Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

28-4 Industrial Communication Systems

 e.basic.insecurities.of.RC4.are

•

. Pseudorandom.IV

•

. Exclusive.OR.based

•

. Weak.keys

•

. Keystream.reuse

WEP

.has.been.cryptographically.broken.due.to.its.reuse.of.IVs..If.the.attacker.can.capture.enough.

data,.the.attacker.can.decrypt.the.encrypted.data.without.ever.learning.the.encryption.key.. ere.are.

a.variety.of.WEP.cracking.tools.freely.available.on.the.Internet,.which.include,.but.are.not.limited.to,.

AirSnort,.Wepcrack,.WepAttack,.and.Asleap-imp.[4].

28.2.2.2

WiFi Protected access

WiFi

.protected.access.(WPA).is.a.security.standard.based.on.IEEE.802.11i.dra.3.with.early.TKIP.imple-

mentations.

. e.main.design.goal.of.WPA.was.to.make.this.protocol.WEP.compatible.but.more.secure.

and.to.coordinate.vendor.solutions.for.WEP.aws..WPA.corrects.the.problems.with.WEP.by.using.a.

larger.key.length.and.improving.the.handling.of.IVs..WPA.distributes.dierent.keys.to.dierent.users.

with.an.IEEE.802.1X.authentication.server..A.48.bit.IV.and.a.128.bit.key.are.used.with.RC4.encryption.

.main.elements.of.WPA.are.TKIP,.message.integrity.code.to.ensure.that.messages.are.not.tampered.

with,.and.the.IEEE.802.1X.authentication.framework..802.1X.denes.how.to.authenticate.wired/wireless.

clients.using.authentication.mechanisms.such.as.RADIUS.or.EAP..RADIUS.(remote.authentication.dial-

in-user

.services).is.a.protocol.used.to.authenticate.dial-in.users..EAP.(extensible.authentication.protocol).

is.a.framework.authentication.protocol.used.by.802.1X.to.provide.network.authentication..One.of.the.

aws.of.WPA.is.pre-shared.key.(PSK),.which.allows.the.administrator.to.specify.a.password.that.must.be.

known.by.all.users.for.access.to.the.AP..An.oine.dictionary.attack.can.be.used.to.recover.the.PSK.if.the.

password.used.is.not.suciently.long.[9].

Payload

CRC

generation

algorithm

CRC Payload

XOR XOR

Generation

algorithm

Concatenate

IV and key

RC4

algorithm

Concatenate

IV and key

RC4

algorithm

CRC Payload

Wireless station

Plaintext input

Shared

key

Initialization

vector

Plaintext

output

Per packet

key

Per packet

key

Shared

key

Keystream

Ciphertext

24 bits

Payload bits

XOR with

keystream

Access point

Radio

interface

Packet

FIGURE 28.3 RC4.encryption/decryption.process.

Industrial Wireless Communications Security (IWCS)/C42 28-5

28.2.2.3 WiFi Protected access 2

WiFi

.protected.access.2.(WPA2).is.based.on.the.fully.ratied.version.of.IEEE.802.11i..WPA2.is.WPA.

with.a.new.advanced.encryption.standard.(AES).based.algorithm.known.as.Counter.Model.with.CBC-

MAC

.protocol.(CCMP)..AES.supports.multiple.encryption.key.sizes:.128,.196,.and.256.bits..WPA2.pro-

vides

.enhanced.security.over.WPA.[10].

.temporal.key.integrity.protocol.(TKIP).depicted.in.Figure.28.4.is.a.link.layer.encryption.protocol.ini-

tially

.called.WEP2..TKIP.has.security.features.that.improve.upon.WEP.and.is.designed.as.a.soware.upgrade.

to.WEP-based.solutions;.i.e.,.a.wrapper.around.WEP..Some.of.the.improvements.made.by.TKIP.include

. 1..Using.multiple.master.keys.instead.of.a.single.key.as.used.in.WEP

. 2.. Deriving.a.unique.RC4.key.for.each.frame.generated.from.a.master.key

. 3..Numbering.of.each.frame.with.a.sequence.number.to.mitigate.against.replay.attacks

. 4.. Using.a.new.integrity.check.hashing.algorithm.called.Michael.to.detect.frame.forgeries.

