Cooper SMP 4 - File certification and integrity checking; Detecting an integrity check failure; Recovering from an integrity failure; Using VPN Connections

102 • SMP Gateway User Manual
13.5 File certification and integrity checking
Every executable file on the SMP Gateway and every SMP Tool are digitally signed to ensure that
it originates from Cooper Power Systems. A digital fingerprint is encrypted and inserted in the file
at the factory.
Whenever you upload a file to the SMP Gateway, SMP Manager or SMP Loader performs an
integrity check on the file. Furthermore, a continuous integrity check is performed on the
SMP Gateway at all times, to detect whether any executable file has been tampered with by a virus
or if an unauthorized file has been loaded via an unconventional method.
Once you have uploaded a version of the SMP Gateway software that includes file integrity
checking to the SMP Gateway, you cannot use a previous uncertified version of the SMP Gateway
software, or a version of the SMP Tools that use uncertified files, since they would fail the
integrity checks.
13.5.1 Detecting an integrity check failure
If a file fails the integrity check, the SMP Gateway restarts and goes into a mode in which there is
no communication between the devices and the SMP Gateway.
You can detect this situation as follows:
 In the SMP Manager window, the Status column shows that the SMP Gateway is in “Safe
mode”.
 All device points are tagged with a communications failure attribute. A series of alarms are
generated, at the SCADA level or in a local HMI.
 The Reset log indicates that the integrity check function has restarted the SMP Gateway in
“Safe mode”.
 The Security log contains an entry indicating when the problem was detected, and several
entries identifying each file that failed the integrity check. It can take up to 5 minutes for all
entries to appear in the log.
13.5.2 Recovering from an integrity failure
Windows CE, which is installed in the SMP Gateway, is the software responsible for the integrity
check. If the gateway goes into “safe mode”, it means that the gateway’s application needs to be
updated to match Windows CE. To do so:
 See “Updating the SMP Gateway Application”, page 224.
 If the SMP Gateway goes into “Safe mode” after the update, contact Cybectec Technical
Support.
13.6 Using VPN Connections
The SMP 4 and SMP 16 each offer their own built-in firewall, which provides maximum security
against intrusion through the substation LAN.