Dr. Johan Åkerberg, ABB Corporate Research, Sweden, Communication in Industrial Automation

Transcription

1 Dr. Johan Åkerberg, ABB Corporate Research, Sweden, Communication in Industrial Automation

2 Outline Industrial Applications Industrial Automation Safety vs. Security Safety Critical Communication Cyber Security in Industrial Applications Industrial Wireless Communication Safety Critical Wireless Communication Concluding Remarks January 26, 2015 Slide 2

3 Industrial Applications

4 Industrial Applications What is meant with Industry? ABB Group January 26, 2015 Slide 4

5 Industrial Applications Examples of Power Systems Grid stabilization and long distance power transmission with low power losses January 26, 2015 Slide 5

6 Industrial Applications Examples of Substation Automation Continuous electrification and load management of cities and industries January 26, 2015 Slide 6

7 Industrial Applications Process Automation Definition: Process manufacturing is the branch of manufacturing that is associated with formulas and manufacturing recipes Once an output is produced by the process, it cannot be distilled back to its basic components Examples: paper, steel, petrol, food, etc.

8 Industrial Applications Examples of Process Automation Continuously stabilizing unstable and unsafe processes January 26, 2015 Slide 8

9 Industrial Applications Discrete Automation Definition: In discrete manufacturing, the manufacturing floor works off orders to build something Output is easier to distill back to original components Examples: cars, consumer electronics, etc

10 Industrial Applications Examples of Discrete Automation High speed assembly, packaging and palletizing January 26, 2015 Slide 10

11 Industrial Automation

12 Industrial Automation The Control Pyramid Several products and protocols in order to meet the requirements January 26, 2015 Slide 12

13 Industrial Automation Fieldbus Communication The distributed control systems collect information from the process in order to control and actuate using for example High voltage to low voltage switchgears Electrical machines ranging from MW to kw Process instrumentation and control valves Installed multi billion equipment have an expected life time of up 20 years and only subsystems are upgraded due to cost issues January 26, 2015 Slide 13

14 Industrial Automation Basic Properties Safety and Security High availability, redundancy protocols Deterministic communication Low latency and jitter Efficient deployment and maintenance Flexible topologies High throughput Often contradicting requirements! January 26, 2015 Slide 14

15 Industrial Automation Controlling Machinery and Processes Protect worker safety and Return of Investment January 26, 2015 Slide 15

16 Industrial Automation Controlling Machinery and Processes Failsafe mode Protect worker safety and Return of Investment January 26, 2015 Slide 16

17 Industrial Automation Controlling Machinery and Processes Protect worker safety and Return of Investment January 26, 2015 Slide 17

18 Industrial Automation Controlling Machinery and Processes Failsafe mode Protect worker safety and Return of Investment January 26, 2015 Slide 18

19 Industrial Automation Controlling Machinery and Processes Protect worker safety and Return of Investment January 26, 2015 Slide 19

20 Industrial Applications Examples of Different Communication Requirements Application Domain Update Rate Nodes / 10 m 2 Process Automation ms 1 20 Factory Automation 500 µs 100 ms Substation Automation 250 µs 50 ms 1 10 High Voltage DC control µs These numbers include processing time for crypto, etc.! January 26, 2015 Slide 20

21 Industrial Automation Where do we come from? A journey from electromechanical relays to centralized control systems and today decentralized control systems Many plants have two or three generations of systems in operation January 26, 2015 Slide 21

22 Industrial Automation Communication Networks Ethernet Penetration 1980s 1990s Internet technologies Phone modems, HVPLC Public cellular Common physical layer Fiber optics Single network technology Integrated switching Legacy network integration Technical advances 100 ms 2000s µs-ms IEC PROFINET IO Fieldbus Foundation EtherNet/IP January 26, 2015 Slide 22 EtherCAT

