Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

22-14 Industrial Communication Systems

unsecure.messages.sacrices.all.security..Another.problem.is.the.limited.message.size.in.some.eld-

busses

.tha

.lea

ves

.onl

.lit

tle

.roo

.for.ec

ient

.sec

urity

.ext

ensions.

.Esp

ecially,

.int

egrity

.ser

vices

.suc

.as.

has

.cod

.or.MAC

.req

uire

.add

itional

.dat

.blo

cks

.red

ucing

.the.act

ually

.ava

ilable

.pay

load

.per.pac

ket,

and.co

nsequently

.th

.pe

rformance

.of.a.se

cured

.ch

annel

.dr

astically.

22.5.3 Security in IP-Based Networks

IP-based.technologies.are.gaining.increased.importance.in.industrial.communication.systems..Due.to.

the.wid

espread

.use.of.IP-b

ased

.LAN

.and.mor

.rec

ently

.the.Int

ernet,

.IP-b

ased

.net

works

.are.alr

eady

wid

ely

.use

.at.the.man

agement

.lev

.and.as.bac

kbones

.to.con

nect

.rem

ote

.el

dbus

.seg

ments.

.How

ever,

due.to.the.dec

reasing

.cos

.for.IP.cab

ling

.and.net

work

.int

erface

.har

dware,

.eve

.sma

.embe

dded

.mic

ro-

controllers

.can.be.equ

ipped

.wit

.a.ded

icated

.Ethe

rnet

.int

erface

.chi

. er

efore,

.IP.and.LAN.tec

hnolo-

gies

.hav

.sta

rted

.to.pen

etrate

.the.el

.lev

el,

.and.the

.use.is.no.lon

ger

.lim

ited

.to.the.man

agement

.lev

whe

.PC

-based

.de

vices

.ar

.lo

cated.

From

.the.sec

urity

.poi

.of.vie

.IP-b

ased

.net

works

.are.esp

ecially

.pro

.to.sec

urity

.att

acks.

. is.is.

for.var

ious

.rea

sons.

.Sin

.IP.as.wel

.as.the.und

erlying

.dat

.lin

.pro

tocols

.(e.

g.,

.Ethe

rnet)

.do.not.pro

vide

nat

ive

.sec

urity

.mec

hanisms,

.man

.wel

l-known

.vul

nerabilities

.exi

st.

.Add

itionally,

.sinc

.IP.net

works

may.be.sha

red

.wit

.oth

.app

lications

.(e.

g.,

.oc

.LAN

)

.and.int

erconnections

.to.for

eign

.net

works

.for.

rem

ote

.ac

cess

.ar

.co

mmon,

.ga

ining

.ac

cess

.to.th

.ne

twork

.ma

.be.ea

sier.

Due

.to.the.wid

espread

.use.of.the.Int

ernet,

.sec

urity

.has.bee

.a.majo

.res

earch

.el

.in.the.IT.wor

for.yea

rs.

. er

efore,

.man

.sec

urity

.ext

ensions

.for.IP-b

ased

.net

works

.are.ava

ilable

.whe

.eac

.of.the

mec

hanisms

.is.sui

table

.for.a.cer

tain

.app

lication

.el

.In.thi

.sec

tion,

.a.sma

.sub

set

.of.ava

ilable,

.sta

te-of-

the-art

.me

chanisms

.th

.ar

.su

itable

.fo

.in

dustrial

.co

mmunication

.sy

stems

.ar

.pr

esented.

Internet Protocol Security

.(IPs

ec)

.[IP

.is.a.sec

urity

.ext

ension

.to.the.IP.pro

tocol,

.and.thu

.ope

rates

on.the.net

work

.lay

er.

.IPs

.is.a.par

.of.IPv

.but.sinc

.IPv

.is.sti

.the.pre

dominantly

.use

.net

work

pro

tocol

.in.the.IT.wor

ld,

.it.has.bee

.por

ted

.to.ext

end

.IPv

.IPs

.ens

ures

.dat

.int

egrity,

.fre

shness,

.and.

condentiality..To.achieve.this,.various.cryptographic.algorithms.can.be.selected.(e.g.,.3-DES,.AES,.

HMA

C-SHA1).

.For.key.exc

hange,

.the.Int

ernet

.Key.Exc

hange

.(IK

.pro

tocol

.is.use

.IKE.use

.asy

metric

.alg

orithms

.lik

.RSA

.ECC

.or.sym

metric

.alg

orithms

.wit

.pre

-shared

.sec

ret

.key

.alt

ernatively.

One.of.the.mai

.con

cepts

.of.IPs

.is.the.not

ion

.of.a.Sec

urity

.Ass

ociation

.(SA

.An.SA.is.a.one

-way

.con

nection

.bet

ween

.a.sen

der

.and.a.rec

eiver

.tha

.spe

cies

.the.sec

urity

.ser

vices

.to.app

.to.the.tra

c

.car

ried

ove

.the.con

nection.

.Eac

.SA.con

tains

.the.fol

lowing

.par

ameters

.tha

.may.be.use

.to.uni

quely

.ide

ntify

it:.a.Sec

urity

.Par

ameter

.Ind

.(SP

I),

.the.IP.des

tination

.add

ress,

.and.the.sec

urity

.pro

tocol

.ide

ntier.

Par

ameters

.of.eve

.SA.are.stor

.in.an.SA.dat

abase.

