Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

22-4 Industrial Communication Systems

locked.doors.to.the.shop.oor,.and.locked.cabinets.to.the.control..Figure.22.1.shows.a.three-zone.security.

model.optimized.for.industrial.communication.applications.as.also.introduced.by.[SC2,TR1,KHA1]..

Corresponding.to.the.interconnection.zones.in.the.company.network.three.zones.are.available.. e.

inner.eldbus.zone.hosting.the.eld-level.communication.systems.mostly.located.at.the.shop.oor,.the.

intranet.zone.oen.build.upon.IP-based.LANs.inside.the.plant.(it.also.includes.demilitarized.zones.

(DMZs).and.checking.domains.or.inner.security.structures.to.strengthen.the.security),.and.nally.the.

Internet.zone.also.referred.to.as.company.or.entrance.domain.connecting.multiple.plants,.remote.main-

tenance

.sites,.customers,.etc.. e.zones.are.separated.from.each.other.by.dedicated.security.measures.

oen.located.at.dedicated.network.nodes.that.can.be.used.as.anchor.points.for.the.security.strategy..

Typical.examples.are.rewalls.between.the.company.and.the.intranet.domain.or.application.gateways.

between.the.intranet.domain.and.the.shop.oor..As.there.is.only.a.limited.number.of.those.network.

nodes.(between.every.couple.of.zones),.it.is.possible.to.use.state-of-the-art.components.in.regard.to.secu-

rity

.without.straining.available.resources.too.much..In.this.way,.a.defense-in-depth.approach.is.installed.

preventing.that.an.adversary.has.access.to.all.zones.and.especially.to.the.most.inner.zone.forming.the.

core.of.production..Additionally,.focusing.most.of.the.eorts.to.those.anchor.points.of.the.network.

infrastructure.avoids.misconguration.that.may.happen.if.the.number.of.security-relevant.nodes.grows.

22.3 Security Measures to Counteract Network attacks

To.counteract.network.attacks,.two.possibilities.exist..First,.unauthorized.access.to.the.network.and.

thus.to.the.data.that.is.transmitted.over.the.network.can.be.avoided..One.approach.is.to.limit.the.physi-

cal

.access.to.the.network.medium.by,.for.example,.immuring.the.network.cable..Obviously,.preventing.

physical.access.is.not.always.possible..Consider,.for.example,.the.use.of.wireless.or.wide.area.networks.

where.public.access.cannot.be.avoided.. erefore,.organizational.measures.that.limit.the.logical.access.

can.be.used.instead..Typical.examples.are.the.use.of.virtual.private.networks.(VPNs).(cf..Section.22.3.1).

and.rewalls.(cf..Section.22.3.2).

Second,

.the.transmitted.data.itself.can.be.protected.in.a.way.that.an.adversary.is.not.able.to.mali-

ciously

.interfere.with.it.even.in.cases.where.an.adversary.has.access.to.the.network..According.to.[GR1],.

the.following.security.objectives.can.be.guaranteed:.data condentiality.(against.interception.attacks),.

data integrity and authentication. (against. modication. attacks),. data freshness. (against. fabrication.

attacks),.and.data availability.(against.interruption.attacks)..Depending.on.the.security.requirements.

Shop oor

domain

(eldbus)

Intranet domain

(checking domain, DMZ)

Company or internet domain

(entrance domain)

Security

measure

Security

measure

Security

measure

Inner security structure

Trustworthy

entity

FIGURE 22.1 ree-zone.security.model.

Security in Industrial Communication Systems 22-5

of.the.application,.it.is.not.always.necessary.to.guarantee.all.of.the.security.objectives.mentioned.above..

For.exa

mple,

.if.the.non

disclosure

.of.the.tra

nsmitted

.dat

.is.not.a.str

ict

.req

uirement,

.gua

ranteeing

.dat

int

egrity,

.ava

ilability,

.and.fre

shness

.may.be.su

cient.

.In.gen

eral,

.onl

.tho

.sec

urity

.mec

hanisms

.tha

are.abs

olutely

.nec

essary

.to.sat

isfy

.the.sec

urity

.dem

ands

.of.the.app

lication

.sha

.be.imp

lemented

.(go

eno

ugh

.sec

urity).

. is.is.esp

ecially

.tru

.for.embe

dded

.net

works

.tha

.con

sist

.of.dev

ices

.wit

.lim

ited

sys

tem

.res

ources

.tha

.are.jus

.su

cient

.to.ful

ll

.the.dev

ices’

.tas

ks.

. is.con

cerns

.pri

marily

.pro

cessing

pow

.(pe

rsistent

.and.vol

atile),

.mem

ory,

.pow

.con

sumption,

.and.net

work

.ban

dwidth.

.Sin

.sec

urity

mec

hanisms

.are.com

putationally

.int

ensive,

.the.rea

lization

.of.sec

urity

.obje

ctives

.is.a.cri

tical

.desi

.ste

and.mu

.no

.ex

ceed

.th

.av

ailable

.de

vice

.re

sources.

Guaranteeing

.dat

.con

dentiality,

.int

egrity,

.and.fre

shness

.can.be.ach

ieved

.usin

.cry

ptographic

.tec

niques

.(cf

.Sec

tion

.22.

3.3).

.How

ever,

.cou

nteracting

.int

erruption

.att

acks

.lik

.DoS.att

acks

.is.not.pos

sible

.usin

.a.cry

ptographically

.sec

ured

.dat

.tra

nsmission.

. er

efore,

.add

itional

.sec

urity

.mea

sures

.are.

req

uired

.to.gu

arantee

.da

.av

ailability

.(c

.Se

ction

.22

.3.4).

22.3.1 Virtual Private Networks

A.VPN.is.a.logical.secure.network.that.is.built.upon.a.possibly.insecure.network..A.VPN.is.transpar-

ent

.to.the.con

nected

.dev

ices.

.Usu

ally,

.a.dev

ice

.ope

.a.sec

ure

.uni

cast

.con

nection

.to.a.tru

sted

.thi

par

.(e.

g.,

.cen

tralized

.VPN.ser

ver)

.whe

.the.who

.net

work

.tra

c

.to.and.fro

.the.dev

ice

.is.tun

neled

thr

ough.

.In.ind

ustrial

.sys

tems,

.VPN

.are.mos

.com

monly

.use

.to.con

nect

.eit

her

.two.dis

located

.el

dbus

seg

ments

.or.to.con

nect

.rem

ote

.mai

ntenance

.or.con

trol

.cen

ters.

.Sec

tion

.22.

5.3

.des

cribes

.the.ope

.VPN.

sol

ution

.an

.IP

sec

.ap

plication.

.Ch

apter

.15.is.fu

rther

.de

dicated

.to.Vi

rtual

.Au

tomation

.Ne

tworks.

22.3.2 Firewalls

A.rewall.is.a.network.entity.that.protects.a.trusted.network,.host,.or.service.against.unauthorized.

acc

ess

.by.ins

pecting

.the.inc

oming

.and.out

going

.net

work

.tra

c

.to.dec

ide

.whe

ther

.the.tra

c

.is.all

owed

or.not.[PF

L].

. e.dec

ision

.abo

.all

owing

.or.den

ying

.net

work

.tra

c

.is.mad

.bas

.on.the.re

wall’s

sec

urity

.pol

icy.

.Suc

.a.sec

urity

.pol

icy

.com

monly

.con

sists

.of.a.def

ault

.pol

icy

.and.a.set.of.app

lication-

specic

.rul

.tha

.spe

cify

.exc

eptions

.or.ame

ndments

.to.the.def

ault

.pol

icy.

.Con

sider,

.for.exa

mple,

.a.man

agement

.int

erface

.to.an.auto

mation

.con

troller.

. e.def

ault

.pol

icy

.to.tha

.int

erface

.may.be.set.to.“DE

NY”

whi

.a.spe

cic

.rul

.may.be.add

.tha

.all

ows

.the.sys

tem

.ope

rator’s

.man

agement

.wor

kstation

.to.acc

ess

the.int

erface.

