It is widely recognized that critical infrastructures of nations present a significant and lucrative target for cyber-attacks and threat actors. With numerous real-world examples, such as the attack on the Ukranian power grid in 2015 which caused 225,000 customers to go without power, the need to secure the networks of such systems is more important than ever. This study introduces an attestation scheme to be implemented on a Data Processing Unit (DPU), such as the Bluefield-2, to enable greater cyber-security in the Smart Grid and other operational technology networks. While previous studies address remote attestation within OT networks, most fail to consider such high-speed performance. We present DPU-LARD, a remote attestation scheme focused on minimizing message latency for common OT network messaging protocols. It tests the performance of this scheme using a DPU as a verifier, and compares it to solutions using a CPU alone. It also evaluates the performance of the scheme on low-power micro-controllers to determine the effect of the construction on latency, availability, memory, and network traffic. It finds that the DPU is able to outperform expensive, server-grade CPU’s with hardware SHA acceleration for high prover counts by up to 1.336x, and match performance at lower counts with much lighter cost. The DPU also beats CPUs lacking SHA acceleration by 11x-22x. Furthermore, under typical circumstances, DPU-LARD offers 99.9% IED availability for a 33s attestation period and incurs negligible message authentication overhead whenever an IED is available.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

DPU-LARD: DPU-Leveraged Attestation of Remote Devices for Security of OT Networks

  • William Kozlowski,
  • Deming Chen,
  • David M. Nicol

摘要

It is widely recognized that critical infrastructures of nations present a significant and lucrative target for cyber-attacks and threat actors. With numerous real-world examples, such as the attack on the Ukranian power grid in 2015 which caused 225,000 customers to go without power, the need to secure the networks of such systems is more important than ever. This study introduces an attestation scheme to be implemented on a Data Processing Unit (DPU), such as the Bluefield-2, to enable greater cyber-security in the Smart Grid and other operational technology networks. While previous studies address remote attestation within OT networks, most fail to consider such high-speed performance. We present DPU-LARD, a remote attestation scheme focused on minimizing message latency for common OT network messaging protocols. It tests the performance of this scheme using a DPU as a verifier, and compares it to solutions using a CPU alone. It also evaluates the performance of the scheme on low-power micro-controllers to determine the effect of the construction on latency, availability, memory, and network traffic. It finds that the DPU is able to outperform expensive, server-grade CPU’s with hardware SHA acceleration for high prover counts by up to 1.336x, and match performance at lower counts with much lighter cost. The DPU also beats CPUs lacking SHA acceleration by 11x-22x. Furthermore, under typical circumstances, DPU-LARD offers 99.9% IED availability for a 33s attestation period and incurs negligible message authentication overhead whenever an IED is available.