This particular tunnel provides a direct route for heavy traffic flowing between London and the South, a recent development which has environmentally transformed surrounding areas due to its ability to ease congestion and improve traffic flow.
Road infrastructure specialists, EM Highway Services (later Kier Group) are accountable to Highways England for the smooth running of tunnel operations.
The mile long tunnel is fitted with numerous ‘Life Safety Systems’; these include Supervisory Control/Data acquisition (SCADA) and Radar Pressurization Units (RPU’s). The SCADA system plays a crucial role in allowing the control room to monitor and, to a point, control the automated systems within the tunnel. Automated systems in place include: CCTV, lighting, ventilation, traffic control, public announcement systems, energy supply, coordinated tele control systems, communication systems, incident detection, emergency radio and wireless, fire detection, fire pump systems with water and a rear projection system.
The RPU is fitted with a ‘Collision Detection System’, which, unlike CCTV, is not compromised by visibility. SCADA and RPU systems are made up of hundreds of interconnected devices, making faults an inevitability. When critical faults occur, the traffic is stopped until the fault is repaired.
Engineers with the right skills to maintain such systems are limited. With the Tunnel’s SCADA and RPU systems maintainers often distant, a secure remote access would speed response to support related issues. The need for a remote access solution therefore emerged.
Considerations
Road infrastructure is considered critical by the UK’s, government-led, Centre for the Protection of National Infrastructure (CPNI); the security of systems associated to the road infrastructure is of paramount importance.
For Highways England (formally Highways Agency) to approve the use of a remote access system, a thorough risk assessment is to be carried-out. This is controlled through Highways England’s Code of Connection (CoCo) approval process.
The specific needs of such a system meant no ‘off the shelf’ solution could be implemented; instead it called for a tailor made solution which required the expertise of a highly skilled solutions provider.
IT4Automation
IT4Automation, experts in critical network infrastructures, have over fifteen years’ experience in building, installing and maintaining networks to light and heavy automation industries. Having already delivered innovative CoCo-compliant solutions which have transformed another UK Motorway network, IT4A were selected without hesitation. From their previous experience, IT4A had a full understanding of CPNI and specifically Highways England’s CoCo quality management and risk treatment processes.
Challenge
Developing a custom-built remote access solution, that fulfils the current need for remote assistance and support, is not necessarily challenging. However, by including segregation at the level of the remote access sessions and meeting (and exceeding) the high security requirements, imposed by Highways England the solution complexity is further increased.
In the basis of design stage, IT4A had to consider other necessities such as interfacing seamlessly with existing systems without inflicting any disruptions during installation and commissioning.
The challenge began when the interface for managing the remote access sessions was introduced. Furthermore, this had be incorporated with the existing Permit to Work system and the activity throughout the remote access sessions, recorded.
Managed Solution
The Fundamental Management Features Are Based On Already Implemented Uk Motorway Network Solutions. However, There Are Several Distinct Additions, Necessary To Ease The Remote Access Sessions Management And Further Security. A Dedicated Software Application Was Developed For This Purpose. In Addition, A Physically Controlled On/off Panel, Fitted With Key Switches, Was Constructed. These Are Used By The Control Room To Grant Or Deny Remote Access Permissions To Individual Remote Maintainers. In Order To Implement This, Intensive Research And Development Was Carried Out By It4a Engineers.
Segregated Remote Access
As Part Of The Requirement To Reduce Vulnerabilities And Potential Risks To The Critical Systems, Direct Interfacing Is Not Permitted. To Overcome This, Segregated Virtual Workstations Were Implemented For Each Remote Maintainer. Despite High Level Security Protection, When Remote Maintainers Are Granted Access Permission, They Can Perform Maintenance Jobs Equal To Physically Being At The Tunnel, Without The Safety-related Concerns. Through The Use Of Secure Remote Access Dongles, Individual For Each Remote Maintainer, The Desired Tunnel System Can Be Accessed At Any Time, Providing That An Internet Connection Exists. As Previously Mentioned, The Control Room Can Grant Exclusive Remote Access Permissions, Using Both The Remote Access Control Application And Panel. With Regards To The Latter, Limiting Access Has Been Achieved By Fitting Two Switches – The First Switch Enables Access To ‘management And Monitoring’, The Second Switch Provides Access To The ‘life Safety Systems’, Including Scada & Rpu.
Critical Network Infrastructure Protection
It4a Selected And Installed Multiple Network Security Appliances In Order To Restrict And Protect Communication, And Prevent Various Cyber-attacks. This Was Achieved Through The Implementation Of A Security Policy, As Per The Highways England, Cpni And Other Relevant Industry Standards. As Part Of The Incident Management Strategy And Quality Assurance, An Automated Activity Logging Feature Has Been Implemented. This Means, For Example, When Granting Remote Access For Repairing A Fault With The Rpu, Changes Made By The Corresponding Engineer Will Be Recorded, Allowing The Control Room To Review Any Performed Changes. The Solution Was Tested Both Off-site (Witnessed ‘factory Acceptance Testing’) And On-site (‘site Acceptance Testing’). These Checks Are To Ensure That All The Features Have Been Correctly Implemented. Including The Protection Against External Attacks, Successful Logging And Alerting, Segmentation And Unused Port Protection.
Outcome
To Determine The Appropriate Components That Fulfil The Functional Needs Of The Solution, It4a Engineers Prepared A Risk Assessment And Mitigation Plan Which Considered The Possible Threats And Risks, At Various Levels. This Means, For Example, To Mitigate Against The Risk Of Service Loss As A Result Of Air Conditioning Failure, Proven, Ruggedized, Components Were Selected. In Some Situations Suitable Products Were Not Available On The Market And Custom-built Elements Of The Solution, Such As The Physically Controlled On/off Panel, Were Engineered. To Consolidate The Solution And Offer The Necessary Versatility, It4a Used A Virtualization Platform. This Allowed Several Separate Virtual Workstations To Come Together Into One Piece Of Hardware.
Robust And Versatile Implementation
The Tunnel Now Boasts A Custom-built ‘secure, Managed And Segregated Remote Access System’, Designed, Developed And Installed By It4a. This Innovative Solution Aims To Decrease Tunnel Closures To Minutes Rather Than Hours And, Through A Significant Reduction In Travel Time, The Overall Maintenance Costs Are Reduced.
Thorough Documentation Has Been Provided To Support The Solution (Operation And Maintenance Manuals, Functional Design Specification, Risk Assessment And Treatment, Test Plans Etc.). All The Components Used In This Solution Have Been Marked As Property Of Highways England, Giving The Solution Longevity, Should Contractors Change In The Coming Years.
It4a Are Pleased With Their Contribution To The Tunnel’s Network Infrastructure And Look Forward To Using Their Expertise In This Field To Help Develop Other Transportation Operations.