.A.sec

urity

.pol

icy

.is.nor

mally

.pre

dened

.acc

ording

.to.the.sys

tem’s

.pol

icy.

.How

ever,

.it.may.

als

.be.nec

essary

.to.dyn

amically

.cha

nge

.the.rul

.set.of.a.re

wall.

.For.exa

mple,

.if.an.int

rusion

.det

ection

sys

tem

.(ID

.(cf

.Sec

tion

.22.

3.4)

.ide

nties

.a.mal

icious

.hos

.wit

hin

.a.net

work,

.the.IDS.may.add.a.spe

cic

rul

.to.the.rul

.set.of.the.re

wall

.tha

.exp

licitly

.dro

.all.tra

c

.ori

ginated

.fro

.the.ide

ntied

.mal

icious

hos

.(d

ynamic

.bl

acklist).

Depending

.on.the.cap

abilities

.pro

vided

.by.the.re

wall,

.thr

.di

erent

.typ

.can.be.dis

tinguished:

Apac

ket ltering rewall

.is.the.simp

lest

.for

.of.re

wall.

.It.use

.par

.of.the.hea

der

.inf

ormation

.to.dec

ide

whe

ther

.a.pa

cket

.sh

all

.be.ac

cepted

.or.dr

opped.

.Fo

.ex

ample,

.to.l

ter

.IP.tr

ac,

.th

.ad

dress

.in

formation

(IP.add

ress,

.UDP

/TCP

.por

.numb

er)

.as.wel

.as.the.enc

apsulated

.app

lication

.pro

tocol

.typ

.(e.

g.,

.HTT

FTP

)

.may.be.con

sidered

.for.ide

ntifying

.val

.tra

c.

.How

ever,

.the.sta

.of.con

nections

.(e.

g.,

.has.the.

con

nection

.alr

eady

.bee

.clo

sed?)

.as.wel

.as.det

ails

.abo

.the.app

lication

.dat

.(e.

g.,

.dis

tinguish

.bet

ween

di

erent

.HT

.me

thods)

.ar

.no

.co

nsidered.

.stateful ltering rewall,.on.the.other.hand,.additionally.maintains.the.state.of.a.connection..Using.

thi

.ext

.inf

ormation,

.the.re

wall

.is.abl

.to.det

ect

.ill

egal

.con

nection

.sta

tes

.and.so.it.is.pos

sible

.to.

spe

cify

.a.mor

.adv

anced

.rul

.set

.For.exa

mple,

.to.avo

.uns

olicited

.con

nections

.wit

.a.pro

tected

.ent

ity,

the.r

ewall

.on

.pe

rmits

.cl

ient

.pa

ckets

.a

.a.de

dicated

.co

nnection

.ha

.be

.es

tablished

.to.th

.se

rver.

Finally,

.an.app

lication proxy

.als

.insp

ects

.the.app

lication

.dat

.of.net

work

.pac

kets.

.To.ful

.ana

lyze

the.ee

cts

.of.inc

oming

.and.out

going

.net

work

.pac

kets,

.an.app

lication

.pro

.sim

ulates

.the.beha

vior

.of.the.

22-6 Industrial Communication Systems

entire.application.. erefore,.a.proxy.acts.as.a.man-in-the-middle:.to.the.outside.network,.a.proxy.behaves.

like.the.destination.device;.to.the.inside.network,.the.proxy.acts.as.the.request.origin;.and.vice.versa..

Sophisticated.application.proxies.are.completely.transparent.to.the.involved.communication.parties.

Due

.to.the.importance.of.rewalls,.they.have.to.be.reliable.and.robust.against.security.attacks..To.min-

imize

.vulnerabilities,.rewalls.are.oen.isolated,.stand-alone.devices.that.are.kept.as.simple.as.possible..

Furthermore,.access.to.rewalls.is.only.permitted.to.users.with.special.administrator.privileges.(if.at.all).

From

.a.security.point.of.view,.using.a.single.rewall.that.acts.as.a.single.wall.of.protection.may.

not.be.sucient..If.an.adversary.is.able.to.bypass.the.rewall,.he.has.full.access.to.the.entire.network..

 erefore,.it.is.more.appropriate.to.separate.the.network.into.several.zones.where.each.zone.is.protected.

with.a.dedicated.rewall.and.a.corresponding.security.policy..A.typical.example.is.shown.in.Figure.22.2..

Besides.a.separation.between.an.outside.and.an.inside.network,.the.inner.network.is.further.divided.

into.a.local.network.that.is.home.for.the.dierent.client.workstations.and.a.so-called.DMZ.. e.rewall.

between.the.outside.network.and.the.DMZ.is.responsible.for.ltering.the.incoming.network.trac.that.

is.intended.for.the.servers.as.well.as.the.client.workstations..However,.to.further.protect.the.clients,.a.

second.rewall.is.located.at.the.boundary.between.the.DMZ.and.the.local.network.. is.rewall.is.able.

to.additionally.lter.trac.that.is.irrelevant.for.the.client.workstations.(e.g.,.HTTP.trac.to.the.Web.

server).. e.main.advantage.of.this.second.rewall.is.that.if.a.server.within.the.DMZ.gets.compromised,.

the.second.rewall.acts.as.an.additional.wall.of.protection.between.the.client.workstations.and.the.com-

promised

.server..Finally,.to.further.secure.the.client.workstations.against.compromised.clients,.each.

client.may.have.its.own.personal.rewall.that.provides.an.additional.layer.of.protection.

22.3.3 Cryptography

Cryptographic.algorithms.use.mathematical.techniques.to.guarantee.a.protection.of.data.against.unau-

thorized

.interference.[MEN]..In.industrial.communication.systems,.these.cryptographic.algorithms.

can.be.used.to.secure.data.while.it.is.transmitted.over.a.possible.insecure.network..Depending.on.the.

used.algorithms,.the.following.security.objectives.can.be.guaranteed:

•

. Data condentiality:.To.avoid.an.unauthorized.disclosure.of.condential.data,.the.producer.has.to.

transform.it.in.way.that.unauthorized.entities.are.not.able.to.interpret.the.data’s.meaning.while.it.

is.transmitted.over.the.network..To.achieve.this,.encryption algorithms.can.be.used.. e.output.of.

the.encryption.(called.cipher.text).is.transmitted.over.the.network.where.the.consumer.receives.

it..To.retrieve.the.clear-text.version.again,.the.consumer.applies.the.inverse.operation.using.the.

corresponding.decryption algorithm.

Local network

DMZ

Web

server

Mail

server

Outside network

Client

workstations

FIGURE 22.2 Demilitarized.zone.

Security in Industrial Communication Systems 22-7

•. Data integrity:.To.protect.the.transmitted.data.against.unauthorized.modication,.digital signa-

tures

.or.mes

sage authentication codes

.(MA

Cs)

.are.com

monly

.use

.In.bot

.cas

es,

.the.pro

ducer

.cal

culates

.a.se

cure

.ta

.wi

.a.xe

.le

ngth.

. e.pr

oducer

.tra

nsmits

.it.tog

ether

.wit

.th

.me

ssage

.ov

the.net

work.

. e.con

sumer

.ret

rieves

.bot

.cal

culates

.the.sam

.sec

ure

.tag

.and.ver

ies

.whe

ther

the.rec

eived

.tag.cor

responds

.to.the.cal

culated

.one

.If.the.ver

ication

.pro

cess

.was.suc

cessful,

.the.

con

sumer

.ha

.pr

oved

.th

.in

tegrity

.of.th

.me

ssage.

•

. Dat

a freshness:

.Dat

.fre

shness

.is.gua

ranteed

.by.inc

luding

.a.tim

e-variant

.par

ameter.

