CIP Security Phase 1
Secure Transport for EtherNet/IP
Brian Batke, Rockwell Automation
Dennis Dubé, Schneider Electric
Joakim Wiberg, HMS Industrial Networks
October 14, 2015

The Need for a Secure Transport
Pump
Off

Attacker’s
ComputerPoisonPoison
ARP
ARP

Production
Equipment

Attacker’s
Router

Pump
Pump
On
Off

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

2

Establish
SecureTransport
Pump
Off

Attacker’s
Computer

Secure Transport Solution
Production
Equipment

Attacker’s
RouterPoisonARP
Poison
Pump
ARP
Pump
On
OffCIP Security Goals• Reject data that has been altered (integrity)• Reject messages sent by untrusted entities (authenticity)• Reject actions that are not allowed (authorization, phase 2)
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

3

Specification Enhancements for CIP Security
Specification Enhancements
for CIP Security™
Device Hardening

General Description
EtherNet/IP product hardening
requirements and recommendations

Technical Description
Protection Mode attribute to Identity
Object.
Recently updated to include Implicit andExplicit modes

The CIP Networks Library2015 PC2

The CIP Networks Library2017+

Technical Track© 2015 ODVA, Inc.

Secure communications between
EtherNet/IP endpoints: data integrity,
data confidentiality, and device
authenticity

EtherNet / IP over TLS for UCMM andClass3

Secure end-to-end communications
between CIP endpoints: data integrity,
device and user authenticity

CIP enhancement to support user anddevice authentication along with device
access policy enforcement (authorization)2015 Industry Conference & 17th Annual Meeting
All rights reserved.

EtherNet / IP over DTLS for Class 0/1
Security is only assured on Ethernet

www.odva.org

4

CIP Security FeaturesSecurity Properties

CIP SecurityTM (2015)

CIP SecurityTM (2017+)

Device Authentication

 (Ethernet device) (CIP device)Device Trust Model

Broad (group(s) of trusted devices)

Narrow (individual trusted device orapp)

Device Identity (PSK or X.509 Certificate) (TBD)

Integrity (Ethernet transport layer) (CIP application layer) (TBD)

Confidentiality

User Authentication

 (CIP device)

Change Detection (Audit)
Policy Enforcement(Authorization)
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

5

CIP Security Profiles
EtherNet/IP Integrity Profile :Provides device authentication and data integrity of packets on Ethernet networks.
EtherNet/IP Confidentiality Profile :Provides confidentiality to data in transit(Adds Confidentiality to EtherNet/IP Integrity profile)

CIP Authorization Profile:
Provides user & device authentication and device access policy enforcement (authorization)
CIP Integrity Profile:
Provides end to end data integrity at the CIP application layer(Adds CIP Integrity to the CIP Authorization profile)

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

6Phase 1 Solution Summary• TLS (TCP) and DTLS (UDP) provide the secure transport– Same approach as HTTPS: HTTPS = HTTP over SSL/TLS– Secure EtherNet/IP = EtherNet/IP over TLS and DTLS
– Same EtherNet/IP, but over a secure transport

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

7

CIP Security P1: EtherNet/IP over TLS/DTLS

EtherNet/IPover (D)TLS

Scanner

AdapterCNet, DNet, etc.
Normal CIPE/IP overTLS/DTLSTechnical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

8Phase 1 Solution Summary•What is TLS?
––––

“Transport Layer Security”
Defined via RFCs: RFC 5246 for TLS; RFC 6347 for DTLS
Related RFCs for X.509 certificates, cipher suite definitions, etc.
Standard protocol, widely used to secure Internet traffic

Bottom line: We don’t have to invent the secure transport
We just use it for EtherNet/IP

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

9TLS Architecture
Establish a session– Agree on algorithms, share secrets, perform authentication
Transfer application data– Ensure privacy and integrity
Handshake
ProtocolChangeCipher SpecAlert
ProtocolTLS Record Protocol

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

10

TLS Architecture
HTTP, EtherNet/IP, etc.

Error handling

Initializes secure
Communication

ChangeCipherAlert

HandShake

AppHandles communication
With the application

Record Layer
Breaks msg into blocks
Adds HMAC & encryption
Transmits the result
Performs opposite on receive

Technical Track© 2015 ODVA, Inc.

