Cybersecurity Assessment Framework for Digital Interface Between Safety and Security at Nuclear Power Plants

Abstract This study aims to assess the cybersecurity aspects of nuclear power plants (NPPs) in regards to a digital safety-security interface. In traditional and advanced NPPs, safety and security functions are performed by analogue and digital systems. The risk of unauthorized software changing real-world system behaviors is a major and critical infrastructure safety and security issue. Within this context, a NPP is one of the most emblematic examples of critical infrastructure cyber targets. In this study, an evaluation of the functional impact of a cyber-attack targeting specific digital equipment in a nuclear facility is performed by means of a nuclear power plant simulator specifically developed for cybersecurity assessments, deployment of realistic cyber-attack simulation scenarios, and collection and evaluation of simulated data. The Asherah nuclear power plant simulator reproduces the dynamic behavior of a two-loop 2,772 MWt pressurized water reactor (PWR) including primary, secondary, and tertiary loops, as well as selected network infrastructure elements, communication protocols, and control systems. The system is projected to survive cyber-attacks, to allow great flexibility for digital systems and network research, and to allow the capture of data for an a posteriori analysis. The preliminary simulation results obtained by the deployment of realistic cyber-attack scenarios facilitated an understanding of the impacts of cyber-attacks, how they propagate in nuclear digital cyber-physical systems and their consequences, both in terms of plant security and safety.