ICS Defense Framework: Encryption, Fault Tolerance, Data Diodes, Physical Segmentation
DOI:
https://doi.org/10.22399/ijcesen.4629Keywords:
Industrial Control Systems (ICS), Operational Technology (OT), Hybrid symmetric encryption schemes, Server architectures, Data diodes, Unidirectional gatewaysAbstract
Industrial Control Systems (ICS) and Operational Technology (OT) networks face unique cybersecurity challenges stemming from legacy infrastructure, constrained computational resources, and the critical need to avoid operational disruptions. Existing solutions—such as lightweight encryption algorithms like TinyAES, VMware’s fault-tolerance mechanisms, and commercial data diodes—tend to address isolated issues but fail to provide the comprehensive resilience required in modern OT environments. This study introduces an integrated security framework comprising four components: a hybrid symmetric encryption engine optimized for low-power devices, fault-tolerant servers that maintain continuous availability, a multi-stream unidirectional data diode that secures data transfer, and a hardware-enforced segmentation mechanism using a non-IP-based kill switch. Evaluation against established security technologies—including Cisco ASA, Owl Cyber Defense, GE Proficy Historian, and Cisco TrustSec—demonstrated notable improvements: encryption latency decreased, throughput reached 9.8 Gbps, uptime exceeded 99.9%, segmentation response time improved to approximately 1.3 seconds, and CPU utilization remained around 45%. These results highlight the necessity of a unified defense-in-depth strategy capable of simultaneously addressing multiple security weaknesses and strengthening the cyber-resilience of critical industrial infrastructures.
References
[1] Kravchik, M., & Shabtai, A. (2018). Detecting cyberattacks in industrial control systems using convolutional neural networks. International Journal of Critical Infrastructure Protection, 22, 3–15.
[2] Niu, X., Sun, J., & Li, J. (2018). Dynamic detection of false data injection attacks in smart grids using deep learning. IEEE Transactions on Smart Grid, 9(4), 3824–3834.
[3] IEC. (2016). IEC 62351: Power systems management and associated information exchange – Data and communications security. International Electrotechnical Commission.
[4] VMware. (2019). Fault tolerance technical overview. VMware Documentation. Retrieved from https://www.vmware.com
[5] Qu, M., Liu, X., Zeng, P., & Liu, X. (2022). FDI attack detection using extra-trees and deep learning in power systems. Journal of Energy Informatics, 5(1), 10. https://doi.org/10.1186/s42162-022-00204-y
[6] Xie, W., Huang, Y., & Chen, Y. (2023). A survey on detection and localisation of false data injection attacks in smart grids. IET Cyber-Physical Systems: Theory & Applications, 8(2), 45–58. https://doi.org/10.1049/cps2.12055
[7] Cisco Systems. (2020). Cisco TrustSec: Simplifying security in a dynamic network. White Paper. Retrieved from https://www.cisco.com
[8] Waterfall Security Solutions. (2020). Data diode technology for critical infrastructure protection. Retrieved from https://waterfall-security.com
[9] Owl Cyber Defense. (2021). Data diode cyber security solutions. Retrieved from https://owlcyberdefense.com
[10] IEC. (2018). IEC 62443: Security for industrial automation and control systems. International Electrotechnical Commission.
[11] Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015). A survey of cyber security management in industrial control systems. International Journal of Critical Infrastructure Protection, 9, 52–80.
[12] Hahn, A., Ashok, A., Sridhar, S., & Govindarasu, M. (2013). Cyber-physical security testbeds: Architecture, application, and evaluation for smart grid. IEEE Transactions on Smart Grid, 4(2), 847–855.
[13] Adepu, S., & Mathur, A. (2016). An investigation into the response of a water treatment system to cyber attacks. Proceedings of IEEE Symposium on Reliable Distributed Systems (SRDS), 14–22.
[14] Cardenas, A. A., Amin, S., & Sastry, S. (2008). Research challenges for the security of control systems. Proceedings of the 3rd Conference on Hot Topics in Security (HotSec), 1–6.
[15] Zhang, Y., Wang, L., Sun, W., Green, R. C., & Alam, M. (2011). Distributed intrusion detection system in a multi-layer network architecture of smart grids. IEEE Transactions on Smart Grid, 2(4), 796–808.
[16] Huitsing, P., Chandia, R., Papa, M., & Shenoi, S. (2008). Attack taxonomies for the Modbus protocols. International Journal of Critical Infrastructure Protection, 1(1), 37–44.
[17] Krotofil, M., & Cárdenas, A. A. (2013). Resilience of process control systems to cyber-physical attacks. Proceedings of the Nordic Conference on Secure IT Systems (NordSec), 166–182.
[18] Zhou, Y., Yang, C., Chen, X., & Zhang, K. (2020). A lightweight encryption scheme based on chaotic maps for industrial IoT. IEEE Access, 8, 44732–44741.
[19] Hassan, M., Rehman, S. U., Javed, A. R., & Bakhsh, S. T. (2022). Security enhancement in industrial control systems using blockchain and deep learning. IEEE Access, 10, 52311–52322.
[20] Krautsevich, L., Lagerspetz, E., & Tarkoma, S. (2019). Evaluating the effectiveness of network segmentation in protecting industrial control systems. Computers & Security, 84, 48–65.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2025 International Journal of Computational and Experimental Science and Engineering
This work is licensed under a Creative Commons Attribution 4.0 International License.
