V i (x, t) V i and h i (x, t) = H i (x, t) H i, the linearized model can be written as ( ) ( ) ( ) ( ) hi Vi Hi hi 0 t + v i g V s =. i v i 0

38 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Stability of linearized flow dynamics in open channels By coordinate changeξ i (t, s) = h i (t, s) + v i Hi /g, ξ m+i (t, s) = h i (t, s) v i Hi /g ( ) ( ) ( ) ξi λi 0 ξi + = t ξ m+i 0 λ m+i s ξ m+i withλ i = ( g H i V i ) andλ m+i = ( g H i + V i ). ( 0 0 Under sub-critical flow, the eigenvalues satisfyλ i < 0<λ m+i. t ξ + Λ s ξ = 0, The boundary conditions in linearized form for each j ξ II (t, 0) = G j L ξ I(t, 0) ξ I (t, 1) = G j R ξ II(t, 1) (1) with appropriately defined G j L, Gj R. Our results provide sufficient conditions to decay for any admissible regulatory control action. )

39 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Switched linear hyperbolic systems Subsystems for the unknown u(t, s) R n with dynamics t u(t, s) + A j (s) s u(t, s) + B j (s)u(t, s) = 0, s (a, b), t> 0 with initial data u(0, s) = ū(s), s (a, b) and left and right boundary conditions D j L u(t, a) = 0, Dj Ru(t, b) = 0, t [0, ) where j belongs to discrete setq ={1,...,N}. t t = 0 s = a s = b

40 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Switched linear hyperbolic systems Consider switching in time among these with a piecewise constant switching signal σ(t) = j k, with j k Q, for t [τ k,τ k+1 ). For initial data ū( ), define u(t) = u(t, ) as u(t, ) = u j k (t, ), for t (τ k,τ k+1 ) where u j k(t, ) is a solution of subsystem for mode j k. At switching timesτ k { limt τk,t<τ k u j k 1(t, ) if k> 0, u j k (τ k, ) = ū( ) if k = 0.

41 Recapitulation from last year The Gignac Water SCADA System Modeling Regulatory ofcontrol Cascadeapplication Canal PoolsSwitched AttacksLinear on PIHyperbolic Control Limits Syste Exponential stability for boundary control actions Exponential stability The system is exponentially stable with respect to a norm if there exists c> 0 andβ> 0 such that for every initial condition u(0, ), the solution u(t, ) satisfies u(t, ) cexp( βt) ū( ). We then say that the switched system is absolutely exponentially stable if it is exponentially stable for all switching sequences σ( ).

42 Recapitulation from last year The Gignac Water SCADA System Modeling Instabilityof bycascade switching Canal Stability Pools criteria AttacksDwell-time on PI Control Limits Instability by switching PDE counterpart to the classical ODE result (n=2, j {1, 2}) Let A j = diag( 1, 1), G j l = 1.5(j 1), Gr j = 1.5(2 j), ū 1. t t t t G 2 L G 2 R G 1 L = 0 G 1 R = 1.5 G 2 L = 1.5 G 2 R = 0 G 1 G 1 L R G 2 G 2 L R s s s Stable Stable Unstable! We have for [a, b] = [0, 1] unswitched: u(t) = 0 for j {1, 2} and t> 2. switch at t = 0.5, 1.5, 2.5,...: u(t) unbounded as t.

43 Recapitulation from last year The Gignac Water SCADA System Modeling Instabilityof bycascade switching Canal Stability Pools criteria Attacks Dwell-time on PI Control Limits Stability criterion for switched hyperbolic systems Theorem (Absolute spectral radius condition) Assume that all matrices A j are diagonal. Further, assume that boundary data satisfy the N 2 absolute spectral radius conditions (( )) (A2) max ρ 0 G j R j,j {1,...,N} G j L 0 < 1. Then there existsǫ>0such that if B j (s) <ǫ, the switched hyperbolic system is absolutely exponentially L -stable. Proof. Integrating along characteristic paths and forming desired upper bounds.

