PROFINET Real-Time Protection Layer: Performance Analysis of Cryptographic and Protocol Processing Overhead

Abstract

Recent times have seen an increasing demand for access to process-data from the field level through to the Internet. This vertical integration of industrial control systems into the IT infrastructure exhibits major drawbacks in the context of security. Such systems now suffer exposure to cyber security attacks well-known from the IT environment. Successful attacks on industrial control systems can lead to downtimes, malfunction of production machinery, cause financial damage and may present a hazard for human life and health. Current automation communication systems generally lack a comprehensive security concept. PROFINET is a widespread Industrial Ethernet standard, fulfilling general communication requirements on automation systems as well as explicit real-time requirements. We elaborate the challenges of protecting the realtime component of PROFINET. We specify the requirements and a concept for ensuring integrity and authenticity using a keyed-hash message authentication code (HMAC) in combination with the cryptographic hash algorithm SHA-3. With a proof of concept implementation of a PROFINET RT protection layer, the performance overhead for generation and transmission of this HMAC and other required data fields, e.g. to prevent replay attacks, could be analyzed. Based on these data the limitations of security technology on real-time systems were explored as was the optimization potential of hardware acceleration.

PROFINET Security: A Look on Selected Concepts for Secure Communication in the Automation Domain

“…Various approaches to integrate cryptographic security into PROFINET have been proposed before. Some of them focus just on the cryptographic protection of cyclic realtime CRs [10], [29]. In contrast to the design of PROFINET Security (as sketched within this section), these approaches do not offer a protection of, e.g., device parametrization or other relevant CRs within a PROFINET AR (e.g., record services).…”

IT security extensions for PROFINET

“…The project [17] evaluated different MAC algorithms and their performance. In [18,19] the authors evaluate PROFINET in combination with transport layer security. The recent publications show that different approaches are possible to protect the PROFINET communication.…”