wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Security in Industrial Communication Systems 22-9
Process model
Data storage
component
Data gathering
Data processing component
Response
component
Knowledge
base
FIGURE 22.3
Intrusion detection system.
as an attack, different techniques such as expert systems as well as signature detection mechanisms
can be used. Anomaly-based intrusion detection tries to detect abnormal behavior by comparing the
observed behavior with the normal and expected behavior also called reference pattern. To achieve such
a comparison, a system model must be specified. This model must define the default reference pattern
(i.e., network traffic or device behavior) that represents the expected and normal behavior of the system.
Obviously, this default behavior is not static since it can change during the life time of the system.
Therefore, self-learning techniques (e.g., neural networks) are usually applied.
Collecting the results as well as the observed data (communication traces) is the task of the data storage
unit. The response unit, finally, is responsible for initiating actions to minimize the consequences of a
detected security attack. This can be done by performing a direct feedback to the network. For example,
it could decouple the affected network segment(s).
Clearly, DoS prevention is preferable to detection since prevention mechanisms avoid even the occurrence
of an attack. Since a full prevention is not always possible, a combination of the advantages of both
methods by using a hybrid approach is the most appropriate solution.
22.4 Security Measures to Counteract Device Attacks
So far, only the protection of network traffic has been discussed, yet also attacks to the device itself have
to be considered. These attacks can be divided into two categories: physical protection of the device and
security software environments.
22.4.1 Protected Hardware and Security Token
Keys used for authentication and encryption of messages typically are confidential information to be stored
on a fieldbus node. Yet, confidential information is not limited to this and also includes application data
such as application counters, e.g., the power consumption value of a electricity meter, which should not be
altered illegitimately. Countermeasures on a first level restrict access to confidential data as offered by most
cryptographic units in today’s communication chips—keys can be written to the key storage but only be
retrieved by the crypto engine, and hence are not visible to the other applications on the node (cf. Section
22.4.2). Yet, some implementations do not honor this fully, and in some fieldbus systems the key data can
nevertheless be read by dedicated management commands originally designed to read an arbitrary part of
the nodes’ memory. For application data, such protected memory areas do not exists in general.
If equipment should be tamper resistant and tamper evident, additionally a protected security token
must be added. A trade-off between security and costs is required. A first level measure might already be
© 2011 by Taylor and Francis Group, LLC