.SAs.eit

her

.sup

port

.tra

nsport

.mod

.for.com

muni-

cation

.bet

ween

.two.hos

.or.tun

nel

.mod

.for.com

munication

.bet

ween

.a.hos

.and.a.sec

urity

.gat

eway

.or.

bet

ween

.tw

.se

curity

.ga

teways.

Secure Sockets Layer

.(SS

.and.its.suc

cessor

.Tra

nsport Layer Security

.(TL

.[TL

.is.a.pro

tocol

.dev

el-

oped

.for.sec

uring

.com

munication

.bet

ween

.two.par

ties.

.Dur

ing

.the.ini

tial

.han

dshake,

.the.dev

ices

.are.

aut

henticated,

.the.use

.cry

ptographic

.alg

orithms

.are.neg

otiated,

.and.sha

red

.sec

ret

.key

.are.exc

hanged.

Ae

.the.ini

tial

.han

dshake,

.the

.sec

ret

.key

.are.use

.to.est

ablish

.a.sec

ured

.cha

nnel

.bet

ween

.the.two.

ent

ities

.tha

.pro

vides

.dat

.con

dentiality,

.int

egrity,

.and.fre

shness.

.Lik

.in.IPs

ec,

.the.ini

tial

.key.exc

hange

is.usu

ally

.don

.usin

.asy

mmetric

.alg

orithms,

.whi

.the.sec

ured

.cha

nnel

.is.pro

tected

.usin

.sym

metric

alg

orithms

.exc

lusively.

.TLS.oe

.simi

lar

.alg

orithms

.but.ope

rates

.on.a.hig

her

.lev

.in.the.ISO

/OSI

.lay

mod

el.

.It.enc

rypts

.dat

.bet

ween

.the.tra

nsport

.lay

.(TC

.or.UDP

)

.and.the.app

lication

.lay

er.

.TLS.is.ver

ex

ible

.wit

.res

pect

.to.the.use.of.alg

orithms.

.So,.it.is.pos

sible

.to.imp

lement

.sec

ured

.uni

cast

.con

nections

on.embe

dded

.dev

ices,

.too..[GU

.sho

.an.imp

lementation

.of.a.com

plete

.sec

ure

.Web.ser

ver,

.usin

HTT

.and.TLS

.In.thi

.imp

lementation,

.the.asy

mmetric

.enc

ryption

.par

.of.TLS.is.don

.wit

.the.hel

.of.

ell

iptic

.cu

rve

.cr

yptography

.(E

CC)

.[H

AN].

.pop

ular

.VPN.imp

lementation

.for.IP-b

ased

.net

works

.is.Ope

nVPN

.[OV

PN].

.In.Ope

nVPN,

.eac

dev

ice

.ope

.a.sec

ure

.uni

cast

.con

nection

.to.a.cen

tralized

.ser

ver

.whe

.the.who

.net

work

.tra

c

.to.and.

Security in Industrial Communication Systems 22-15

from.the.device.is.tunneled.through..To.secure.the.tunneling.connection,.TLS.is.used..OpenVPN.pro-

vides

.seve

ral

.meth

ods

.to.ensu

.auth

entication:

.a.pre-

shared

.symm

etric

.key,.a.user

name

.and.pass

word

combi

nation,

.a.TLS.cert

icate,

.or.a.combi

nation

.of.thes

.meth

ods.

.Whil

.IPse

.mani

pulates

.the.net-

ork

.proto

col,

.Open

VPN

.enca

psulates

.the.encr

ypted

.VPN.pack

ets

.into.untou

ched

.TCP.or.UDP.pack

ets

of.the.host.netw

ork.

.Howe

ver,

.the.VPN.pack

ets

.them

selves

.are.secu

red

.down.to.the.IP.laye

.(lay

.3).in.

the.rou

ting

.mod

.or.dow

.to.Ethe

rnet

.(la

yer

.2).in.the.bri

dging

.mod

22.5.4 Security in Wireless Communication Systems

Like.many.other.sectors,.wireless.networks.are.also.more.and.more.introduced.in.industrial.and.build-

ing

.autom

ation

.infr

astructures.

.Main.conc

ern

.is.the.robu

stness

.to.elec

tromagnetic

.inte

rference

.and.in.

gene

ral

.the.secu

rity

.goal.of.avai

lability

.that.can.only.be.solv

.by.prop

.orga

nizational

.meas

ures

.(e.g

redu

ndant

.tran

smission

.path

s).

.Also

.the.wire

less

.tran

smission

.is.pron

.to.eave

sdropping

.and.mess

age

inse

rtion

.since.the.medi

.can.be.acce

ssed

.by.ever

yone.

.Chapt

.28.intr

oduces

.the.secu

rity

.meas

ures

.to.

ful

.the.abov

e-mentioned

.secu

rity

.goal

.To.combi

.exis

ting

.physi

cal

.secu

rity

.meas

ures

.(e.g

.fenc

es,

clos

.room

.to.incr

ease

.secu

rity,

.new.rese

arch

.is.goin

.in.the.dire

ction

.of.loca

tion-based

.secu

rity

serv

ices

.limi

ting

.the.acce

ssibility

.of.a.netw

ork

.not.only.by.the.signa

.stre

ngth,

.but.also.by.an.acti

loca

lization

.of.the.node

. e.Aust

rian

.Acad

emy

.of.Scie

nces

.inve

stigates

.such.secu

rity

.meas

ures

.base

on.a.loc

alization

.of.COT

.Wire

less

.LAN.har

dware

.via.ded

icated

.acc

ess

.poi

nts

.[TR

2].

