Expanding CIP Security with the CIP
Authorization ProfileIntroduction•••

No standard way to define what privilege levels are required to access whatresources
A standard profile gives the user a powerful mechanism to define
authorization in a highly flexible and configurable way
An investigation of technology options, as well as tradeoffs for the user

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

2

Existing CIP Security Profiles
Security ProfileGeneral Description

EtherNet/IP Integrity Profile(Obsoleted)

Provides secure communications between EtherNet/IP endpoints to assure data
integrity and device authenticity.

EtherNet/IP Confidentially Profile

Provides secure communications between EtherNet/IP endpoints and ensuresdata confidentiality for transport class 0/1 traffic. Includes the EtherNet/IP
Integrity profile as a subset.

CIP Authorization Profile (future)

Provides secure communications between CIP endpoints to ensure device anduser authenticity.

CIP User Authentication Profile

Provides User-level authentication for CIP communication

Resource-Constrained CIP Security
ProfileProvides a lightweight version of the protections afforded byother CIP Security Profiles specifically for highly ResourceConstrained devices

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

3

Security Properties in existing CIP Security Profiles
Security Property

DeviceAuthentication
Trust Domain

Technical Track© 2022 ODVA, Inc.

EtherNet/IP
Confidentially Profile

CIP Authorization
Profile (future)√√

Broad –
group of devices

CIP User
Authentication
ProfileResourceConstrained
CIP SecurityProfile√

Narrow individual
device/user√ (Identity of User)

Broad – option tobe Narrow via
Gateway or Proxy√

Device Identity√

Data Integrity√√DataConfidentiality
UserAuthentication
Change Detection(Audit)
PolicyEnforcement(Authorization)√

Via Gateway orProxy√√
Flexible

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

Fixed

www.odva.org

Via Gateway orProxy4

Authentication vs. Authorization••••

Authentication is the security practice to confirm that the users is who theyclaim to beAuthentication is the first step in security on logging in and gaining accessto digital information
The process of authenticating a user could be accomplished by different
means such as passwords, authentication apps, or biometrics
This is used to prove that that the user is who they claim to be, thereby
authenticating the user

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

5Authentication vs. Authorization•••

Once authenticated, a user can see the information that they are authorized
to see and access information that they are authorized to access
Authorization in system security is the process of giving the user permissionto access a specific resource or function
This could be granting access to folders on a server or starting certain
applications

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

6Authorization strategies•••

Authorization can be determined in different ways, often referred to as
authorization strategies
Different authorization strategies have been developed for different
purposes and use cases
The two most prominent authorization strategies are:– Role-Based Access Control (RBAC)– Attribute-Based Access Control (ABAC)

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

7

Role-Based Access Control•

Well-known roles are defined and users are mapped to one (or more) roles– Whichever role a user is mapped to is the basis of the privileges that user has– Example: ”Operator” role may be able to create I/O connections and diagnose
problems but not program a controller, that may be reserved for the ”Engineer”role•Note CIP Security User Authentication Profile already has some roles
defined and associated permissions– However, there is no way to change what a given role can do

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

8

Attribute-Based Access Control•

Permissions depend on one or more attributes– This is more general than RBAC, which can be seen as a subset of ABAC (role isjust one attribute)– Example: your permissions might depend on your role, time of day, training
record status, and your location•This is a more powerful and configurable mechanism for authorization,although the complexity needs to be managed

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

9Requirements for CIP Authorization Profile•

CIP Endpoints must be policy enforcement point– Profile must be suitable for implementation in an embedded device•

Reuse existing technologies if possible– Sometimes this is not possible but the preference is always to use what is there(e.g.: TLS, OpendID Connect, EST)•Support both RBAC and ABAC
– ABAC might be optional•Provide options for simple access policy and complex policy– Simple declarative statements to complex logical operations•

Integrate with IT systems– Similar to reusing existing technology

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

10

Existing Authorization systems••

There are some existing authorization schemes that may be usable within a
CIP environment
Most existing schemes rely on a “policy document” format– A policy authority generates a document with access policy rules encoded• Rules may be complex logical statements or simple descriptions, depending on what
the technology supports– Document is signed for authenticity assurances, can even be encrypted if
needed– Document is then distributed to policy enforcement points (in this case CIPendpoints, although a proxy model could be used)

