Download SCADAPack E Security Technical Reference

Security Technical
4
9
Terminology
SCADA Security and its options for Encryption and Authentication can be complex.
Refer to this glossary of terms used in this document. For additional definitions related to SCADAPack
E, see SCADAPack E Technical Overview.
AGA12 Gateway RTU: An SCADAPack E RTU operating mode that performs encoding and decoding
between cleartext 9 and ciphertext 9 on behalf of other nodes in the network. Commonly used to
interface a secure AGA12 network to a cleartext master station. The DNP3 Host uses the AGA12
gateway feature of a SCADAPack ES to encypt plain text DNP3 messages frong from the Host to the
RTUs in the field. The same gateway decrypts the cipher text messages coming back from the field
RTUs to the Host.
AGA12 Node: A device providing SCADA Cryptographic Module (SCM) services in order to receive and
transmit secure data to the AGA12-2 standard.
Authentication: A challenge and reply exchange between two devices that provides them both with
confidence that the other device is who it claims to be.
Authority: An independent entity holding and providing security credentials. The SCADAPack E
Security Administrator 11 application is an example of a simple authority.
Challenger: A device attempting to authenticate
also Responder 10 .
9
that a partner device is who it claims to be. See
Cipher Suite: A set of cryptographic algorithms, keys, and parameters identified by a cipher suite
number. The AGA12 virtual SCM within each RTU maintains a mapping of every static session and every
open dynamic session to a cipher suite (see also session 11 )
Cipher text: Transmitted or received data that has been encoded (see also encoding
10
)
Cipher text Port: In the context of SCADAPack E RTUs, this is a communications port supporting
ciphertext DNP3. In the case of a AGA12 Gateway RTU, a ciphertext port may also support cleartext
DNP3 when operating in mixed mode.
Clear Device Port: Applies to SCADAPack E AGA12 Gateway RTU only (see AGA12 Gateway 9 ).
This port receives DNP3 data in cleartext and encodes it for transmission on a ciphertext port. A clear
device port transmits cleartext DNP3 data after it has been decoded from reception on a ciphertext port.
Cleartext: Data that has not been encoded (see also encoding 10 ). It may be received data, that is to
be transmitted ‘in-the-clear,’ data that is yet to be encoded, or data that is already decoded 9 .
Common Key: A cryptographic key value that is used amongst multiple entities to allow inter-operation.
e.g. a Group of controllers, e.g. each Configurator node.
Counterpart: An associated AGA12 device that, together with this device, form a pair for secure data
exchange.
CM: A Cryptographic Module (defined in the US Federal Information Processing Standard FIPS 140-2) is
an electronic component that is placed in-line on a communications channel and affords cryptographic
protection for the communications, including, but not limited to, encryption and authentication. The class
of such electronic devices is sometimes referred to as “bump-in-the-wire”.
Decoding: The process of checking data is signed correctly (not tampered with) and extracting the
original data from the obscured encrypted data. The algorithms for decoding are determined by the
Cipher Suite and security keys. Decoding is one of the tasks carried out by the SCADAPack E RTU’s
Virtual SCM receiving a message from another SCM. Also see Encoding 10