Content area
DNP3 (Distributed Network Protocol) is a recent protocol having been standardized by the IEEE 1815 standard in 2012. It is employed predominantly in the electric utility industry. The advent of DNP3 over TCP/IP made many devices and networks available on the internet which prompted attacks and exploits by several researchers and organizations. In the period 2007 to 2009 there were 27 attacks. In this paper we present an out of the box approach to bolstering security for DNP3 devices by using a split protocol design that can be selectively deployed in crucial and vulnerable parts of a utility network. We implemented a ‘mini’ DNP3 protocol stack with a reduced feature set that facilitated Class 0 and Class 1 data polls. Master and Outstation devices with this ‘mini’ stack were built and tested with Third Party tools to verify compliance with the IEEE 1815 standard. 20 Class 0 counters were configured in the Outstations. The time taken to complete the Class 0 poll was measured with and without the split design. Measurements with the split design used 1, 2, 3 and 4 Data Servers. We saw a maximum improvement of 98% reduction in the time taken for the Class 0 poll using 2 Data Servers. The Class 0 poll duration decreased as we added more Data Servers going from 1 to 2 and 3 Data Servers showing scalability. In order to test security we subjected the Outstations to a simulated Denial of Service attack using a ‘Heavy Load’ windows program which increases the CPU utilization to 98%. Under this condition we measured the Class 0 poll duration and observed a reduction in time taken by 96% using 2 Data Servers. We conclude based on these results that using a split design in DNP3 can improve security, scalability and speed.