28.2.2.4

tKIP, CCMP, WaPI

TKIP

.adds.new.keying.and.message.integrity.check.(MIC).mechanisms.to.WEP.to.oer.additional.

security.. ese.new.mechanisms.are.key.hierarchy.and.automatic.key.management,.per-frame.keying,.

sequence.counter,.new.MIC,.and.countermeasures.on.MIC.failures.[11].

Key hierarchy and automatic key management:

.Keys.used.to.encrypt.frames.are.derived.from.master.

keys.that.are.refreshed.in.a.secure.manner.

Per-frame keying:

.A.unique.RC4.key.is.derived.for.each.frame.from.the.master.key.to.lessen.the.likeli-

hood

.of.key.attacks.

Sequence counter:

.Each.frame.is.numbered.with.a.sequence.number.to.eliminate.replay.attacks.(cap-

turing

.trac.and.transmitting.the.trac.at.another.time).

New MIC:

.Michael,.a.cryptographic.integrity.check.hashing.algorithm,.is.used.to.defeat.forgeries.

Countermeasures on MIC failures:

.Two.failed.forgeries.in.a.second.cause.a.station.to.invoke.a.rekeying.

procedure.

TKIP

.dynamically.changes.keys.as.the.system.is.used..A.large.IV.used.with.TKIP.defeats.the.key.recovery.

attacks.that.were.possible.in.WEP..TKIP.temporarily.solves.four.problems:.forgeries.with.the.MIC,.replays.

with.IV.sequence.enforcement,.weak.key.attacks.with.key.mixing,.and.collision.attacks.with.rekeying..CCMP.

Transmit

MAC address

Mixer, Phase 1

Mixer, Phase 2

Intermediate key

Base key

Ciphertext

Plaintext

RC4

Packet

sequence

4 most

significant bits

2 least

significant

bits

Per-packet key

Software

Hardware

FIGURE 28.4 Temporal.key.integrity.protocol.

28-6 Industrial Communication Systems

is.the.link.layer.security.protocol.based.on.AES.that.provides.support.for.encryption.and.data.integrity..

WLAN.Auth

entication

.and.Priv

acy

.Infra

structure

.(WAP

.is.a.Chine

.stan

dard

.for.wire

less

.LAN.

28.2.3 Deployment Issues

Some.issues/guidelines.for.deploying.WLANs.include

. 1..To.mini

mize

.the.chan

.of.wire

less

.eave

sdropping,

.avoi

.havi

.the.WLAN.signa

.exte

.beyo

the.boun

daries

.of.the.desir

.rang

.of.the.netw

ork.

. e.signa

.stre

ngth

.can.be.mini

mized

.by.

turn

ing

.down.the.powe

.on.the.AP.and.using.only.the.mini

mum

.ante

nna

.gain.nece

ssary.

.Use.

secto

red

.or.pane

.ante

nnas

.inst

ead

.of.omni

directional

.ante

nnas.

.Use.meta

.blin

.or.tint

ing

.on.

exte

rior

.wind

ows.

.Exte

rior

.meta

.wall

.are.pref

erable

.to.exte

rior

.wood

.wall

.Plac

.APs.in.the.

most.int

erior

.of.the.bui

lding

.spa

ce.

. 2.. Use.MAC.addr

ess

.lte

ring.

.MAC.addr

ess

.lte

ring

.will.prev

ent

.unaut

horized

.and.regi

stered

.user

from.acces

sing

.and.asso

ciating

.with.a.wire

less

.AP..An.acces

.cont

rol

.list.(ACL

)

.of.allo

wed

.MAC.

addresses.stored.either.internally.or.externally,.RADIUS,.can.be.used.to.limit.access.to.the.network.

. 3.. Con

gure

.the.AP.to.disab

.broa

dcast

.of.the.wire

less

.AP’s.serv

ice

.set.iden

tier

.(SSI

.whic

.is.used.

to.iden

tify

.a.LAN.that.a.user.may.asso

ciate

.with

. is.limi

.the.expo

sure

.of.the.netwo

.to.atta

ckers.

. 4.. WPA2.is.pre

ferable

.to.WPA.whi

.is.pre

ferable

.to.WEP

28.3 PaN Security

A.personal.area.network.(PAN).represents.a.limited.number.of.computer.and.communications.devices.

that.have.the.abil

ity

.to.form.netw

orks

.and.exch

ange

.info

rmation.