.Usu

ally,

.a.

num

ber used only once

.(non

ce)

.is.tak

.as.uni

que

.ide

ntier

.(e.

g.,

.ran

dom

.numb

er,

.mon

otonically

inc

reasing

.cou

nter,

.tim

.sta

mp).

.How

ever,

.to.avo

.a.mal

icious

.man

ipulation

.of.the.uni

que

.toke

dur

ing

.tra

nsmission,

.it.has.to.be.use

.in.comb

ination

.wit

.an.enc

ryption

.and

/or

.a.MAC.or.dig

ital

sign

ature

.al

gorithm.

Today,

.man

.di

erent

.cry

ptographic

.alg

orithms

.tha

.are.sui

table

.to.gua

rantee

.the.sec

urity

.obje

ctives

men

tioned

.abo

.exi

st.

.Mos

.of.the

.are.bas

.on.the.Ker

ckho’s

.pri

nciple

.([K

ER],

.see.Sec

tion

.22.

2):

Whi

.the.alg

orithm

.its

elf

.can.be.mad

.pub

licly

.ava

ilable,

.only.key.par

ameters

.mus

.be.kep

.sec

ret

.(se

cret

key

s).

.Gen

erally,

.suc

.a.cry

ptographic

.alg

orithm

.wor

.as.fol

lows:

.the.pro

ducer

.tha

.wan

.to.sec

urely

tra

nsmit

.dat

.via.an.ins

ecure

.com

munication

.cha

nnel

.(e.

g.,

.pub

lic

.net

work)

.gen

erates

.a.sec

ured

.ver

sion

.of.the.unp

rotected

.dat

.by.usin

.an.alg

orithm,

.sec

ret

.key

.and.som

.oth

.kin

.of.pub

lic

.inp

par

ameters.

. e.con

sumer

.on.the.oth

.side.of.the.com

munication

.cha

nnel

.rec

eives

.the.sec

ured

.dat

and.ap

plies

.th

.re

verse

.op

eration

.to.re

trieve

.th

.pl

ain

.ve

rsion

.of.th

.da

ta.

Depending

.on.the.sec

ret

.key

.use

.at.bot

.side

.cry

ptographic

.alg

orithms

.can.be.cla

ssied

.into.sym

metric

.and.asy

mmetric

.alg

orithms.

.In.the.cas

.of.sym

metric algorithms,

.it.is.rel

atively

.eas

.to.der

ive

.the.

sec

ret

.at.the.con

sumer

.site.out.of.the.sec

ret

.on.the.pro

ducer

.site

.In.sym

metric

.alg

orithms,

.the.sec

rets

.on.

the.pro

ducer

.and.con

sumer

.site.are.the.sam

.Typ

ical

.exa

mples

.of.sym

metric

.enc

ryption

.alg

orithms

.are.

DES.[DE

S],

.AES.[AE

S],

.Cam

ellia

.[R3

7],

.and.SAF

.[SA

F].

.Pop

ular

.MAC.cal

culation

.alg

orithms

.tha

use.sy

mmetric

.al

gorithms

.ar

.CM

.[R

44]

.an

.HM

.[H

MA].

.asy

mmetric algorithms

.(al

.cal

led

.pub

lic

.key.alg

orithms),

.eac

.ent

ity

.has.a.so-

called

.pub

lic/

private

.key.pai

.whe

.the.pub

lic

.key.is.mad

.pub

licly

.ava

ilable

.and.the.priv

ate

.key.is.onl

.kno

.to.

the.ent

ity

.its

elf.

.In.the.cas

.of.asy

mmetric

.enc

ryption

.alg

orithms,

.the.pub

lic

.key.of.the.con

sumer

.is.

used.to.encrypt.the.data.at.the.producer.site.. e.consumer.is.able.to.decrypt.the.data.using.its.private.

key

.In.the.cas

.of.asy

mmetric

.sig

nature

.cal

culation

.and.ver

ication

.alg

orithms,

.the.prod

ucer

.sig

the.tag.of.the.dat

.usi

.its.priv

ate

.key.and.the.con

sumer

.is.abl

.to.ver

ify

.the.sig

nature

.usi

.the.pub

lic

.key.of.the.prod

ucer.

.Asy

mmetric

.alg

orithms

.rel

.on.the.fac

.tha

.it.is.com

putationally

.inf

easible

to.der

ive

.the.priv

ate

.key.out.of.the.pub

lic

.key

.Pop

ular

.asy

mmetric

.enc

ryption

.alg

orithms

.are.RSA.

[RS

A],

.ElG

amal

.enc

ryption

.sys

tem

.[EL

G],

.and.ell

iptic

.cur

.int

egrated

.enc

ryption

.sch

eme

.(EC

IES)

[HA

N].

.Typ

ical

.exa

mples

.of.dig

ital

.sig

nature

.gen

eration

.and.ver

ication

.alg

orithms

.bas

.on.asy

metric

.alg

orithms

.are.the.dig

ital

.sig

nature

.alg

orithm

.(DS

.[DS

S],

.ElG

amal

.sig

nature

.sch

eme

.[EL

G],

and.ell

iptic

.cur

.DSA.(EC

DSA)

.[HA

N].

.add

ition

.to.sym

metric

.and.asy

mmetric

.alg

orithms

.tha

.are.gen

erally

.ref

erred

.to.as.key

.alg

rithms,

.the

.are.cry

ptographic

.alg

orithms

.tha

.do.not.nee

.any.sec

ret

.par

ameters

.at.all

. es

.so-

called

unk

eyed algorithms

.do.not.dir

ectly

.gua

rantee

.any.of.the.sec

urity

.obje

ctives

.men

tioned

.abo

ve.

.Mor

eover,

the

.are.oe

.use

.in.comb

ination

.wit

.key

.alg

orithms.

.A.typ

ical

.exa

mple

.is.a.cry

ptographic hash

function

.tha

.may.be.use

.in.comb

ination

.wit

.oth

.alg

orithms

.to.gua

rantee

.dat

.int

egrity.

.A.cry

pto-

graphic

.has

.fun

ction

.is.a.com

putationally

.ec

ient

.one

-way

.fun

ction

.tha

.map

.an.inp

.of.arb

itrary

len

gth

.to.an.out

put

.of.xe

.len

gth.

. e.mai

.pro

perty

.of.suc

.a.fun

ction

.is.col

lision

.resi

stance:

.It.is.

computationally.infeasible.to.nd.two.distinct.inputs.that.have.the.same.hash.value.as.output.. e.

mos

.com

monly

.use

.cry

ptographic

.has

.fun

ctions

.are.MD5.[R1

.and.fun

ctions

.fro

.the.SHA.fam

ily

[SH

A].

.Cry

ptographic

.has

.fun

ctions

.are.use

.to.cal

culate

.the.tag.tha

.is.use

.in.MAC.and.dig

ital

.sig-

atures.

.Oth

.exa

mples

.of.unk

eyed

.alg

orithms

.are.pse

udo

.ran

dom bit generators

.whe

.the.gen

erated

pse

udo

.ra

ndom

.nu

mber

.ma

.be.us

.as.no

nces

.to.gu

arantee

.da

.fr

eshness.

22-8 Industrial Communication Systems

22.3.4 DoS Prevention and Detection

Nevertheless,.there.are.security.attacks.that.cannot.be.prevented.using.cryptographic.methods..Typical.

rep

resentatives

.of.suc

.att

acks

.are.DoS.att

acks

.tha

.thr

eaten

.dat

.ava

ilability.

.DoS.att

acks

.can.be.cla

sied

.into.hos

t-based

.and. net

work-based

.DoS.att

acks.

.Hos

t-based DoS attacks

.try. to. was

.sys

tem

res

ources

.(e.

g.,

.by.con

suming

.pro

cessor

.tim

.of.a.ser

ver

.by.sen

ding

.mul

tiple

.req

uests)

.to.pre

vent

.the.

tar

get

.fro

.per

forming

.its.exp

ected

.fun

ction.

