Critical Infrastructure Protection XVI : 16th IFIP WG 11.10 International Conference, ICCIP 2022, Virtual Event, March 14–15, 2022, Revised Selected Papers

The information infrastructure – comprising computers, embedded devices, networks and software systems – is vital to operations in every sector: chemicals, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors, materials and waste, transportation systems, and water and wastewater systems. Global business and industry, governments, indeed society itself, cannot function if major components of the critical information infrastructure are degraded, disabled or destroyed. Critical Infrastructure Protection XVI describes original research results and innovative applications in the interdisciplinary field of critical infrastructure protection. Also, it highlights the importance of weaving science, technology and policy in crafting sophisticated, yet practical, solutions that will help secure information, computer and network assets in the various critical infrastructure sectors. Areas of coverage include: Industrial Control Systems Security; Telecommunications Systems Security; Infrastructure Security. This book is the 16th volume in the annual series produced by the International Federation for Information Processing (IFIP) Working Group 11.10 on Critical Infrastructure Protection, an international community of scientists, engineers, practitioners and policy makers dedicated to advancing research, development and implementation efforts focused on infrastructure protection. The book contains a selection of 11 edited papers from the Fifteenth Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection, held as a virtual event during March, 2022. Critical Infrastructure Protection XVI is an important resource for researchers, faculty members and graduate students, as well as for policy makers, practitioners and other individuals with interests in homeland security. Contents 6 Contributing Authors 8 Preface 13 I THEMES AND ISSUES 15 Chapter 1 NATIONAL CYBER RESILIENCE AND ROLES FOR PUBLIC AND PRIVATE SECTOR STAKEHOLDERS 16 1. Introduction 16 2. Related Work 19 2.1 Cyber Infrastructure Threats 19 2.2 Cyber Infrastructure Resilience 20 3. Cyber Infrastructure and Threats 21 3.1 Cyber Infrastructure Model 21 3.2 Cyber Infrastructure Threats 25 4. National-Scale Resilience Model 26 4.1 Cyber Infrastructure and Resilience 29 4.2 Basic Resilience Model 30 4.3 Applying Resilience to Cyber Infrastructure 31 4.4 Measuring Practices in Cyber Infrastructure 31 5. Implementing the Resilience Model 39 5.1 Phase 1: Prepare 39 5.2 Phase 2: Implement 41 5.3 Phase 3: Test 42 5.4 Phase 4: Evaluate 44 6. Stakeholders and Roles 46 6.1 Cyber Resilience Government Stakeholders 46 6.2 Building Cyber Infrastructure Resilience 49 7. Conclusions 51 References 52 Chapter 2 ARE EUROPEAN SECURITY POLICIES READY FOR ADVANCED METERING SYSTEMS WITH CLOUD BACK-ENDS? 60 1. Introduction 60 2. Background 62 2.1 Advanced Metering System Evolution 62 2.2 European Union Cyber Security Legislation 64 3. Research Methodology Overview 66 4. Reference Model 68 5. Framework to Legislation Mapping 69 6. Cloud-Secure AMS Policy Framework 74 7. Conclusions 77 Acknowledgements 78 References 78 II INDUSTRIAL CONTROL SYSTEMS SECURITY 83 Chapter 3 IMPORTANCE OF CYBER SECURITY ANALYSIS IN THE OPERATIONAL TECHNOLOGY SYSTEM LIFECYCLE 84 1. Introduction 85 2. Project Background and Overview 86 3. Assessment Methodology 88 4. Research Findings 91 4.1 Device Command Processing 92 4.2 IMS/AMS Operator Workstations 92 4.3 Safety Instrumented SystemCommunications 94 4.4 Security Control Performance 96 4.5 Assessment Questions and Findings 96 4.6 Architecture Comparison 101 5. Recommendations 102 6. Discussion 107 7. Conclusions 109 Acknowledgements 110 References 110 Chapter 4 TRUSTED VIRTUALIZATION-BASED PROGRAMMABLE LOGIC CONTROLLER RESILIENCE USING A BACKFIT APPROACH 113 1. Introduction 113 2. Related Work 114 3. Virtualization for Trust and Resilience 115 3.1 PLC Virtualization 115 3.2 Remote TPM-Based Attestation 116 4. Experiments and Results 119 4.1 Experimental Environment 119 4.2 Resilience Experiments and Results 121 5. Conclusions 124 References 126 III ADDITIVE MANUFACTURING SYSTEMS 128 Chapter 5 ATTACK-DEFENSE MODELING