EXata Network Modeling - Critical Infrastructure

Connecting Supervisory Controls and Data Acquisition (SCADA) systems and Operational Technology (OT) devices via the Internet has significantly improved accessibility, automation, and efficiency, but it also introduces vulnerabilities. Every communication line is a potential attack surface. Because of this, cyber threats against public utilities and other critical infrastructure are just as ubiquitous as attacks on government and corporate computing infrastructures. By causing loss, denial of access, or manipulation of system view and control, cyber attacks against SCADA systems, i.e., power generation and distribution systems, water treatment plants, and transportation facilities, can cause widespread disruption of commerce and daily life. 

There is a pressing need for operators of SCADA systems to determine how resilient their operational systems are to cyber attacks and to develop plans to mitigate the associated risks. 

Simulating these cyber-physical systems in a lab is a safe way to investigate their vulnerabilities and develop defenses without compromising the real systems. To test the cyber resilience of such a system, it is important to simulate the dynamics of both the physical system and the underlying communication fabric, i.e., the communication system used by the cyber-physical system, which can be the target of cyber attacks.

Keysight Network Technologies has developed a high-fidelity network emulator, EXata – Critical Infrastructure, to simulate the underlying communication fabric of electrical grids and test the cyber resilience of such systems. EXata – Critical Infrastructure is integrated with OPAL-RT’s HYPERSIM simulator on the same hardware (or box) to offer a complete real-time cyber-physical solution for the development, testing, and assessment of electrical grids with communication networks. HYPERSIM, which simulates the physical system, is the only real-time digital simulator with the power to simulate electromagnetic transients of large-scale power systems, tackling operational and reliability issues threatening a power system’s cybersecurity. This integration of EXata – Critical Infrastructure and HYPERSIM provides a way to test the resilience of power systems to cyber attacks and improve their cyber defenses, thereby helping to ensure cybersecurity, reliability, and efficiency of such systems.

SCADA Network Emulated in EXata

Because EXata – Critical Infrastructure and HYPERSIM reside in the same box, they can employ low-latency communications at Layer 2 (MAC or link layer) to analyze cyber threats that can be injected at these lower layers in the physical system. An example is an attack on a power grid control system that modifies sensor messages to the controller, reporting less power than is actually available, leading the controller to shed power by stopping service to some residential consumers. Another example is an attack that delays a message from a controller to an actuator to shut down a generator, possibly leading to overloading and damaging parts of the grid. 

EXata – Critical Infrastructure provides a way to more effectively identify and visualize the impact of cyber attacks on monitoring and control systems used by power systems. With EXata – Critical Infrastructure, specific environments can be replicated in a lab and “what-if” scenarios can be quickly evaluated to determine what happens to power systems if they are subjected to cyber attacks.

EXata – Critical Infrastructure leverages Keysight’s EXata simulation/emulation software, which is a tool for planners, analysts, IT technicians and communication specialists to create software models of all types of communication networks. The models are used to study the performance of networks under different operational conditions to identify and find solutions to potential problems and to investigate the resiliency of the network to cyber threats. The models are comprised of nodes representing network elements and endpoints (e.g., routers, switches, radios, sensors, PCs, servers, firewalls and other security equipment) and the links that connect the nodes (e.g., buses, LAN segments, radio transmissions, Wi-Fi signals, LTE connections, etc.). Hardware elements (live or simulated by HYPERSIM) can be integrated into the EXata – Critical Infrastructure emulation by means of the system-inthe loop capability. Since EXata – Critical Infrastructure uses an efficient kernel designed to leverage multi-core and parallel processors to dramatically increase the event processing rate and hence simulation execution speeds, it can run emulations of networks comprised of thousands of nodes at real-time speeds with real-world high fidelity.