wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

22-10 Industrial Communication Systems
a seal to allow visual detection of direct manipulation and to disable network management commands
if applicable. A second level might be a solid case that cannot be opened without obviously damaging
the case or components of it. The third level of physical protection is the usage of a security token that
contains the secrets.
In general, for most applications detecting the opening of the case would increase security, but due
to cost restrictions measures can only be very simple, e.g., a switch or a simple light detector. Hence,
the overall increase of security is only very marginal, since the devices do not have independent power
supply (battery) that maintains the security functions if the device is unplugged. That is, an attacker can
analyze the turned-off device and circumvent the security measures with little effort.
Considering all possible attacks, it is not cost effective to protect the whole node, rather a small part
is equipped with high-security measures, which is called security token. For other applications in commerce
and for building security, such security tokens are already on the market and state of the art.
The most known token is the smart card that implements well-proven security measures to fulfill the
requirements defined before. These commercially available security tokens offer an advanced security
design and satisfy the requirements of high-security applications (e.g., electronic money, digital signatures).
Measures like scrambled RAM placement, power supply monitoring, fail-safe operation, and
power consumption ciphering are already included in such devices. Common products often have a
certificate to be resistant against malicious scrutiny and manipulation (e.g., common criteria evaluation
levels).
In [SC1], the authors already implemented such an approach for the LonWorks [LON] protocol offering
two advantages: First the smart card provided the required secure data storage for the node, and
second the card also supported state-of-the-art cryptographic functions. The smart card was connected
to a LonWorks node using a serial interface and integrated in the application in such a way that each
message sent was protected by an HMAC-SHA-1 cryptographic check sum and encrypted using 3-DES
overcoming the limitations of the LonWorks security mechanisms with respect to strength, number of
security groups (only one is supported by LonWorks), and the support of security services (LonWorks
only supports a weak authentication for unicast services).
Yet, a complete integration of the security token in the chip is often favorable compared to the external
smart card and the required interconnection circuit. Especially for wireless networks, many chips
already have a security token integrated for cryptographic operations reducing the necessity for an additional
security token.
22.4.2 Secure Software Environments
A common approach that directly manipulates the behavior of a device is to interfere with the software
running on it. To achieve this, an adversary may try to change existing program code or even add new
code fragments to existing ones. Thus, modifications that have never been the intention of the software
developer can result in malicious software behavior. This changed or newly added malicious code is
generally called malware, an abbreviation for malicious software. Note that unintentional software faults
are by definition not malware even if they may result in vulnerabilities that an adversary may utilize.
Depending on the intention of malware and on the damage it may cause, malware can further be categorized.
In the literature, different definitions that may differ to each other exist. The most important
kinds of malware are the following:
• Virus: A virus is a self-replicating piece of software that inserts itself into existing program
code or replaces part of it. By definition, a virus needs always a host program that activates it,
since a virus cannot run by itself.
• Worm: In contrast to a virus, a worm is a malicious stand-alone program that propagates a complete
copy of itself usually over the network. The main characteristic is that a worm does not need
any user interaction.
© 2011 by Taylor and Francis Group, LLC