.Net

work-based DoS attacks,

.on.the.oth

.han

.try.to.

int

errupt

.the.com

munication

.in.a.net

work.

.A.com

mon

.exa

mple

.is.an.adv

ersary

.tha

.tri

.to.con

sume

the.net

work

.ban

dwidth

.(e.

g.,

.by.oo

ding

.the.net

work

.wit

.uns

olicited

.mes

sages).

. e.situ

ation

.is.fur

ther

.ag

gravated

.if.mu

ltiple

.so

urces

.at

tack

.a.sin

gle

.vi

ctim

.(d

istributed

.Do

.at

tack).

DoS

.att

acks

.for

emost

.hav

.mas

sive

.eco

nomic

.imp

act.

.Con

sider,

.for.exa

mple,

.an.ass

embly

.lin

.tha

.is.

the.tar

get

.of.a.DoS.att

ack.

.A.shu

tdown

.of.the.lin

.lea

.to.an.eco

nomic

.imp

act

.tha

.can.be.easi

.com

pared

.to.the.imp

act

.of.a.suc

cessful

.att

ack

.on.the.com

pany

.Web.ser

ver.

. e.onl

.di

erence

.is.tha

.for.the.

Web.se

rver

.el

aborate

.IT.se

curity

.me

asures

.ar

.al

ready

.co

mmon

.pr

actice.

.cou

nteract

.DoS.att

acks,

.two.pos

sibilities

.exi

st.

.DoS

prevention,

.on.the.one.han

.has.the.aim.to.

lim

.the.acc

ess

.to.sys

tem

.res

ources

.in.a.way.tha

.an.adv

ersary

.doe

.not.hav

.the.opp

ortunity

.to.suc

cess-

fully

.per

form

.DoS.att

acks.

.One.opp

ortunity

.to.ful

.pre

vent

.DoS.att

acks

.is.to.lim

.the.phy

sical

.acc

ess

to.the.net

work

.med

ium

.and.to.the.dev

ices

.tha

.hav

.an.int

erface

.to.the.med

ium.

.(e.

g.,

.imm

uring

.the.

net

work

.cab

.or.by.loc

king

.the.dev

ices

.into.a.saf

.con

tainment.)

.Obv

iously,

.suc

.iso

lation

.is.not.alw

ays

eas

.to.ac

hieve.

Another

.pos

sibility

.to.pre

vent

.hos

t-based

.DoS.att

acks

.is.the.use.of.so-

called

.cli

ent puzzles

.[TU

O].

. e.

main.objective.of.a.client.puzzle.is.to.make.a.DoS.attack.at.least.as.expensive.for.the.adversary.as.for.the.

tar

get

.in.ter

.of.com

putational

.cos

.Con

sider,

.for.exa

mple,

.a.cli

ent

.(e.

g.,

.ope

rator

.wor

kstation)

.wan

to.est

ablish

.a.con

nection

.to.a.ser

ver

.(e.

g.,

.con

troller).

.To.set.up.a.con

nection,

.the.cli

ent

.sen

.an.ini

tial

req

uest

.to.the.ser

ver.

.If.the.ser

ver

.is.bus

.(e.

g.,

.the

.are.oth

.ope

.con

nections),

.the.ser

ver

.sen

.bac

.a.

cli

ent

.puz

zle

.tha

.the.cli

ent

.has.to.sol

ve.

.A.typ

ical

.exa

mple

.of.suc

.a.cli

ent

.puz

zle

.wou

.be.a.has

.val

of.lim

ited

.len

gth

.[WE

I].

. e.cli

ent

.has.the.obje

ctive

.to.nd.the.inp

.val

.tha

.pro

duces

.thi

.has

.val

ue.

To.ach

ieve

.thi

.the.cli

ent

.has.to.sol

.thi

.pro

blem

.by.bru

.for

ce.

.As.it.is.ver

.eas

.to.ver

ify

.whe

ther

.the.

sol

ution

.is.val

.or.not

.the.cli

ent

.mus

.pay.mor

.com

puting

.cos

.tha

.the.ser

ver.

.Ae

.the.cli

ent

.has.

sol

ved

.the.puz

zle,

.it.sen

.the.sol

ution

.to.the.ser

ver.

. e.ser

ver

.ver

ies

.the.sol

ution,

.and.if.it.is.cor

rect

the.ser

ver

.acc

epts

.fur

ther

.req

uests.

.If.the.sol

ution

.is.not.val

id,

.acc

ess

.to.the.req

uested

.ser

vice

.is.den

ied

and.fu

rther

.re

quests

.ar

.te

mporally

.bl

ocked

.fr

.th

.cl

ient.

.situ

ations

.whe

.pre

vention

.met

hods

.are.ina

pplicable,

.DoS.att

acks

.sha

.at.lea

.be.det

ected

.(DoS.

det

ection).

.In.gen

eral,

.the.aim.is.to.mak

.the.sys

tem

.int

rusion

.tole

rant

.and.lim

.the.ae

cted

.are

.Aty

ical

.exa

mple

.wou

.be.the.use.of.an.IDS.[CH

R].

.An.IDS.tri

.to.det

ect

.abn

ormal

.sys

tem

.sta

tes

.by.com

paring

.the.act

ual

.beh

avior

.wit

.the.exp

ected

.one

.If.a.situ

ation

.tha

.may.lea

.to.a.sec

urity

.att

ack

.has.

bee

.de

tected,

.co

untermeasures

.ha

.to.be.in

itiated

.to.mi

nimize

.th

.co

nsequences.

.IDS.com

monly

.con

sists

.of.fou

.com

ponents

.(cf

.Fig

ure

.22.

3).

. e.dat

a gathering component

.is.

res

ponsible

.for.col

lecting

.the.dat

.by.obs

erving

.the.net

work

.tra

c

.as.wel

.as.the.beh

avior

.of.the.di

erent

net

work

.dev

ices.

.IDS.are.cla

ssied

.acc

ording

.to.the.typ

.of.dat

.col

lection

.(i.

e.,

.the.loc

ation

.of.the.dat

gat

hering

.com

ponents).

.A.hos

t-based

.IDS.tri

.to.dis

cover

.abn

ormal

.act

ivities

.on.a.sing

.hos

. es

met

hods

.obs

erve

.the.act

ivities

.on.a.sing

.dev

ice

.and.com

pare

.the.beh

avior

.pat

tern

.wit

.a.ref

erence

.pat

tern

.(pr

oling).

.Hos

t-based

.int

rusion

.det

ection

.is.esp

ecially

.app

licable

.for.sec

urity-critical

.dev

ices

.(e.

g.,

key.ser

vers).

.A.net

work-based

.IDS.obs

erves

.the.ent

ire

.net

work

.tra

c.

. er

efore,

.the

.sys

tems

.are.abl

to.di

scover

.an

omalies

.th

.a

ect

.mo

.th

.a.sin

gle

.ho

st.

.cor

.uni

.of.an.IDS.is.the.dat

a processing component.

. is.com

ponent

.pro

cesses

.the.col

lected

dat

.and.det

ermines

.whe

ther

.abn

ormal

.beh

avior

.is.pre

sent.

.Aga

in,

.di

erent

.app

roaches

.exi

st.

. e.two.

mos

.imp

ortant

.one

.are.cal

led

.mis

use-based

.and.ano

maly-based.

.Mis

use-based

.sys

tems

.use.a.pri

ori

kno

wledge.

act

ivities.

tha

for

att

ack..

kno

wledge.

stor

ed.

dat

abase.

tha

con

tains.

typ

ical.

pat

terns

.of.kno

.att

acks

.als

.cal

led

.sign

atures.

.To.det

ermine

.whe

ther

.an.obs

ervation

.can.be.cla

ssied

Security in Industrial Communication Systems 22-9

as.an.attack,.dierent.techniques.such.as.expert.systems.as.well.as.signature.detection.mechanisms.

can.be.used..Anomaly-based.intrusion.detection.tries.to.detect.abnormal.behavior.by.comparing.the.

observed.behavior.with.the.normal.and.expected.behavior.also.called.reference.pattern..To.achieve.such.

a.comparison,.a.system.model.must.be.specied.. is.model.must.dene.the.default.reference.pattern.

