適用於工業控制系統環境的輕量級 P4 防火牆

Abstract

保護營運技術 (OT) 基礎設施至關重要，因為它們維繫著整個社會的正常運作。現代 OT 安全解決方案提供多種進階威脅偵測與防護功能。然而，這些產品通常價格高昂且配置複雜，因此阻礙了資源受限組織部署這些方案。本論文提出了一種工業控制系統 (ICS) 防火牆設計，該設計以低廉的價格提供基本防護，並且使用上相當簡易。我們基於ICS普渡模型定義了通用的網路分段以及存取規則。此外，我們設計了一套控制流程，無需手動配置即可自動執行這些規則。評估結果表明，我們的解決方案能夠從根本上防禦針對 OT 環境的進階攻擊，並且在多數正常情況下能保持穩定的封包延遲。

Protecting OT infrastructures is of critical importance, as they maintain the operation of the entire society. Modern OT security solutions offer a wide variety of capabilities for advanced threat detection and prevention. However, their high cost and configuration complexity hinder resource-constraint organizations in deploying them. In this thesis we propose an ICS firewall design, which provides basic protection at a low price and is simple to use. We defined generic network segmentation and access policies based on the Purdue Model for ICS. In addition, we designed a control flow to automatically enforce the policies without the need for manual configuration. The evaluation showed that our solution can fundamentally prevent advanced attacks targeted at OT environments. Besides, it offers stable packet latency in most normal situations.