Cyber Security for Utilities | SCADA and DCS Security

On Shaky Ground - A Study of Security Vulnerabilities in Control Protocols

V. CONFORMANCE TESTING MODBUS/TCP

The blackPeer framework is well-suited to conformance testing. Given a protocol's specification, one can easily construct a grammar defining the correct operation of an implementation to this specification. An excerpt of the grammar written for the MODBUS/TCP protocol is shown in Example I. In conjunction with the creation of a grammar comes the definition of the variability found across implementations. An example of one such variability is the number of holding registers present on the DUT. Such variability's are defined in a separate variable initialization file and are passed as input to the test case generator, see Figure 1. An Excerpt of the variable file for the MODBUS/TCP grammar is shown in Example II.

EXAMPLE I. Excerpt from MODBUS grammar file

REQ ::= TX HDR FC DATA %post{ int i = Utilily.getVariableValue("currLen"); int tot = Utility.sumOfLengths(tokens)-6 ;
if(i==-1)//sub with real length
	Utility.setRuleResolve(tokens[1],2, tot, 2 );
else if( tot != i )
	Utility.setVariableValue("exceptCode",4);
}%

EXAMPLE II. Excerpt from variable init file

rQuan = {0,1,$rhmaxconsec-1,$rhmaxconsec,
	$rhmaxconsec+1, $cmaxconsec-1, $cmaxconsec, $cmaxconsec+1}
wAddr={0,1,$numIReg-1,$numIReg,$numDisc-
	1,$numDisc,$numCoils-1,$numCoils, $numHReg-1,$numHReg,3000}

« Prev | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | Next »