white paper on industrial automation security in fieldbus and

29times just because TCP says so. When usingUDP, retransmission of old data can be avoidedin case one cycle of data is missed; the nextcycle with up-to-date data is sent instead.The bridging between Modbus TCP or ModbusUDP into the serial line variants, e.g. ModbusRTU, has become more common as IndustrialEthernet also increases in popularity.3.4.7.2 PROFINET IOPROFINET IO is an Ethernet-based protocoldesigned for real-time communication. Theexperience gained from the PROFIBUS fieldbuswas integrated with the Industrial Ethernettechnology to create PROFINET. The masterdevice in a PROFINET IO system is called the“Controller”, while slaves are referred to as“Devices”. Cyclic data exchange in PROFINETIO takes place directly in the Ethernet layer 2,not involving any transport protocols such asUDP or TCP; the messages are addressed usingthe MAC addresses of the PROFINET IOdevices. Acyclic data is exchanged using theUDP protocol.The cyclic data exchange connections aremonitored using a watchdog time, which isconfigured as a multiple of the update (cycle)time of the network. As an example, if theupdate time is 8 milliseconds and the watchdogtime multiplier is 3, then the watchdog time willbe 24 milliseconds. If the communication is idlefor longer than this period of time, the devicemonitoring the watchdog will detect this eventand execute some reaction; however this isdevice- or user-specific.Because the PROFINET IO real-time dataexchange frames are communicated in theEthernet layer 2, these frames contain only MACaddresses. This means that the real-time framescannot be communicated outside a subnet whichis delimited by a router, because routers formsubnets based on IP addresses as defined in layer3.A hardware implementation is required for themost deterministic class of PROFINET IOdevices, known as IRT (Isochronous Real Time).This is commonly an ASIC with integratedswitch and other functionality needed for thePROFINET IO IRT protocol.A PROFINET IO Controller always needs toconnect to a PROFINET IO Device using anexplicit “Connect” message. After this theController downloads startup parameters to thedevice, following a handshake verifying that thestartup is successful and complete. An intruderwishing to establish a connection to a device, i.e.to act as a second master, has to know how thedevice is structured and how to initialize itproperly at startup. Based on vendor ID anddevice ID it may be possible to find the GSDMLdescription file for the device, however if thedevice is modular then knowing the trueconfiguration likely requires physical access ordocumentation about the system.The PROFINET IO protocol furthermorerequires the same I&M functionality asdescribed for PROFIBUS DP earlier.PROFINET IO devices thus expose the sameinformation to anyone who can access it.At startup the PROFINET IO controller providesthe vendor ID and product ID that is configuredfor the targeted IO device. The device checks themaster’s expected information against its owndata and aborts the connection request if amismatch occurs.Two potential methods of attacking thecommunication in a PROFINET IO system aredescribed in [7]. The authors propose that it maybe possible to modify the outputs of aPROFINET IO Device without being detectedby either the Device or the Controller.