IT security extensions for PROFINET

Abstract

The impact of vertical and horizontal integration in the context of Industry 4.0 requires new concepts for the security of industrial Ethernet protocols. The defense in depth concept, basing on the combination of several measures, especially separation and segmentation, needs to be complimented by integrated protection measures for industrial real-time protocols. To cover this challenge, existing protocols need to be equipped with additional functionality to ensure the integrity and availability of the network communication, even in environments, where possible attackers can be present. In order to show a possible way to upgrade an existing protocol, this paper describes a security concept for the industrial Ethernet protocol PROFINET.

PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain

“…Security Class 2 and 3 extensions target cases where an (active or passive) attacker may inject, manipulate, or read messages on the network [20]. Currently, these types of attacks are countered by a zone concept, which strictly limits the access to network zones.…”

“…The security extensions improve this situation by providing state-of-the-art cryptographic protection for PROFINET messages. However, PROFINET Security is just one building block, and further measures (outside the scope of the PROFINET specification) are necessary for holistic security [15].…”

“…We start by providing a conceptual overview of PROFINET Security as defined and specified by PI [13]- [15]. A discussion of requirements and attack vectors, as well as the extent to which these can be addressed respectively countered by PROFINET Security can be found in a PI white paper [14].…”

Communications Security in Industry X: A Survey

“…Such a process field bus, which is meant for interfacing decentralized peripherals, where can drastically reduce the wiring costs. However, one of the serious concerns in the Profibus is the authentication issues among the master and slave nodes in the network [365]. Moreover, they are also susceptible to DoS threats, which need isolation from the other devices in the network.…”

Towards Securing Hard Real-Time Networked Embedded Devices and Systems: a cBPF Implementation for an FPGA

“…A useful performance comparison of eleven TLS cyphers suites is provided by [14]. Of the hard real time protocols in existence, [15] take issue with the security of EtherCAT and for PROFINET we observe a substantial time-gap between the initial voicing of concerns [16] and results from the relevant specification committees [17].…”