(i.e.,.network.trac.or.device.behavior).that.represents.the.expected.and.normal.behavior.of.the.sys-

tem.

.Obviously,.this.default.behavior.is.not.static.since.it.can.change.during.the.life.time.of.the.system..

 erefore,.self-learning.techniques.(e.g.,.neural.networks).are.usually.applied.

Collecting

.the.results.as.well.as.the.observed.data.(communication.traces).is.the.task.of.the.data stor-

age unit. e response unit,

.nally,.is.responsible.for.initiating.actions.to.minimize.the.consequences.of.a.

detected.security.attack.. is.can.be.done.by.performing.a.direct.feedback.to.the.network..For.example,.

it.could.decouple.the.aected.network.segment(s).

Clearly,

.DoS.prevention.is.preferable.to.detection.since.prevention.mechanisms.avoid.even.the.occur-

rence

.of.an.attack..Since.a.full.prevention.is.not.always.possible,.a.combination.of.the.advantages.of.both.

methods.by.using.a.hybrid.approach.is.the.most.appropriate.solution.

22.4 Security Measures to Counteract Device attacks

So.far,.only.the.protection.of.network.trac.has.been.discussed,.yet.also.attacks.to.the.device.itself.have.

to.be.considered.. ese.attacks.can.be.divided.into.two.categories:.physical.protection.of.the.device.and.

security.soware.environments.

22.4.1 Protected Hardware and Security token

Keys.used.for.authentication.and.encryption.of.messages.typically.are.condential.information.to.be.stored.

on.a.eldbus.node..Yet,.condential.information.is.not.limited.to.this.and.also.includes.application.data.

such.as.application.counters,.e.g.,.the.power.consumption.value.of.a.electricity.meter,.which.should.not.be.

altered.illegitimately..Countermeasures.on.a.rst.level.restrict.access.to.condential.data.as.oered.by.most.

cryptographic.units.in.today’s.communication.chips—keys.can.be.written.to.the.key.storage.but.only.be.

retrieved.by.the.crypto.engine,.and.hence.are.not.visible.to.the.other.applications.on.the.node.(cf..Section.

22.4.2)..Yet,.some.implementations.do.not.honor.this.fully,.and.in.some.eldbus.systems.the.key.data.can.

nevertheless.be.read.by.dedicated.management.commands.originally.designed.to.read.an.arbitrary.part.of.

the.nodes’.memory..For.application.data,.such.protected.memory.areas.do.not.exists.in.general.

.equipment.should.be.tamper.resistant.and.tamper.evident,.additionally.a.protected.security.token.

must.be.added..A.trade-o.between.security.and.costs.is.required..A.rst.level.measure.might.already.be.

Data gathering

Knowledge

base

Response

component

Data storage

component

Data processing component

Process model

FIGURE 22.3 Intrusion.detection.system.

22-10 Industrial Communication Systems

a.seal.to.allow.visual.detection.of.direct.manipulation.and.to.disable.network.management.commands.

if.app

licable.

.A.sec

ond

.lev

.mig

.be.a.sol

.cas

.tha

.can

not

.be.ope

ned

.wit

hout

.obv

iously

.dam

aging

the.cas

.or.com

ponents

.of.it.. e.thi

.lev

.of.phy

sical

.pro

tection

.is.the.usa

.of.a.sec

urity

.toke

.tha

con

tains

.th

.se

crets.

.gen

eral,

.for.mos

.app

lications

.det

ecting

.the.ope

ning

.of.the.cas

.wou

.inc

rease

.sec

urity,

.but.due.

to.cos

.res

trictions

.mea

sures

.can.onl

.be.ver

.simp

le,

.e.g

.a.swi

tch

.or.a.simp

.lig

.det

ector.

.Hen

ce,

the.ove

rall

.inc

rease

.of.sec

urity

.is.onl

.ver

.mar

ginal,

.sinc

.the.dev

ices

.do.not.hav

.ind

ependent

.pow

sup

ply

.(ba

ttery)

.tha

.mai

ntains

.the.sec

urity

.fun

ctions

.if.the.dev

ice

.is.unp

lugged.

. at.is,.an.att

acker

.can.

ana

lyze

.th

.tu

rned-o

.de

vice

.an

.ci

rcumvent

.th

.se

curity

.me

asures

.wi

.li

ttle

.e

ort.

Considering

.all.pos

sible

.att

acks,

.it.is.not.cos

.ee

ctive

.to.prot

ect

.the.who

.nod

.rat

her

.a.sma

.par

is.equ

ipped

.wit

.hig

h-security

.meas

ures,

.whi

.is.cal

led

.sec

urity token.

.For.oth

.appl

ications

.in.com

merce

.and.for.bui

lding

.sec

urity,

.suc

.sec

urity

.toke

.are.alr

eady

.on.the.mark

.and.sta

.of.the.art

 e.most.kno

.toke

.is.the.sma

.car

.tha

.imp

lements

.wel

l-proven

.sec

urity

.meas

ures

.to.ful

ll

.the.

req

uirements

.de

ned

.bef

ore.

. es

.com

mercially

.ava

ilable

.sec

urity

.toke

.oe

.an.adv

anced

.sec

urity

des

ign

.and.sat

isfy

.the.req

uirements

.of.hig

h-security

.appl

ications

.(e.

g.,

.ele

ctronic

.mone

.dig

ital

.sig

na-

tures).

.Mea

sures

.lik

.scr

ambled

.RAM.pla

cement,

.pow

.supp

.moni

toring,

.fai

l-safe

.ope

ration,

.and.

pow

.con

sumption

.cip

hering

.are.alr

eady

.inc

luded

.in.suc

.dev

ices.

.Com

mon

.prod

ucts

.oe

.hav

.a.

cer

ticate

.to.be.res

istant

.aga

inst

.mal

icious

.scr

utiny

.and.man

ipulation

.(e.

g.,

.com

mon

.cri

teria

.eva

lua-

tion

.lev

els).

.[SC1],.the.authors.already.implemented.such.an.approach.for.the.LonWorks.[LON].protocol.oer-

ing

.two.adv

antages:

.Fir

.the.sma

.car

.pro

vided

.the.req

uired

.sec

ure

.dat

.stor

age

.for.the.nod

.and.

sec

ond

.the.car

.als

.sup

ported

.sta

te-of-the-art

.cry

ptographic

.fun

ctions.

. e.sma

.car

.was.con

nected

to.a.Lon

Works

.nod

.usin

.a.ser

ial

.int

erface

.and.int

egrated

.in.the.app

lication

.in.suc

.a.way.tha

.eac

mes

sage

.sen

.was.pro

tected

.by.an.HMA

C-SHA-1

.cry

ptographic

.che

.sum.and.enc

rypted

.usin

.3-D

ove

rcoming

.the.lim

itations

.of.the.Lon

Works

.sec

urity

.mec

hanisms

.wit

.res

pect

.to.str

ength,

.numb

.of.

sec

urity

.gro

ups

.(on

.one.is.sup

ported

.by.Lon

Works),

.and.the.sup

port

.of.sec

urity

.ser

vices

.(Lo

nWorks

onl

.su

pports

.a.we

.au

thentication

.fo

.un

icast

.se

rvices).

Yet,

.a.com

plete

.int

egration

.of.the.sec

urity

.toke

.in.the.chi

.is.oe

.fav

orable

.com

pared

.to.the.ext

er-

nal

.sma

.car

.and.the.req

uired

.int

erconnection

.cir

cuit.

.Esp

ecially

.for.wir

eless

.net

works,

.man

.chi

alr

eady

.hav

.a.sec

urity

.toke

.int

egrated

.for.cry

ptographic

.ope

rations

.red

ucing

.the.nec

essity

.for.an.add

tional

.se

curity

.tok

en.

