Joint Test Action Group Data Acquisition for Cyber-Physical System Security

It is crucial to secure the cyber-physical systems that automate the industrial processes essential to modern life. A hardware monitor utilizing the JTAG interface supported by most microprocessors could provide an immutable security monitor for industrial controllers. This paper explores the viability of using a commercial off-the-shelf debugger to dynamically extract memory and register data from industrial controllers to detect cyber attacks. We conducted five experiments using the Lauterbach PowerDebug Pro and the Schweitzer Engineering Laboratories RTAC-3505 real-time automation controller to determine access speed for register and memory information. The results show the fastest average downtime for register acquisition to be 8.178ms, with the fastest average downtime for processor pausing being 8.087ms. The fastest average time for reading 1KB of memory information was 24.798ms. The need to pause the microprocessor before data collection is the most significant performance-limiting factor. Based on these results, we conclude that commercial debuggers are not designed for high-speed data collection and are unsuitable for real-time cyber-attack detection. In the future, a custom tool may be designed to optimize data collection, reduce cost, and minimize the performance impact to the target device.