Construction of a DMZ demilitarized zone in industrial control systems using Modbus and IEC-60870-5-104 protocols
Hello everybody! It is intended for specialists in the field of industrial control systems. The rest of it may be incomprehensible due to the abundance of specific terms.
As a rule, in an automated process control system, the implementation of the demilitarized zone is as follows:
In network No. 1, there is an OPC server from which OPC client in network No. 2 should receive data. There is a DMZ server. Firewall 1 allows only connections from network 1, the rest of the connections are denied. Firewall 2 only allows connections from network 2, the rest of the connections are denied. OPC DA transmission is not possible under such conditions.
What are the standard exchange protocols in ACS TP? Of course, Modbus comes first to mind. For TCP / IP, there is Modbus TCP. There is also a Modbus-RTU mode over TCP / IP: the same packets that pass through RS-485 are transmitted over TCP / IP. Modbus-RTU over TCP / IP mode has become the de facto standard, but remains non-standard de jure.
Let's define the terms:
So, consider this scheme:
In network No. 1, the “OPC to Modbus TCP converter” is a Modbus-slave; it receives data from the OPC server. The “OPC to Modbus TCP Converter” itself establishes a TCP connection with the Modbus TCP OPC server (Modbus-Master) in the DMZ (it has a passive connection standby mode), the OPC to Modbus TCP (Modbus-slave) converter in the demilitarized zone receives data from OPC server. The OPC server Modbus TCP (Modbus-Master) in network 2 establishes a connection with the "OPC to Modbus TCP Converter" in the DMZ and transmits data to the OPC client.
In this scheme, it is non-standard that the “OPC to Modbus TCP converter”, being a Modbus-slave, itself establishes a connection with the Modbus-Master. That is why it was required to write your own converter.
Simplify the scheme:
For the server of the perimeter network, create a simple program with the code name TCP connections Convertor. She opens 2 TCP ports. From network No. 1, the OPC to Modbus TCP converter establishes a connection with it over port 1000, the Modbus TCP OPC server establishes a connection with it over port 1001. A packet arriving at port 1000 is sent to a client connected to port 1001. A packet arriving to port 1001, it is sent to a client connected to port 1000.
We can say that a potential attacker could break into the “OPC to Modbus TCP converter” by sending him bad packets. Then, in TCP connections Convertor, you can enter a ban on connecting to it from unknown IP addresses, enter packet length control and check packets for compliance with the Modbus TCP standard.
Now let's move on to IEC-60870-5-104. This protocol is more advanced than Modbus. Using it, you can send the validity of signals and timestamps. Also, the IEC-60870-5-104 standard supports the mode when Slave establishes a connection with the Master.
Master is called a supervisory station by standard, Slave is called a supervised station.
Let's redraw the scheme:
We repeat the description: In the network No. 1, the “OPC to IEC-104 converter” is a slave; it receives data from the OPC server. The “OPC to IEC-104 converter” itself establishes a TCP connection with the IEC-104 (Master) OPC server in the DMZ, the OPC to IEC-104 (slave) converter in the demilitarized zone receives data from the IEC-104 OPC server. The OPC server IEC-104 (Master) in network 2 establishes a connection with the OPC to IEC-104 Converter in the DMZ and transmits data to the OPC client.
Again, this scheme can be simplified using the TCP connections Convertor program. Another idea!
With the advent of wireless GSM / GPRS modems that provide data transmission over the network via the TCP / IP protocol stack, it has become convenient to organize communication channels with remote objects. However, it is not always possible to obtain a static IP address for a GSM / GPRS modem. In this case, a static IP address is assigned to the server. The GSM / GPRS modem establishes a connection with the server, the TCP connections Convertor program is installed on the server. The OPC server sends a request to the server on port 1000, the GSM / GPRS modem connected to port 1001 receives this packet, sends it to the counter, the counter responds, the GSM / GPRS modem sends a response to the server on port 1001, the server sends a response through port 1000 OPC server. The OPC server “thinks” that it communicates directly with the counter, the computer with the OPC server is isolated from the external network (Internet).