22.4.2 Secure Software Environments

A.common.approach.that.directly.manipulates.the.behavior.of.a.device.is.to.interfere.with.the.soware.

run

ning

.on.it..To.ach

ieve

.thi

.an.adv

ersary

.may.try.to.cha

nge

.exi

sting

.pro

gram

.cod

.or.eve

.add.new.

cod

.fra

gments

.to.exi

sting

.one

. us

.mod

ications

.tha

.hav

.nev

.bee

.the.int

ention

.of.the.so

ware

dev

eloper

.can.res

ult

.in.mal

icious

.so

ware

.beh

avior.

. is.cha

nged

.or.new

.add

.mal

icious

.cod

.is.

gen

erally

.cal

led

.mal

ware,

.an.abb

reviation

.for.mal

icious soware.

.Not

.tha

.uni

ntentional

.so

ware

.fau

lts

are.by.de

nition

.no

.ma

lware

.ev

.if.th

.ma

.re

sult

.in.vu

lnerabilities

.th

.an.ad

versary

.ma

.ut

ilize.

Depending

.on.the.int

ention

.of.mal

ware

.and.on.the.dam

age

.it.may.cau

se,

.mal

ware

.can.fur

ther

.be.cat

egorized.

.In.the.lit

erature,

.di

erent

.de

nitions

.tha

.may.di

.to.eac

.oth

.exi

st.

. e.mos

.imp

ortant

kin

.of.ma

lware

.ar

.th

.fo

llowing:

•

. Virus:.A.virus.is.a.self-replicating.piece.of.soware.that.inserts.itself.into.existing.program.

cod

.or.rep

laces

.par

.of.it..By.de

nition,

.a.vir

.nee

.alw

ays

.a.hos

.pro

gram

.tha

.act

ivates

.it,.

sin

.a.vir

.can

not

.run.by.its

elf.

•

. Wor

.In.con

trast

.to.a.vir

us,

.a.wor

.is.a.mal

icious

.sta

nd-alone

.pro

gram

.tha

.pro

pagates

.a.com

plete

.cop

.of.its

elf

.usu

ally

.ove

.the.net

work.

. e.mai

.cha

racteristic

.is.tha

.a.wor

.doe

.not.nee

any.us

.in

teraction.

Security in Industrial Communication Systems 22-11

•. Trojan horse:.A.Trojan.horse.obscures.its.malicious.intent.by.pretending.to.have.a.useful.func-

tion.

.How

ever,

.ae

.bei

.act

ivated

.by.the.use

.a.hid

den

.mal

icious

.fun

ction

.is.per

formed

.tha

all

ows

.a.rem

ote

.adv

ersary

.to.gai

.una

uthorized

.acc

ess

.to.the.hos

.tha

.exe

cutes

.the.Troj

hor

se.

•

. Log

ical bomb:

.A.log

ical

.bomb.is.mal

ware

.tha

.onl

.act

ivates

.itse

.ae

.cer

tain

.con

ditions

.are.

met

.A.spe

cial

.kin

.of.log

ical

.bomb.is.a.tim

.bomb.whe

.a.spe

cic

.poi

.in.tim

.is.use

.as.

tri

gger.

•

. Roo

tkit:

.A.roo

tkit

.is.a.spe

cial

.kin

.of.mal

ware

.tha

.inf

ects

.the.sys

tem

.in.a.way.tha

.it.rem

ains

inv

isible

.at.the.hos

.To.ach

ieve

.thi

.roo

tkits

.typ

ically

.rep

lace

.cor

.com

ponents

.of.the.sys

tem

so

ware

.li

.ke

rnel

.mo

dules

.in.op

erating

.sy

stems.

•

. Bac

kdoor or trapdoor:

. is.kin

.of.mal

ware

.pro

vides

.an.alt

ernative

.way.to.acc

ess

.the.inf

ected

sys

tem

.th

.by

passes

.th

.no

rmal

.au

thentication

.pr

ocedure.

•

. Spy

ware:

.Spyw

are

.usu

ally

.doe

.not.cau

.dir

ect

.har

.It.rat

her

.col

lects

.con

dential

.inf

ormation

on.the.hos

.bei

.use

.for.fur

ther

.att

acks,

.e.g

.pas

swords

.or.oth

.majo

.ass

ets

.(e.

g.,

.che

mical

rec

ipes).

.any.oth

.sec

urity

.att

ack,

.mal

ware

.is.onl

.abl

.to.uti

lize

.exi

sting

.vul

nerabilities

.in.the.dev

ice

.to.

inf

ect

.it..To.cou

nteract

.att

acks

.on.so

ware

.two.pos

sibilities

.exi

.Fir

st,

.met

hods

.can.be.use

.tha

.pre

vent

the.exi

stence

.of.vul

nerabilities.

.Sec

ond,

.if.a.ful

.pre

vention

.is.not.pos

sible,

.mal

ware

.or.the.att

empt

.to.

ins

ert

.it.into.the.dev

ice’s

.so

ware

.sha

.at.lea

.be.det

ected.

.Cou

ntermeasures

.tha

.pre

vent

.and

/or

.det

ect

the.ex

istence

.of.ma

lware

.ca

.be.ca

tegorized

.as.fo

llows.

•

. Sta

tic soware methods

.try.to.avo

.the.exi

stence

.of.so

ware

.vul

nerabilities

.a.pri

ori

.dur

ing

.the.

so

ware

.dev

elopment.

.Typ

ical

.tec

hniques

.are.sta

tic

.cod

.ana

lysis

.met

hods

.tha

.try.to.det

ect

.pro

gramming

.aw

.(e.

g.,

.bu

.ove

rows)

.as.wel

.as.cod

e-signing

.met

hods

.whe

.the.dev

eloper

.sign

the.exe

cutables

.to.con

rm

.the.non

-modication.

.Ano

ther

.exa

mple

.is.pro

of-carrying

.cod

.whe

the.de

veloper

.pr

ovides

.a.pr

oof

.al

ong

.wi

.a.pr

ogram

.th

.al

lows

.ch

ecking

.wi

.ce

rtainty

.th

cod

.ca

.be.ex

ecuted

.in.a.se

cure

.wa

•

. Dyn

amic soware methods

.try.to.ide

ntify

.mal

ware

.by.det

ecting

.a.mal

icious

.beh

avior

.dur

ing

.run

time.

.A.com

mon

.app

roach

.is.to.use.a.hos

t-based

.IDS.tha

.det

ects

.mal

icious

.beh

avior

.or.act

ions

dur

ing

.run

time

.(cf

.Sec

tion

.22.

3.4).

.A.simi

lar

.tec

hnique

.is.cal

led

.so

ware

.mon

itoring,

.whe

pro

gram

.exe

cution

.is.obs

erved

.to.che

.whe

ther

.the.so

ware

.beh

aves

.acc

ording

.to.a.spe

cied

sec

urity

.pol

icy.

.Ano

ther

.app

roach

.is.to.use.sel

f-checking

.cod

.Her

.the.so

ware

.its

elf

.ver

ies

the.pro

gram

.cod

.for.una

uthorized

.mod

ications

.dur

ing

.exe

cution.

.A.fur

ther

.app

roach

.tha

.is.

pop

ular

.in.env

ironments

.whe

.unt

rustworthy

.and.thu

.pos

sible

.mal

icious

.so

ware

.has.to.be.

exe

cuted

.is.cal

led

.san

dboxing.

.Usin

.thi

.tec

hnique,

.the.unt

rustworthy

.so

ware

.is.run

ning

.in.a.

so-

called

.san

dbox

.whe

.it.is.exe

cuted

.in.a.con

trolled

.way.wit

.res

tricted

.per

missions.

