Railway cyber security systems
A system for providing security to a railway system, the system comprising: a data monitoring and processing hub; a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway infrastructure devices and onboard devices of rolling stock having a train communication network (TCN), train to wayside communications (such as GSM-R) and forward monitored data to the hub for processing by the hub to detect anomalies in railway operation that are indicative of a cyber-attack; wherein an agent of the plurality of data collection agents monitoring an onboard device connected to the TCN of a given rolling stock receives signals propagated to or from the device via the TCN and forwards to the hub data based on a given received signal together with a time stamp comprising a network clock time at which the given received signal is received by the agent.
1. A cyber security system for providing security to a railway, the system comprising:
a data monitoring and processing hub;
a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway infrastructure devices and onboard devices of rolling stock having a train communication network (TCN), and forward monitored data to the hub for processing by the hub to detect anomalies in railway operation that are indicative of a cyber-attack;
wherein an agent of the plurality of data collection agents monitoring an onboard device connected to the TCN of a given rolling stock receives signals propagated to or from the device via the TCN and forwards to the hub data based on a given received signal together with a time stamp comprising a network clock time at which the given received signal is received by the agent.
2. The cyber security system according to claim 1 wherein the TCN comprises a multifunctional vehicle bus (MVB) coupled to a wired train bus (WTB) and the time stamp comprises a value of a time lapse between a beginning of a turn of the MVB during which the given received signal is propagated over the TCN.
3. The cyber security system according to claim 2 wherein the network of data collection agents is synchronized based on a reference frequency and time of day (TOD) timing information provided by Global Navigation Satellite System (GNSS) transmissions.
4. The cyber security system according to claim 3 wherein the timing information comprises a reference frequency and time of day (TOD).
5. The cyber security system according to claim 4 wherein the agent monitoring the onboard device comprises a primary reference time clock (PRTC) that provides the reference frequency and ToD.
6. The cyber security system according to claim 1 wherein an agent of the plurality of data collection agents is a stealth agent configured to operate in a stealth mode, in which stealth mode the agent is minimally disruptive of real time operation of a device that the agent monitors.
7. The cyber security system according to claim 6 wherein in the stealth mode, operation of the stealth agent satisfies limits to disruption established by an international standard.
8. The cyber security system according to claim 7 wherein the stealth mode agent is configured to monitor a device only during idle time of the device.
9. The cyber security system according to claim 7 wherein the stealth agent comprises an antenna configured to provide a wireless connection to a monitored device via which wireless connection the stealth agent receives signals from the monitored device with a minimum disruption to real time operation of the device.
10. The cyber security system according to claim 9 wherein the stealth agent is configured to receive a spreading code sequence to demodulate a signal that the stealth agent receives from the device.
11. The cyber security system according to claim 10 wherein the antenna is configured to provide a wireless connection to a radiating coax cable of a Euroloop.
12. The cyber security system according to claim 1 wherein the agents are configured to encode monitored data in a common protocol for forwarding to the hub.
13. The cyber security system according to claim 1 wherein the hub generates a signal occurrence frequency spectrum that provides a number of signals of a particular type that is received by the hub as a function of time.
14. The cyber security system according to claim 13 wherein the hub processes the occurrence frequency spectrum to identify anomalies that may be indicative of a cyber-attack.
15. The cyber security system according to claim 13 wherein the occurrence frequency spectrum provides a number of signals received during a given time period as a function of type of signals.
16. The cyber security system according to claim 13 wherein the hub generates a signal occurrence frequency spectrum for each of at least two different rolling stocks and processes the spectra to identify anomalies that might be indicative of a cyber-attack.
17. The cyber security system according to claim 1 wherein the hub processes data that it receives from the agents to identify temporal anomalies in operation of infrastructure and/or onboard devices that might be indicative of a cyber-attack.
18. The cyber security system according to claim 1 wherein the hub processes data that it receives to generate a context for operation of an infrastructure or rolling stock device and determines if operation of the device conflicts with the context to identify anomalies that might be indicative of a cyber-attack.
19. The cyber security system according to claim 1 and comprising at least one anonymizer configured to scrub information items from data that the hub receives from a data collection agent of the plurality of data collection agents which may be used to identify the cyber security system or the railway for which the system provides security.