22.6 Outlook and Conclusion

 e.lack.of.state-of-the-art.security.measures.at.the.eld.level.of.many.industrial.communication.sys-

tems

.almo

.sole

.allo

.impl

ementing

.secu

rity

.meas

ures

.on.top.of.the.autom

ation

.netw

orks.

. is.

usua

lly

.intr

oduces

.over

head

.and.unde

rmines

.inte

roperability.

.To.omit.secu

rity

.is.rela

ted

.to.high.risk

At.the.intr

anet/Internet

.zone

.a.gene

ral

.awar

eness

.of.thes

.risk

.exis

.and.secu

rity

.meas

ures

.are.com-

only

.impl

emented

.in.term

.of.secu

red

.tunn

eling.

.At.the.eld

-level

.zone

.this.awar

eness

.is.missi

ng.

Look

ing

.at.thre

ats

.to.indu

strial

.comm

unication

.syst

ems,

.omit

ting

.secu

rity

.meas

ures

.at.the.eld.leve

must.be.very.care

fully

.consi

dered.

.Secu

rity

.meas

ures

.(at.all.leve

ls)

.also.help.to.tack

.othe

.prob

lems

such.as.acci

dental

.erro

.with

.remo

.main

tenance

.or.safe

.issu

es.

. ere

fore,

.it.is.wort

.the.eor

.to.

inte

grate

.secu

rity

.meas

ures

.at.all.leve

ls.

.Yet,.secu

rity

.must.not.sole

.be.equa

ted

.to.netw

ork

.secu

rity

.or.

crypto

graphy.

.Many.secu

rity

.thre

ats,

.e.g..DoS.atta

cks,

.requ

ire

.more.orga

nizational

.meas

ures

.and.show.

that.secu

rity

.must.incl

ude

.the.comp

lete

.syst

.and.not.only.a.dedi

cated

.part

.Sett

ing

.the.appr

opriate

boun

daries

.for.secu

rity

.is.the.most.crit

ical

.part.in.secu

rity

.desig

.Den

ing

.what.is.trus

ted

.and.what.

is.untr

usted

.requ

ires

.deep.insig

.into.the.over

all

.appl

ications,

.espe

cially

.since.indu

strial

.comm

unica-

tion

.and.indu

strial

.proc

ess

.cont

rol

.stro

ngly

.inte

ract

.with.its.envi

ronment.

.In.prac

tical

.impl

ementations

the.secu

rity

.goal

.of.inte

grity,

.avai

lability,

.and.auth

entication/authorization

.are.the.most.impo

rtant

ones.to.prot

ect.

.Con

dentiality

.and.non-

repudiation

.are.of.mino

.inte

rest

.for.indu

strial

.appl

ications.

Addi

tionally,

.tra

ceability

.is.imp

ortant

.dur

ing

.mai

ntenance.

abbreviations

AES. Advanced.encryption.standard.(cryptographic.cipher)

BACnet

. Buil

ding

.auto

mation

.con

trol

.net

work

CMAC

. Ciph

er-based

.mes

sage

.aut

hentication

.cod

CIM

. Comp

uter-integrated

.man

ufacturing

CPU

. Cent

ral

.pro

cessing

.uni

DMZ

. Demi

litarized

.zon

DES

. Data.Enc

ryption

.Stan

dard

.(cr

yptographic

.cip

her)

DoS

. Deni

.of.ser

vice

.(at

tack)

22-16 Industrial Communication Systems

DSA. Digital.signature.algorithm

ECC

. Ell

iptic

.cu

rve

.cr

yptography

ECIES

. Ell

iptic

.cu

rve

.in

tegrated

.en

cryption

.sc

heme

ECDSA

. Ell

iptic

.cu

rve

.di

gital

.sig

nature

.al

gorithms

FTP

. Fil

.tr

ansfer

.pr

otocol

HMAC

. Has

hed

.me

ssage

.au

thentication

.co

HTTP

. Hyp

ertext

.tr

ansfer

.pr

otocol

IDS

. Int

rusion

.de

tection

.sy

stem

IEC

. Int

ernational

.El

ectric

.Co

mmission

IKE

. Int

ernet

.ke

.ex

change

. Int

ernet

.pr

otocol

IPsec

. Int

ernet

.pr

otocol

.se

curity

ISO/OSI

. Int

ernational

.Sta

ndard

.Or

ganization/Open

.Sy

stem

.In

terface

. Inf

ormation

.te

chnology

KNX

. Stan

dard

.fo

.ho

.an

.bu

ilding

.au

tomation

LAN

. Loc

.ar

.ne

twork

LON

. Loc

.op

eration

.ne

twork;

.Lo

nWorks

.(

eldbus)

MAC

. Mes

sage

.au

thentication

.co

.(c

ryptographic

.ch

ecksum)

MAC

. Med

.ac

cess

.co

ntrol

MD5

. Message.Digest.#5

OUNCE

. Numb

.us

.on

. No.ex

ecute

. Per

sonal

.co

mputer

RAM

. Ran

dom

.ac

cess

.me

mory

ROM

. Rea

.on

.me

mory

RSA

. Riv

est

.Sh

amir

.Ad

elman

.(c

ryptographic

.ci

pher)

. Sec

urity

.As

sociation

SHA

. Sec

ure

.ha

.al

gorithm

SPI

. Sec

urity

.Pa

rameter

.In

dex

SSL

. Sec

ure

.so

cket

.la

yer

TCP

. Tra

nsmission

.co

ntrol

.pr

otocol

TLS

. Tra

nsport

.la

yer

.se

curity

UDP

. Use

.da

tagram

.pr

otocol

VPN

. Vir

tual

.pr

ivate

.ne

twork

3-DES

. Tri

ple

.Da

.En

cryption

.Sta

ndard

.(c

ryptographic

.ci

pher)

references

[AES].National.Institute.of.Standards.and.Technology,.Advanced.Encryption.Standard.(AES),.FIPS.PUB.