23 Industrial Automation Communication Architecture in Process Automation ABB Group January 26, 2015 Slide 23

24 Industrial Automation Basics of PROFINET IO UDP Channel (context, diagnostics) Record Data CR IO Data CR Alarm CR Application Relationship RT Channel (IO Data) RT Channel (Alarms) PROFINET IO uses switched 100 Mbit/s Ethernet networks to transmit both real-time and non real-time data For non real-time data Remote Procedure Calls are used on top of UDP/IP For real-time data PROFINET IO defines a layer on top of the Ethernet layer Both unicast and multicast communication is possible for realtime data ABB Group January 26, 2015 Slide 24

25 Industrial Automation Basics of PROFINET IO PROFINET IO devices are modeled in a XML file, General Station Description Markup Language (GSDML) file The GSDML file is imported into the control system and knowledge is gained regarding the devices Modules and Submodules Parameters Data types ABB Group January 26, 2015 Slide 25

26 Industrial Automation Basics of PROFINET IO

27 Industrial Automation Basics of PROFINET IO

28 Industrial Automation The OSI model January 26, 2015 Slide 28

29 Industrial Automation Example of Architecture and its Adaption Layers January 26, 2015 Slide 29

30 Safety vs. Security

31 Safety vs. Security Why safety for industrial automation? Because I care about the environment and worker safety! January 26, 2015 Slide 31

32 Safety vs. Security Why security for industrial automation? Because I cannot unplug the correct network cable in time? January 26, 2015 Slide 32

33 Safety vs. Security Safety To reduce the risk of damage to person, property or environment All possible error cases are determined pre-runtime, and must not change over time Examples: A faulty device causes environmental pollution or an uncontrolled chemical process Examples of solutions: Diagnostics, redundancy, voting, and hardware and software diversity Security To reduce the risk of unauthorized access or sabotage to a system Security threats will change over time Examples: A deliberate security attack causes loss of production or degraded production Examples of solutions: cryptography, firewalls, intrusion detection systems January 26, 2015 Slide 33

34 Safety vs. Security How to deal with this? January 26, 2015 Slide 34

35 Safety Critical Communication

36 Safety Critical Communication The Safety Function Response Time (SFRT) January 26, 2015 Slide 36

37 Safety Critical Communication The Principle of the Black Channel Safety application PROFIsafe PROFIBUS / PROFINET Standard application PROFIsafe PROFIBUS / PROFINET Safety application PROFIsafe is based on the experiences from the railway signaling domain and is documented in IEC /2 Safe and standard applications can share the same standard PROFIBUS/PROFINET communication system The communication system can be excluded from functional safety certification PROFIsafe is certified for Safety Integrity Level 3 Safety profile Black Channel ABB Group January 26, 2015 Slide 37

38 Safety Critical Communication PROFIsafe Identified Communication Errors ABB Group January 26, 2015 Slide 38

39 Safety Critical Communication PROFIsafe - Deployed Safety Measures ABB Group January 26, 2015 Slide 39

40 Safety Critical Communication PROFIsafe - Deployed Safety Measures

41 Safety Critical Communication PROFIsafe - Safety Container Structure F input/output data Status / control byte CRC2 Max. 12 / 123 Bytes 1 Byte 3 / 4 Bytes PROFIsafe Container A PROFIBUS or PROFINET IO real-time frame can contain one or more PROFIsafe containers Different requirements for processing speed and number of I/O. There are two modes of operation safety I/O data up to 12 bytes together with a 24 bit CRC2 or safety I/O data up to 123 bytes together with a 32 bit CRC2. ABB Group January 26, 2015 Slide 41

42 Safety Critical Communication PROFIsafe - Consistency Check of Safety Container F-Parameters CRC1 Initial value for CRC2 2 Bytes VCN F-Host Consecutive Number 3 Bytes F-Output data Max. 12 or 123 octets Control Byte 1 Byte Toggle Bit CRC2 Across F-Output data and F-Parameter and VCN 3 or 4 Bytes The safe host and safe device/modules produces a 2 byte CRC1 signature over the safety parameters (F- Parameters) Only the CRC2 is calculated for each cyclic PROFIsafe container ABB Group January 26, 2015 Slide 42

