Realizing Greater System Robustness
Through Combining CIP Safety and CIP
SecurityIndustrial Communications•

Basic functional requirements:•

Extra requirements for Functional Safety:

1.
2.
3.
4.
5.

1.
2.

•

Quick connect/disconnect of devices
Simple integration of new devices
Easy configuration and communication between devices
Diagnostic data
Simple IT – OT integration

Messages delivered as intended in a timely manner, or an expected action will be taken(e.g. the device goes to the safe state)
Suitably small quantitative risk (residual error) that a corrupted message will not be
detected and therefore the device will not go to the safe state

Extra requirements for Security:
1.
2.
3.

If messages are not delivered as sent, prevent the message from affecting operations
Provide logging and alarming to alert operators to the potential thread
Confidentiality: ensuring that intellectual property is protected

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

2Known Challenges With Industrial Ethernet
Risk

Technical Track© 2022 ODVA, Inc.

Consequence– Electrical noise– Cable breaks & aging

–
–
–
–

– Hardware failures– Software bugs

– Incorrect message routing– Coupling with other packets– Mixing with other packets– Security threats– Loss of production– Damage– Compromised Intellectual
Property

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

Loss
Repetition
Corruption
Delay

3

Data Integrity Protection – Ethernet CRC
•
•
•
•

•
•

Ethernet packets have a CRC that is 32 bits longPrimary function is detecting corrupted data
Network components will discard frames in the event of an
error
What is the chance that an error is not detected?
– Applying the birthday
paradox, collisions are likely to occur
32
approx. every 2 2 = 216 = 65536 messages– Note this assumption is likely overly conservative

Even though the space is small this will still catch many
possible errors
Note that assumptions are likely overly conservative: even
if a collision occurs after about 65,000 messages, thecollision must also be coincident with some kind ofenvironmental error (e.g. EMC noise)Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

4Error Detection Requirements for Functional Safety
IEC 61784-3 defines errors that must be mitigated for functional safety communications and possible
corresponding remedial measures
Communication errors:
1.
Corruption
2.
Unintended Repetition
3.
Incorrect Sequence
4.
Loss
5.
Unacceptable Delay
6.
Insertion
7.
Masquerade
8.
Addressing• Addressed by safety measures:• Sequence number• Time stamp••••

Not necessarily one-on-one mapping
One measure can cover several errors
Not all listed measures are required
Each error covered by at least one measure• Time expectation• Connection authentication• Feedback message• Data integrity assurance• Redundancy with cross checking• Different data integrity assurance systems

Binary Symmetric Channel (BSC) disturbance or background noise - modelled with Bit Error
Probability of Pe = 0.01
Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

5How Do Safety Protocols Mitigate These Risks?
White Channel vs Black Channel•

IEC 61508-2 7.4.11.2 describes two possible approaches for safety communications––

White channel (entire network must be developed according to 61508 and certified)Black channel (only safety network protocol subject to certification)

Advantages
White Channel•

All components certified

Black Channel•••

Architectural flexibility
Broader choice of network components
Simpler deployment of other features•••

Additional development cost and complexity
May not be feasible to account for all potential errors andcommunication technologies•

Requires a conservative approach to error modelling

IEC 61784-3 extends IEC 61158 fieldbus specifications to Functional Safety Communication Profiles (FSCP)••

Disadvantages

All defined 61784-3 FSCPs use the black channel approach

Safety protocols make use of various diverse CRC polynomials (distinct from that used for ethernet)

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

6How Does CIP Security Mitigate Against Threats?

Security Property

Common Technology

Device Identity

X.509 Digital Certificates are used to provide cryptographically secure identities
to devices

Device Authentication

TLS/DTLS cryptographic handshake provides authentication via the certificate
verification and challenge.

Data Integrity

Data Confidentiality

Technical Track© 2022 ODVA, Inc.

Hashes or HMAC (keyed-Hash Message Authentication Code) as a
cryptographic method of providing data integrity and message authenticity; the
HMAC relies on a secret symmetric key to generate and/or verify. In TLS/DTLS
this key is derived as part of the handshake.
Data encryption as a means of encoding messages or information in such a way
as to help prevent reading or viewing of data by unauthorized parties; thisgenerally involves a symmetric key applying an algorithm like AES to the data.
Similar to the HMAC key, this key is generally derived as part of the handshakein TLS and DTLS.
2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

7

Data Integrity Protection – Cryptographic Hashing
•
•
•
•
•
•

For CIP Security using TLS and DTLS the cryptographic hash is applied to data at thetransport layer
Commonly used one is SHA-256–

As the name implies, hash space is 256 bits
256

Birthday attack: 2 2 = 2128 ≈ 3.402 × 1038
This is a big number; it would be hard to cover this space in our lifetime–

As an example, a system sends a 1,000 messages every microsecond, that is 3.1536 × 1018
messages in 100 years
5122

If you’d like to be even more conservative, take SHA-512: 2 = 2256 ≈ 1.157 × 1077 thisis getting close to some estimates about the number of atoms in the universe (1077 to 1082 )Also note, this is the probability that any two hashes collide–

Probability that a hash collision is also coincident with a data error is much smaller, but eventhe probability of any collision is already extremely small

Conclusion: we can safely ignore the theoretical probability of a (properly
working) cryptographic hash failing to detect a bit error
Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

8System View

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

9Trend in Safety: Detect Events Causing “Heavy Corruption”•

Recognition that BSC disturbance alone may not provide sufficient error detection capability
–
–
–
–
–
–
–
–
–
–

Bit stuffing/destuffing
Bit slipping
Symbol coding/decoding
Block coding/decoding
Compression/Decompression
Encryption/Decryption
Error correction
Buffer overwrittenEMI...