197,.Gai

thersburg,

.MD,.2001.

AC]

. BAC

net—A

. Dat

. Com

munication

. Pro

tocol

. for. Bui

lding

. Aut

omation

. and. Con

trol

. Net

works,

Ame

rican

.Soc

iety

.of.Hea

ting,

.Refr

igerating,

.and.Air

-Conditioning

.Eng

ineers

.or.ASH

RAE

.SSP

.135

Atl

anta,

.GA,.200

[BIS]

.M..Bi

shop,

.Co

mputer Security: Art and Science,

.Addi

son-Wesley,

.Bos

ton,

.MA,.2002.

[CHR]

.C..Krüg

el,

.Netw

ork

.alert

ness:

.Towa

rds

.an.adap

tive,

.coll

aborating

.intr

usion

.detec

tion

.system,.PhD.

thesi

.Vienn

.Uni

versity

.of.Te

chnology,

.Vienn

.Au

stria,

.2002.

ES]

.Nat

ional

.Ins

titute

.of.Sta

ndards

.and.Tech

nology,

.Dat

.Enc

ryption

.Sta

ndard

.(DE

S),

.FIP

.PUB.

46-

.Gait

hersburg,

.MD,.199

[DSS]

. Nat

ional

. Ins

titute

. of. Sta

ndards

. and. Tec

hnology,

. Digit

. Sign

ature

. Sta

ndard,

. FIPS. PUB. 186,.

Gait

hersburg,

.MD,.1994.

Security in Industrial Communication Systems 22-17

[DZU].D..Dzung,.M..Naedele,.T..P..von.Ho,.and.M..Crevatin,.Security.for.industrial.communication.

system

.Pr

oceedings of the IEEE,

.93(6),.1152–1177,.Jun

.2005.

[ELG]

.T..ElGam

al,

.A.pub

lic

.key.crypt

osystem

.and.a.signa

ture

.sch

eme

.bas

.on.discr

ete

.logari

thms,

.IEEE

Tra

nsactions on Information eory,

.IT-31(4),.469–472,.1985.

[GR1]

.W..Granzer

.C..Reinis

ch,

.and.W..Kas

tner,

.Key.set.man

agement

.in.netw

orked

.buildin

.aut

oma-

tion

.system

.using.mul

tiple

.key.serv

ers,

.in.Pro

ceedings of Seventh IEEE International Workshop on

Factory Communication Systems,

.Dres

den,

.Ger

many,

.pp

.205–214,.Ma

.21–23,.2008.

[GR2]

.W..Granzer

.W..Kas

tner,

.G..Neugsc

hwandtner,

.and.F..Prau

.Sec

urity

.in.netw

orked

.buildin

.aut

mation

.system

.in.Pro

ceedings of Sixth IEEE International Workshop on Factory Communication

Systems,

.To

rino,

.It

aly,

.pp

.283–292,.Jun

.2006.

[GUP]

.V..Gup

ta,

.M..Mil

lard,

.S..Fung

.Y..Zhu,.N..Gura,.H..Eber

le,

.and.S..C..Sha

ntz,

.Sizzle:.A.sta

ndards-

based

. end-to-en

. sec

urity

. arc

hitecture

. for. the. embe

dded

. Int

ernet,

. in. Pro

ceedings of the ird

IEEE International Conference on Pervasive Computing and Communications,

.Hawa

ii,

.pp..247–256,.

Decem

ber

.2005.

[HAN]

.D..R..Han

kerson,

.S..A..Van

stine,

.and.A..J..Mene

zes,

.Gui

de to Elliptic Curve Cryptography,

.Spr

inger,

New.Yo

rk,

.2004.

[HMA]

.Nat

ional

.Ins

titute

.of.Sta

ndards

.and.Tec

hnology,

.e K

eyed-Hash Message Authentication Code

(HMAC),

.FIPS.PUB.198,.Gai

thersburg,

.MD,.2002.

15]

. Inf

ormation

. Tec

hnology—Security

. Tec

hnique—Evaluation

. Cri

teria

. for. IT. Sec

urity,

. IEC. 154

08,

International.Electrotechnical.Commission.or.IEC,.Geneva,.Switzerland,.2005.

[IEC1]

.Int

ernational

.Elec

trotechnical

.Commi

ssion,

.Digit

.dat

.communic

ations

.for.mea

surement

.and.

cont

rol—Part

.1:.Pro

le

.sets.for.cont

inuous

.and.discr

ete

.man

ufacturing

.rel

ative

.to.eldb

.use.in.

indu

strial

.con

trol

.syst

ems,

.IEC.61784-1,.Gen

eva,

.Sw

itzerland,

.2003.

[IEC2]

.Int

ernational

.Elec

trotechnical

.Commi

ssion,

.Digit

.dat

.communic

ations

.for.mea

surement

.and.

cont

rol—Fieldbus

.fo

.us

.in.ind

ustrial

.con

trol

.syst

ems,

.IEC.61158,.Gen

eva,

.Sw

itzerland,

.2003.