44 Recapitulation from last year The Gignac Water SCADA System Modeling Instabilityof bycascade switching Canal Stability Pools criteria Attacks Dwell-time on PI Control Limits Stability criterion for switched hyperbolic systems Theorem (Absolute spectral radius condition) Assume that all matrices A j are diagonal. Further, assume that boundary data satisfy the N 2 absolute spectral radius conditions (( )) (A2) max ρ 0 G j R j,j {1,...,N} G j L 0 < 1. Then there existsǫ>0such that if B j (s) <ǫ, the switched hyperbolic system is absolutely exponentially L -stable. Special case (n = 2) (A2) max G j j,j L {1,...,N} Gj R <1.

45 Recapitulation from last year The Gignac Water SCADA System Modeling Instabilityof bycascade switching Canal Stability Pools criteria Attacks Dwell-time on PI Control Limits Stability criterion for switched hyperbolic systems Theorem (Absolute spectral radius condition) Assume that all matrices A j are diagonal. Further, assume that boundary data satisfy the N 2 absolute spectral radius conditions (( )) (A2) max ρ 0 G j R j,j {1,...,N} G j L 0 < 1. Then there existsǫ>0such that if B j (s) <ǫ, the switched hyperbolic system is absolutely exponentially L -stable. For our example ( ) ρ =ρ 0 0 ( ) 0 0 =ρ ( ) 0 0 = 0, ρ 0 0 ( ) =

46 Recapitulation from last year The Gignac Water SCADA System Modeling Instabilityof bycascade switching Canal Stability Pools criteria Attacks Dwell-time on PI Control Limits Dwell-time result for switched hyperbolic systems Theorem (Dwell-time) Assume that all matrices A j are diagonal. Further, assume that the boundary conditions satisfy the only N spectral radius conditions (( 0 G j max ρ R )) j {1,...,N} G j L 0 < 1. and define the following value τ := { (min max (b a) λ j i (s) ) 1+ ( min j {1,...,N} s [a,b] i=1,...,m j s [a,b] i=m j +1,...,n } λ j i (s) ) 1. Then, for anyτ τ assumed as dwell-time for the switching signal σ( ), i. e. if the intervals between consecutive switches are no shorter thanτ, the switched hyperbolic system is exponentially L -stable.

47 Static Data Reconciliation Similar setting to power system state estimation (false data injection attacks, CCS 2009.) Collected n sensor measurements Y m (k) = [y m1 (k),...,y mn (k)]. Physical model as a static relationship of m equations MY (k) = R (2) True, unknown measurements Y (k) = [y 1 (k),...,y n (k)] Additive sensor model: ǫ(k) Gaussian mean 0, covariance V Y m (k) = Y (k) +ǫ(k) Solution by solving weighted least squares with S = VM (MVM ) 1. Ŷ = (I n SM)Y m + SR

48 Detection of Bad Data m dimensional residual r = M(Y m Ŷ ) When no bad data r has mean 0, covariance V r = MVM, Statistical hypothesis test H 0 : No bad data and H 1 : Bad data Hypothesis test can now be expressed as If {ˆφ>τ, reject H 0 ˆφ τ, accept H 0. where the statisticφ := r Vr 1 r andτ depends on allowed false alarm probability.

49 Stealthy Attack on Data Reconciliation Theorem (Stealthy Attacks) Assume that the original measurements Y m can pass the bad data detection test. Then malicious measurements Y a = Y m + A can also pass the bad measurement detection if the adversary with knowledge of the original measurements Y m, the model M, R, the error variance V and the thresholdτ, chooses A such that. MY m R + MA 2 (MVM) 1 τ

50 Acknowledgements This research is sponsored by the Team for Research in Ubiquitous Secure Technology (TRUST ) at UC Berkeley The support of the Cemagref is gratefully acknowledged We thank the project leaders of SIC simulation software: J.P. Baume & P.O. Malaterre