wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Security in Industrial Communication Systems 22-5
of the application, it is not always necessary to guarantee all of the security objectives mentioned above.
For example, if the nondisclosure of the transmitted data is not a strict requirement, guaranteeing data
integrity, availability, and freshness may be sufficient. In general, only those security mechanisms that
are absolutely necessary to satisfy the security demands of the application shall be implemented (good
enough security). This is especially true for embedded networks that consist of devices with limited
system resources that are just sufficient to fulfill the devices’ tasks. This concerns primarily processing
power (persistent and volatile), memory, power consumption, and network bandwidth. Since security
mechanisms are computationally intensive, the realization of security objectives is a critical design step
and must not exceed the available device resources.
Guaranteeing data confidentiality, integrity, and freshness can be achieved using cryptographic techniques
(cf. Section 22.3.3). However, counteracting interruption attacks like DoS attacks is not possible
using a cryptographically secured data transmission. Therefore, additional security measures are
required to guarantee data availability (cf. Section 22.3.4).
22.3.1 Virtual Private Networks
A VPN is a logical secure network that is built upon a possibly insecure network. A VPN is transparent
to the connected devices. Usually, a device opens a secure unicast connection to a trusted third
party (e.g., centralized VPN server) where the whole network traffic to and from the device is tunneled
through. In industrial systems, VPNs are most commonly used to connect either two dislocated fieldbus
segments or to connect remote maintenance or control centers. Section 22.5.3 describes the open VPN
solution and IPsec application. Chapter 15 is further dedicated to Virtual Automation Networks.
22.3.2 Firewalls
A firewall is a network entity that protects a trusted network, host, or service against unauthorized
access by inspecting the incoming and outgoing network traffic to decide whether the traffic is allowed
or not [PFL]. The decision about allowing or denying network traffic is made based on the firewall’s
security policy. Such a security policy commonly consists of a default policy and a set of applicationspecific
rules that specify exceptions or amendments to the default policy. Consider, for example, a management
interface to an automation controller. The default policy to that interface may be set to “DENY”
while a specific rule may be added that allows the system operator’s management workstation to access
the interface. A security policy is normally predefined according to the system’s policy. However, it may
also be necessary to dynamically change the rule set of a firewall. For example, if an intrusion detection
system (IDS) (cf. Section 22.3.4) identifies a malicious host within a network, the IDS may add a specific
rule to the rule set of the firewall that explicitly drops all traffic originated from the identified malicious
host (dynamic blacklist).
Depending on the capabilities provided by the firewall, three different types can be distinguished:
A packet filtering firewall is the simplest form of firewall. It uses part of the header information to decide
whether a packet shall be accepted or dropped. For example, to filter IP traffic, the address information
(IP address, UDP/TCP port number) as well as the encapsulated application protocol type (e.g., HTTP,
FTP) may be considered for identifying valid traffic. However, the state of connections (e.g., has the
connection already been closed?) as well as details about the application data (e.g., distinguish between
different HTTP methods) are not considered.
A stateful filtering firewall, on the other hand, additionally maintains the state of a connection. Using
this extra information, the firewall is able to detect illegal connection states and so it is possible to
specify a more advanced rule set. For example, to avoid unsolicited connections with a protected entity,
the firewall only permits client packets after a dedicated connection has been established to the server.
Finally, an application proxy also inspects the application data of network packets. To fully analyze
the effects of incoming and outgoing network packets, an application proxy simulates the behavior of the
© 2011 by Taylor and Francis Group, LLC