[IEE]

.IEEE.802.15.4,.Wir

eless Medium Access Control (MAC) and Physical Layer (PHY) Specications for

Low-Rate Wireless Personal Area Networks (WPANs),

.IEEE.Com

puter

.Societ

.Was

hington,

.DC,.

2006.

[IPS]

.S..Kent.and.K..Seo

.Sec

urity

.Arc

hitecture

.for.the.Int

ernet

.Pro

tocol,

.RFC.4301,.Int

ernet

.Engin

eering

Tas

.Fo

rce

.(IETF).Net

work

.Wo

rking

.Gr

oup,

.Fer

mont,

.CA,.2005.

[KER]

.A..Kerc

khos,

.La.crypt

ographie

.milit

aire,

.Jou

rnal des Sciences Militaires,

.9,.5–38,.Jan

vier

.1883;.

161–191,.Fé

vrier

.1883.

[KHA1]

.B.A..Kha

.J..Mad,.and.A..Tre

ytl,

.Sec

urity

.in.agen

t-based

.aut

omation

.system

.in.Pro

ceedings of

11th IEEE Conference on Emerging Technologies and Factory Automation,

.Prague

.Czech.Repu

blic,

pp..768–771,.2007.

[KNX]

. Info

rmation

. tec

hnology—Home

. Elec

tronic

. Syst

ems

. (HES). Arc

hitecture,

. ISO/IEC. 14543-3,.

Int

ernational

.Ele

ctrotechnical

.Com

mission

.or.IEC

.Gen

eva,

.Swi

tzerland,

.2006.

[LO

.Con

trol

.Netw

ork

.Pro

tocol

.Spe

cication,

.ANSI/EIA/CEA.709.1,.Amer

ican

.Nat

ional

.Sta

ndards

Ins

titute

.or.ANSI,.Wa

shington,

.DC,.1999.

[MEN]

.A..J..Mene

zes,

.P..C..van.Oor

schot,

.and.S..A..Van

stone,

.Han

dbook of Applied Cryptography,

.CRC.

Pres

.Bo

.Ra

ton,

.FL,.2001.

[OVP

.Op

enVPN,

.2010,.ht

tp://openvpn.net

.[Onlin

.25.01.2010].

[PFL]

.C.P..Peeg

.and.S.L..Peeg

er,

.Secu

rity in Computing,

.4th.edn.,.Pren

tice

.Hal

.Upp

.Saddle.Riv

er,

NJ,.2006.

[R13]

.R..Riv

est,

. e.MD5.Mess

age-Digest

.Algo

rithm,

.RFC.1321,.Int

ernet

.Engin

eering

.Tas

.For

.(IETF).

Netw

ork

.Wo

rking

.Gr

oup,

.Fer

mont,

.CA,.1992.

[R37]

.M..Mats

ui,

.J..Naka

jima,

.and.S..Mor

iai,

.A.Descr

iption

.of.the.Cam

ellia

.Encryp

tion

.Algo

rithm,

.RFC.

3713,.In

ternet

.Eng

ineering

.Ta

.Fo

rce

.(IETF).Net

work

.Wo

rking

.Gr

oup,

.Fer

mont,

.CA,.2004.

[R44]

.J..H..Son

.R..Poo

vendran,

.J..Lee

.and.T..Iwat

. e.AES-CMAC.Algo

rithm,

.RFC.4493,.Int

ernet

Engin

eering

.Ta

.Fo

rce

.(IETF).Net

work

.Wo

rking

.Gr

oup,

.Fer

mont,

.CA,.2006.

22-18 Industrial Communication Systems

[R49].R..Shirey,.Internet.Security.Glossary,.Version.2,.RFC.4949,.Internet.Engineering.Task.Force.(IETF).

Netw

ork

.Wo

rking

.Gr

oup,

.Fer

mont,

.CA,.2007.

[RSA]

.R..L..Riv

est,

.A..Sha

mir,

.and.K..Adlem

an,

.A.meth

.for.obt

aining

.digit

.signa

tures

.and.pub

lic-key

crypt

osystems,

.Co

mmunications of the ACM,

.21(2),.120–126,.1978.

[SAF]

.J..Mas

sey,

.SAFER.K-64:.A.byte-o

riented

.bloc

k-ciphering

.algo

rithm,

.Lec

ture Notes in Computer

Science,

.809,.1–17,.1994.

C1]

.C..Sch

waiger

.and.A..Tre

ytl,

.Sma

.card.bas

.sec

urity

.for.el

dbus

.sys

tems,

.in.Pro

ceedings of Ninth

IEEE Conference on Emerging Technologies and Factory Automation,

.Cat

ania,

.Ita

ly,

.pp..398

–406,

.200

[SC2]

.C..Sch

waiger

.and.T..Saut

er,

.Sec

urity

.stra

tegies

.for.eld.are

.netw

orks,

.in.28th A

nnual Conference of

the IEEE Industrial Electronics Society,

.Se

villa,

.Sp

ain,

.pp

.2915–2920,.2002.

[SH

. Nat

ional

. Ins

titute

. of. Sta

ndards

. and. Tec

hnology,

. Sec

ure

. Has

. Sta

ndard,

. FIPS. PUB. 180–2,.

Gait

hersburg,

.MD,.2002.

[TLS]

.T..Dierks.and.K..Reso

rla,

. e.Tran

sport

.Lay

.Sec

urity

.(TLS).Pro

tocol

.Versio

.1.2,.RFC.5246,.2008.

