Accelerator Network Safety at PSI Dirk Zimoch :: Controls Section :: Paul Scherrer Institut Accelerator Network Safety at PSI 6th Control System Cyber-Security Workshop at ICALEPCS 2017

Example: SLS External users at beamlines bring their own devices misconfigured ? malfunctioning ? compromised ? Need access to their home institutes, mail, web, … Protect accelerator and beamlines from each other and from outside world Confine problems Where needed give controlled access

Network layout Beamline Network Beamline Network Beamline Network Wireless Guest Network Goals Allow users their own equipment Allow access to outside Confine problems inside beamline Protect networks from outside Beamline Network Beamline Network Beamline Network Accelerator Network ssh http dhcp General PSI Network Separate firewalled networks No access into beamline or accelerator …except through defined channels

EPICS access Beamline Network Beamline Network Beamline Network Beamline Channel Access Gateways Connect beamlines with accelerator Dual network interfaces Beamline writable from accelerator Accelerator not writable from beamline (except for selected channels) EPICS access Goals Allow safe channel Access between beamlines and from office Read-only access … except for selected channels Beamline Network Beamline Network r/o Beamline Network CA Gateway CA Gateway Accelerator Network r/o CA Gateway CA Gateway General PSI Network Accelerator Channel Access Gateway Read-only access from office Uses non-standard port through firewall r/o

Access Configuration Host Remote Login Goal Allow controlled login from outside Access Configuration Host Single host with write access to user list drive Only operators can log in Operator tool modifies user list Shift Calendar Cron job checks shift calendar and clears or fills user list network drive user2 user1 Registered user list Approved user list Accelerator Network ssh Gateway sshd checks user against list Firewall blocks login Except from ssh gateway During operation Operators can control access Begin of shutdown Any registered user can log in End of shutdown No user can log in General PSI Network