Overview of Authentication and Access Controls for I&C systems

The integration of digital equipment and diverse automation platforms in modern power plants, including Nuclear Power Plants is due to the gradually increasing use of digital technologies. This development has raised new vulnerabilities that may endanger the critical systems for nuclear safety and physical protection at the facilities. An Instrumentation and Control system may comprise a huge number of systems, each of which must be accessed by several users. The performance of authentication and authorization processes of these users presents a challenge to the Instrumentation and Control system. Furthermore, legacy nuclear facilities may lack robust security controls such as authentication, authorization, and encryption services in their digital systems. Inadequate authentication creates vulnerabilities in Instrumentation and Control system protocols, network packets, products, and databases. Based on the authentication determination, a system may or may not permit authorized users accessing their resources. Authorization is the process of defining who and what should be permissible to have access to a specific resource. On the other hand, access control is the mechanism used to enforce authorization. In this paper, we will give an overview of current authentication and authorization schemes used in critical systems, analyze their vulnerabilities and give proper recommendations to be used. We envision that the findings in this paper provide a significant understanding of the threat of inappropriate authentication and access control mechanisms facing digital systems in Nuclear Power Plants with security and technical requirements to be used with.