https://www.mdu.se/

mdu.sePublications
EnglishSvenskaNorsk
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
On Security in Safety-Critical Process Control
Mälardalen University, School of Innovation, Design and Engineering.ORCID iD: 0000-0002-7159-7508
2009 (English)Licentiate thesis, comprehensive summary (Other academic)
Abstract [en]

This Licentiate thesis is about security in automation networks with emphasis on fieldbus communication. In the process industry, network and system security have become even more important since the introduction of Ethernet-based fieldbus protocols. As an example, a successful attack on a power plant, supporting large cities with energy, could result in a temporal but total power loss. Such attacks could be devastating for the society. The security threats are real, and motivations for attacking industrial communication systems may be political or economical.

The visions of autonomous systems, which can be supervised, diagnosed and maintained from remote is not far from reality, but stress the need for security and safety measures. Wired fieldbus protocols are mature when it comes to safety and there are existing standards for safe communication. In a setup like an autonomous system security measures over safe communication has to be taken into account.

The state-of-the-art in automation security is to use firewalls to restrict incoming and outgoing traffic to the networks. Firewalls can be deployed between different automation networks, i.e. server, control, and fieldbus networks, and even protect a single automation cell with a dedicated firewall. If an adversary can penetrate the perimeter defenses, no other security countermeasures exist in process automation to protect the safety-critical communication from sabotage.

In this thesis we initially explore the possibilities of security attacks on the automation protocols PROFINET IO and PROFIsafe. We show that it is possible to attack safety-related communication to take control of safety-critical fieldbus nodes. We propose the concept of Security Modules in combination with PROFINET IO and PROFIsafe to achieve safe and secure real-time fieldbus communication.
Place, publisher, year, edition, pages
Västerås: Mälardalen University , 2009.
Series
Mälardalen University Press Licentiate Theses, ISSN 1651-9256 ; 110
National Category
Information Systems
Research subject
Computer Science
Identifiers
URN: urn:nbn:se:mdh:diva-7334ISBN: 978-91-86135-42-3 (print)OAI: oai:DiVA.org:mdh-7334DiVA, id: diva2:245921
Presentation
2009-11-13, Kappa, Mälardalens högskola, Västerås, 13:15 (English)
Opponent
Supervisors
Available from: 2009-10-14 Created: 2009-10-08 Last updated: 2018-01-13Bibliographically approved
List of papers
1. Introducing Security Modules in PROFINET IO
Open this publication in new window or tab >>Introducing Security Modules in PROFINET IO
2009 (English)In: 14th IEEE International Conference on Emerging Technologies and Factory Automation, Mallorca, Spain: IEEE , 2009, p. 1-8Conference paper, Published paper (Refereed)
Abstract [en]

In this paper we show that it is possible to retrofit a security layer on top of PROFINET IO without changing the underlying transmission system or standards. By introducing security modules, end-to-end network security can be achieved and ensure authentication, integrity and confidentiality for real-time communication.

The concept of security modules is a flexible framework and countermeasures can be changed, as security threats and exploits are changing over time. A proof-of-concept implementation shows that it is possible to implement security modules on existing products and secure them against, for example, man-in-the-middle attacks.
Place, publisher, year, edition, pages
Mallorca, Spain: IEEE, 2009
Identifiers
urn:nbn:se:mdh:diva-7333 (URN)10.1109/ETFA.2009.5347205 (DOI)000355314000210 ()2-s2.0-77949881635 (Scopus ID)978-1-4244-2727-7 (ISBN)
Available from: 2009-10-08 Created: 2009-10-08 Last updated: 2018-08-21Bibliographically approved
2. Exploring Security in PROFINET IO
Open this publication in new window or tab >>Exploring Security in PROFINET IO
2009 (English)In: Proceedings - International Computer Software and Applications Conference, vol. 1, 2009, , p. 7p. 406-412Conference paper, Published paper (Refereed)
Abstract [en]

In this paper we show that it is possible to attack and gain control over PROFINET IO nodes and also that this can be done without any of the communicating peers detecting the attack. Analysis of attacks in both shared and packet switched networks show that the attacker can control the process data and thus the state of the machines connected to the I/O modules.

As the security risks are increasing in automation with the level of vertical and horizontal integration, the concept of security modules is proposed towards a method to retrofit security in PROFINET IO. The concept of security modules can be applied without changing anything in the underlying transmission system and is extendable if and when new security threats are identified.
Publisher
p. 7
Series
33rd Annual IEEE International Computer Software and Applications Conference, ISSN 0730-3157 ; 1
Keywords
PROFINET IO, network security, attack, security modules
National Category
Engineering and Technology
Identifiers
urn:nbn:se:mdh:diva-7301 (URN)10.1109/COMPSAC.2009.61 (DOI)000274261400055 ()2-s2.0-70449642862 (Scopus ID)9780769537269 (ISBN)
Conference
2009 33rd Annual IEEE International Computer Software and Applications Conference, COMPSAC 2009; Seattle, WA; United States; 20 July 2009 through 24 July 2009
Available from: 2009-09-30 Created: 2009-09-30 Last updated: 2014-05-16Bibliographically approved
3. Exploring Network Security in PROFIsafe
Open this publication in new window or tab >>Exploring Network Security in PROFIsafe
2009 (English)In: Lecture Notes In Computer Science: Proceedings of the 28th International Conference on Computer Safety, Reliability, and Security, Heidelberg: Springer-Verlag , 2009, p. 67-80Conference paper, Published paper (Refereed)
Abstract [en]

Safety critical systems are used to reduce the probability of failure that could cause danger to person, equipment or environment. The increasing level of vertical and horizontal integration increases the security risks in automation. Since the risk of security attacks can not be treated as negligible anymore, there is a need to investigate possible security attacks on safety critical communication.

In this paper we show that it is possible to attack PROFIsafe and change the safety-related process data without any of the safety measures in the protocol detecting the attack. As a countermeasure to network security attacks, the concept of security modules in combination with PROFIsafe will reduce the risk of security attacks, and is in line with the security concept defense-in-depth.
Place, publisher, year, edition, pages
Heidelberg: Springer-Verlag, 2009
Series
Lecture Notes In Computer Science, ISSN 0302-9743 ; 5775
National Category
Computer Systems
Identifiers
urn:nbn:se:mdh:diva-7332 (URN)10.1007/978-3-642-04468-7_7 (DOI)000272105300007 ()2-s2.0-70350453950 (Scopus ID)9783642044670 (ISBN)
Conference
28th International Conference on Computer Safety, Reliability, and Security, SAFECOMP 2009; Hamburg; Germany; 15 September 2009 through 18 September 2009
Available from: 2009-10-08 Created: 2009-10-08 Last updated: 2018-08-21Bibliographically approved

Open Access in DiVA

fulltext(680 kB)1281 downloads
File information
File name FULLTEXT01.pdfFile size 680 kBChecksum SHA-512
2e02d865321e0c9743c0089a163bdef8807297964dbfe9e205fed6d2580dd69212199406002caaeb77dfc611f5bdc6da75d1a02a6b11b2748755de170d1df5be
Type fulltextMimetype application/pdf

Authority records

Åkerberg, Johan

Search in DiVA

By author/editor
Åkerberg, Johan
By organisation
School of Innovation, Design and Engineering
Information Systems

Search outside of DiVA

GoogleGoogle Scholar
Total: 1281 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

isbn
urn-nbn

Altmetric score

isbn
urn-nbn
Total: 703 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
v. 2.44.0
|
WCAG
|
Mälardalen University Library
|
DiVA Log in