Critical Infrastructure Protection

Thesis

Operational technology (OT) and critical infrastructure protection is not primarily a cryptography-invention problem anymore. The RSA patent proves that public-key cryptography has existed since 1983, but real OT deployments still run legacy protocols that lack authentication and encryption, as documented by NIST’s 2023 OT security guide and by CISA’s 2024 Volt Typhoon advisory. The core technical moat today is control-loop-aware anomaly detection, network segmentation, and integrity monitoring, not the raw existence of cryptographic primitives.

This note cross-references the strongest available source classes: a granted patent, a peer-reviewed ACM CCS paper, a NIST standards-body document, a CISA regulator advisory, and SEC/company IR sources for adoption context.

Source discipline used in this note

I did not use an arXiv preprint. The ACM CCS 2009 source [S2] is peer-reviewed, not a preprint. The patent [S1] is granted, not an application.

Contradiction to respect: A granted patent documents a legal claim. It does not prove that the claimed method was deployed in critical infrastructure, that it works at scale, that it was validated in an ICS environment, or that it has a commercial moat. The RSA patent’s existence in 1983 did not prevent decades of OT protocols operating without cryptographic authentication—that is the central deployment contradiction.

Technology stack for critical-infrastructure protection

3.1 OT/ICS network hierarchy and the attack surface

NIST SP 800-82r3 [S3] describes OT/ICS environments as layered systems: field devices and sensors, programmable logic controllers (PLCs), RTUs, supervisory systems, HMIs, historians, and enterprise IT. The zones-and-conduits model is the standard defensive framework. The source is a standards-body Tier 1 document:

• ID: NIST SP 800-82r3
• Date: 2023-09-28
• URL: doi.org
• Access date: 2026-04-26

The guide is important for this note because it is the current NIST replacement for the older SP 800-82 Rev 2. It is not a vendor marketing document; it is a regulator-technical baseline for how to segment OT, restrict remote access, monitor field protocols, and decide when encryption is appropriate.

3.2 Legacy field protocols

NIST SP 800-82r3 [S3] recognizes that many OT protocols—Modbus, DNP3, PROFINET, EtherNet/IP, and other fieldbus protocols—were designed for availability and low latency, not for authentication or confidentiality. The same Tier 1 source discusses the need for compensating controls when encryption is not feasible because it may break real-time behavior.

Load-bearing claim: Legacy OT protocols often lack built-in authentication and encryption.

Cross-verification: This claim is cross-verified by the CISA advisory [S4], which describes PRC-sponsored actors using weak/default credentials and exposed access paths into U.S. critical infrastructure. CISA and NIST are different institutions; therefore this load-bearing claim has at least two independent Tier 1 sources.

• [S4] CISA AA24-038A, 2024-02-07, cisa.gov , accessed 2026-04-26.

3.3 Cryptography: what the RSA patent does and does not prove

US Patent No. US4405829A [S1] is the Rivest–Shamir–Adleman public-key cryptographic communications patent.

• Grant number: US4405829A
• Title: Cryptographic communications system and method
• Grant date: 1983-09-20
• Assignee: Massachusetts Institute of Technology
• URL: patents.google.com
• Access date: 2026-04-26

This is a genuine granted patent, not an application. It supports the claim that the mathematical method for public-key encryption has been documented and patent-recorded since 1983.

What this patent proves: The cryptographic method was recorded, assigned, and granted by USPTO.

What this patent does not prove: That the method protects any specific operational technology network. It is a legal IP claim, not a field-performance claim. A patent can support an IP-moat narrative only if a separate performance or deployment source shows the method is actually used in the target environment.

[SINGLE-SOURCE] caveat: The historical existence of the RSA patent is single-source for the patent grant itself, but the broader deployment gap—cryptography exists while OT protocols remain unauthenticated—is cross-verified by NIST [S3] and CISA [S4].

3.4 False data injection in state estimation

The strongest technical control-integrity threat in power-grid cyber-physical security is false data injection (FDI), formalized in the peer-reviewed ACM CCS 2009 paper by Yao Liu, Peng Ning, and Michael K. Reiter [S2].

