Mitigating Common Cyber Vulnerabilities in DNP3 with Transport Layer Security

Distributed Network Protocol (DNP3) is a popular protocol used in Industrial Control Systems (ICS) and Critical infrastructure (CI) landscape, and is predominantly used in electrical sector. Its protocol stack is a slightly modified version of the Open Systems Interconnection model and allows reliable communication via TCP/IP making it optimal for Supervisory Control and Data Acquisition (SCADA) systems for remote device monitoring of various electrical equipment & devices, real time monitoring, as well as fault detection. DNP3 however is a plain text application protocol making it vulnerable to Man-in-the-Middle, message replays, message manipulation, and Denial of service attacks. With increased attacks on critical infrastructure, DNP3 protocol security is gaining importance as this SCADA protocol was traditionally designed with flexible communication as requirement but not with security requirements. In this work we test protection features offered by Transport Layer Security protocol, that can be used to secure data and communication channel from attackers by using asymmetric cryptographic suites such as RSA for generating secure session keys to symmetrically encrypt the data in transit; to prevent eavesdropping, ensure message integrity and authentication. This research paper will test security in different attack scenarios and demonstrate that TLS can mitigate some of the more common types of cyber attacks implemented on critical infrastructure.