As a rule, in an automated process control system, the implementation of the demilitarized zone is as follows:
In network No. 1, there is an OPC server from which OPC client in network No. 2 should receive data. There is a DMZ server. Firewall 1 allows only connections from network 1, the rest of the connections are denied. Firewall 2 only allows connections from network 2, the rest of the connections are denied. OPC DA transmission is not possible under such conditions.
What are the standard exchange protocols in ACS TP? Of course, Modbus comes first to mind. For TCP / IP, there is Modbus TCP. There is also a Modbus-RTU mode over TCP / IP: the same packets that pass through RS-485 are transmitted over TCP / IP. Modbus-RTU over TCP / IP mode has become the de facto standard, but remains non-standard de jure.
Let's define the terms:
- Modbus-Slave - a program that sends data via the Modbus protocol
- Modbus-Master - a program that receives data from Slave via Modbus protocol
So, consider this scheme:
In network No. 1, the “OPC to Modbus TCP converter” is a Modbus-slave; it receives data from the OPC server. The “OPC to Modbus TCP Converter” itself establishes a TCP connection with the Modbus TCP OPC server (Modbus-Master) in the DMZ (it has a passive connection standby mode), the OPC to Modbus TCP (Modbus-slave) converter in the demilitarized zone receives data from OPC server. The OPC server Modbus TCP (Modbus-Master) in network 2 establishes a connection with the "OPC to Modbus TCP Converter" in the DMZ and transmits data to the OPC client.
In this scheme, it is non-standard that the “OPC to Modbus TCP converter”, being a Modbus-slave, itself establishes a connection with the Modbus-Master. That is why it was required to write your own converter.
Simplify the scheme:
For the server of the perimeter network, create a simple program with the code name TCP connections Convertor. She opens 2 TCP ports. From network No. 1, the OPC to Modbus TCP converter establishes a connection with it over port 1000, the Modbus TCP OPC server establishes a connection with it over port 1001. A packet arriving at port 1000 is sent to a client connected to port 1001. A packet arriving to port 1001, it is sent to a client connected to port 1000.
We can say that a potential attacker could break into the “OPC to Modbus TCP converter” by sending him bad packets. Then, in TCP connections Convertor, you can enter a ban on connecting to it from unknown IP addresses, enter packet length control and check packets for compliance with the Modbus TCP standard.
Now let's move on to IEC-60870-5-104. This protocol is more advanced than Modbus. Using it, you can send the validity of signals and timestamps. Also, the IEC-60870-5-104 standard supports the mode when Slave establishes a connection with the Master.
Master is called a supervisory station by standard, Slave is called a supervised station.
Let's redraw the scheme:
We repeat the description: In the network No. 1, the “OPC to IEC-104 converter” is a slave; it receives data from the OPC server. The “OPC to IEC-104 converter” itself establishes a TCP connection with the IEC-104 (Master) OPC server in the DMZ, the OPC to IEC-104 (slave) converter in the demilitarized zone receives data from the IEC-104 OPC server. The OPC server IEC-104 (Master) in network 2 establishes a connection with the OPC to IEC-104 Converter in the DMZ and transmits data to the OPC client.
Again, this scheme can be simplified using the TCP connections Convertor program. Another idea!
With the advent of wireless GSM / GPRS modems that provide data transmission over the network via the TCP / IP protocol stack, it has become convenient to organize communication channels with remote objects. However, it is not always possible to obtain a static IP address for a GSM / GPRS modem. In this case, a static IP address is assigned to the server. The GSM / GPRS modem establishes a connection with the server, the TCP connections Convertor program is installed on the server. The OPC server sends a request to the server on port 1000, the GSM / GPRS modem connected to port 1001 receives this packet, sends it to the counter, the counter responds, the GSM / GPRS modem sends a response to the server on port 1001, the server sends a response through port 1000 OPC server. The OPC server “thinks” that it communicates directly with the counter, the computer with the OPC server is isolated from the external network (Internet).