[TR1]

.A.. Tre

ytl,

.T.. Saut

er,

. and. C..Sch

waiger,

.Sec

urity

.mea

sures

.in. aut

omation

. system

s—A

. pract

ice-

oriented

.app

roach,

.in.Pro

ceedings of 11th IEEE Conference of Emerging Technologies and Factory

Automation,

.Ca

tania,

.It

aly,

.Sep

tember

.19–22,.2005.

[TR2]

.A..Tre

ytl,

.T..Saut

er,

.H..Ada

mcyk,

.S..Ivan

ov,

.and.S..H..Tres

.Sec

urity

.concep

.for.exible.wire

less

aut

omation

.in.re

al-time

.env

ironments,

.in.Pr

oceedings of IEEE Conference on Emerging Technologies

and Factory Automation 2009,

.Pa

lma

.de.Ma

llorca,

.Sp

ain,

.pp

.1–8,.2009.

[TUO]

.A..Tuomas,.N..Pekka,.and.L..Jussipekka,.DOS.resistant.authentication.with.client.puzzles,.in.

Pro

ceedings of Eighth International Workshop on Security Protocols,

.Cam

bridge,

.U.K.,.pp..170–177,.

Apr

.3–5,.2000.

[WEI]

.B..Weis

.Aut

hentication

.under.denial-o

f-service

.att

acks,

.in.Pro

ceedings of IASTED Conference on

Communications and Computer Networks,

.Bos

ton,

.MA,.pp

.134–139,.No

vember

.2002.

[ZIG]

.Zi

gBee Specication 2007,

.ZigB

.Al

liance,

.San.Ra

mon,

.CA,.2007.

23-1

23.1 Introduction

Chaos.is.common.in.nature.. e.earliest.discovery.of.chaotic.behavior.can.be.casted.back.to.Poincare,.

a.Fren

.math

ematician

.in.the.nine

teenth

.cent

ury.

.In.his.stud

.of.cele

stial

.mech

anics

.of.cons

ervative

syst

em,

.Poin

care

.foun

.that.some.solu

tions

.of.a.dete

rministic

.dyna

mic

.equa

tion

.were.unpr

edictable.

But.the.rese

arch

.work.on.chao

.is.usua

lly

.said.to.begi

.with.Lore

.[L63

.an.Amer

ican

.mete

orologist.

When.he.was.work

ing

.on.the.prob

lem

.of.weat

her

.pred

iction

.using.comp

uter,

.he.foun

.that.the.solu

tion

of.a.dete

rministic

.dyna

mic

.equa

tion

.with.cert

ain

.para

meters

.can.be.rand

om-liked.

. is.phen

omenon

came.to.be.know

.as.the.butt

ery

.eec

.Aer.then

.Heno

.[H76

]

.and.Ross

ler

.[R79

]

.obta

ined

.simil

conc

lusions.

.Sinc

.then

.chao

.theo

.has.beco

.one.of.the.most.popu

lar

.rese

arch

.topic

.and.grea

deve

lopment

.has.bee

.mad

.in.cha

.sci

ence.

Chaos

.has.a.seri

.of.inte

resting

.and.usef

.feat

ures,

.such.as.bein

.extr

emely

.sensi

tive

.to.very.mino

vari

ations

.of.init

ial

.cond

itions,

.poss

essing

.at.leas

.one.posit

ive

.Lyap

unov

.expo

nent,

.havi

.boun

ded

traje

ctories

.in.the.phas

.spac

.bein

.ergo

dic

.in.the.eld.of.the.stra

nge

.attr

actor,

.and.so.on..Due.to.its.

dist

inguished

.feat

ures,

.a.broa

d-spectrum

.and.nois

e-like

.chao

tic

.signa

.is.part

icularly

.appr

opriate

.for.

secu

.comm

unications.

.In.a.secu

.comm

unication

.sche

me,

.encr

yption

.and.decr

yption

.are.proc

essed

at.the.tran

smitter

.and.the.rece

iver,

.resp

ectively.

.In.a.typi

cal

.chao

tic

.secu

.comm

unication

.syst

.as.

show

.in.Figu

.23.1.[LLW

S03],

.whic

.is.disc

ussed

.in.Sect

ion

.23.3

.a.chao

tic

.crypto

system

.is.oen.used

With.a.suit

able

.crypto

graphic

.sche

me,

.the.orig

inal

.signa

.is.hidd

.in.the.nois

e-like

.chao

tic

.signa

ls.

. e.

cryp

tosystem

.is.comp

osed

.of.two.main.part

.encr

ypter

.and.decr

ypter.

.Each.part.incl

udes

.a.chao

tic

syst

em,

.call

.driv

ing

.and.resp

onse

.syst

em,

.resp

ectively.

.It.is.esse

ntial

.to.sync

hronize

.the.two.chao

tic

.sys-

ems

.in.orde

.to.reco

ver

.the.orig

inal

.data.from.encr

ypted

.ones.in.the.rece

iver

.side.. is.can.be.ensu

red

Secure Communication

Using Chaos

Synchronization

23.1. Introduction.....................................................................................23-1

23.2

. Chao

.Syn

chronization...................................................................23-2

Feedback.Control.for.Chaos.Synchronization.via.PartialStates. •. .

Adaptive.Control.for.Chaos.Synchronization.via.PartialStates. •. .

Impulsive.Control.for.Chaos.Synchronization.via.PartialStates. •. .