.WPAN

.allo

.comp

uting

.devi

ces

with

.clos

.rang

.of.one.anot

her

.to.comm

unicate

.whet

her

.they.are.stat

ionary

.or.in.moti

on.

.WPAN

may.use.die

rent

.tech

nologies

.to.comm

unicate,

.such.as.Blue

tooth,

.Infr

ared

.Data.Asso

ciation

.(IrD

A),

ultr

a-wideband

.(UW

B),

.and.Zig

Bee

.[12

,13].

. e.IEE

.802

.15

.wor

king

.gro

.has.de

ned

.sev

eral

.cla

sses

of.WPAN

.802.

15.1

. (Blu

etooth),

. 802.

15.3

. (hig

. data.rate. WPAN

. and. 802.

15.4

. (low

-rate

. WPAN

When.it.come

.to.secu

rity

.aspe

cts

.of.PAN,.the.enti

ties

.of.inte

rest

.are.Blue

tooth

.Speci

.Inte

rest

.Grou

(SIG

.the.Zig

Bee

.All

iance,

.and.the.IEE

.802

.15.4

.wor

king

.gro

.(wi

reless

.sen

sor

.net

works).

PANs

.have.a.wide.appl

ication

.scop

.and.may.be.used.in.buil

ding

.auto

mation

.such.as.acces

.cont

rol;

smoke.dete

ction;

.heat

ing,

.vent

ilation,

.and.air.cond

itioning

.(HVA

C);

.and.light

ing.

.Othe

.appl

ications

incl

ude

.indu

strial

.moni

toring,

.auto

matic

.mete

.read

ing,

.medi

cal

.sens

ing,

.and.envi

ronmental

.data.coll

ec-

tion

.[14,

15].

.Secu

rity

.is.an.impo

rtant

.issu

.in.thes

.cont

rol

.and.data.acqui

sition

.appl

ications.

. ese.tech

nologies

.(ZigB

.and.IEEE.802.

15.4)

.can.be.linke

.toge

ther

.into.netw

orks

.of.virt

ually

.unli

mited

.dist

ance.

PAN

. secu

rity

. conc

erns

. will. be. addr

essed

. with. rega

rds

. to. the. foll

owing

. aspe

cts:

. eave

sdropping,

auth

entication,

.loc

ation

.tra

cking,

.con

guration,

.jam

ming,

.col

lision,

.and.oth

ers.

Eavesdropping—wireless

. comm

unications

. in. gene

ral

. is. subje

. to. eave

sdropping

. and. pote

ntially

dest

roying

.the.con

dentiality

.of.the.data

.If.encr

yption

.is.not.enab

led,

.then.an.atta

cker

.may.atte

mpt

.to.

subs

titute

.mis

leading

.dat

.for.the.aut

hentic

.dat

Authentication

.and.encr

yption,

.when.enab

led,

.occu

.at.the.low.leve

.of.the.comm

unications

.stac

 is.makes.impersonation.of.a.sending.or.receiving.PAN.unit.dicult.[16,17].

Location

.trac

king—all

.PAN.devi

ces

.have.uniq

.addr

esses.

.Many.devi

ces

.are.mobi

.and.the.radi

signa

.is.trac

table.

.If.the.devi

.can.be.iden

tied

.with.a.spec

ic

.user

.the.move

ments

.of.the.user.can.be.

trac

ked

.[18

,19].

.matt

.how.good.a.desig

.spec

ication

.is,.impl

ementation

.aws.can.caus

.secu

rity

.hole

. e.

PAN.qual

ication

.proc

ess

.cann

.test.ever

.possi

ble

.perm

utation

.of.PAN.proto

col

.exch

anges.

.Some.

impl

ementations

.of.the.rst.PAN.spec

ications

.cont

ained

.vuln

erabilities

.that.gran

ted

.acce

.to.some.

serv

ice

.on.the.loca

.devi

ce.

.Addi

tionally,

.the.proto

cols

.spec

ied

.for.PAN.pro

les

.leav

.room.for.manu

facturer-specic

.dat

Industrial Wireless Communications Security (IWCS)/C42 28-7

When.PAN.devices.rst.appeared.in.the.marketplace.the.typical.conguration.of.these.devices.were.

wit

.mod

.1.or.no.sec

urity.

