Securing a safety-critical system is a challenging task, because safety requirements have to be considered alongside security controls. We report on our experience to develop a security architecture for railway signalling systems starting from the bare safety-critical system that requires protection. We use a threat-based approach to determine security risk acceptance criteria and derive security requirements. We discuss the executed process and make suggestions for improvements. Based on the security requirements, we develop a security architecture. The architecture is based on a hardware platform that provides the resources required for safety as well as security applications and is able to run these applications of mixed-criticality (safety-critical applications and other applications run on the same device). To achieve this, we apply the MILS approach, a separation-based high-assurance security architecture to simplify the safety case and security case of our approach. We describe the assurance requirements of the separation kernel subcomponent, which represents the key component of the MILS architecture. We further discuss the security measures of our architecture that are included to protect the safety-critical application from cyberattacks.

The railway industry—traditionally a conservative industry with low adaption speed for innovation—is currently entering its digitization phase. The sector faces a challenge in integrating new technologies and approaches into the employed—often safety-critical—systems. Keeping the systems secure while conforming to the demanding safety norms creates previously unknown problems. In the last decades, the number of attacks on the railway system has increased. Furthermore, with standardized digital technologies, the attack surface will keep growing. Therefore, in this work, we look into the foreseeable future of the railway system and present 21 likely use cases. We analyze these use cases regarding possible threats, rate the severity of these threats, and deduce and rate necessary countermeasures. To this end, we model these use cases and the corresponding threats and countermeasures using Attack Graphs. We use a graphical solution for the risk and security analysis due to advantages over other methods, i.e., table-based solutions, like simplified presentation and an easier understanding of relationships, dependencies, and interactions between various elements. From these Attack Graphs, we extracted 14 commonly recurring attack strategies. After analyzing 49 countermeasures regarding their current maturity and further research and standardization demands, we identified 21 in need of further investigation. This implies that 21 necessary countermeasures to secure these future use cases require further research to apply to railway systems or require standardization. These results will help researchers focus on the necessary research and standardization and railway operators to ensure the security of their systems.

The railway domain is a complex critical infrastructure (CI) linking communication and control elements, and susceptible to multiple security threats similar to those encountered by industrial control systems. However, protecting modern railway signalling systems is a challenging task given the rigorous human safety standards that must be adhered to while augmenting the systems with security mechanisms. As railway CIs are subject to strong regulation and also cannot be adequately protected by physical security given that they are distributed over large areas, the strong interplay of security and safety requirements results in both unique problems and solutions. In this paper, we describe the current state of railway signalling, the obstacles to consider when protecting signalling using state of the art information security, and also outline contemporary approaches to address such obstacles. Overall, we propose a shell concept as an approach to decouple safety and security.

RaSTA is a transport protocol that has been designed to be deployed in the safety-critical domain of railway signalling. The protocol provides safety properties such as message authenticity, integrity, timeliness, and sequence. However, critical railway infrastructures face cyber attacks and therefore require security measures. We investigate the security properties of RaSTA by analysing weaknesses of the utilized MD4 algorithm in the context where RaSTA is utilized. To overcome the weaknesses, we propose relevant enhancements to the protocol that maintain the safety properties and additionally provide secure message authentication. We evaluate our work using the computation time for message authentication which is crucial for the utilization of RaSTA in a safety-critical network.