PLCrypto: A Symmetric Cryptographic Library for Programmable Logic Controllers

Abstract

Programmable Logic Controllers (PLCs) are control devices widely used in industrial automation. They can be found in critical infrastructures like power grids, water systems, nuclear plants, manufacturing systems, etc. This paper introduces PLCrypto, a software cryptographic library that implements lightweight symmetric cryptographic algorithms for PLCs using a standard PLC programming language called structured text (ST). To the best of our knowledge, PLCrypto is the first ST-based cryptographic library that is executable on commercial off-the-shelf PLCs. PLCrypto includes a wide range of commonly used algorithms, totaling ten algorithms, including one-way functions, message authentication codes, hash functions, block ciphers, and pseudo-random functions/generators. PLCrypto can be used to protect the confidentiality and integrity of data on PLCs without additional hardware or firmware modification. This paper also presents general optimization methodologies and techniques used in PLCrypto for implementing primitive operations like bit-shifting/rotation, substitution, and permutation. The optimization tricks we distilled from our practice can also guide future implementation of other computationheavy programs on PLCs. To demonstrate a use case of PLCrypto in practice, we further realize a cryptographic protocol called proof of aliveness as a case study. We benchmarked the algorithms and protocols in PLCrypto on a commercial PLC, Allen Bradley ControlLogix 5571, which is widely used in the real world. Also, we make our source codes publicly available, so plant operators can freely deploy our library in practice.

SCADA Authentication Identification Over The Next Generation CyberNet

“…3. PLCrypto: A Symmetric Cryptographic Library for Programmable Logic Controllers [30] • A software cryptographic library that implements lightweight symmetric…”

“…Zheng Yang , Zhiting Bao , Chenglu Jin , Zhe Liu, and Jianying Zhou , developed a comprehensive symmetric cryptographic library which is named PLCrypto on the control logic layer [30]. Modbus-S protocol is provided by Luo Xuan, Li Yongzhong, and others by analyzing Modbus TCP protocol to avoid flaws [31].…”

Protecting Modbus/TCP-Based Industrial Automation and Control Systems Using Message Authentication Codes

“…When compared to the Chaskey-12 MAC implementation in the Allen Bradley ControlLogix 5571 PLC presented in [30], our implementation has a significantly lower runtime cost for the same amount of data. For example, the average execution time of their implementation is around 65 ms for a data size of 260 bytes (maximum size of the Modbus/TCP ADU), while our implementation takes around 5.3 and 2.8 ms for S7-1200 and S7-1500 PLCs, respectively.…”

“…Assuming that both implementations are correct, which was proven by testing the implementations against the test vectors given in [27], such runtime difference could theoretically be caused by the fact that the authors had to create their own bitwise shift/rotate instructions as the used PLC does not provide them in the ST language [30]. Concerning the difference between the PLC resources, both the Control-Logix 5571 and S7-1500 series are high performance PLCs, which means that they are used for similar complex and highperformance systems.…”

“…Finally, some authors [30], [31], implemented lightweight cryptographic algorithms within the PLC's program and showed that the real-time performance of IACSs was preserved. To our knowledge, there are no studies that used the implemented algorithms to protect industrial communication protocols.…”