wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Vertical Integration 13-9
Internet
Frequent, automated attacks (port scans)
Standard IT solutions: VLANs, SSH, TLS
Intranet
Fieldbus
AP
Firewall, network address translation
Main threat: malicious software
Restricted, controlled user group
Firewall, role-based access
Reduced security, proprietary solutions
Controlled access (maintenance staff)
FIGURE 13.6
Defense-in-depth security model for vertically integrated company networks.
As the timeline in Figure 13.2 shows, most of these developments were concluded long before the
Internet became known and was widely employed by the broad public. It is thus no wonder that security
considerations never played a prominent role in automation before the end of the 1990s [D97,PS00].
The most promising approach to cope with the heterogeneity of the networks is a hierarchical security
model following the defense-in-depth approach. Figure 13.6 shows the three typical interconnection
zones in the company network. The zones are separated from each other by dedicated network nodes
that can be used as anchor points for the security strategy. The inner connection node (access point) to
the actual fieldbus is the gateway or proxy already discussed in Section 13.3.
As existing standards cannot be changed, the only viable option for the field level is to use the fieldbus
simply as a transport channel and to tunnel secure packets over standard fieldbus protocols and
services [SS02]. Such an application-level approach could easily achieve end-to-end security, which is
desired in most applications, anyway. Unfortunately, it is likely to cause problems with interoperability
unless all nodes in the network adhere to this enhanced standard, i.e., a mixture of secure and insecure
devices would normally not be feasible. In addition, the limited messages size in some fieldbuses leaves
only little room for the additional data blocks required by efficient security extensions. This problem is
similar to the one encountered in IP tunneling discussed in Section 13.3.
The access point itself has so far been the focal point of interest for most researchers. Given the lack
of general field-level security, it is the only part of the automation system (apart from the Internet side)
where security can easily be applied. One very common approach is to combine the access point with a
firewall, which is the most widely employed security measure in the design of network interconnections
today even in the field of automation [D97]. Indeed, the term “firewall” is nowadays frequently used as a
synonym for network security. In practice, however, their application is not so straightforward. Owing
to the inherently asymmetric operation of a firewall (transparent from the private network, opaque
from outside), it is difficult to place a standard firewall in front of a fieldbus access point; it is better to
tightly integrate the firewall into the access point and use, e.g., port forwarding to control the traffic
[PS00]. On top of this, the access point is also the ideal point to control and manage access to the fieldbus
zone. A suitable model for handling access rights is role-based access control, where all communication
partners (users, devices, tools) are associated with particular roles depending on the context of the data
exchange. In the IT world, this concept is widely employed, and it can also be used in an automation
context [WB04].
Security in the Internet finally is a well-researched topic with a large number of meanwhile very
mature solutions. In fact, for nearly all Internet application layer protocols, secure versions exist, or
conventional insecure protocols can be used on top of a secure transport layer. This standard mechanism
of first establishing an encrypted channel between communication partners is called Transport
© 2011 by Taylor and Francis Group, LLC