. e.mai

adv

antage

.of.thi

.sch

eme

.is.tha

.mal

icious

.so

ware

.is.not.abl

.to.lea

.the.san

dbox

.and.inf

ect

oth

.par

.of.the.sys

tem

.sinc

.an.int

eraction

.wit

.the.res

.of.the.sys

tem

.is.onl

.pos

sible

.usin

wel

l-dened

.an

.pr

otected

.in

terfaces.

•

. Har

dware supported methods

.use.har

dware-specic

.imp

lementations

.tha

.try.to.avo

.an.ins

er-

tion

.of.mal

ware.

.A.typ

ical

.exa

mple

.is. the. use. of. mic

rocontrollers

.tha

.are.imp

lementing

.the.

Har

vard

.arc

hitecture.

.Due.to.the.phy

sical

.par

titioning

.of.ins

truction

.and.dat

.mem

ory,

.cod

inje

ction

.is.not.pos

sible

.by.desi

gn.

.Ano

ther

.rec

ent

.tec

hnique

.is.the.no.exe

cute

.(NX

)

.bit.in.mod

ern

.CPU

.whe

.mem

ory

.reg

ions

.can.be.desi

gnated

.as.bei

.non

-executable.

.Ano

ther

.com

mon

app

roach

.is.the.use.of.a.cop

rocessor

.tha

.is.ded

icated

.to.per

form

.sec

urity

.che

cks

.dur

ing

.run

time.

•

. Hum

an-assisted methods:

.In.cas

.whe

.auto

matic

.met

hods

.can

not

.ful

.pre

vent

.or.det

ect

.the.

existence.of.malware,.human-assisted.methods.can.additionally.be.used..Typical.examples.are.

man

ual

.ins

pection

.or.the.use.of.cer

ticated

.so

ware.

.Obv

iously,

.hum

an-assisted

.met

hods

.are.

tim

.con

suming

.and.req

uire

.ext

ensive

.kno

wledge.

. er

efore,

.it.is.rea

sonable

.to.use.the

.onl

.in.

comb

ination

.wi

.au

tomatic

.te

chniques.

22-12 Industrial Communication Systems

Guaranteeing.a.secure.environment.for.the.execution.of.soware.is.a.typical.task.of.the.operation.

syst

.runn

ing

.on.the.devi

ce.

.Howe

ver,

.indu

strial

.comm

unication

.syst

ems

.cont

ain

.embed

ded

.devi

ces

with.limi

ted

.syst

.reso

urces.

. ere

fore,

.thes

.devi

ces

.are.oen.not.equi

pped

.with.an.oper

ation

.syst

that.prov

ides

.supp

ort

.for.adva

nced

.secu

rity

.serv

ices.

. ere

fore,

.prov

iding

.a.secu

.sow

are

.exec

ution

envi

ronment

.is.esp

ecially

.cha

llenging

.in.embe

dded

.net

works.

22.5 State of the art in automation Systems

 is.section.will.give.an.overview.of.the.state.of.the.art.of.security.measures.in.industrial.communica-

tion

.syst

ems.

. ese.are.divi

ded

.into.eld

bus

.syst

ems

.orig

inally

.desig

ned

.for.buil

ding

.autom

ation,

.but.

also.used.in.indu

strial

.comm

unications,

.clas

sical

.indu

strial

.eld

bus

.syst

ems,

.and.IP-ba

sed

.netw

orks.

An.over

view

.of.the.supp

orted

.secu

rity

.mech

anisms

.can.be.foun

.in.Tabl

.22.1.at.the.end.of.this.sect

ion.

22.5.1 Security in Building automation Systems

Today,.many.dierent.protocol.standards.for.building.automation.systems.exist.. e.most.important.

open.ones.that.span.more.than.one.appl

ication

.doma

.are.BACn

.[BAC

.KNX.[KNX

.LonW

orks

[LON

.and.IEE

.802

.15.4/ZigBee

.[IE

E,ZIG].

BACnet

.in.its.curr

ent

.vers

ion—version

.numb

.2008

—oers

.an.auth

entication

.serv

ice

.as.well.as.die

ent

.secu

rity

.serv

ices

.that.guar

antee

.data.con

dentiality,

.data.integ

rity,

.and.data.fres

hness.

. ese.mech

nisms

.use.the.symm

etric

.Data.Encr

yption

.Stan

dard

.(DES

)

.algo

rithm

.and.a.trus

ted

.key.serv

er,

.whic

.is.

resp

onsible

.for.gene

rating

.and.dist

ributing

.the.secr

.keys

.Howe

ver,

.due.to.seve

ral

.secu

rity

.aws.[GR2

ther

.are.inve

stigations

.under

way

.to.repl

ace

.thes

.secu

rity

.serv

ices

.by.new.ones

. e.new.secu

rity

.arch

tecture,

.whic

.is.dene

.in.BACn

.Adden

dum

.g,.uses.AES.and.HMAC.in.comb

ination

.with.a.mess

age

ID.and.a.time.stam

.At.the.time.of.writ

ing,

.BACn

.Adden

dum

.g.has.not.been.decla

red

.as.nal.yet.

NX,

.on.the.othe

.hand

.only.prov

ides

.a.basic.acce

.cont

rol

.sche

.base

.on.clea

r-text

.pass

words.

Up.to.255.die

rent

.acce

.leve

.can.be.den

ed,

.each.of.them.asso

ciated

.with.a.die

rent

.(oth

erwise

unsp

ecied)

.set.of.priv

ileges.

.For.each.of.thes

.acce

.leve

ls,

.a.4.byte.pass

word

.(key

)

.can.be.spec

ied.

Howe

ver,

.since.this.rudi

mentary

.acce

.cont

rol

.mech

anism

.does.not.prov

ide

.stro

.secu

rity

.[GR2

.it.

is.only.of.limi

ted

.use.in.secu

rity-critical

.envi

ronments.

.Furt

hermore,

.it.is.not.avai

lable

.for.proc

ess

.data.

exch

ange,

.whi

.is.cal

led

.gro

.com

munication

.in.KNX

.LonW

orks,

.an.auth

entication

.mech

anism

.that.guar

antees

.data.inte

grity

.and.fres

hness

.is.avai

able.

.Suppo

.for.data.con

dentiality

.is.not.prov

ided.

. is.mech

anism

.is.base

.on.a.four

-step

.chal

lenge–

response

. proto

col.

. e. used. crypto

graphic

. algo

rithm

. calc

ulates

.a. 64. bit.hash. valu

. over. the. plai

TABLE 22.1 Security.Services.of.Common.Fieldbus.Systems

Fieldbus Security.Services

Foundation

.Fieldb

us 8

.access.gro

ups,

.8.bit.unencr

ypted

.pas

sword

ControlNet Connection

.aut

hentication,

.unencr

ypted

.pas

sword

PROFIBUS Access

.cont

rol

.for.pre

dened

.address

P-Net Simple

.wri

.pro

tection

.for.vari

ables

WorldFIP 8

.access.gro

ups,

.8.bit.unencr

ypted

.pas

sword

Interbus 8

.access.gro

ups,

.8.bit.unencr

ypted

.pas

sword

SwiNet None

LonWorks Challenge–response

.auth.,.integr

ity

.chec

.MD5.for.IP

KNX Unencr

ypted

.pas

sword

.for.man

agement

.access

Cnet

.Addend

.g AES.for.dat

.condent

iality,

.HMAC.for.dat

.integ

rity,

time.sta

.+.mess

age

.ID.for.dat

.fres

hness

ZigBee CCM*

.algorithm.for.data.integrity,.freshness,.and.

condentiality

Security in Industrial Communication Systems 22-13

message.and.a.random.number.using.a.shared.secret.key..However,.due.to.key.length.and.several.proto-

col

.aw

.thi

.mec

hanism

.can

not

.be.con

sidered

.as.sec

ure

.[SC

1].

.In.add

ition

.to.thi

.basi

.aut

hentication

mec

hanism,

.a.mor

.adv

anced

.one.bas

.on.MD5.is.ava

ilable

.for.Lon

Works/IP.