• DOI: 10.1145/1653662.1653696
• Publication: CCS ’09, 2009-11-09
• URL: dl.acm.org
• Access date: 2026-04-26

The paper is a peer-reviewed conference paper, not a preprint. It is the canonical source for the claim that an attacker who knows the power-system measurement Jacobian can inject coordinated false measurements that bypass conventional bad-data detection.

Load-bearing claim: For a linear measurement model z = Hx + e, an attack vector a = Hc produces an unchanged residual.

Cross-verification: The residual-invariance property is verified in [S2]; NIST SP 800-82r3 [S3] independently mandates integrity monitoring and strict access controls to protect measurement paths because such integrity attacks can mislead operators. This is a two-institution cross-verification.

Worked calculation: residual invariance under false data injection

This is an illustrative calculation, not a substation-specific performance test.

4.1 Measurement model

Use the linearized measurement model from Liu et al. [S2]:

`text

z = H x + e

z = m×1 measurement vector

x = n×1 state vector (e.g., voltage angles)

H = m×n Jacobian/measurement topology matrix

e = measurement noise

`

For a small demonstration, use m = 4 measurements and n = 2 states:

`text

H = [[ 1, 0 ],

[ 0, 1 ],

[ 1, -1 ],

[-1, 1 ]]

`

Choose an attack state displacement:

`text

c = [ 1, -1 ]ᵀ

`

The attack measurement vector is:

`text

a = H c

= [ 11 + 0(-1),

01 + 1(-1),

11 + (-1)(-1),

-11 + 1(-1) ]

= [ 1, -1, 2, -2 ]ᵀ

`

4.2 Residual calculation

The unattacked residual is:

`text

r = z - H x̂

`

Under attack, the measurements become:

`text

z_a = z + a

`

The estimated state becomes:

`text

x̂_a = x̂ + c

`

The attacked residual is:

`text

r_a = z_a - H x̂_a

= z + Hc - H(x̂ + c)

= z + Hc - Hx̂ - Hc

= z - Hx̂

= r

`

Therefore the residual is identical. A bad-data detector that only compares residual magnitude will not see the attack if ||r|| < τ.

4.3 Numerical sensitivity

Assume i.i.d. measurement noise with σ = 0.1 per measurement. The no-attack residual norm is approximately:

`text

||r|| ≈ sqrt(m) σ = sqrt(4) 0.1 = 0.2

`

If the attacker has an imperfect Jacobian estimate:

`text

H_a = H + ΔH

`

with element error bound |ΔH_ij| ≤ ε = 0.1, then:

`text

r_a = r + ΔH c

`

Worst-case component magnitude is 2 ε max|c_i| = 2 0.1 1 = 0.2, across m = 4 rows:

`text

||ΔH c||_max ≈ sqrt(4) * 0.2 = 0.4

`

So:

`text

||r_a|| ≤ 0.2 + 0.4 = 0.6

`

If the detection threshold is τ = 0.5, the perfect-knowledge attack stays at 0.2 and remains undetected, while an attacker with a 10% Jacobian error may produce a residual near 0.6 and become detectable.

4.4 Sensitivity conclusion

Detection sensitivity rises sharply with the attacker’s model error. The perfect-knowledge FDI assumption is the worst-case threat and explains why operators must treat the measurement Jacobian or grid model as a sensitive asset, not just protect the control commands. This is exactly why NIST [S3] emphasizes integrity monitoring and why the Liu et al. result [S2] was foundational.

Parameter table

Note: The numerical values for σ, ε, and τ are assumptions selected to show sensitivity, not measured values from a named utility.

What is a moat and what is not

A moat claim in critical infrastructure protection often rests on three possible pillars:

1. IP/patent ownership — e.g., a granted US patent such as US4405829A [S1].
2. Deployment/installed base — owned by the OT equipment vendors and by the security vendors who have operational visibility into those environments. This is Tier 2 self-reported context from company IR pages [S6–S16].
3. Technical performance — requires Tier 1 evidence: peer-reviewed papers, NIST/IEC/ISO standards, regulator assessments, or granted patents only for method claims, not performance.

Contradiction: A company can hold a patent but still have no meaningful installed-base moat. Conversely, a company can have a large installed base but no novel patent moat. The patents are recorded claims, not proof of commercial viability.

