Abstract
Ethernet POWERLINK is an industrial Ethernet protocol created for applications with high degree of determinism, and amongst the closest to real-time (class 3 industrial Ethernet protocol). Consequently, it was developed for efficiency and short cycle times, with no security as it would only slow down the communications. In this paper, we show that most of the common known industrial Ethernet attacks cannot be carried out for Ethernet POWERLINK due to its isochronous real-time characteristics. We also show that it is still possible to perform attacks to affect such a system. We thus present five different attacks: a denial of service, a command insertion for a slave and then for a master, and impersonation of a slave and, finally, of a master. These attacks are afterwards validated on a testbed. We finally present proposals to defend against them without adding any major delay in the cyclic communications, by modifying transitions of the state machines of the protocol.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
References
Neumann, P.: Communication in industrial automation what is going on? Contr. Eng. Pract. 15, 1332–1347 (2007)
Jasperneite, J., Schumacher, M., Weber, K.: Limits of increasing the performance of industrial ethernet protocols. In: IEEE Conference on Emerging Technologies and Factory Automation (ETFA), pp. 17–24. IEEE (2007)
Ethernet POWERLINK Standardization Group: EPSG Draft Standard 301. Ethernet POWERLINK Communication Profile Specification (2013)
CAN in Automation: CiA 301 CANopen application layer specification (2011)
Falliere, N., Murchu, L.O., Chien, E.: W32. stuxnet dossier. White paper, Symantec Corp., Security Response 5 (2011)
Spenneberg, R., Brüggemann, M., Schwartke, H.: PLC-blaster: a worm living solely in the PLC (2016)
Huitsing, P., Chandia, R., Papa, M., Shenoi, S.: Attack taxonomies for the modbus protocols. Int. J. Crit. Infrastruct. Protect. 1, 37–44 (2008)
Bristow, M.: Modscan: a scada modbus network scanner. In: DefCon-16 Conference, Las Vegas, NV (2008)
Spyridopoulos, T., Topa, I.-A., Tryfonas, T., Karyda, M.: A holistic approach for cyber assurance of critical infrastructure with the viable system model. In: Cuppens-Boulahia, N., Cuppens, F., Jajodia, S., Abou El Kalam, A., Sans, T. (eds.) SEC 2014. IAICT, vol. 428, pp. 438–445. Springer, Heidelberg (2014). doi:10.1007/978-3-642-55415-5_37
Antonioli, D., Tippenhauer, N.O.: Minicps: a toolkit for security research on CPS networks. In: Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and/or Privacy, pp. 91–100.1 ACM (2015)
Åkerberg, J., Björkman, M.: Exploring security in profinet IO. In: 33rd Annual IEEE International Computer Software and Applications Conference (COMPSAC 2009), vol. 1, pp. 406–412. IEEE (2009)
Paul, A., Schuster, F., König, H.: Towards the protection of industrial control systems – conclusions of a vulnerability analysis of profinet IO. In: Rieck, K., Stewin, P., Seifert, J.-P. (eds.) DIMVA 2013. LNCS, vol. 7967, pp. 160–176. Springer, Heidelberg (2013). doi:10.1007/978-3-642-39235-1_10
Bhatia, S., Kush, N., Djamaludin, C., Akande, J., Foo, E.: Practical modbus flooding attack and detection. In: Proceedings of the Twelfth Australasian Information Security Conference, vol. 149, pp. 57–65. Australian Computer Society, Inc. (2014)
Basecamp Digital Bond: Attacking ControlLogix: ControlLogix Vulnerability Report (2012)
Patel, S.C.: Secure Internet-Based Communication Protocol for SCADA Networks. University of Louisville (2006)
International Electrotechnical Commission: AGA Report No. 12. Cryptographic Protection of SCADA Communications Part 1: Background, Policies and Test Plan (2006)
West, A.: Securing DNP3 and modbus with AGA12-2J. In: 2008 IEEE Power and Energy Society General Meeting-Conversion and Delivery of Electrical Energy in the 21st Century, pp. 1–4. IEEE (2008)
Tsang, P.P., Smith, S.W.: YASIR: a low-latency, high-integrity security retrofit for legacy SCADA systems. In: Jajodia, S., Samarati, P., Cimato, S. (eds.) SEC 2008. ITIFIP, vol. 278, pp. 445–459. Springer, Boston, MA (2008). doi:10.1007/978-0-387-09699-5_29
Shahzad, A., Musa, S., Aborujilah, A., Irfan, M.: Secure cryptography testbed implementation for scada protocols security. In: 2013 International Conference on Advanced Computer Science Applications and Technologies (ACSAT), pp. 315–320. IEEE (2013)
Fovino, I.N., Carcano, A., Masera, M., Trombetta, A.: Design and implementation of a secure modbus protocol. In: Palmer, C., Shenoi, S. (eds.) ICCIP 2009. IAICT, vol. 311, pp. 83–96. Springer, Heidelberg (2009). doi:10.1007/978-3-642-04798-5_6
Hayes, G., El-Khatib, K.: Securing modbus transactions using hash-based message authentication codes and stream transmission control protocol. In: 2013 Third International Conference on Communications and Information Technology (ICCIT), pp. 179–184. IEEE (2013)
Wang, Y.: sSCADA: securing scada infrastructure communications. Int. J. Commun. Netw. Distrib. Syst. 6, 59–78 (2010)
Czybik, B., Hausmann, S., Heiss, S., Jasperneite, J.: Performance evaluation of MAC algorithms for real-time ethernet communication systems. In: 2013 11th IEEE International Conference on Industrial Informatics (INDIN), pp. 676–681. IEEE (2013)
IEEE Power, Energy Society: IEEE 1815. IEEE Standard for Electric Power Systems Communications - Distributed Network Protocol (DNP3) (2012)
Ethernet POWERLINK Standardization Group: EPSG Draft Standard Proposal 302-A. Ethernet POWERLINK Part A, High Availability (2013)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Yung, J., Debar, H., Granboulan, L. (2017). Security Issues and Mitigation in Ethernet POWERLINK. In: Cuppens-Boulahia, N., Lambrinoudakis, C., Cuppens, F., Katsikas, S. (eds) Security of Industrial Control Systems and Cyber-Physical Systems. CyberICPS 2016. Lecture Notes in Computer Science(), vol 10166. Springer, Cham. https://doi.org/10.1007/978-3-319-61437-3_6
Download citation
DOI: https://doi.org/10.1007/978-3-319-61437-3_6
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-61436-6
Online ISBN: 978-3-319-61437-3
eBook Packages: Computer ScienceComputer Science (R0)