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

11

Document-Based Access Policy Management••••

Managing access policy using a document-based structure
A signed document enumerates access policy and then distributed to CIP
endpoints that will then enforce that access policyThe document might implement complex access policy rules that include
logical operations (AND/OR/IF THEN) on various attributes and device state
Based on Rego, XACML, and a YANG Model-based mechanism.
– Provides the advantage of better integrating with many existing authorization
definition technologies– The downside that CIP endpoints would have to support the technology

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

12

Open Policy Agent and Rego••••

OPA is the agent and Rego the Access Policy language
Supports RBAC and ABAC
Commonly used in software and cloud-based architectures
Powerful, but may not be well suited to embedded devices– OPA in particular would be challenging to run in an embedded device, but Rego
could be used without OPA

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

13

eXtensible Access Control Markup Language (XACML)•••

Access Policy language based on XML
Supports RBAC and ABAC
Has been used in some web/Internet applications before– Somewhat older than OPA and Rego
– Not as richly features as Rego•

Generally not designed for embedded systems, but not as complex as Rego

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

14

General Data Modeling Language•An existing data modeling/encoding language could be used to create anaccess policy language specific to CIP endpoints– Example: YANG (Yet Another Next Generation)•••

Significantly more design work
Could be tailored to be specific to CIP
Much less opportunity for technology reuse

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

15

Mapping to CIP•••

Every CIP node is modeled as acollection of objects
CIP objects are structured into classes,instances and attributes
Hard to manage all combinations ofCIP defined classes and attributes aswell as Vendor Specific classes andattributes in a generic way

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

16

Mapping to CIP•

CIP Security Roles:––––––

Administrator
EngineerOperator
AuditorViewerAnonymousTechnical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

17CIP Service-Based Access Policy Management••

Each attribute to also carry permission information
Would be additional information that would go together with the rest of theattribute data within the device
Attr
ID
1

Need inImplem
Optional

Access
Rule
Get

2

Required3

RequiredTechnical Track© 2022 ODVA, Inc.

NVNameData Type

Description of Attribute

AtReference

BOOLGetSpeedActualINT

0 = Drive hasn’t reached SpeedRef
1 = Drive has reached SpeedRef
Actual speedSetSpeedRef

INT

Commanded reference speed2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

18

CIP Service-Based Access Policy Management•

New services to manage the permissions:– View_Permission_Information– Apply_Permission_Information
AccessValue

Access rights to Engineer

No access

0ENUM

Access rights to Operator

Read access1

Auditor access

ENUM

Access rights to Auditor

Write access2

Viewer access

ENUM

Access rights to Viewer

Anonymous access

ENUM

Access rights to Anonymous

Name

Data TypeEngineer access

ENUM

Operator accessTechnical Track© 2022 ODVA, Inc.

Description of Parameter2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

19CIP Service-Based Access Policy Management•Example with permission information
Access
NVNameRuleGet
AtReferenceData
TypeBOOL

RequiredGet

SpeedActual

INT

Required

Set

SpeedRef

INT

Attr ID

Need in Imp

1

Optional

23

Technical Track© 2022 ODVA, Inc.

Permission information

Engineer access
Operator access
Auditor access
Viewer access
Anonymous
accessEngineer access
Operator access
Auditor access
Viewer access
AnonymousaccessEngineer access
Operator access
Auditor access
Viewer access
Anonymousaccess

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

Description of Attribute

Read
Read
ReadNoNo

0 = Drive hasn’t reached
SpeedRef
1 = Drive has reached
SpeedRef

Read
Read
Read
ReadNoActual speed

Write
Read
Read
NoNo

Commanded reference
speed

www.odva.org

20

Conclusions••••

This serves as an introduction into possibilities for the CIP Authorization
ProfileMany options exist for access policy/authorization within CIP endpoints
Each option has particular advantages and disadvantages that must beweighed
Further investigation is needed to determine the optimal direction

Technical Track© 2022 ODVA, Inc.

2022 Industry Conference & 21st Annual Meeting
All rights reserved.

www.odva.org

21