Bridge Me If You Can! Evaluating the Latency of Securing Profinet

Abstract

Fieldbusses have been the backbone of inter-device communication in both industrial and home automation settings for a few decades. The underlying assumption is the availability of reliable and low-latency communication for all busses. This often implies that the busses are confined to a single physical location. With the advent of the 'Internet of Things' (IoT) and succinctly the 'Industrial Internet of Things' (IIoT) and the increased demand for control logic to be pushed into the 'Cloud', that assumption can no longer be upheld. Since no (I)IoT protocol exists to provide remote control, let alone in a secure fashion, while providing low latency at the same time, we are left with the problem of routing fieldbusses from, say, data-centres to shopfloors. This presents a challenge, because those busses have been designed for safety rather than security.In this paper, we elaborate on the viability of routing layer two fieldbus traffic while providing both: low latency to fulfil real-time requirements and security through cryptographic tunnels. We design and implement a network topology where Profinet traffic is routed through a VXLAN over Wireguard overlay to control a SoftPLC instance. We evaluate our implementation in a realistic test-bed and our measurements indicate that bridging Profinet over VXLAN and Wireguard induces a latency low enough for running time-critical applications.

PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain

“…The first aspect is left as future work, given the lack of implementations of PROFINET Security (see Section IV). Studies on the second aspect can be found in the literature [8]- [12].…”