Security Analysis of Building Automation Networks

Threat Model and Viable Mitigation Techniques
  • Alessio Antonini
  • Alessandro Barenghi
  • Gerardo Pelosi
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8208)


Building automation systems are becoming increasingly commonplace in modern cities, thanks to the advantages they bring in terms of power efficiency and ease of management. Typically, they are connected to consumer grade platforms, to perform monitoring and management actions via a proper IP gateway, possibly from a remote location. In this work, we analyze the direct threats to the building automation network domain, considering an attacker able to eavesdrop or modify arbitrarily the packets. We detail the threat model under consideration, identifying the security desiderata and propose a secure communication protocol, together with a new distributed key agreement scheme. We analyze the feasibility of their implementation and the overhead in terms of computation and communication costs, using the KNX network standard as case study.


Time Slot Block Cipher Threat Model Forward Secrecy Beacon Message 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Atmel Corporation: ATMel Xmega Microcontroller Line Overview (2013),
  2. 2.
    Barenghi, A., Bertoni, G., Breveglieri, L., Pelosi, G.: A FPGA Coprocessor for the Cryptographic Tate Pairing over Fp. In: ITNG, pp. 112–119. IEEE Computer Society (2008)Google Scholar
  3. 3.
    Barenghi, A., Pelosi, G., Teglia, Y.: Information Leakage Discovery Techniques to Enhance Secure Chip Design. In: Ardagna, C.A., Zhou, J. (eds.) WISTP 2011. LNCS, vol. 6633, pp. 128–143. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  4. 4.
    Barenghi, A., Pelosi, G., Terraneo, F.: Efficient and Cost Effective Design of Block Cipher Implementations on Embedded Devices. Int. Journal of Grid and Utility Computing (IJGUC) 4(3), 1–10 (2013)Google Scholar
  5. 5.
    Bender, J., Newman, M.: BACnet/IP (2013),
  6. 6.
    den Boer, B.: Diffie-Hellman is as Strong as Discrete Log for Certain Primes. In: Goldwasser, S. (ed.) CRYPTO 1988. LNCS, vol. 403, pp. 530–539. Springer, Heidelberg (1990)CrossRefGoogle Scholar
  7. 7.
    Burmester, M., Desmedt, Y.: A Secure and Efficient Conference Key Distribution System. In: De Santis, A. (ed.) EUROCRYPT 1994. LNCS, vol. 950, pp. 275–286. Springer, Heidelberg (1995)CrossRefGoogle Scholar
  8. 8.
    Cavalieri, S., Cutuli, G.: Implementing Encryption and Authentication in KNX using Diffie-Hellman and AES Algorithms. In: IEEE Industrial Electronics Conf., pp. 2459–2464 (2009)Google Scholar
  9. 9.
    Dolev, D., Yao, A.C.: On the Security of Public Key Protocols. IEEE Transactions on Information Theory 29(2), 198–207 (1983)MathSciNetCrossRefMATHGoogle Scholar
  10. 10.
    Granzer, W., Kastner, W.: Security Analysis of Open Building Automation Systems. In: Schoitsch, E. (ed.) SAFECOMP 2010. LNCS, vol. 6351, pp. 303–316. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  11. 11.
    Granzer, W., Praus, F., Kastner, W.: Security in Building Automation Systems. IEEE Transactions on Industrial Electronics 57(11), 3622–3630 (2010)CrossRefGoogle Scholar
  12. 12.
    Hayashi, Y., Homma, N., Sugawara, T., Mizuki, T., Aoki, T., Sone, H.: Non-invasive EMI-based Fault Injection Attack against Cryptographic Modules. In: 2011 IEEE International Symposium on Electromagnetic Compatibility (EMC), pp. 763–767. IEEE (2011)Google Scholar
  13. 13.
    International Organization for Standardization: ISO/IEC 14908-[1-4]:2012 (2013),
  14. 14.
    Katz, J., Lindell, Y.: Introduction to Modern Cryptography. CRC Press (2007)Google Scholar
  15. 15.
    KNX Association: Network Communications Protocol for Intelligent Buildings. ISO/IEC 14543 (2013),
  16. 16.
    Lee, J., Park, G.L., Kim, S.W., Kim, H.J., Sung, C.O.: Power Consumption Scheduling for Peak Load Reduction in Smart Grid Homes. In: Chu, W.C., Wong, W.E., Palakal, M.J., Hung, C.C. (eds.) SAC, pp. 584–588. ACM (2011)Google Scholar
  17. 17.
    Mangard, S., Oswald, E., Popp, T.: Power Analysis Attacks - Revealing the Secrets of Smart Cards. Springer (2007)Google Scholar
  18. 18.
    Maurer, U.M.: Towards the Equivalence of Breaking the Diffie-Hellman Protocol and Computing Discrete Logarithms. In: Desmedt, Y.G. (ed.) CRYPTO 1994. LNCS, vol. 839, pp. 271–281. Springer, Heidelberg (1994)Google Scholar
  19. 19.
    Modbus: Open Protocol (2013),
  20. 20.
    Newman, M.: BACnet-A Tutorial Overview (2013),
  21. 21.
    NIST: Digital Signature Standard (DSS). FIPS 186-3, US National Tech. Inf. Service (2009)Google Scholar
  22. 22.
    NIST: Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication. FIPS 800-38B, US National Tech. Inf. Service (2009)Google Scholar
  23. 23.
    NSA/CSS: Cryptography–Suite B Implementer’s Guide to NIST SP 800-56A (2013),
  24. 24.
    Penzhorn, W.T., Amsenga, J.: IPv6, IPSec, and VPNs. In: Zurawski, R. (ed.) The Industrial Information Technology Handbook, pp. 1–18. CRC Press (2005)Google Scholar
  25. 25.
    Shelby, Z.: Embedded Web Services. IEEE Wireless Commun. 17(6), 52–57 (2010)CrossRefGoogle Scholar
  26. 26.
    Steiner, M., Tsudik, G., Waidner, M.: Diffie-Hellman Key Distribution Extended to Group Communication. In: Gong, L., Stearn, J. (eds.) ACM Conference on Computer and Communications Security, pp. 31–37. ACM (1996)Google Scholar
  27. 27.
    STMicroelectronics: STM32 F4 Series of High-performance MCUs (2013),
  28. 28.
    Ugus, O., Westhoff, D., Laue, R., Shoufan, A., Huss, S.A.: Optimized Implementation of Elliptic Curve Based Additive Homomorphic Encryption for Wireless Sensor Networks. In: 2nd Workshop on Embedded Systems Security (WESS 2007), pp. 11–16 (2009)Google Scholar
  29. 29.
    Vuagnoux, M., Pasini, S.: Compromising Electromagnetic Emanations of Wired and Wireless Keyboards. In: USENIX Security Symposium, pp. 1–16. USENIX Association (2009)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Alessio Antonini
    • 1
  • Alessandro Barenghi
    • 1
  • Gerardo Pelosi
    • 1
  1. 1.Dipartimento di Elettronica, Informazione e Bioingegneria – DEIBPolitecnico di MilanoMilanoItaly

Personalised recommendations