Practical.Impulsive.Synchronization.of.Chaotic.Systems.with.

Parametric.Uncertainty.and.Mismatch

23.3. Secure.Communication.Using.Chaos.Synchronization............23-8

Secure.Communication.Schema. •. eEncrypter. •. .

 eDecrypter. •. Synchronization.Time.Estimation. •. .

Implementation

References...................................................................................................23-13

Yan-Wu Wang

Huazhong University

ofSci

ence

and Tec

hnology

Changyun Wen

Nanyang Technological

Univ

ersity

23-2 Industrial Communication Systems

by.chaos.synchronization..But.before.1990,.chaos.synchronization.was.very.dicult.and.nearly.impos-

sible.

. e.ground-breaking.scheme,.called.Pecara.and.Carroll.scheme.[PC90],.rstly.oered.a.method.

to.control.and.realize.chaos.synchronization..From.then.on,.chaos.synchronization.and.its.application.

to.secure.communication.have.seen.a.urry.of.research.activities.for.decades.

.main.advantage.of.a.chaotic.secure.communication.system.over.conventional.cryptosystems.is.

that.chaotic.secure.communication.schemas.can.oen.be.realized.using.very.simple.circuits.on.a.part.

of.a.chip.[GHGS00].and.they.can.be.used.in.applications.that.do.not.require.a.high.level.of.information.

security.such.as.remote.keyless.entry.system,.video.phone,.and.wireless.telephone.[GHGS00]..In.this.

chapter,.some.typical.control.methods.for.chaos.synchronization.will.be.presented.rst,.and.then.how.

they.are.applied.to.secure.communication.will.be.illustrated.

23.2 Chaos Synchronization

A.number.of.methods.have.been.proposed.for.the.synchronization.of.chaotic.systems,.including.the.

linear.and.nonlinear.feedback.control,.fuzzy.control,.adaptive.control,.sliding.mode.control,.and.impulsive.

control..In.this.section,.some.typical.synchronization.control.methods.are.introduced.with.the.Chua’s.

circuit.as.an.illustrated.example.

23.2.1 Feedback Control for Chaos Synchronization via Partial States

One.of.the.important.aspects.to.evaluate.the.eectiveness.of.the.secure.communication.schema.is.the.

transmission.eciency,.i.e.,.the.ratio.of.the.data.information.to.the.entire.transferred.information..In.

order.to.achieve.chaos.synchronization,.it.is.unavoidable.to.occupy.the.communication.channel.by.syn-

chronization

.control.information.of.the.driving.system.that.needs.to.be.transmitted.to.the.receiver..In.

the.full-order.synchronization.control.schema.in.which.synchronization.is.achieved.by.controlling.all.

the.system.states,.information.on.all.the.states.of.the.driving.system.should.be.sent.to.the.receiver,.which.

leads.to.a.poor.transmission.eciency..In.addition,.the.full-order.synchronization.control.schema.is.not.

feasible.for.the.case.when.some.of.the.system.states.are.not.available.or.controllable..In.order.to.over-

come

.the.problem.for.such.a.case.and.to.improve.the.transmission.eciency,.one.may.wish.to.transmit.

Original

Original signal

Encrypter

Chaotic

system

Decrypter

p(t)

k(t)

Synchronization

drive impulses

Synchronization

drive impulses

Digital signal

Channel

Intruder

Cryptographic

scheme e()

p(t)

(t)

k(t)

Chaotic

system

Magnifying-

glass

Composition

Decomposition

Magnifying-

glass

Cryptographic

scheme d()

Digital signal

Compressed and D/A A/D and decompressed

FIGURE 23.1 System. block. diagram. of. the. chaotic. cryptosystem.. (Reprinted. from. Li,. Z.G.. et. al.,. IEEE

Trans.Commun.,

.51(8),.1306,.2003..Copyright.@.2003.by. e.Institute.of.Electrical.and.Electronics.Engineers..

With..permission.)

Secure Communication Using Chaos Synchronization 23-3

less.control.information.to.achieve.chaos.synchronization..An.intuitive.idea.is.to.realize.the.chaos.

syn

chronization

.on

.by.usi

.pa

.of.th

.st

ates

.in

formation.

Suppose

.th

.dr

iving

.sy

stem

.is.gi

ven

.as



X AX f X Y h t

Y g X Y h t

= − + +

= +











( , ) ( ),

(23

.1)

where

.X.=.[x

. .... x

]

.∈.R

.and.Y.=.[x

n+1

. .... x

n+m

]

.∈.R

.are.the.state.vectors.of.the.nonlinear.

sys

tem,

.A∈ R

n×n

..f :.R

.×.R

.→.R

,.g :.R

.×.R

.→.R

.are.nonlinear.functions.of.X.and.Y,.h

.:.R

.→.R

.and.

.:.R

.→.R

.are.linear.or.nonlinear.functions.of.t.

.re

sponse

.sy

stem

.un

der

.co

ntrol

.usi

.pa

rtial

.sy

stem

.st

ates

.is.gi

ven

.as.fo

llows:





  





 

X AX f X Y h t

Y g X Y h t U t

= − + +

= + +











( , ) ( ),

( , ) ( ) ( ),

(23

.2)

where

.=.[x

. .... x

]

.∈.R

,.Y

.=.[x

n+1

. .... x

n+m

]

.∈.R

,.and.U(t).is.the.control.action.which.is.only.

add

.to.st

ates

.of.th

.n.+.mth.or

der

.sy

stem

.(2

3.2).

