Securing DNP3 broadcast communications in SCADA systems
Abstract
The Distributed Network Protocol version 3 (DNP3) provides Secure Authentication (DNP3-SA) as the mechanism to authenticate unicast messages from a master station to its outstations in supervisory control and data acquisition systems. In large-scale systems, it may be necessary to broadcast a critical request from a master station to multiple outstations at once. The DNP3 protocol standard describes the use of broadcast communication; however, it does not specify its security. This paper is the first to present DNP3 Secure Authentication for Broadcast (DNP3-SAB), a new lightweight security scheme for broadcast mode communication. This scheme is based on hash chain and only makes use of the existing cryptographic primitives specified in DNP3-SA. The scheme integrates itself into the DNP3-SA key update process. The proposed scheme is modeled, validated, and verified using colored Petri Nets against the most common protocol attacks such as modification, injection, and replay. Performance analysis on our scheme and the existing DNP3-SA modes (NACR and AGM) shows that DNP3-SAB reduces the communication overhead significantly at the cost of an increase with a constant term in processing and storage overhead. This benefit is maintained even when DNP3-SAB is under attack.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
DNP3-SA significantly improves resistance to unauthorized control manipulation in fielded systems despite added key management complexity.
“Despite added key management complexity, DNP3-SA significantly improves resistance to unauthorized control manipulation in fielded systems [25,26].”
From Encryption for Industrial Control Systems: A Survey of Application-Level and Network-Level Approaches in Smart Grids (2026) · cites this paper as [26]
Cites
Smart Grid Technologies: Communication Technologies and Standards
Güngör, V. Ç., Sahin, D., Koçak, T., Ergüt, S., Buccella, C., Cecati, C., & Hancke, G. P. (2011) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2011.2166794 · Cited by 2,694 · see citing works
SPINS: Security Protocols for Sensor Networks
Perrig, A., Szewczyk, R., Tygar, J. D., Wen, V. S. H., & Culler, D. (2002) · Wireless Networks · doi:10.1023/a:1016598314198 · Cited by 2,257 · see citing works
Coloured Petri Nets and CPN Tools for modelling and validation of concurrent systems
Jensen, K., Kristensen, L. M., & Wells, L. (2007) · International Journal on Software Tools for Technology Transfer · doi:10.1007/s10009-007-0038-x · Cited by 1,150 · see citing works
The TESLA Broadcast Authentication Protocol
Perrig, A., Canetti, R., Tygar, J. D., & Song, D. X. (2018) · Figshare · doi:10.1184/r1/6073610 · Cited by 842 · see citing works
A survey SCADA of and critical infrastructure incidents
Miller, B., & Rowe, D. (2012) · Proceedings of the 1st Annual conference on Research in information technology · doi:10.1145/2380790.2380805 · Cited by 336 · see citing works
Attack taxonomies for the Modbus protocols
Huitsing, P., Chandia, R., Papa, M., & Shenoi, S. (2008) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2008.08.003 · Cited by 249 · see citing works
A Taxonomy of Attacks on the DNP3 Protocol
East, S., Butts, J. W., Papa, M., & Shenoi, S. (2009) · IFIP advances in information and communication technology · doi:10.1007/978-3-642-04798-5_5 · Cited by 192 · see citing works
Lu, X., Wang, W., & Ma, J. (2013) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2012.2225453 · Cited by 133 · see citing works
Advanced Key-Management Architecture for Secure SCADA Communications
Choi, D., Kim, H., Won, D., & Kim, S. (2009) · IEEE Transactions on Power Delivery · doi:10.1109/tpwrd.2008.2005683 · Cited by 96 · see citing works
Efficient Secure Group Communications for SCADA
Choi, D., Lee, S., Won, D., & Kim, S. (2009) · IEEE Transactions on Power Delivery · doi:10.1109/tpwrd.2009.2036181 · Cited by 73 · see citing works
Formal modelling and analysis of DNP3 secure authentication
Amoah, R., Camtepe, S. A., & Foo, E. (2015) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2015.05.015 · Cited by 52 · see citing works
Self-citationSecure authentication for DNP3
Gilchrist, G. (2008) · IEEE Power Engineering Society General Meeting · doi:10.1109/pes.2008.4596147 · Cited by 52 · see citing works
Formal Vulnerability Analysis of a Security System for Remote Fieldbus Access
Cheminod, M., Pironti, A., & Sisto, R. (2011) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2010.2099233 · Cited by 46 · see citing works
Exploring Security in PROFINET IO
Åkerberg, J., & Björkman, M. (2009) · doi:10.1109/compsac.2009.61 · Cited by 44 · see citing works
Modeling and verification of cryptographic protocols using coloured petri nets and design/CPN
Al-Azzoni, I., Down, D. G., & Khédri, R. (2005) · Nordic journal of computing · doi:10.5555/1145884.1145886 · Cited by 39 · see citing works
Programming in Standard ML '97: A Tutorial Introduction
Gilmore, S. T. (1997) · Cited by 13 · see citing works
Security analysis of the non-aggressive challenge response of the DNP3 protocol using a CPN model
Amoah, R., Suriadi, S., Camtepe, S. A., & Foo, E. (2014) · International Conference on Communications · doi:10.1109/icc.2014.6883422 · Cited by 12 · see citing works
Self-citationPrivacy Compliance Verification in Cryptographic Protocols
Suriadi, S., Ouyang, C., & Foo, E. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-35179-2_11 · Cited by 7 · see citing works
Self-citationKim, W. (2012) · International Journal of Web and Grid Services · doi:10.1504/ijwgs.2012.051522 · Cited by 2 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics
Pliatsios, D., Sarigiannidis, P., Lagkas, T., & Sarigiannidis, A. G. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2987688 · Cited by 320 · see citing works
“Amoah et al. [125] developed a security mechanism for the broadcast communication mode of the DNP3 protocol.”
BackgroundSecure authentication in the grid: A formal analysis of DNP3 SAv5
Cremers, C., Dehnel-Wild, M., & Milner, K. (2019) · Journal of Computer Security · doi:10.3233/jcs-181139 · Cited by 27 · see citing works
Narayanan, M., Hafeez, M. A., & Munir, A. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6010011 · Cited by 3 · see citing works
“Despite added key management complexity, DNP3-SA significantly improves resistance to unauthorized control manipulation in fielded systems [25,26].”
- Authors
- Amoah, R., Camtepe, S., & Foo, E.
- Affiliations
- Queensland University of Technology (AU)
- Venue
- IEEE Transactions on Industrial Informatics
- Published
- 2016-08
- Volume
- 12
- Issue
- 4
- Pages
- 1474-1485
- ISSN
- 1551-3203 (ISSN-L)
- 1941-0050
- OpenAlex
- W2473954534
- Cited by
- 72
- References
- 19
- Citations by year
- 2026: 7 · 2025: 7 · 2024: 2 · 2023: 6 · 2022: 6 · 2021: 9 · 2020: 5 · 2019: 14 · 2018: 10 · 2017: 4 · 2016: 2
- FWCI
- 8.41
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Transactions on Industrial Informatics (publishedVersion)
- QUT ePrints (Queensland University of Technology) (submittedVersion)
- Griffith Research Online (submittedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Keywords
- DNP3, broadcast communication, SCADA security, hash chains, lightweight authentication, key update, colored Petri nets, replay attacks, injection attacks, modification attack, communication overhead, industrial control systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
