Abstract
Aiming at the risk assessment requirements of typical industrial control systems with integrated architecture of security and safety, we propose an objective and quantitative integrated security and safety assessment scheme based on Fuzzy Analytic Hierarchy Process (FAHP). First, we establish a safety and security integrated (SSI) architecture for typical industrial control systems with security measures integrated into safety failure modes. On this basis, we establish a hierarchical model of risk assessment with SSI failure mode as an element of the evaluation layer, and then standardize characteristic values of various safety-related heterogeneous index parameters. We design an entropy weight method that uses Grey Relation Analysis (GRA) method to modify the correlation of multiple indicators as a parameter strategy for determining the relative importance of element layer and evaluation layer and then use the membership function method of fuzzy statistical method to obtain the membership degree of hierarchical elements, and finally obtain the failure risk level value of equipment and system by fuzzy comprehensive evaluation. Based on a typical distributed control system, we build an experimental platform to test and verify the risk assessment plan, and compared with expert experience parameter method. The result shows that the scheme takes into account the correlation between indicators which measure the SSI risk level of industrial control system, and the entropy weight method is used to evaluate the risk of industrial control system which can overcome the subjectivity and uncertainty of individual judgment. Furthermore, the quantitative evaluation of system risk is completed by using fuzzy statistical method in the case of industrial control system without prior knowledge, and the idea of this scheme has a wide range of engineering value.
Highlights
With the application and integration of network architecture of smart factories, safety-related equipment does not exist in the form of independent isolation, but needs to be interconnected.For the safety of industrial control system, security protection requirements are necessary regarding how to balance and coordinate the resolution of contradiction between safety and security, IEC standard only provides the trade-off principle, that is, the implementation of security should not affect safety
According to the requirements of IEC 62859 Nuclear Power PlantInstrumentation and Control System-Coordination of Safety and Network Security, in its 5.2 section, there is a provision that the implementation of security should not affect safety, and this provision is used as the design principle of safety and security integrated (SSI) system, that is, the system collaborative design principle is to ensure that there is no conflict between safety and security
We focus on intrusion prevention requirements and several indicators representing its SSI attributes are mainly affected by the five failure modes in Figure 3, but this cannot replace the evaluation criteria for risk levels of other technical requirements, and needs to be analyzed separately
Summary
For the safety of industrial control system, security protection requirements are necessary regarding how to balance and coordinate the resolution of contradiction between safety and security, IEC standard only provides the trade-off principle, that is, the implementation of security should not affect safety. There is no recognized solution in the industry. Domestic and foreign solutions for the integration of safety and security can be roughly divided into two parts: unified and integrated methods [1]. The unified method can be summarized as constructing a unified risk and vulnerability analysis framework for security and security according to specific requirements and corresponding standards [2] ~ [5], and designing a step-by-step process for risk and vulnerability analysis covering safety integration VOLUME XX, 2021.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
