Supervisory Control and Data Acquisition
(SCADA) Systems Architecture and
Cybersecurity in Smart Cities
Shuangbao (Paul) Wang, Ph.D.
Professor, Director
Center for Security Studies
This research is funded in part by grants from US National Science
Foundation (NSF) [EAGER-1419055 and DGE-1439570].
image courtesy of blackdoctor.org
Solutions?
•
•
•
•
•
•
Work on a water treatment system with 3,000+ PLCs
Build a SCADA system
Study the architecture for IoT – API, databases
Look into data acquisition – various sensors
Focus on PLC/RTU – com, legacy
Assess vulnerability and security
SCADA System Diagram
•
•
•
•
Supervisory System
PLCs/RTUs
Sensors
HMI (Human Machine
Interface)
• Communication
equipment
Water Treatment System Diagram
Sensors
PLCs
PLC and Communication
Water Treatment SCADA Systems
• Before smart city project was launched
– water treatment plants were linked only by cables or standalone PLC systems,
– do not connect to the Internet,
– data flow in a closed environment (not shared).
• With SCADA system
–
–
–
–
the system collects data,
it issues commands from dashboard,
it can configure or control the PLCs remotely,
This also, opens up vulnerabilities to intruders
SCADA System Water Treatment Implementation
Data Acquisition
Smart City Architecture
Smart City Architecture (cont.)
• REST – Jason over HTTP
• MIT - Robotic device for patching for
pipeline leaks
• Libelium – smart sensor to monitor
water quality in rivers
• Carnegie Mellon Univ. – Water Quest:
monitor using GIS
• xAPI
– serial database: one attribute at a time
System Process
•
•
•
•
Read data from serial DB
Filter data
Send data to a relational DB
Data can then be further analyzed and displayed on a dashboard
Legacy Systems
Raspberry Pi 3
•
•
•
•
•
•
•
•
•
SoC: Broadcom BCM2837
CPU: 4× ARM Cortex-A53, 1.2GHz
GPU: Broadcom VideoCore IV
RAM: 1GB LPDDR2 (900 MHz)
Networking: 10/100 Ethernet, 2.4GHz 802.11n wireless
Bluetooth: Bluetooth 4.1 Classic, Bluetooth Low Energy
Storage: microSD
GPIO: 40-pin header, populated
Ports: HDMI, 3.5mm analogue audio-video jack, 4× USB 2.0, Ethernet,
Camera Serial Interface (CSI), Display Serial Interface (DSI)
Com Software Flowchart
Dashboard
Privacy and Security
•
•
•
•
Executive Order 13010 – critical infrastructure protection
NIPP – secure critical infrastructure
Vulnerabilities in IoT systems: S7-1200
Vulnerability in xAPI configuration file:
Takeaways
• Sensors and PLCs
– Use smart sensors
– Use PLCs (or microcontrollers: Raspberry Pi ,Arduino) with TCP/IP interfaces
• Smart city architecture
– xAPI (Jason over HTTP)
– Serial database for PLCs and sensors, Relational DB for dashboard
• Privacy and Security
– Strong auth and encryption, S7-1200, xAPI, legacy
• Curriculum Development
– Visual Mapping, NICE – join me @ CISSE next week.