.Alt

hough

.mos

.PAN.dev

ices

.toda

.shi

.wit

.som

.lev

.of.sec

urity

.ena

bled

for.var

ious

.pro

les/services,

.use

.hav

.a.ten

dency

.to.tur

.PAN.sec

urity

.o.for.eas

.of.use.and.con

ve-

nience.

.“Pa

sskeys”

.are.typ

ically

.use

.as.an.aut

hentication

.tool

.Def

ault

.or.pre

set

.pas

skeys

.tha

.are.wel

kno

.ar

.st

andard

.on.so

.de

vices

.an

.sh

ould

.be.ch

anged

.to.pr

otect

.co

ndentiality

.of.in

formation.

802.15.4

.is.als

.the.bas

.for.wir

eless

.sen

sor

.net

works

.and.mes

.net

working.

.An.exa

mple

.of.a.mes

net

work

.for.a.fac

tory

.env

ironment

.is.sho

.in.Fig

ure

.28.

.Mes

.APs.are.wir

elessly

.net

worked

.wit

one.of.the.APs.pos

sibly

.pro

viding

.acc

ess

.to.the.Int

ernet.

.Oth

.app

lications

.inc

lude

.bui

lding

.aut

omation

whe

.ele

ctrical

.dev

ices

.tha

.nee

.to.be.con

trolled

.and.mon

itored

.cou

.int

erface

.to.a.mes

.AP..A.wir

less

.mes

.net

work

.(WM

.wou

.enab

.mai

ntenance

.wor

kers

.usi

.mob

ile

.han

dheld

.dev

ices

.such.as.

sma

rtphones

.or.per

sonal

.dig

ital

.ass

istants

.to.gat

her

.dat

.fro

.whe

rever

.the

.are.in.a.bui

lding.

Wireless

.mes

.net

works

.are.an.ee

ctive

.sol

ution

.for.bui

lding

.auto

mation

.and.con

trol.

. e.mes

.APs.

in.Fig

ure

.28.

.com

municate

.onl

.wit

.the

.adj

acent

.rou

ters.

.In.lar

ger

.mes

.net

work

.dep

loyments,

som

.of.the.APs.wou

.act.as.int

ermediate

.rou

ters

.or.rel

ays

.bet

ween

.APs.(mu

lti-hopping)

.not.wit

hin

wir

eless

.ran

.(no

n-line-of-sight)

.of.one.ano

ther.

.Whe

.an.int

ermediate

.rou

ter

.bec

omes

.fau

lty,

.oth

rou

ters/APs

.ada

.and.pic

.up.the.rou

ting;

.i.e

.the.mes

.net

work

.is.sel

f-healing,

.ens

uring

.con

stant

ava

ilability

.of.in

formation.

Office

Mesh AP

Mesh

FIGURE 28.5 Large.industrial.mesh.network.environment.

28-8 Industrial Communication Systems

 e.security.issues.of.wireless.mesh.networks.are.similar.to.the.security.issues.of.other.communica-

tions

.netw

orks:

.avai

lability,

.auth

enticity,

.inte

grity,

.and.con

dentiality.

.Atta

ckers

.can.aec

.the.avai

ability

.of.the.netw

ork

.by.empl

oying

.signa

.jamm

ing.

.A.defe

nse

.agai

nst

.signa

.jamm

ing

.is.freq

uency

hopp

ing

.and.spre

.spec

trum,

.whic

.wide

.the.jamm

ing

.rang

.and.chan

ges

.freq

uencies

.peri

odically.

Auth

enticity

.refe

.to.node

.in.a.WMN.ensu

ring

.the.iden

tity

.of.thei

.peer.node

.An.auth

entication

mech

anism

.can.be.impl

emented

.on.the.basis.of.publ

.key.crypto

graphy.

.Inte

grity

.is.ensu

ring

.that.the.

cont

ents

.of.a.comm

unication

.betw

een

.send

.and.rece

iver

.is.pres

erved

.inta

ct.

.Inte

grity

.can.be.achi

eved

thro

ugh

.crypto

graphy

.and.the.use.of.digi

tal

.signa

tures.

.Con

dentiality

.is.ensu

ring

.that.data.is.pro-

ected

.from.brea

ches

.by.unau

thorized

.pers

ons.

