Figure 1: 
IEC 61162-460 network

Figure 1 shows an example IEC 61162-460 network which is composed of physical and logical network components. The physical components include a 450-Node, a 460-Node, a 460- Switch, a 460-Forwarder, and a 460-Gateway. The 460-Switch is the network infrastructure device used to connect nodes on the 460-Network. The 460-Forwarder safely exchanges data streams between the 460-Network and other controlled networks, including other 460-Networks. Moreover, the 460- Gateway connects 460-Networks and uncontrolled networks. Logical network components consist of network monitoring and system management functions. All 460-Network devices should satisfy the safety and security requirements as specified in the IEC 61162-460 standard.

All traffic from uncontrolled networks is passed or processed through the 460-Gateway.

Figure 2: 
Uncontrolled network security

To protect the 460-Network from uncontrolled networks, the 460-Gateway contains firewalls and a DMZ (Demilitarized Zone) with various application servers as shown in Figure 2. An application server is a security device that can access common data from uncontrolled networks and 460-Networks, but only uncontrolled networks have permission to access data through firewalls. A DMZ is the physical manifestation of a logical subnetwork that contains and exposes an organization’s external-facing services to larger and uncontrolled networks, usually including the internet; it is located inside the firewall. Two firewalls are implemented: one for the uncontrolled network and other for the 460-Network. The firewall is used to permit or deny traffic to and from uncontrolled networks, including off-ship network systems and other ship-borne systems, according to the preconfigured combination of source/destination IP (Internet Protocol) address, protocol, and port number [7]. All incoming and outgoing traffic must register in advance for the firewall. In this paper, a network-monitoring function, shown in Figure 1, is designed and placed in the DMZ as one application server.

Figure 3: 
IEC 611612 460-gateway

Figure 3 shows the standard IEC 61162-460 requirements for a 460-Gateway. By default, the direct connection of the 460- Network to an uncontrolled network is prohibited. Internal and external firewalls configure and implement the source/ destination IP address, protocol, and port number. All connections between the 460-Network and uncontrolled networks need to be registered, and the 460-Gateway maintains a list of all activated connections. A direct connection between the 460-network and an uncontrolled network can only be activated or deactivated by an operation on the installation site (460-Network side of the firewall). Any direct connection will terminate automatically if its time exceeds 4 hours. Automatic forward traffic of the connection will stop if there is no traffic flow after time period pre-defined by manufacturer following 10 minutes.

Given below are the Network Monitoring System requirements according to the IEC 61162-460 standard. The information that it is required to monitor includes the following:

• (1) Network loads
• (2) Traffic flow
• (3) Network Status
• (4) Network failure
• (5) Device connection

The following information is the required traffic flow information:

• (1)Input link utilization% (average over 5 minutes)
• (2)Output link utilization% (exceeding 5 minutes)
• (3)Number of input bytes (average over 5 minutes)
• (4) Number of output bytes (average over 5 minutes)
• (5) Input packets per second (average over 5 minutes)
• (6) Output packets per second (average over 5 minutes)
• (7) Input rate per interface (exceeding 5 minutes)
• (8) Output rate per interface (average over 5 minutes)

Figure 4: 
IEC 61162-460 gateway design

In designing the 460-Gateway, shown in Figure 4, the following network components are used:

• a) CISCO L3 Catalyst 3560 X series [8] 460-Switch
• b) Fort iGATE 300D [9] (460-Firewall)
• c) DMZ (Demilitarized Zone) L2 Switch
• d) 460-NMS (Network Monitoring System)
• e) 460-Nodes

Figure 4 shows, the FortiGate 300D 460-Firewall and the CISCO L3 Catalyst 3560-X Series 460-Switch used to build a secure 460-Gateway. The FortiGate 300D 460-Firewall constructs two firewalls using VDOMs: a NAT L3 VDOM and a TP-Link L2 VDOM. Each VDOM operates as a single FortiGate security firewall, and all traffic enters or leaves the VDOM completely separate from other VDOM traffic. The NAT L3 VDOM controls the traffic to and from uncontrolled external networks, and the TPLINK L2 controls traffic to and from the internal 460-Network. The CISCO 460-Switch is configured to create an uplink by setting up a VLAN1 with an IP address of 192.168.1.2/24. The SNMP server is enabled with the VLAN1 and assigned with this IP address. After that, the IP address 192.168.1.10 is assigned to the 460-NMS, which is a network monitoring system used to monitor the 460-Network. The SNMP Trap and Syslog Trap are enabled and assigned the 192.168.1.10 IP address of the 460-NMS host server. Finally, the FortiGate 300D 460-Firewall is configured to allow the 460-NMS to access the 460-Switch. 192.168.100.x/24- series network devices under the 460-Switch cannot communicate with outside networks.

In a monitoring system, the SNMP server and the Syslog Server should use static IP addresses so that monitoring system can receive information from a fixed IP.