Initializes communcation
Between client & server

TCP

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

11

CIP Security Layers
CIP Application(including objects)

CIP I/O Application

UCMM / Class 3

Class 0/1

EtherNet/IP Encapsulation

EtherNet/IP Common Packet Format

Transport Layer Security (TLS)

DTLS

TCP

UDP

Internet Protocol (IP)Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

12

CIP Security Capabilities•Only trusted entities (device or s/w app) able to connect. Two trust options:– Pre-Shared Keys (PSK), configured in originator and target– X.509 Certificates, with common root authority– In both cases, both originator and target verified•

Message integrity and authenticity– Provided by HMAC on (D)TLS packets.
– Includes anti-replay•

Optional message encryption– Will be a user choice (performance impact)
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

Prevent
untrustedcommsPrevent
msg
tampering

Preventeavesdropping
www.odva.org

13OriginatorTarget

Class 0/1 over DTLS

FwdOpen[if class 0/1 AND no DTLS session] Open DTLS session

FwdOpen Request
FwdOpen Reply
Class 0/1 Connected Data

Note: FwdOpen
over UDP

Class 0/1 Connected DataClass 0/1 Connected DataClass 0/1 Connected Data
FwdClose
FwdClose Request
FwdClose Reply[if no class 0/1] close DTLS session

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

14

Volume 8 Content
Chapter 1: Introduction
Chapter 2: <currently empty, expected to be CIP Security>
Chapter 3: EtherNet/IP Security
Chapter 4: Configuration and Commissioning
Chapter 5: Object Library
Chapter 6: Security Profiles
Chapter 7: <currently empty, expected to be EDS Files>
Chapter 8: Certificate Management

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

15

Volume 8 Content• Behavior of EtherNet/IP over TLS and DTLS (Chapter 3)– New port number (2221 for both TCP and UDP, registered with IANA)– Required (D)TLS cipher suites– New CPF message for FwdOpen over UDP (in Volume 2, Chapter 2)– Originator and target behavior with respect to (D)TLS• Multiple connections, sequence number rollover, etc.

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

16

Cipher Suites
Cipher Suite
TLS_RSA_WITH_NULL_SHA256

TLS_RSA_WITH_AES_128_CBC_SHA25
6
TLS_RSA_WITH_AES_256_CBC_SHA25
6
TLS_ECDHE_ECDSA_WITH_NULL_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_C
BC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_C
BC_SHA384
TLS_ECDHE_PSK_WITH_NULL_SHA25
6Description
RSA for key exchange; null encryption; SHA256 for message integrity.
Encryption not provided.
RSA for key exchange. AES 128 for message encryption, SHA256 for messageintegrity.
RSA for key exchange. AES 256 for message encryption, SHA256 for message
integrity.
ECDHE_ECDSA for key exchange; null encryption; SHA1 for message integrity.
Encryption not provided.
ECDHE_ECDSA for key exchange. AES 128 for message encryption, SHA256
for message integrity.
ECDHE_ECDSA for key exchange. AES 256 for message encryption, SHA256
for message integrity.
ECDHE in conjunction with PSK for key exchange; null encryption; SHA256 formessage integrity. Encryption not provided.

TLS_ECDHE_PSK_WITH_AES_128_CBC ECDHE in conjunction with PSK for key exchange. AES 128 for message_SHA256
encryption, SHA256 for message integrity.
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

17

Volume 8 Content

EtherNet/IP Security Object

EtherNet/IP Security Object
instance 1

CIP Security Object• Exclusivity duringcommissioning

Active Device CertificatesattributeCertificate Management Object

Certificate Management Object
instance ‘x’

File Object

File Object instance

Device Certificate attribute
Trusted Authorities attribute

File Object instance
CA Certificate attribute
CRL attribute

EtherNet/IP Security Object• Configuration ofTLS/DTLS related settings(oth er attributes)

Certificate ManagementObject• Interface to get/set
certificate and related files
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

File Object instanceFile Object instancewww.odva.org

18

Volume 8 Content• Certificate management requirements / recommendations– Vendor certificate recommended (802.1AR)– Self-signed default certificate if no vendor cert
– Key generation and storage considerations• CIP Security profiles– Defined groupings of capabilities– Will drive conformance test

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

19

… But will it work?
• Several vendors have prototype implementations• UCMM / Class 3 over TLS• Class 0 / 1 over DTLS (partial implementation)• Possibility of multi-vendor prototype interop event• Tentative• More participants welcome!

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

20

Next steps
CIP Security Phase “1.5”• Certificate enrollment via standard protocol (EST required, SCEP optional)• Multiple certificate support• Investigate secure multicast support
CIP Security “Phase 2”• CIP level authentication and authorization• Users and devices• Will require further input and scoping with ODVA Security Task Force

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

21

THANK YOU