Can lead to heavily corrupted SPDU error
pattern which cannot be covered by the
Binary Symmetric Channel (BSC) with
Pe=0.01

Uniformly Distributed Segment (UDS) Errors could conservatively be modelledwith a Bit Error Probability of Pe = 0.5 but is not representative of real world.
Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

10What is the Value to Use?
••••p=0.000 Increasing Functional Safety System Reliability by Adding Communication Security
p=0.001 Increasing FunctionaL Safety System Reliability by`Adding Communication Security
p=0.010 inãreasing Functional Safety System RelhabIlity bx Adding Communica|io. Secubity
p=0.500 ÷Q½Xé♀×#aö☼Yë♫►♦û<ÕÖî«rS¶Ú♥§Q¥×¹]ßÀ£O☻^i⌂Q▼@e+T©7cÕ‼gmKXôÿàÆACÜ◄}Ù;¸~ã·°§If the bit error probability is 50% then the data is unusable

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

11

Mathematics Versus the Real World
Real World Evidence• Assuming a safety system goes into a safe state if an error is
detected, a Pe value of 0.5 would imply a noticeably high rateof trips owing to errors in the installed base of safety systems• Would imply that safety systems are unusable with anunacceptable level of availability• No empirical evidence that safety systems are experiencing
an unusually high level of safe state transition• What is really happening?
– Something other than the safety communication layer isaddressing the problem to some degree– The Pe value assumption of 0.5 is too high (without
considering additional factors to reduce effective failure
rate)Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

Discrepancy between
the mathematicalassumption and realworld evidence

12System View
Noise or Disturbanceƒ = frequency(M=Messages, EMI =Electromagnetic
interference)
λ = hardware failure
rate

fM, fEMI

λHTNTechnical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

λHTD
www.odva.org

λHCD
λINTF
13

Markov Model: A Safety System with Security
State State Description

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

1

The transmission system is operational without faults. Transmissions occur
under the potential of EMI disturbances or soft errors.

2

State of the transmission system when random HW fault(s) have occurred
within either the transmitting device, the transmission media, network
components, the receiver in the target device, or any combination thereof.

3

State of the transmission system when random HW fault(s) have occurred
ONLY within the transmission decoder of a target device, such that it
cannot perform its normal function, but itself does not inject faults into themessage. An example of this state would be when the transmission
decoder is fully bypassed.

4State of the transmission system when random HW fault(s) have occurred
ONLY within the cryptographic decoder of a target device, such that it
cannot perform its normal function, but itself does not inject faults into themessage. An example of this state would be when the cryptographic
decoder is fully bypassed.

5State of the transmission system when random HW fault(s) have occurred
within either the transmitting device, the transmission media, network
components, the receiver in the target device, or any combination thereof,
AND random HW fault(s) have occurred within the transmission decodersuch that it cannot perform its normal function.
www.odva.org

14

Markov Model:
A Safety
Systemwith Security
1
2
3
Fault

FaultsFaultsState
6

State of the transmission system when random HW fault(s)have occurred within either the transmitting device, thetransmission media, network components, the receiver in thetarget device, or any combination thereof, AND random HWfault(s) have occurred within the cryptographic decoder such thatit cannot perform its normal function.

7

State of the transmission system when random HW fault(s)have occurred within both the transmission decoder AND thecryptographic decoder such that neither of them cannot performtheir normal function. In this state, EMI is the only mechanism
modelled to cause a corrupted message.
State of the transmission system when random HW fault(s)have occurred within both the 1) transmission decoder AND 2)
the cryptographic decoder such that neither of them cannot
perform their normal function, AND 3) within either thetransmitting device, transmission media, network components,
the receiver of the target device, or any combination
thereof. This state represents the condition when only the safety
decoder is the only decoder functional, and an error has
corrupted the message somewhere during transmission.
State of the transmission system when random HW fault(s)have occurred within the interface blocks between thecryptographic decoder and the safety blocks at either theencoder or decoder. In this state the transmission andcryptographic decoder offer no detection capability for theseerrors. The safety decoder is the last and only line of defense
once this state is reached.

8

9

Most significant factor
Technical Track© 2022 ODVA, Inc.

10
2022 Industry Conference & 21st Annual Meeting
All rights reserved.

