Legacy-Compliant Data Authentication for Industrial Control System Traffic

  • John Henry CastellanosEmail author
  • Daniele Antonioli
  • Nils Ole Tippenhauer
  • Martín Ochoa
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10355)


Industrial Control Systems (ICS) commonly rely on unencrypted and unauthenticated communication between devices such as Programmable Logic Controllers, Human-Machine-Interfaces, sensors, and actuators. In this work, we discuss solutions to extend such environments with established cryptographic authentication schemes. In particular, we consider schemes that are legacy compliant in the sense that authentication data is embedded as additional payload for domain specific protocols, for example the industrial EtherNet/IP protocol. To that end, we propose a selective protocol (that signs every critical packet sent) and a protocol that aggregates groups of packets based on real-time requirements and the available throughput, for various realistic hardware configurations. We evaluate our analysis by implementing an authenticated channel in a realistic Water Treatment testbed.


Industrial Control Systems Authentication Network security 


  1. 1.
    Batke, B., Wiberg, J., Dubè, D.: CIP security phase 1 secure transport for Ethernet/IP. In: ODVA Industry Conference (2015)Google Scholar
  2. 2.
    Cárdenas, A.A., Amin, S.M., Sinopoli, B., Giani, A., Perrig, A., Sastry, S.S.: Challenges for securing cyber physical systems. In: Workshop on Future Directions in Cyber-physical Systems Security, DHS, July 2009Google Scholar
  3. 3.
    Cárdenas, A.A., Baras, J.S.: Evaluation of classifiers: practical considerations for security applications. In: AAAI Workshop on Evaluation Methods for Machine Learning (2006)Google Scholar
  4. 4.
    Dierks, T.: The transport layer security (TLS) protocol version 1.2 (2008).
  5. 5.
    Fletcher, K.K., Liu, X.: Security requirements analysis, specification, prioritization and policy development in cyber-physical systems. In: Secure Software Integration Reliability Improvement Companion (SSIRI-C), pp. 106–113 (2011)Google Scholar
  6. 6.
    Galloway, B., Hancke, G.: Introduction to industrial control networks. Commun. Surv. Tutor. 15(2), 860–880 (2013). IEEECrossRefGoogle Scholar
  7. 7.
    Gomes, N., Mattos, L.: Attacks detection based on IP and TCP protocols violation. Int. J. Forensic Comput. Sci. 1, 49–56 (2006)CrossRefGoogle Scholar
  8. 8.
    Hash libraries for arduino.
  9. 9.
    Igure, V.M., Laughter, S.A., Williams, R.D.: Security issues in scada networks. Comput. Secur. 25(7), 498–506 (2006)CrossRefGoogle Scholar
  10. 10.
    P. Inc.: Profinet and it. Technical report, PROFIBUS Nutzerorganisation e.V. (2008)Google Scholar
  11. 11.
    iTrust: Center for Research in Cyber Security. Secure water treatment test-bed.
  12. 12.
    Johnson, D., Menezes, A., Vanstone, S.: The elliptic curve digital signature algorithm (ECDSA). Int. J. Inf. Secur. 1(1), 36–63 (2001)CrossRefGoogle Scholar
  13. 13.
    Karlof, C., Sastry, N., Wagner, D.: TinySec: a link layer security architecture for wireless sensor networks. In: Proceedings of the International Conference on Embedded Networked Sensor Systems, SenSys 04, pp. 162–175. ACM (2004)Google Scholar
  14. 14.
    Krawczyk, H., Bellare, M., Canetti, R.: HMAC: keyed-hashing for message authentication (1997).
  15. 15.
    Krotofil, M., Cárdenas, A.A., Manning, B., Larsen, J.: CPS: driving cyber-physical systems to unsafe operating conditions by timing DoS attacks on sensor signals. In: Proceedings of the Computer Security Applications Conference (ACSAC), pp. 146–155. ACM (2014)Google Scholar
  16. 16.
    Kuhn, M.G.: An asymmetric security mechanism for navigation signals. In: Fridrich, J. (ed.) IH 2004. LNCS, vol. 3200, pp. 239–252. Springer, Heidelberg (2004). doi: 10.1007/978-3-540-30114-1_17 CrossRefGoogle Scholar
  17. 17.
    Gnu cryptographic library.
