IHP Im Technologiepark Frankfurt (Oder) Germany IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved An Engineering Approach for Secure and Safe Wireless Sensor and Actuator Networks for Industrial Automation Systems Steffen Peter, Oliver Stecklina, Peter Langendörfer

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Outline Motivation Introduction development flow System analysis Mapping process Conclusions

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Realflex project ( ) Water worksBiogas facilityRoboter cell wireless architecture for industrial automation large distance, public networks Small latency, dependability Standards, existent architecture

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Waterworks scenario

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Today’s way of handling security Shield network and define that it is secure  not realistic in wireless networks Enable “sort of miracle” security layer  mostly not right solution Patch security where a hole is assumed  often not efficient  all threads considered? Proper design of security solutions  expensive and time-consuming

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Proposed development flow

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved System Analysis Break it down -Find atomic flows of information  Data flow graph with dependencies Analyze each processing step separately -What are the requirements for this step? -Ignore dependencies at this stage Resolve dependencies -Requirements resolve over data flow

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Example Control pumps based on measured flow and pressure values –Uplink -Sensors on the field  PLC -Wireless connection to the Ethernet access point –Downlink -PLC  pumps -Wireless connection to the Ethernet access point -High integrity requirement sensorAP PLC AP pump U p l i n kD o w n l i n k

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Security properties Concealment / Secrecy Integrity Availability Authentication Authorization Accountability Non-Repudiation Security requirements vector

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Security Metric Security classAttackerAttacker toolsBudget 0No securityattack can be succeed 'by accident' 1curious hackercommon tools< 10,000$ 2 organized attacker (academic, crime) special tools < 100,000$ 3 large organized attacker (crime, government) highly specialized tools, laboratory > 100,000$ An algorithm belongs to class c if it resists all attacks from attacker groups smaller than c.  Requirement Vector =

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Proposed development flow

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Mapping Process

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved What to do if drawer is empty? Find a solution from scratch –State of the art –Good solution –Not efficient Look in neighborhood –Find close solutions –Analyze & solve the differences

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Waterworks Example Security: –Strong integrity Environment: –open field, short range wireless ( ) –One message every 30 seconds Dependability: –node life time min. one month  400mJ/operation -Information integrity > %  1/1 million

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Waterworks Example (2) Assumed no direct solution found Neighborhood: wired environment –Security requirements fulfilled by protected environment –Information integrity realized with CRC  we have no protected environment, but CRC is fine  adapt dependencies (information integrity solved) How to realize protected environment –Mapping tells us AES OFB is solution (message integrity due to pair-wise shared keys)  Test against other requirements: too high energy consumption

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Waterworks Example (3) Problem message overhead –16 bit message + 20 bit CRC encrypted with 128 bit AES Solution: take one AES key for 3 messages  40 bit ciphertext  Still security of 128 bit AES OFB  Information integrity as in wired environment  Dependency requirements fulfilled

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Conclusions Suitable security and safety needs consideration of –Environment –Dependability requirements –Security requirements  Huge complexity, expensive development flow Proposed semi-formal engineering methodology is a first answer –Requirements and potential solutions are cataloged as result of a formal analysis process  Allows reproducible problems and reusability of answers –Mapping process as efficient way to integrate applications Fuzzy requirements (environment) still biggest challenge for a full automatic integration process

IHP Im Technologiepark Frankfurt (Oder) Germany © All rights reserved Thank You Questions?