.Con

dentiality

.can.be.achi

eved

.thro

ugh

.the.auth

entica-

tion

.mec

hanism

.pre

viously

.dis

cussed

.as.wel

.as.enc

rypting

.the.com

munications

.ses

sion.

.WMN.has.mult

iple

.node

.and.chan

nels

.in.an.open.wire

less

.envi

ronment

.that.are.open.to.atta

ck.

Eave

sdropping

.on.wire

less

.chan

nels

.and.injec

ting

.fake.mess

ages

.into.the.chan

nel

.is.a.pote

ntial

.thre

at.

 e.self

-healing

.adapt

ive

.chan

.of.netw

ork

.topol

ogy

.may.make.it.easie

.for.an.atta

cker

.to.impe

rson-

ate

.a.legi

timate

.node

. e.node

.may.not.resid

.in.physi

cally

.prot

ected

.plac

es.

.Ille

gitimate

.node

.may.

viol

ate

.the.rout

ing

.proto

col

.and.forw

ard

.pack

ets

.to.dest

inations

.inco

nsistent

.with.the.rout

ing

.proto

col.

Low-rate

.PANs.such.as.ZigB

.are.high

.vuln

erable

.to.jamm

ing

.atta

cks

.due.to.thei

.very.low.tran

mission

.powe

.[20]

.A.high

-power-compliant

.tran

smitter

.coul

.send.out.radi

.signa

.at.the.physi

cal

laye

.(PH

.and.wea

ken

.or.eli

minate

.the.ava

ilability

.of.a.low

-rate

.PAN

Selective

.coll

ision

.of.some.cont

rol

.and.mana

gement

.fram

.by.an.adve

rsary

.may.appe

.like.ran-

om.collisions.and.are.not.easily.detectable..An.attacker.may.send.frames.(packets).that.collide.with.

ackn

owledgment

.of.asso

ciation

.resp

onse

.fram

es,

.causi

.an.expo

nential

.back.o.by.the.send

.and.

rest

art

.of.an.ass

ociation

.pro

cedure.

WMNs

.have.no.cent

ral

.auth

ority

.or.trus

ted

.thir

.part

.resp

onsible

.for.the.dist

ribution

.of.keys.that.

are.used.for.crypto

graphy.

.ZigB

.does.make.use.of.keys

.whic

.can.be.prec

ongured

.with.devi

ces,

.at.

die

rent

.lay

ers

.as.wel

.as.cha

llenge-authentication

.pro

cedures.

28.4 Summary

Wireless.in.industrial.environments.is.a.dicult.problem.that.requires.multiple.solutions.and.products.

whil

.at.the.same.time.enab

ling

.new.appl

ications

.and.serv

ices

.and.driv

ing

.down.cost

.Secu

rity

.is.a.

para

mount

.conc

ern.

.Wirel

ess

.syst

ems

.prov

ide

.secu

rity

.feat

ures

.such.as.con

dentiality

.thro

ugh

.AES.

end-

to-end

.encr

yption

.so.sensi

tive

.data.is.not.inte

rpreted,

.inte

grity

.code

.to.prev

ent

.tamp

ering

.with.

info

rmation,

.non-

repeating

.coun

ters

.to.prev

ent

.repl

.atta

cks,

.and.chan

nel

.hopp

ing

.to.mini

mize

.the.

risk.of.deni

.of.serv

ice

.atta

ck.

.Indu

strial

.envi

ronments

.cont

ain

.mach

inery

.and.meta

.objec

.that.pres

ent

.chal

lenges

.to.wire

less

.comm

unications.

.Reli

ability

.and.secu

rity

.consi

derations

.must.be.take

.into.

acco

unt

.bef

ore

.dep

loying

.app

lications

.ove

.wir

eless

.net

works.

references

. 1.. Goleniewski,.L.,.Telecommunications Essentials,.Addison-Wesley,.Boston,.MA,.2007.

. 2.. ZigBee.Alli

ance,

.htt

p://www.zigbee.org/

. 3.. IEEE.Sta

ndards,

.htt

p://standards.ieee.org/getieee802/download/802.15.4-2006.pdf

. 4.. Vlasimir

ov,

.A.,.Gavri

lenko,

.K.,.and.Mikh

ailovsky,

.A.,.WI-FOO, 

e Secrets of Wireless Hacking,

Addiso

n-Wesley,

.Readin

.MA,.2004.

