Secure Policy Based Configuration Framework

funded by the U.S. Department of Energy (via subcontract from EPRI)

researchers: Tim Yardley, David M. Nicol, William H. Sanders, and Klara Nahrstedt

This project is developing an extensible, policy-based configuration framework, the Secure Policy-Based Configuration Framework (PBCONF), to support the secure configuration of and remote access to modern and legacy devices from a variety of vendors. The open-source framework will combine a policy engine with a translation engine to address the interoperability challenges of the various remote access control methods and provide utilities with a single, organization-wide view of the security configuration of their power delivery devices.

Incorrect or inconsistent configuration of the multitude of energy sector devices in the field is a large potential attack vector. By applying a uniform security policy across devices in a way that provides consistency and visibility, that attack vector can be mitigated. Further, both utilities and vendors have indicated the need for configuration through remote access methods for energy sector devices in a uniform way rather than through mutually isolated applications (stovepipes). Some vendors have standardized their device configurations to address the issue, but those solutions are typically only for that vendor’s devices. A vendor-neutral framework for secure configuration and remote access is needed to solve these problems for the industry. PBCONF will address those needs through its ontology-driven policy, modular architecture, and distributed secure architecture. PBCONF will further serve as an audit tool, allowing an organization to maintain a change-managed repository of the remote access methods implemented on the configured systems. If the remote access configuration of devices is secured via this mechanism, a utility can also gain efficiency by centrally applying its policies across all devices or sets of devices in a controlled and verifiable way.

For more information, please visit http://publish.illinois.edu/iti-pbconf.