wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

22-6 Industrial Communication Systems
Mail
server
Client
workstations
Local network
DMZ
Web
server
Outside network
FIGURE 22.2
Demilitarized zone.
entire application. Therefore, a proxy acts as a man-in-the-middle: to the outside network, a proxy behaves
like the destination device; to the inside network, the proxy acts as the request origin; and vice versa.
Sophisticated application proxies are completely transparent to the involved communication parties.
Due to the importance of firewalls, they have to be reliable and robust against security attacks. To minimize
vulnerabilities, firewalls are often isolated, stand-alone devices that are kept as simple as possible.
Furthermore, access to firewalls is only permitted to users with special administrator privileges (if at all).
From a security point of view, using a single firewall that acts as a single wall of protection may
not be sufficient. If an adversary is able to bypass the firewall, he has full access to the entire network.
Therefore, it is more appropriate to separate the network into several zones where each zone is protected
with a dedicated firewall and a corresponding security policy. A typical example is shown in Figure 22.2.
Besides a separation between an outside and an inside network, the inner network is further divided
into a local network that is home for the different client workstations and a so-called DMZ. The firewall
between the outside network and the DMZ is responsible for filtering the incoming network traffic that
is intended for the servers as well as the client workstations. However, to further protect the clients, a
second firewall is located at the boundary between the DMZ and the local network. This firewall is able
to additionally filter traffic that is irrelevant for the client workstations (e.g., HTTP traffic to the Web
server). The main advantage of this second firewall is that if a server within the DMZ gets compromised,
the second firewall acts as an additional wall of protection between the client workstations and the compromised
server. Finally, to further secure the client workstations against compromised clients, each
client may have its own personal firewall that provides an additional layer of protection.
22.3.3 Cryptography
Cryptographic algorithms use mathematical techniques to guarantee a protection of data against unauthorized
interference [MEN]. In industrial communication systems, these cryptographic algorithms
can be used to secure data while it is transmitted over a possible insecure network. Depending on the
used algorithms, the following security objectives can be guaranteed:
• Data confidentiality: To avoid an unauthorized disclosure of confidential data, the producer has to
transform it in way that unauthorized entities are not able to interpret the data’s meaning while it
is transmitted over the network. To achieve this, encryption algorithms can be used. The output of
the encryption (called cipher text) is transmitted over the network where the consumer receives
it. To retrieve the clear-text version again, the consumer applies the inverse operation using the
corresponding decryption algorithm.
© 2011 by Taylor and Francis Group, LLC