. 5.. Nicho

ls,

.R..and.Lek

kas,

.P.,.Wir

eless Security,

.McGra

w-Hill,

.New.Yor

.2002.

. 6.. Gast,.M.,.802.11 Wir

eless Networks,

.O’R

eilly

.Medi

.Inc.,.Seb

astopol,

.CA,.2005.

. 7.. Aime,.M.,. Cala

ndriello,

. G.,. and. Lioy,. A.,. Depend

ability

. in. wireles

. netwo

rks,

. IEEE Secu

rity &

Privacy,

.5(1),.23–29,.Jan

uary/February

.2007.

Industrial Wireless Communications Security (IWCS)/C42 28-9

. 8.. Masika,.K.,.Securing WLANs using 802.11i Dra Recommended Practice Prepared for Idaho National

Laboratory Critical Infrastructure Protection Center,

. Law

rence

. Liv

ermore

. Nat

ional

. Lab

oratory

(LLNL),.Li

vermore,

.CA,.Fe

bruary

.2007.

. 9.. Berg

hel,

. H.. and. Uec

ker,

. J.,. WiFi. att

ack

. vec

tors,

. Com

munications of the ACM,

. 48(8),. 21–28,.

Augus

t2005.

. 10.. Zah

ur,

.Y..and.Yan

.T.,.Wire

less

.LAN.sec

urity

.and.lab

oratory

.designs,.Jou

rnal of Computing Sciences

in Colleges,

.19(3),.44–60,.Ja

nuary

.2004.

. 11.. Wal

ker,

. J.,. 802.11. Sec

turity

. Series,. Par

. II:. e. Temp

oral

. Key. Int

egrity

. Pro

tocol

. (TKIP),. Int

Technical Report,

.2004.

. 12.. Fara

hani,

.S.,.Zi

gBee Wireless Networks and Transceivers,

.Ne

wnes,

.Ne

wton,

.MA,.2008.

. 13.. Holg

er,

.K..and.Wil

lig,

.A.,.Pro

tocols and Architectures for Wireless Sensor Networks,

.Wile

y-Interscience,

Chich

ester,

.U.K.,.Oc

tober

.2007.

. 14.. Eady

.F.,.Han

ds-On ZigBee: Implementing 802.15.4 with Microcontrollers (Embedded Technology),

New

nes,

.Oxf

ord,

.U.K.,.Ma

rch

.2007.

. 15.. Gis

lason,

.D.,.Zi

gbee Wireless Networking,

.Ne

wnes,

.Oxf

ord,

.U.K.,.Augu

.2008.

. 16.. Sca

rfone,

. K.. and. Padget

te,

. J.,. Gui

de to Bluetooth Security, Special Publication 800-121,

Reco

mmendations

. of. the. Nat

ional

. Ins

titute

. of. Sta

ndards

. and. Tec

hnology,

. Gait

hersburg,

. MD,.

Sept

ember

.2008.

. 17.. Sto

uer,

.K.,.Falco

.J.,.and.Sca

rfone,

.K.,.Gui

de to Industrial Control Systems (ICS) Security, Special

Publication 800-82,

. Recommendations. of. the. National. Institute. of. Standards. and. Technology,.

Gait

hersburg,

.MD,.Sep

tember

.2008.

. 18.. Sca

rfone,

.K.,.Dicoi,.D.,.Sexto

.M.,.and.Tib

bs,

.C.,.Gui

de to Securing Legacy IEEE 802.11 Wireless

Networks, Special Publication 800-48,

.Reco

mmendations

.of.the.Nat

ional

.Ins

titute

.of.Sta

ndards

.and.

Tec

hnology,

.Gai

thersburg,

.MD,.Ju

.2008.

. 19.. Fran

kel,

.S.,.Eyd

.B.,.Owen

.L.,.and.Sca

rfone,

.K.,.Est

ablishing Wireless Robust Security Networks:

AGuide to IEEE 802.11i, Special Publication 800-97,

.Reco

mmendations

.of.the.Nat

ional

.Ins

titute

.of.

Sta

ndards

.an

.Te

chnology,

.Gai

thersburg,

.MD,.Fe

bruary

.2007.

. 20.. Masi

ka,

.K.,.Rec

ommended Practices Guide For Securing ZigBee Wireless Networks in Process Control

System Environments Dra Prepared for DHS US CERT Control Systems Security Program (CSSP),

Law

rence

.Li

vermore

.Na

tional

.La

boratory

.(LLNL),.Li

vermore,

.CA,.Ap

ril

.2007.