The following commands are used to configure a 460-Switch:

• a) Set up Gateway IP for 460-Switch
  #interface vlan1
  #IP address 192.168.1.2 255.255.255.0
• b) Enable SNMP
  # snmp-server host 192.168.1.2 v3 auth authuser
• c) Enable SNMP Trap
  #snmp-server host 192.168.1.10 traps v3 auth authuser
  #snmp-server enable traps
• d) Enable Syslog
  #logging host 192.168.1.10
  #logging trap 7
  #logging on

Figure 5 shows the conceptual model view of a 460-NMS that defines the structure, behavior, and specifics of the system.

Figure 5: 
460-NMS architecture

The 460-NMS collects and presents polling data from the 460-Switch MIB (Management Information Base) file using SNMP, Syslog, and SNMP Trap protocols. The C# SNMP SharpNet library [12] is used to query the network information of the 460-Switch using SNMP protocol over UDP on port 161. Enabling the SNMP Trap in the 460-Switch allows it to send notifications over UDP on port 162 in case any device is inserted or removed or if any unknown device detected in the network. Enabling Syslog in the 460-Switch allows it to send event notification messages to the Syslog server (460-NMS). Syslog uses the UDP port 514 for communication [11]. The SQLite database management tool is used to store and manage network information received from the 460-Switch.

The GUI is used for monitoring and visualizing the network information. The system backhand service collects network information periodically and saves it into the database. The main thread of the GUI configures the polling services and controls the child thread timers. The child thread contains timers that periodically send a query to retrieve network information from the database and send the data to the main thread.

Figure 7: 
460-NMS ER model

The Entity-Relationship diagram (ERD) model identifies the entities and the relationships between those entities. Figure 7 shows the ERD of the 460-NMS. It consists of the following system information entities:

• (1) Interface: Manages the details of the 460-Switch interfaces.
• (2) Interface Utilization: Manages the traffic flow information of each 460-Network device interface connected to a 460-Switch.
• (3) System: manages the information of the system that is to be monitored
• (4) SNMP Trap: Manages SNMP Trap information received from the 460-Switch.
• (5) Notification: Manages all kinds of notifications.

To calculate the traffic flow information of each 460- Switch interface, the following formulas are used (as shown in Table 1):

Below Table 2 shows the interface table (ifTable), which is the description of interface traffic flow abbreviations used in Table 1[15].

An example of how to calculate the Input Rate of a 460- Switch interface is given below, which is taken from Table 1. The same process applies for remaining traffic flow information mentioned in Table 1:

a) Receiving and parsing the interface’s input octet value using the SNMP SharpNet library.

b) Using the method given below to calculate the Input Rate of the interface:

If currIfInOctets < prevIfInOctets then currIfInOctets = currIfInOctets + 2³²-1

Input rate = (currIfInOctets- prevIfInOctets) / (1024 * (time2 - time1))

Because the ifInOctets type in the SNMP MIB file is “Counter,” it is reset to 0 when its value reaches at maximum value (2³²-1).

where CurrIfInOctets is the interface’s input octet’s value at time2 and PrevIfInOctets is the interface’s input octet’s value at time1.

SNMP SharpNet Library commands are used to fetch the network information from the CISCO 460-Switch MIB file. MIB is a tree-structured database. Each node of an MIB consists of the object identifier (OID), data type, and value, which is related to the network [16]. For example, to access the “sysDescr” node in the MIB file, the MIB tree structure, which is shown in Figure 8 by green nodes, must be followed.

Figure 8: 
MIB tree structure

The process to access the “sysDescr” tree structure format is described below:

• a) In string format: iso.org.dod.internet.mgmt.mib.system.sysDescr,
• b) In number format: 1.3.6.1.2.1.1.1

The parsed information of the “sysDescr” node entities of the CISCO 460-Switch is as follows:

• a) OID: 1.3.6.1.2.1.1.1
• b) Data type: Octet String (as defined in MIB file)
• c) Value: Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 15.0)

4.5.1 SNMP Message Parsing

The 460-NMS’s background services will periodically send a request (containing an OID) to the SNMP agent, and then the agent will reply with the specified object’s information to the SNMP manager [17]. Figure 9 shows SNMP manager requests with an OID of 1.3.6.1.2.1.1.1.0 using the GET command. In response to the request, the SNMP agent checks the requested OID in the MIB database and sends the object’s information, which contains its value and data type, to the SNMP Manager.

Figure 9: 
SNMP message parsing

The login wizard was designed to allow access to the 460- NMS to only trusted users. The user needs an Admin ID and a password to log in, as shown in Figure 10.

Figure 10: 
460-NMS login interface

Figure 11 shows the main system view, in which the 460- Switch represents the main root and its interfaces represent child nodes. Users can double-click on each node to view its detailed information.

Figure 11: 
460-NMS main form