.How

ever,

.sinc

.MD5.is.

not.co

llision

.re

sistant,

.it.is.al

.re

garded

.as.in

secure.

IEEE 802.15.4

.sup

ports

.sec

urity

.mec

hanisms

.at.the.dat

.lin

.lay

er.

. e.cur

rent

.ver

sion

.IEE

.802

.15.4-

2006

.use

.a.var

iant

.of.the.cou

nter

.wit

.CBC

-MAC

.(CC

.alg

orithm

.cal

led

.CCM.to.gua

rantee

.dat

int

egrity,

.fre

shness,

.and.con

dentiality.

.Zig

Bee

.in.its.cur

rent

.ver

sion

.Zig

Bee

.200

.uti

lizes

.the.IEE

802

.15.4-2003

.tra

nsmission

.ser

vices

.of.the.dat

.lin

.lay

er.

.How

ever,

.Zig

Bee

.200

.doe

.not.use.the.sec

rity

.mec

hanisms

.pro

vided

.by.IEE

.802

.15.4-2003—they

.are.com

pletely

.rep

laced

.by.a.mor

.adv

anced

sec

urity

.con

cept.

. is.con

cept

.sup

ports

.the.use.of.di

erent

.key.typ

.and.pro

vides

.adv

anced

.key.man

agement

.se

rvices.

.Ag

ain,

.CC

.is.us

.as.a.cr

yptographic

.al

gorithm.

Beside

.the.sec

urity

.fea

tures

.wit

hin

.the.pro

tocol,

.an.imp

ortant

.iss

.is.the.con

nection

.of.the.bui

lding

to.rem

ote

.mai

ntenance

.cen

ters.

.For.suc

.con

nections,

.bui

ldings

.are.equ

ipped

.wit

.gat

eways

.tha

.all

rem

ote

.acc

ess

.to.the.und

erlying

.el

dbus.

.Typ

ical

.sec

urity

.mea

sures

.for.the

.gat

eways

.are.IP.con

nec-

tions

.pro

tected

.by.tra

nsport

.lay

.sec

urity

.(TL

.or.VPN.tha

.sec

urely

.tun

nel

.the.com

mands

.fro

.the.

rem

ote

.site.to.the.el

dbus

.(se

.Sec

tion

.22.

5.3).

.In.rar

.cas

.als

.Web.Ser

vices

.Sec

urity

.is.use

.To.the.

el

dbus

.sit

.th

.ga

teways

.us

ually

.pr

ovide

.no.se

curity

.or.th

.se

curity

.pr

otocols

.me

ntioned

.ab

ove.

22.5.2 Security in Industrial Communication

Although.almost.never.used,.some.industrial.automation.eldbusses.support.security..However,.these.

sec

urity

.mea

sures

.are.ver

.lim

ited

.in.sco

.and.cap

abilities,

.and.the

refore

.can

not

.be.con

sidered

.as.

ser

ious

.pro

tection

.if.a.con

siderable

.thr

eat

.lev

.nee

.to.be.ass

umed.

. e.el

dbus

.sys

tems

.for.ind

ustrial

and.pro

cess

.auto

mation

.cur

rently

.sta

ndardized

.by.the.IEC.in.the.sta

ndards

.IEC.617

84-1

.[IE

C1]

.and.the.

und

erlying

.IEC.611

.ser

ies

.[IE

C2]

.are.a.het

erogeneous

.col

lection

.of.sol

utions.

. ei

.sec

urity

.fea

tures

can.be.div

ided

.into.two.cat

egories:

.in.sys

tems

.lik

.Con

trolNet,

.P-N

et,

.and.Swi

Net,

.har

dly

.any.sta

te-of-

the-art

.sec

urity

.mea

sures

.are.use

.at.all

.Fou

ndation Fieldbus,

.Pro

bus,

.Wor

ldFIP,

.and.Int

erbus

.on.the.

oth

.han

.imp

lement

.ver

.simi

lar

.app

lication

.lay

.ser

vices

.and.pro

tocols

.mod

eled

.ae

.the

.el

dbus

anc

estor

.MMS

. e.simp

.acc

ess

.pro

tection

.mec

hanism

.of.the

.sys

tems

.is.bas

.on.acc

ess

.rig

hts

.man

agement

.simi

lar

.to.UNI

X-based

.sys

tems.

.Eve

.obje

.has.a.8.bit.lon

.pas

sword

.ass

ociated

.wit

.it.and.a.

lis

.of.8.di

erent

.acc

ess

.gro

ups

.cod

.in.an.8.bit.wor

.Bot

.pas

sword

.and.acc

ess

.gro

ups

.are.tra

nsmit-

ted

.in.pla

.tex

.If.the

.mat

.for.a.spe

cic

.req

uest,

.the.add

itional

.acc

ess

.rig

hts

.par

ameter

.de

nes

.the.

all

owed

.ope

rations.

.Usu

ally

.the.acc

ess

.rig

hts

.dep

end

.on.the.typ

.of.obje

.and.all

.rea

ding,

.wri

ting,

exe

cuting,

.de

letion,

.et

Unfortunately,

.the

.sec

urity

.mea

.are.not.man

datory

.for.imp

lementation,

.and.the.pas

sword

.its

elf,

add

itionally,

.has.no.exp

licit

.pro

tection.

. at.is,.it.is.tra

nsmitted

.in.cle

.tex

.and.hen

.sho

uld

.not.

be.use

.at.all

.A.not

.in.IEC.611

58-5

.rev

eals

.the.act

ual

.int

ention

.of.the.sec

urity

.mec

hanisms:

.“ i

.is.

not.a.pro

tection

.aga

inst

.int

entional

.mis

use

.of.the.com

munication

.fac

ilities

.of.a.el

.dev

ice

.but.hel

to.pro

tect

.a.sys

tem

.for.acc

idental

.err

oneous

.use.of.pro

cess

.dat

a.”

. is.sta

tement

.is.in.fac

.tru

.for.all.

traditional.eldbus.systems.in.industrial.and.process.automation..Hence,.to.secure.data.trac.security.

mea

sures

.can.onl

.be.imp

lemented

.on.top.of.the.pro

tocol

.sta

ck.

. at.is,.the.el

dbus

.is.onl

.use

.as.a.

tra

nsparent

.tra

nsport

.cha

nnel

.to.tra

nsmit

.sec

ure

.mes

sages

.ove

.sta

ndard

.el

dbus

.pro

tocols

.and.ser

vices.

.Suc

.an.app

lication-level

.app

roach

.cou

.easi

.ach

ieve

.end

-to-end

.sec

urity,

.whi

.is.the.goa

in.man

.app

lications,

.any

way.

.Sim

ilar

.app

roaches

.hav

.alr

eady

.bee

.imp

lemented

.for.saf

ety

.app

lica-

tions

.suc

.as.the.Pro

safe

.pro

le

.of.Pro

bus

.(IE

.611

58).

.Dra

wback

.of.add

ing

.suc

.an.app

lication-level

app

roach

.for.sec

urity

.is.to.cau

.pro

blems

.wit

.int

eroperability,

.sinc

.in.gen

eral

.the.int

eroperability

mec

hanism

.of.the.und

erlying

.el

dbus

.sys

tem

.can

not

.be.use

.Exi

sting

.var

iable

.typ

.or.mes

sages

.can

not

.be.use

.sinc

.the

.de

.no.pro

perties

.for.sec

urity

.mea

sures.

.Hen

ce,

.the.onl

.way.is.to.use.gen

eral

pur

pose

.mes

sages

.and.red

ene

.the

.beh

avior.

.Alt

hough

.a.par

allel

.usa

.of.sec

ure

.and.ins

ecure

.dev

ices

is.po

ssible

.wi

.th

.ap

proach,

.th

.pr

actical

.ap

plication

.de

mands

.a.joi

.us

.Ye

.co

nnecting

.se

cure

.an