YekTrain, probably the smallest hackable train in the world
OT security in rail: the YekTrain as a research platform. Rail is becoming more digital and more connected, which puts OT security at the centre of the work. Modern trains are complex networks in which mechanical components, electronic control and digital systems interact.
OT security in rail: the YekTrain as a research platform
Rail is becoming more digital and more connected, which puts OT security in rail at the centre of the work. Modern trains and rail systems are complex networks in which mechanical components, electronic control and digital systems interact. That raises efficiency, and it creates new problems for the safety and reliable operation of the network as a whole.
In our FINESSE research project we built the YekTrain, a platform that lets us research and test OT security concepts for rail in a hands-on way. The YekTrain is based on real train networks and protocols such as Ethernet and the Multifunction Vehicle Bus (MVB). The idea is to represent the complexity of a modern rail system in miniature and create a test bed where things can be tried out.
How the YekTrain came about
The YekTrain did not appear by accident. During the FINESSE project we ran network analyses and recorded data from several trains. That real rail data went into the platform. The goal was an environment in which we can find weaknesses and try out countermeasures without touching an operational rail system.
With the YekTrain we can work through the security of OT systems systematically by simulating real threat scenarios. That matters because many rail systems stay in service for decades, and integrating new technology into them can produce security problems nobody planned for.
Making complexity and security tangible
Trains are highly complex systems that coordinate many components in real time. The YekTrain represents that complexity in miniature, which lets us work on traction control, HVAC systems, door control, the HMI and network security.
Traction control: precise control of the drive is essential to running a train safely. The YekTrain simulates the dynamics and control commands of a real train, so that attacks on that control can be analysed.
HVAC systems: temperature control matters in rail because the electronics depend on it. The YekTrain has an HVAC system that reproduces conditions in a real train, so we can work on the security and stability of those systems.
Door control: the door control on the YekTrain simulates the control and monitoring of electronic doors in trains. We demonstrate what an attacker can manipulate in that system to affect physical access. That lets us develop scenarios for handling attacks on physical OT components.
HMI: the YekTrain has an HMI that shows information such as temperature, door state and general operating data. The YekTrain is a miniature model without a driver, but the HMI reproduces the kind of real-time display used in modern trains for that information. In a research context it lets us examine manipulation of what is displayed, and attacks on visual systems.
Network security: rail uses standardised communication protocols such as MVB and Ethernet to control trains and move data. The YekTrain uses those protocols and lets us simulate attacks on the communication interfaces in a controlled environment.
The YekTrain as a test and research platform
Besides simulating OT security scenarios, the YekTrain serves as a learning and test platform across several areas of rail security:
-
Training and awareness: specialists can work on OT security questions hands-on. Reproducing attack scenarios such as network anomalies or manipulated control systems deepens the understanding of what is actually at risk in rail.
-
Penetration tests and security analysis: the YekTrain allows penetration tests that surface weaknesses in control and communication systems without risk. Those tests are the basis for the security strategy that follows.
-
Cyber defence and SIEM integration: simulated attacks on the YekTrain can be fed straight into SIEM systems. Threats can then be monitored and analysed in real time, and countermeasures developed against them.
-
Simulating real threat scenarios: the YekTrain is an environment close enough to the real thing to simulate attacks on network security or physical access to critical control components.
-
Research and further development: in the FINESSE project we can build new OT security work and test it in a realistic environment. The data and the experience feed straight back into the next iteration.
Research as the basis for lasting security
The YekTrain is more than a demonstration object. It is a research platform that helps us understand the problems of OT security in rail and develop answers that hold up in practice. Through the research and the work with our partners in the FINESSE project we contribute to rail security as it develops.
The reasoning behind that work is simple: security measures that last can only be built on a deep understanding of the threats OT systems face. The YekTrain is a central part of how we get there.
The project: FINESSE, attack detection for road and rail