wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

28-6 Industrial Communication Systems
is the link layer security protocol based on AES that provides support for encryption and data integrity.
WLAN Authentication and Privacy Infrastructure (WAPI) is a Chinese standard for wireless LAN.
28.2.3 Deployment Issues
Some issues/guidelines for deploying WLANs include
1. To minimize the chance of wireless eavesdropping, avoid having the WLAN signal extend beyond
the boundaries of the desired range of the network. The signal strength can be minimized by
turning down the power on the AP and using only the minimum antenna gain necessary. Use
sectored or panel antennas instead of omnidirectional antennas. Use metal blinds or tinting on
exterior windows. Exterior metal walls are preferable to exterior wooden walls. Place APs in the
most interior of the building space.
2. Use MAC address filtering. MAC address filtering will prevent unauthorized and registered users
from accessing and associating with a wireless AP. An access control list (ACL) of allowed MAC
addresses stored either internally or externally, RADIUS, can be used to limit access to the network.
3. Configure the AP to disable broadcast of the wireless AP’s service set identifier (SSID) which is used
to identify a LAN that a user may associate with. This limits the exposure of the network to attackers.
4. WPA2 is preferable to WPA which is preferable to WEP.
28.3 PAN Security
A personal area network (PAN) represents a limited number of computer and communications devices
that have the ability to form networks and exchange information. WPANs allow computing devices
within close range of one another to communicate whether they are stationary or in motion. WPANs
may use different technologies to communicate, such as Bluetooth, Infrared Data Association (IrDA),
ultra-wideband (UWB), and ZigBee [12,13]. The IEEE 802.15 working group has defined several classes
of WPANs: 802.15.1 (Bluetooth), 802.15.3 (high data rate WPAN), and 802.15.4 (low-rate WPAN).
When it comes to security aspects of PAN, the entities of interest are Bluetooth Special Interest Group
(SIG), the ZigBee Alliance, and the IEEE 802.15.4 working group (wireless sensor networks).
PANs have a wide application scope and may be used in building automation such as access control;
smoke detection; heating, ventilation, and air conditioning (HVAC); and lighting. Other applications
include industrial monitoring, automatic meter reading, medical sensing, and environmental data collection
[14,15]. Security is an important issue in these control and data acquisition applications. These technologies
(ZigBee and IEEE 802.15.4) can be linked together into networks of virtually unlimited distance.
PAN security concerns will be addressed with regards to the following aspects: eavesdropping,
authentication, location tracking, configuration, jamming, collision, and others.
Eavesdropping—wireless communications in general is subject to eavesdropping and potentially
destroying the confidentiality of the data. If encryption is not enabled, then an attacker may attempt to
substitute misleading data for the authentic data.
Authentication and encryption, when enabled, occur at the low levels of the communications stack.
This makes impersonation of a sending or receiving PAN unit difficult [16,17].
Location tracking—all PAN devices have unique addresses. Many devices are mobile and the radio
signal is tractable. If the device can be identified with a specific user, the movements of the user can be
tracked [18,19].
No matter how good a design specification is, implementation flaws can cause security holes. The
PAN qualification process cannot test every possible permutation of PAN protocol exchanges. Some
implementations of the first PAN specifications contained vulnerabilities that granted access to some
service on the local device. Additionally, the protocols specified for PAN profiles leave room for manufacturer-specific
data.
© 2011 by Taylor and Francis Group, LLC