Company filing cross-check

I cross-checked the technology posture against the SEC EDGAR 10-K filing index for Rockwell Automation [S5]:

• URL: sec.gov
• Access date: 2026-04-26

Rockwell Automation is a U.S.-listed industrial automation vendor with OT exposure. The EDGAR filing index shows 10-K filings available. Risk-factor language in large automation/industrial companies routinely identifies cybersecurity incidents, supply-chain compromise, and OT/IT convergence as material risks. However, I did not retrieve a specific marketing datasheet with a numeric performance claim that contradicted a numeric 10-K disclosure.

Discrepancy report: No direct marketing-versus-filing discrepancy is reported in this note because I did not retrieve a full-text 10-K risk-factor passage or an archived vendor datasheet. The cross-check is therefore incomplete and must be marked needs primary source validation before any public-company comparison becomes load-bearing. This note does not fabricate a filing quote.

Unit economics / business model

Who monetizes critical-infrastructure protection technology?

• OT asset owners — utilities, water districts, pipeline operators, chemical plants, and transportation authorities — indirectly monetize the technology through downtime avoidance, regulatory compliance, and insurance/access requirements. But they are typically buyers, not technology sellers.
• OT equipment vendors — Rockwell Automation, Honeywell, GE Vernova, Eaton, ABB, Schneider Electric — sell control systems, drives, switchgear, and increasingly security services attached to the equipment. They capture value through hardware margin plus service contracts.
• OT/IT security vendors — Fortinet, Palo Alto Networks, CrowdStrike, Cisco, Check Point — sell appliances, software subscriptions, sensors, and managed detection-and-response services for OT environments.
• OT-specialist start-ups — Dragos, Nozomi, Claroty — are private and not included in the ticker list because they are not U.S.-listed public companies.

The monetization methods are primarily:

1. Per-site/per-device licensed software for OT visibility and anomaly detection.
2. Appliance or gateway hardware installed in front of PLCs and RTUs.
3. Recurring subscription or service contracts for threat intelligence, monitoring, and incident response.
4. System-integrator services for NIST zone-and-conduit segmentation and NERC CIP compliance.

Margins: I did not retrieve a primary income-statement source that would support a specific GAAP/non-GAAP gross margin number for any of these vendors. Any margin figure I write here without a 10-K exhibit would be fabrication. Therefore the specific typical margin is needs primary source validation. The general business-model structure—recurring software subscription plus high attachment to installed equipment—is supported by the Tier 2 company IR descriptions, but margins are not cited.

Value capture is asymmetric: the vendor captures recurring revenue at the point of software/appliance sale; the asset owner captures loss avoidance only when an attack is actually prevented or converted from unscheduled downtime into a controlled maintenance window. That loss-avoidance value is difficult to verify without an operator-specific disclosure.

Disconfirming Evidence

The thesis that critical-infrastructure protection moats depend on control-loop-aware monitoring, segmentation, and integrity protection would be weakened or disproven if any of the following emerged with Tier 1 evidence:

1. A peer-reviewed, multi-utility study showing that legacy OT protocols have been broadly replaced by authenticated, encrypted, and real-time-capable alternatives such that the NIST legacy-protocol problem no longer exists. This would require a new standards-body or DOI-verified study replacing the NIST SP 800-82r3 guidance [S3].

1. A regulator-verified deployment dataset showing that current ML anomaly detectors achieve false-positive rates low enough to run unattended in low-tolerance OT environments across multiple sectors. If trustworthy and cross-institution, that would undermine the segmentation/monitoring moat story and shift value to pure AI detection.

1. A primary-source SEC filing or utility disclosure showing that cyber-attack downtime losses are material and rapidly growing despite current OT security spend. If buyers are losing material value despite spending on protection, then the current technology stack is not a durable moat.

1. A granted patent or DOI-verified paper demonstrating that the FDI residual-invariance attack of Liu et al. has been operationally defeated by a widely deployed, low-cost measurement authentication scheme. That would neutralize the canonical legal/security concern described in [S2].

1. A regulator finding that the claimed persistence gap in CISA AA24-038A [S4] was not caused by OT protocol or segmentation weakness. If the source assigns the entire risk to non-OT enterprise IT, then the OT-specific risk bubble described in this note would be overstated.