OF MATERIAL EXTRUSION ADDITIVE MANUFACTURING SYSTEMS 129 1. Introduction 130 2. Additive Manufacturing Workflow 132 3. Additive Manufacturing Threats 133 3.1 Threats Leveraging Additive Manufacturing 134 3.2 Threats Against Additive Manufacturing 134 4. Material Extrusion Additive Manufacturing 135 5. Attack-Defense Modeling 138 6. Material Extrusion Attack-Defense Model 139 6.1 Design Phase Attack-Defense Model 140 6.2 Slicing Phase Attack-Defense Model 141 6.3 Printing Phase Attack-Defense Model 143 7. Material Extrusion Case Studies 145 7.1 Printer Annamieke 145 7.2 Printer Beatrijs 145 7.3 Printer Cathelijne 145 8. Material Extrusion Attacks 146 8.1 Design Phase Attack 146 8.2 Slicing Phase Attacks 147 8.3 Printing Phase Attack 152 9. Discussion 156 10. Conclusions 158 Acknowledgement 159 References 159 Chapter 6 MANIPULATION OF G-CODE TOOLPATH FILES IN 3D PRINTERS: ATTACKS AND MITIGATIONS 162 1. Introduction 162 2. Background and Related Work 164 2.1 Additive Manufacturing Process Chain 164 2.2 Process Chain Attacks 165 3. G-Code Toolpath File Attack Surface 167 4. G-Code Toolpath File Exploitation 169 4.1 Software Execution Vulnerability 169 4.2 Software Execution Attack 169 5. G-Code Toolpath File Attacks 171 5.1 Temperature Modification Attacks 171 5.2 Infill Exclusion Attacks 172 6. Attack Results and Mitigations 172 6.1 Attack Effectiveness Experiments 172 6.2 Temperature Modification Experiments 174 6.3 Infill Exclusion Experiments 175 6.4 Discussion 176 7. Mitigations 178 8. Conclusions 178 Acknowledgement 179 References 179 Chapter 7 DETECTING PART ANOMALIES INDUCED BY CYBER ATTACKS ON A POWDER BED FUSION ADDITIVE MANUFACTURING SYSTEM 182 1. Introduction 182 2. Related Work 184 3. Powder Bed Fusion 186 3.1 Powder Bed Fusion Process 186 3.2 Selective Laser Sintering Printer 187 4. Powder Bed Fusion Printer Anomalies 188 5. Anomaly Detection Method 190 5.1 Data Collection 192 5.2 Data Processing 194 5.3 Data Analysis 195 6. Anomaly Creation Attacks 197 7. Experimental Setup and Results 198 7.1 Experimental Setup 198 7.2 Anomaly Detection Results 200 8. Discussion 205 9. Conclusions 206 Acknowledgement 207 References 207 Chapter 8 LOW-MAGNITUDE INFILL STRUCTURE MANIPULATION ATTACKS ON FUSED FILAMENT FABRICATION 3D PRINTERS 211 1. Introduction 212 2. Related Work 214 3. Low-Magnitude Infill Structure Attacks 215 3.1 Attack Success Criteria 215 3.2 Printing Accuracy 215 3.3 Attacking Infill Structures 216 4. Attack Implementation 219 4.1 Attack Overview 221 4.2 Attack Plan 222 5. Evaluation Results 224 5.1 Stealthiness Performance 224 5.2 Mechanical Strength Impacts 228 6. Analysis and Discussion 231 7. Attack Countermeasures 234 8. Conclusions 235 Acknowledgement 235 References 236 IV INFRASTRUCTURE DEVICE SECURITY 239 Chapter 9 LEVERAGING CONFIDENTIAL COMPUTING TO ENABLE SECURE INFORMATION SHARING 240 1. Introduction 240 2. Background and Related Work 241 2.1 Confidential Computing 241 2.2 RISC-V Instruction Set Architecture 243 2.3 Keystone Enclave 243 2.4 Related Work 245 3. Experimental Configuration 246 4. Proposed Development 251 5. Experimental Results and Analysis 253 6. Conclusions 255 References 256 Chapter 10 EVALUATING THE USE OF BOOT IMAGE ENCRYPTION ON THE TALOS II ARCHITECTURE 258 1. Introduction 258 2. Background 260 2.1 Talos II Architecture 260 2.2 PNOR Image Structure 261 2.3 Initial Program Load 262 2.4 Ciphers 265 2.5 Secure Key Management 266 3. Related Work 268 3.1 Secure Firmware Updates Using AES 268 3.2 Image Encryption 268 4. Experimental Setup 269 4.1 Microcontroller Setup 269 5. Experimental Methodology 270 5.1 Experimental Factors 270 5.2 Data Collection 271 5.3 Application Scenarios 271 5.4 Assumptions 272 6. Experimental Results and Analysis 272 6.1 Boot Image Encryption Performance Impact 272 6.2 Comparison of Encryption Methods 274 6.3 Encryption Ratio 276 7. Conclusions 277 References 277 V TELECOMMUNICATIONS SYSTEMS SECURITY 279 Chapter 11 SECURING INFINIBAND TRAFFIC WITH BLUEFIELD-2 DATA PROCESSING UNITS 280 1. Introduction 280 2. Background and Related Work 281 2.1 InfiniBand Network Overview 281 2.2 Convergent Technologies 285 2.3 Security Concepts 287 3. Testbed Design 289 4. Experimental Scenarios 293 5. Experimental Results 297 6. Conclusions 301 References 302