29-1

29.1 Introduction

Power.generation.is.a.complex.process.in.which.automation.systems.play.important.roles.in.assisting.

huma

. to. oper

ate

. the. plan

. Safe

. auto

mation

. syst

ems

. are. desi

gned,

. howe

ver,

. to. run. auto

no-

mously

.in.orde

.to.prot

ect

.the.proc

ess

.runn

ing

.out.of.its.oper

ating

.doma

.or.to.avoi

.huma

.erro

rs.

Apo

wer

.plan

.is.desi

gned

.to.oper

ate

.in.compl

.power.grid

.in.whic

.huma

.and.autom

ation

.syst

ems

inte

ract

.toge

ther

.to.deal.with.unex

pected

.situ

ations.

. ese.situ

ations

.may.conc

ern

.the.imba

lance

betw

een

.gene

ration

.and.cons

umption

.foll

owing

.haza

rds

.or.fail

ure

.of.the.powe

.plan

.or.the.net-

ork,

.or.the.need.of.powe

.anci

llary

.serv

ices

.to.stab

ilize

.the.grid

’s

.freq

uency

.or.volt

age.

.Toda

most.of.the.powe

.plan

.cont

rol

.room.is.conn

ected

.to.the.util

ity

.econ

omic

.disp

atch

.syst

ems

.wher

powe

.gene

ration

.opti

mization

.is.perf

ormed

.in.conj

unction

.with.trad

ing

.oper

ation.

.To.impr

ove

the.eci

ency

.of.main

tenance

.oper

ation,

.mode

.powe

.plan

.info

rmation

.syst

ems

.are.more.and.

more.conn

ected

.to.a.cent

ralized

.e-mo

nitoring

.cent

.(Fig

ure

.29.1

)

.wher

.plan

.expe

rts

.can.anal

yze

proc

ess

.para

meters

.for.stud

ying

.the.impr

ovement

.of.plan

.perf

ormances

.or.for.plan

ning

.cond

ition-

based

.main

tenance.

.show

.in.the.abov

.gur

.mode

.powe

.plan

.info

rmation

.syst

ems

.are.desig

ned

.to.inte

rface

.with.

the.worl

.outsi

.the.plan

.the.grid

.the.econ

omic

.disp

atch

.cent

er,

.the.e-mo

nitoring

.expe

rtise

.cent

er,

etc..In.the.foll

owing

.para

graphs,

.we.will.pres

ent

.the.most.comm

.comm

unication

.proto

cols

.used.for.

intr

.and.ext

ra-power

.pla

.com

munications.

Protocols in Power

Generation

29.1. Introduction.....................................................................................29-1

29.2

. Powe

.Pla

.Auto

mation

.Sys

tems

.and.Int

ra-Plant

Comm

unications.............................................................................29-2

Example.ofNuclearPowerPlantAutomation.

Systems. •. Safety.Requirements.and.System.Classications.

(IEC61226,.F1A,.F1B,.F2)

29.3. Power.Plant.Information.Systems.and.Extra-Plant.

Comm

unications.............................................................................29-4

Common.Information.Model. •. DistributedEnergy.

Resource.Model

29.4. Conclusions......................................................................................29-7.

Referen

ces.....................................................................................................29-7

Tuan Dang

EDF Research

andDe

velopment

Gaëlle Marsal

EDF Research

andDe

velopment

29-2 Industrial Communication Systems

29.2 Power Plant automation Systems

and Intra-Plant Communications

Power.plant.automation.systems.architecture.is.structured.by.functional.layers.as.shown.below.(Figure.29.2):

For

.example,.level.0.deals.with.instrumentation.such.as.sensors.and.actuators..Level.1.gathers.control.

and.protection.functions.that.are.typically.implemented.in.programmable.logic.controller.(PLC).. is.

layer.concerns.simple.and.fast.control.logics..Level.2.gathers.more.complex.supervisory.logics.includ-

ing

.human.system.interface.(HSI)..Levels.3.and.4.deal.with.computer-aided.scheduling.of.generation,.

maintenance,.and.refueling.if.relevant.

 ese

.layers.may.slightly.dier.from.one.power.generation.technology.to.another,.depending.on.the.

integration.scale.of.automation.systems..In.distributed.generation.such.as.wind.turbine,.micro-turbine,.

fuel.cell,.and.small.hydropower.plant.(up.to.hundreds.of.kilowatt),.the.integration.scale.is.relatively.

high.to.reduce.the.automation.cost..Centralized.generation.and.traditional.power.plant,.such.as.nuclear.

power.plant,.are.complex.processes.so.that.they.require.many.automation.systems.that.are.distributed.

