Over Cellular. Jim Weikert Strategic Marketing Manager ProSoft Technology Technical Track

Transcription

1 Accessing EtherNet/IP Networks Over Cellular Jim Weikert Strategic Marketing Manager ProSoft Technology Technical Track

2 Introduction Pervasiveness of Cellular 100% annual increase in iphone sales Cost to OEMs On-site support is a key element Engineer costs of $1,000/day Travel cost & Lost productivity Global Solutions OEMs ship product to Latin America, Europe & Asia as well as North America Cellular carriers and their offerings vary greatly Benefit of remote access is greater the more remote the location is. 2 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 2

3 Introduction Challenges to OEM Limitations of global carrier network offerings Secure remote access solutions Complexity of understanding components Considerations for EtherNet/IP Fixed port numbers & NAT 2222 for Implicit connections for Explicit connections IPv6 and Remote Access 3 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 3

4 Industrial Application OEM A service engineer wants to access equipment on site at his customer s facility. Offer quick response to customer down time How does he configure IP addresses properly in PC & devices? How does he identify the IP address of the cell modem? Can he access it from the office or from on the road. Can he communicate directly with all the devices? What problems might occur? Fixed Port Number IP of modem Security issues Ability to see all devices 4 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 4

5 Industrial Application SI A system integrator wants remote engineers to assist in the installation of a big gproject. Monitor the system over time. Download program updates. Can he communicate with the entire system? How does he configure IP addresses properly in PC & devices? Can he access it from the office or from on the road. 5 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 5

6 Cellular Technology Evolution Two main technology groups: GSM: Global Standard (AT&T in US) CDMA: Predominantly North America (Verizon) 2G Standards: GPRS/EDGE & IS-95 3G Standards: HSPA(+) / EV-DO Rev. B 4G Future: LTE Advance or WiMAX 6 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 6

7 Cellular Security Cellular security protects wireless traffic Encryption EV-DO: 128-bit AES GSM: 128-bit KASUMI Authentication EV-DO: Challenge & Response GSM: 128-bit key in SIM card Message Integrity EV-DO: Included in AES MIC GSM: 128-bit KASUMI Once data becomes part of the public network, it still needs security. 7 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 7

8 Cellular Network IP Network Each cellular device is an IP device even your phone Assigned by carrier Public or Private Communicate via IP address Similar to PC on company LAN Assigned by DHCP Server Private (accessible by LAN devices only) Communicate via IP address IP Address (Private) IP Address (Private) Company Network Internet Cellular Network 8 IP Address (Private) IP Address IP Address Company (Public) (Public) Cellular Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 8 Gateway Provider 2011 ODVA, Inc. All rights reserved. Gateway

9 Accessing the Internet Is accessing a cell modem like using your phone to get and web pages? How a PC accesses the Internet PC initiates communication (to website, etc.) Website can t initiate communications to the PC NAT: Gateway translation of internal IP to external IP Cellular modem access to the Internet Modem must initiate communications to Internet Private IP vs. Public IP Mobile Originate vs. Mobile Terminate IP Address IP Address (Private) (Public) Web Server IP Address (Private) Company Network Company Gateway Internet Cellular Provider Gateway Cellular Network 9 LAN WAN WAN LAN IP Address IP Address IP Address IP Address IP Address Technical Track 2011 (Private) ODVA Industry Conference (Private) & 14 th Annual (Public) Meeting (Public) page (Private) 9

10 Cellular Gateway Cell modems aren t an end in themselves Sometimes accessing the modem IP is sufficient serial More typically: Remote Access to devices attached to modem Modem acts as a gateway for the devices. Issue: similar to remotely accessing a PC on a LAN Devices could originate, unlikely Gateway NAT in modem could be programmed Requires port translation WAN IP Address LAN IP Address Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 10

11 Tunneling Need something to access devices through cell gateway Tunneling allows 2 private networks to access each other over public networks. NAT removed Use fixed ports & IP of local l network No concern about who initiates communication Secure Methods: VPN & SSL 11 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 11

12 Tunneling Methods VPN Tunnel Commonly used for remote business access Full network layer access open for communication Need to make sure no duplicate IPs at either location Uses IPSec security. Undesired traffic needs to be blocked. SSL Tunnel Uses HTTPS Built into most web browsers No unique VPN tunnel software required Browser becomes a proxy for the applications trying to access remote equipment. Only a web connection at the application layer exists. Client-server applications can provide network-layer tunnels 12 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 12

13 IPSec Security Encryption: scramble the data 128-bit AES Triple DES Authentication IKE: Internet t Key Exchange creation of a secure channel Mutual Authentication Message Integrity Each packet contains authentication header to verify origin and packet integrity. Entire packet encapsulated protecting payload as well as header information 13 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 13

14 Secure remote access An additional benefit of Cellular gateways for remote access is that they avoid IT concerns with connecting automation equipment to company LAN and configuring a VPN to allow the remote OEM technician access to the equipment. Changes made to the machine don t affect the rest of the network. The remote access can be removed by powering down the modem There is no chance that t the OEM technician i has access to any other network resources. 14 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 14

15 Tunneling Recap VPN Tunnel provides the following benefits NAT not required Security All remote devices accessible Either end can initiate communications Need something to establish communication with modem to allow creation of VPN 15 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 15

16 Access via Remote Server Cellular modem is not easily accessible. Cellular modem is behind the cellular provider gateway IP address is typically dynamic & private Solution is an external VPN Server that allows multiple private devices to connect to it. PC can initiate tunnel to VPN server Remote locations can initiate tunnel to VPN server 16 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 16

17 Security Logged Access 17 Beyond prevention of unauthorized access to data, many applications want & require access logging g Logging Identity of user gaining access Time and duration of access Devices & information accessed Implementation SSL VPN Server provide granular logging and auditing reports Cellular gateway Who s desiring i logging? Pharmaceuticals anything impacting their process OEM Customer log of access to equipment Utility log of activity from SI HIPAA, Sarbanes Oxley Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 17

18 IPv6 Benefits for Tomorrow Today EtherNet/IP equipment uses IPv4 Complications of IPv4 Limited Address Space Last IPv4 address block was allocated in February 2011 Private Computer IPs translated t behind a single Public IP address Security not integral to protocol Differences in IPv6 Parallel communications with IPv4 Unique IP for each global device (3.4 x addresses) Security: IPsec integrated into the standard 18 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 18

19 IPv6 Benefits for Tomorrow Value of IPv6 for Remote Access Removes barriers of tunnels to resolve NAT issues Adds inherent security into the communications protocol May remove need for external server for remote access of cellular devices with dynamic IP on private network 19 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 19

20 IPv6 Benefits for Tomorrow Questions regarding IPv6 Will users accept devices which are addressable remotely? Will the industrial controllers gain support for activity logging? As the industrial controllers become more central to their security, what methods will they have for intrusion detection and prevention? 20 Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 20

21 Discussion Questions Technical Track 2011 ODVA Industry Conference & 14 th Annual Meeting page 21