State Description

State of the transmission system when a safety hazard ispresent and not detectable.

www.odva.org

15

Markov Model: A Safety System with Security
Symbol

λHTN

λHTD

λHCD

λINTF

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

The meaning of a Symbol
Random HW failure rate of a transmitting device, transmission
media, network components, and the receiver of a target
device. This includes soft errors, such as from high energy,
atmospheric particles.
Random HW failure rate of a transmission decoder within atarget device. This represents random hardware-based failuresof the decoder such that it cannot perform its function, but not
injection of faults into a message. This also includes soft errors
resulting in bit flips, such as from high energy, atmosphericparticles.
Random HW failure rate of a cryptographic decoder within a
product. This represents random hardware-based failures ofthe decoder such that it cannot perform its function, but not
the injection of faults into a message. This also includes soft
errors resulting in bit flips, such as from high energy,
atmospheric particles.
Random HW failure rate within the interface between thecryptographic decoder and the safety decoder. This could
represent a serial channel or a simple memory interface. This
also includes soft errors resulting in bit flips, such as from highenergy atmospheric particles.

fEMI

Mean frequency of corrupted messages caused by EMI.

fM

Mean frequency of messages generated by a transmitter.

pUT

Probability of the transmission decoder not detecting an error.

pUC

Probability of the cryptographic decoder not detecting an error.

pUS

Probability of the safety decoder not detecting an error.

www.odva.org

16

Markov Model: A Safety System with Security
State
11

SymbolTechnical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

State Description
State of the transmission system when a fault has been detected
and controlled by either the transmission decoder, cryptographic
decoder, or safety decoder such that a safety state is entered.

The meaning of a Symbol

δT

Fault detection rate from the transmission decoder.

δC

Fault detection rate from the cryptographic decoder.

δS

Fault detection rate from the safety decoder.

www.odva.org

17Markov Model: A Safety System with Security

SymbolThe meaning of a Symbol

β1
β2

Common Cause Factor of λHTD occurring at the same time as λHTN.

β3
β4

Common Cause Factor of λHTD occurring at the same time as λHTC.
Common Cause Factor of λHTD, λHTC, and λHTN all occurring at thesame time.

Common Cause Factor of λHTC occurring at the same time as λHTN.

This is shown for completeness –but, impact is statisticallyinsignificant

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

18

Summary• The number of States of Markov Model is related to combinationsof λHTN, λHTD, λHCD, λINTF– 24 = 16 states, plus two additional states for the Hazard and
Safe state– However, since Ethernet and Security checkers cannot
detect λINTF faults, the number of states can be collapsed
down to 11 states• As the number of checkers increases in the black channel, theprobability of undetected failures as seen by Safety
Communication Layer gets smaller– Not in accordance with IEC 61508, but as a lower effective
bit error rate when modelling the black channel– More states means there are more multiplicative factors to
reduce the overall undetected failure rate in the black
channel– Adding security helps in a positive and significant way due tothe strong coverage provided• Mathematically, according to the Markov model the biggest impact
on the probability of undetected failures comes from the interface
λINTF term.
– Since Ethernet and Security checkers cannot detect
these type of faults, the safety check is the last and only
line of defense
Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

19

Conclusions• Although non-safety rated fault detection mechanisms in the black channel cannot be used formallyto provide diagnostic coverage of a safety function per IEC 61508, adding a security layer to asafety system results in a lower effective bit error rate as seen by the safety communication layer• The most significant factor affecting the reliability of a system is the interface (λINTF) between thesafety and security layers– However, this interface forms part of a certified product (IEC61508, IEC62443 or both)– Systematic errors can be minimised owing to the processes defined in these standards– Failure rate can be managed and controlled• Data security is a necessary function in Safety systems to prevent attackers from compromising thesafety system• In applications where security and safety are deployed together there is an opportunity to increase
the reliability (and availability) of systems without adding additional capabilities to the safety layer• Encourage the development of safety standards that consider the presence of security features asa way for modelling error probabilities, and the means for delivering safe and secure solutions
Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

20

References[1] K. Rastocny, M. Franekova, “Modelling in development of safety-related communication
systems”, in Communications - Scientific Letters of the University of Zilina, vol. 10, no. 1, p. 2430, 2008.
[2] M. Franekova, K. Rastocny, “Safety evaluation of fail-safe fieldbus in safety related control
system”, in Journal of Electrical Engineering, vol. 61, no. 6, p. 350-356, 2010.
[3] M. Franekova, P. Luley, T. Ondrasina, “Modelling of Failures Effect of Open Transmission
System for Safety Critical Applications with the Intention of Safety”, in Elektronika IR
Elektrotechnika, ISSN 1392-1215, vol. 20, no. 1, 2014.
[4] M. Bellare, T. Kohno, “Hash Function Balance and Its Impact on Birthday Attacks”, in CachinC., Camenisch J.L. (eds) Advances in Cryptology - EUROCRYPT 2004. EUROCRYPT 2004.
Lecture Notes in Computer Science, vol 3027. Springer, Berlin, Heidelberg.
https://doi.org/10.1007/978-3-540-24676-3_24
Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

21