  18. 18.
    Majdalawieh, M., Parisi-Presicce, F., Wijesekera, D.: DNPSec: distributed network protocol version 3 (DNP3) security framework. In: Elleithy, K., Sobh, T., Mahmood, A., Iskander, M., Karim, M. (eds.) Advances in Computer, Information, and Systems Sciences, and Engineering, vol. 3, pp. 227–234. Springer, Dordrecht (2007). doi: 10.1007/1-4020-5261-8_36 Google Scholar
  19. 19.
    Modbus-IDA. Modbus messaging on tcp/ip implementation guide v1.0b. Technical report, Modbus Organization (2006)Google Scholar
  20. 20.
    Nie, P., Vähä-Herttua, J., Aura, T., Gurtov, A.: Performance analysis of HIP diet exchange for wsn security establishment. In: Proceedings of the ACM Symposium on QoS and Security for Wireless and Mobile Networks, Q2SWinet 11, pp. 51–56. ACM (2011)Google Scholar
  21. 21.
    Radu, A.I., Garcia, F.D.: LeiA: a lightweight authentication protocol for CAN. In: Askoxylakis, I., Ioannidis, S., Katsikas, S., Meadows, C. (eds.) ESORICS 2016. LNCS, vol. 9879, pp. 283–300. Springer, Cham (2016). doi: 10.1007/978-3-319-45741-3_15 CrossRefGoogle Scholar
  22. 22.
    Rajkumar, R., Lee, I., Sha, L., Stankovic, J.: Cyber-physical systems: the next computing revolution. In: 2010 47th ACM/IEEE on Design Automation Conference (DAC), pp. 731–736, June 2010Google Scholar
  23. 23.
    Sandaruwan, G., Ranaweera, P., Oleshchuk, V.A.: PLC security and critical infrastructure protection. In: Industrial and Information Systems (ICIIS), pp. 81–85. IEEE (2013)Google Scholar
  24. 24.
    Schiffer, V., Vangompel, D., Voss, R.: The common industrial protocol (CIP) and the family of CIP networks. ODVA, Ann Arbor (2006)Google Scholar
  25. 25.
    Shahzad, A., Lee, M., Lee, Y.-K.K., Kim, S., Xiong, N., Choi, J.-Y.Y., Cho, Y.: Real time MODBUS transmissions and cryptography security designs and enhancements of protocol sensitive information. Symmetry 7(3), 1176–1210 (2015)MathSciNetCrossRefGoogle Scholar
  26. 26.
    Slay, J., Miller, M.: Lessons learned from the maroochy water breach. In: Goetz, E., Shenoi, S. (eds.) ICCIP 2007. IIFIP, vol. 253, pp. 73–82. Springer, Boston, MA (2008). doi: 10.1007/978-0-387-75462-8_6 CrossRefGoogle Scholar
  27. 27.
    Smart, N., Babbage, S., Catalano, D., Cid, C., Weger, B. d., Dunkelman, O., Ward, M.: Ecrypt ii yearly report on algorithms and keysizes (2011–2012). In: European Network of Excellence in Cryptology (ECRYPT II) (2012)Google Scholar
  28. 28.
    Tsang, P.P., Smith, S.W.: YASIR: a low-latency, high-integrity security retrofit for legacy SCADA systems. In: Jajodia, S., Samarati, P., Cimato, S. (eds.) SEC 2008. ITIFIP, vol. 278, pp. 445–459. Springer, Boston, MA (2008). doi: 10.1007/978-0-387-09699-5_29 CrossRefGoogle Scholar
  29. 29.
    Urbina, D., Giraldo, J., Tippenhauer, N.O., Cárdenas, A.: Attacking fieldbus communications in ICS: applications to the SWaT testbed. In: Proceedings of Singapore Cyber Security Conference (SG-CRC), January 2016Google Scholar
  30. 30.
    Van Herrewege, A., Singelee, D., Verbauwhede, I.: CANAuth-a simple, backward compatible broadcast authentication protocol for CAN bus. In: ECRYPT Workshop on Lightweight Cryptography, vol. 2011 (2011)Google Scholar
  31. 31.
    Wang, W., Lu, Z.: Cyber security in the smart grid: survey and challenges. Comput. Netw. 57(5), 1344–1371 (2013)CrossRefGoogle Scholar
  32. 32.
    Weinberger, S.: Computer security: is this the start of cyberwarfare? Nature 174, 142–145 (2011)CrossRefGoogle Scholar
  33. 33.
    Wright, A.K., Kinast, J.A., McCarty, J.: Low-latency cryptographic protection for SCADA communications. Acns 3089, 263–277 (2004)zbMATHGoogle Scholar

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  • John Henry Castellanos
    • 1
    Email author
  • Daniele Antonioli
    • 1
  • Nils Ole Tippenhauer
    • 1
  • Martín Ochoa
    • 1
  1. 1.Singapore University of Technology and DesignSingaporeSingapore

Personalised recommendations