Security Architecture for Secure Train Control and Monitoring System

Area of Science:

• Computer Science
• Cybersecurity
• Transportation Engineering

Background:

• Train Control and Monitoring Systems (TCMS) rely on wireless data transmission.
• Shared wireless networks pose significant security risks to train sensor data, including hacking and attacks.
• Existing security measures may not provide comprehensive end-to-end protection.

Purpose of the Study:

• To propose and develop the Securebox architecture for secure data transfer in TCMS.
• To enhance the security of data communication from the Vehicle Control Unit (VCU) to the data server.
• To provide end-to-end data security beyond traditional Mobile Station to Base Station (MS-BS) security.

Main Methods:

• Development of the Securebox architecture with four core functions: network, buffer, data, and security management.
• Implementation of the architecture within a Hardware Security Module (HSM).
• Verification through alpha and beta software testing and real-time testing on an electric-diesel train.

Main Results:

• The AES-based HSM demonstrated a 55% faster processing time compared to 3DES.
• The implementation resulted in only a 0.1% increase in memory usage.
• The Securebox architecture successfully withstood Man-in-the-Middle (MITM) attacks, providing end-to-end data security.

Conclusions:

• The Securebox architecture offers a robust solution for securing data transfer in TCMS.
• The developed HSM provides significant performance improvements and enhanced security.
• This approach establishes a new standard for end-to-end data security in railway systems.