43 Safety Critical Communication PROFIsafe - Virtual Consecutive Number F-Host Consecutive Number Toggle_h (from F-Host) Toggle_d (from F-Device) F-Device Consecutive Number The consecutive number is not visible in the safety container, thus called virtual consecutive number 24 bit counter, wrapping over to 1 at the end. Number 0 is reserved for error conditions and synchronization The toggle bit in the Control/Status byte indicates an increment at each edge ABB Group January 26, 2015 Slide 43

44 Cyber Security in Industrial Applications

45 Cyber Security in Industrial Applications The need for secure systems and communication Firewalls Intrusion Detection Systems Access Control / User Account Mgmt Antivirus Whitelisting Secure Communication Code Signing Classical security mechanisms are necessary, but no longer sufficient. January 26, 2015 Slide 45

46 Cyber Security in Industrial Applications From the Product Lifecycle to the Plant Lifecycle Product Lifecycle Design Implementation Verification Release Support Project Lifecycle Design Engineering FAT Commissioning SAT Plant Lifecycle Operation Maintenance Review Upgrade January 26, 2015 Slide 46

47 Cyber Security in Industrial Applications Challenges Why not applying security best practices from the IT domain directly? We do, but locking down systems for sake of security might have a negative impact on safety Patching embedded systems in a plant every year hamper the production rate How to keep things secure with all different actors involved over the complete lifecycle of a plant? Maintenance and commissioning personnel are not crypto experts, but process experts They cannot enter a RSA key pair in a device or install digital certificates on New Year s Eve when the plant manager demands full production after a component failure January 26, 2015 Slide 47

48 Cyber Security in Industrial Applications Challenges How to deal with key distribution over the complete lifecycle with different vendors over time? Most security solutions demand out-of-channel communication to establish a secure channel, this is challenging in high availability systems Solutions needed to deal with multiple involved parties over time is needed Security/cryptography is all about trust, so whom to trust then? Most likely one-solution-fits-all is not feasible How to deal with trust over years of operation and vendors are entering and leaving the plant due to competition and market economics. January 26, 2015 Slide 48

49 Cyber Security in Industrial Applications PROFINET is vulnerable to man-in-the-middle attacks Attacker Controller Device Controller Attacker Device n n+1 Period time Period time m n+1 n n+1 ARP-poisoning n+2 m+1 m+1 n+3 n+2 n+2 We have shown that it is possible to deploy a man-in-themiddle attack on PROFINET IO from IEC and IEC and change process data without any peer detecting the attack In case of identified security threats and vulnerabilities, how to guarantee safety? ABB Group January 26, 2015 Slide 49

50 Cyber Security in Industrial Applications PROFIsafe is vulnerable to man-in-the-middle attacks F-Parameters CRC1 Initial value for CRC2 2 Bytes VCN F-Host Consecutive Number 3 Bytes F-Output data Max. 12 or 123 octets Control Byte 1 Byte Toggle Bit CRC2 Across F-Output data and F-Parameter and VCN 3 or 4 Bytes We have shown that it is possible to deploy a man-in-themiddle attack on a SIL3 certified implementation of PROFIsafe from IEC 61784, and change safety-related process data without any peer detecting the attack Safety does not necessarily include security ABB Group January 26, 2015 Slide 50

51 Cyber Security in Industrial Applications Remarks Security is important, but remember that Security should be deployed based on a risk/benefit assessment Example IEC with RSA crypto Security is a process and not a state you enter How to deal with trust and privacy during a plant life time of more than years Air-gaps will not keep you secure Use multiple counter measures, defense in depth and hide information from possible attackers Security is not better than the weakest link Will an adversary stubbornly try to get through the armored main gate, or be scared by a formal proof on an abstract level? And is in most cases based upon the assumption of computationally infeasible January 26, 2015 Slide 51

52 Cyber Security in Industrial Applications Remarks The safest and securest critical infrastructure is the one that is never taken in to operation! But that would be the worst multi billion investment ever So, should we go back to electromechanical relays? Or will it be more cost efficient to secure real-time embedded systems that control critical infrastructure? But more important, just because we can add for example technologies like IoT, IPv6, Cloud, M2M, etc., are the benefits worth the risks? January 26, 2015 Slide 52