.sy

nchronization

.er

rors

.ar

.de

ned

.as

E X t X t E Y t Y t

1 2

= − = −

 

( ) ( ), ( ) ( )

and

.th

.ca

.be.de

noted

.as.ve

ctors

E e e E e e

n n m

1 1 2 1

















+ +

 , .

.th

.li

near

.fe

edback

.co

ntrol

.sc

hema,

.th

.co

ntroller

.is.de

signed

.as

U t KE t K diag k j m

( ) ( ) ( ) , , ,= − = =

1with for …

(23

.3)

where

.is.a.parameter.determined.according.to.the.conditions.given.in.[WWSX06].

Obviously,

.suc

.a.fee

dback

.con

troller

.sav

.the.ban

dwidth

.of.the.com

munication

.cha

nnel

.as.onl

.m.

sta

tes

.of.th

.dr

iving

.sy

stem

.ar

.re

quired

.to.be.tr

ansmitted,

.in

stead

.of.al

.th

.n.+.m.st

ates.

Note

.tha

.the.sys

tem

.(23

.1)

.is.qui

.gen

eral

.as.f(X,.Y),.g(X,.Y),.h

(t),.and.h

(t).are.general.nonlinear.

fun

ctions.

.In.fac

.it.inc

ludes

.the.maj

ority

.of.typ

ical

.non

linear

.cha

otic

.sys

tems

.stu

died

.so.far.and.thu

can.be.eas

ily

.imp

lemented.

.Now,.the.Chu

a’s

.cir

cuit

.giv

.bel

.is.tak

.as.an.exa

mple

.for.ill

ustration:



x x x

x y x x

y y x h y

1 2 1

2 1 2 1

1 1 2 1

= − −

= − +

= − + −











β γ

α α α

( ),

(23

.4)

23-4 Industrial Communication Systems

where.α,.β,.and.γ.are.parameters,.h(y

).=.by

.+.0.5(a.−.b)(|y

.+.1|.−.|y

.−.1|),.a.and.b.are.constants.which.

satisfying.a.<.b.<.0.. e.response.system.under.feedback.control.is.given.by





 





  





  

x x x

x y x x

y y x h y U

1 2 1

2 1 2 1

1 1 2 1

= − −

= − +

= − + − +

β γ

α α α

( ) (( ).t











(23.5)

Clearly,

A f X Y

y x

g X Y y x h y=













−













= − + −

γ β

α α α

0 1

1 1

1 2 1

, ( , ) , ( , ) ( )..

In.this.case,.only.one.state.y

.in.the.response.system.(23.5).is.controlled.by.using.one.state.y

.from.the.

driving.system,.namely

U t k y t y t( ) ( ) ( ) .= − −









1 1 1



.illustrate.the.synchronization.of.the.two.Chua’s.circuits,.choose.α.=.10,.β.=.16,.γ.=.0.0385,.a.=.−.8/7,.and.

b.=.−5/7,.and.the.initial.conditions.for.the.driving.system.and.the.response.system.are.(18. −26. −17)

and.(2. 10. 10)

,.respectively..According.to.the.guidelines.in.[WWSX06].and.based.on.the.above.param-

eters,

.it.is.computed.that.k

.>.11.9911.in.order.to.ensure.synchronization.of.the.two.chaotic.systems..

Let.k

.=.30.in.the.simulation.. e.synchronization.errors.of.two.identical.Chua’s.circuits.(23.4).and.(23.5).

under.feedback.control.are.shown.in.Figure.23.2.

Clearly,

.the.errors.are.almost.zero.for.t.>.10.s.

100

0 2 4 6 8 10

12 14 16 18 20

0 2 4 6 8 10 12 14 16 18 20

–100

–200

–50

–20

FIGURE 23.2 Synchronization.of.two.Chua’s.circuits.under.feedback.control.

Secure Communication Using Chaos Synchronization 23-5

23.2.2 adaptive Control for Chaos Synchronization via Partial States

Sometimes,.the.determination.of.suitable.controller.gain.K.in.(23.3).is.complicated..So,.an.adaptive.version.

of.the.controller.can.be.designed.to.continuously.adjust.the.gain.parameters.based.on.the.system.responses.

for.synchronization..Based.on.the.results.in.[WWSX06],.the.following.adaptive.controller.can.be.designed:

U t K t E t K t diag k t k t e t

j j j n j

( ) ( ) ( ), ( ) ( ( )) ( ) ( )= − = =

with and fo



θ rr j m=1, ,…

(23.6)

where

.θ

.is.a.positive.parameter.chosen.by.users.

Again,

.the.two.Chua’s.circuits.(23.4).and.(23.5).are.considered.under.the.adaptive.control.(23.6)..Let.

.=.10,.and.the.initial.condition.of.the.adaptive.control.(23.6).is.k

(0).=.0,.the.synchronization.errors.of.

two.identical.Chua’s.circuits.(23.4).and.(23.5).and.the.changing.parameter.of.the.adaptive.control.(23.6).

are.shown.in.Figures.23.3.and.23.4,.respectively.

.is.observed.that.the.two.systems.are.synchronized.

100

–100

–200

–50

–20

0 1 2 3 4 5 6 7 8 9 10

0 1 2 3 4

5 6 7 8 9 10

FIGURE 23.3 Synchronization.of.two.Chua’s.circuits.under.adaptive.control.

150

100

0 1 2 3 4 5 6

7 8 9 10

FIGURE 23.4 Changing.parameter.of.the.adaptive.control.