Main

SCADA

Control system — balance of plant

Operating center

Sensors and actuators

Data

historian

Environmental

processing system

(demineralization...)

Burner

management

system

Gas pipeline

control system

Protection and

control steam

turbine

Protection and

control

combustion

turbine

Grid

dispatching

center

Fuel supplier

Interface to the grid

Combined cycle power plant DCS

O&M—asset management system

e-monitoring

center

Economic

dispatch

center

FIGURE 29.1 Example.of.combined.cycle.power.plant.information.system.

Out of process

planning

(Level 4)

In-process planning

(Level 3)

Supervision — HSI

(Level 2)

Control — protection

(Level 1)

Instrumentation

(Level 0)

FIGURE 29.2 Functional.layers.in.power.plant.automation.systems.architecture.

Protocols in Power Generation 29-3

over.the.whole.installation.. ese.systems.are.connected.to.the.plant.control.room.through.intra-plant.

communication.infrastructure..In.the.following.paragraphs,.examples.of.intra-plant.communication.in.

nuclear.power.generation.automation.systems.are.presented.because.they.have.numerous.and.specic.

requirements.comparing.to.other.power.generation.technologies.

29.2.1 Example of Nuclear Power Plant automation Systems

In.a.nuclear.power.plant,.there.are,.as.in.fossil.fuel.power.plant,.several.automation.systems.(Figure.29.3):.

turbine.control,.boiler.control,.core.protection.control,.switchyard.control,.and.other.dedicated.control.

systems.(chemical.processing,.air.conditioning,.etc.).

.dierence.with.fossil.fuel.power.plants.is.the.mandatory.high.safety.level..For.example,.the.core.

protection.control.system.must.be.designed.for.this.purpose.following.very.strong.design.rules,.whereas.

the.safety.requirements.on.the.boiler.control.system.authorized.the.use.of.commercial.o-the-shelf.con-

trol

.system.if.it.fullls.the.requirements.on.its.class.of.systems.. e.other.control.systems.(turbine.and.

switchyard).are.oen.provided.by.the.corresponding.system.manufacturers.and.they.are.not.concerned.

by.nuclear-specic.safety.requirements.

.global.automation.systems,.which.are.designed.to.interact.with.the.operators.in.the.control.room,.

are.particularly.concerned.by.the.safety.design.rules.. ese.systems.involve.control.functions.from.level.

0.to.level.2.as.shown.in.Figure.29.2..In.the.following.paragraph,.the.nuclear.safety.design.rules.of.auto-

mation

.system.will.be.detailed.

29.2.2 Safety requirements and System Classications

(IEC 61226, F1

a, F1B, F2)

Safety.requirements.in.nuclear.power.generation.concern.many.systems.. ere.are.strong.design.rules.

on.the.automation.systems.and.particularly.on.the.communication.subsystems.that.are.included.in.

the.core.protection.control.systems.. e.required.characteristics.of.the.communication.subsystems.are.

determinism,.redundancy,.functional.and.technical.diversity,.and.fault.tolerance..Moreover,.the.func-

tional

.architecture.of.the.global.control.systems.must.comply.with.the.system.classication.rules.that.

Level 1

Level 2

Level 0

TXS

SPPA T2000

Conventional

technology

TPCS

Turbine I&C

Synoptic view

Backup panel

Technical premises of crisis

Backup

operation

system

PACS

Grappes de

contröle

Actuators

F1A

Actuators

F1A

Actuator

F1B

Sensors

F1B

Actuator F2

et NC

RCSL

reactor

control

reactor

protection

Sensors F2

et NC

Main

operation

system

Main automation systems

PAS (process

automation

system)

SAS (safety

automation

system)

Specific technology

Core I&C

Standard I&C

Turbine & generator I&C

Standard I&C

FIGURE 29.3 Example.of.core.protection.control.system.