Secure Multicast

Jack Visoky and Joakim Wiberg
Rockwell Automation and HMS
October 10, 2018

Why Multicast••Multicast has been a mainstay of EtherNet/IP for years
Depending on the variables involved multicast transmission can provide asignificant improvement to network transmission– Multicast can be particularly beneficial for I/O communications– In a case with several “listeners” the network infrastructure can take care ofefficient delivery via multicast

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org2

What Makes Multicast Security Difficult•

TLS and DTLS (the most widely supported transport security technologies)
don’t have any support for multicast– These are also the technologies on which CIP Security is based•

Large groups of senders/receivers make key management particularly
difficult– Key servers need to authenticate each entering member and securely transmit
key materials– Key servers are a single point of failure that can impact runtime– Members leaving the group mean that an action must be taken (like issuing new
key material to all remaining group members) to ensure the departing members
can no longer access data

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

3

Secure (Unicast) Communication Background••As background, security
protocols (like TLS, DTLS,IPsec, etc…) generally areunicast, point-to-point
protocols
The same basic structure isseen across these protocols– Asymmetric cryptography
generally used to set up
the connection– Symmetric cryptography
generally used to protect
the data in transit

Technical Track© 2018 ODVA, Inc.

OriginatorTarget

Asymmetric Cryptography

 May involve several round trips
 Performance not as important
 Authenticates endpoint(s) Generates session keyfor symmetric cryptography
Symmetric Cryptography
 Used to protect connection data Generally "long lived" Performance is important2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

4Secure Unicast Communication••••

This basic pattern has served digital communications well for many years
It’s been proven in use across a number of industries, including securingindustrial communications
Despite this, there are some issues with mapping this pattern on tomulticast
Two issues stand out because they are fundamental to how thecryptography works
1. Lack of originator authenticity
2. Consumers dynamically joining and leaving

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

5Issue #1: Lack of Originator Authenticity•In unicast connections there are only
two parties– Symmetric cryptography (MAC) works
well; data is either sent by party 1 orparty 2– It is trivial for either the sender or
received to know who sent this dataProducer– A compromised consumer cannot affectother consumers if they are all using
independently secured unicast
connections

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

CompromisedConsumer Cannot
Affect other Consumers
UnicastUnicastConsumer Still Securely
Communicating withProducer

www.odva.org

6Issue #1: Lack of Originator Authenticity•In multicast, there is more than
one consumer of the data
– Example: trivial case, 1 producer
and two consumers– Symmetric key is shared between
all parties– A given consumer cannot tell ifthe data came from the producer
or the other consumer– Put another way, one
compromised consumer canpotentially compromise all otherconsumers

Technical Track© 2018 ODVA, Inc.

Compromised Consumer
Impersonates Producer for
Other Consumers

MulticastProducer

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

Compromised Data with Valid MAC

Consumer Using Data
Compromised by OtherConsumer
www.odva.org

7

Issue #2: Consumers Dynamically Joining and Leaving•Each time a consumer leaves thegroup, a new group key must begenerated, distributed, andsynchronized– This also generalizes to someonejoining the group– Depends on threat model if the user
cares about new consumers
2. New Key Material is Derived
accessing old data, or oldand/or Distributed
consumers accessing new data•

These operations can be quite
computationally expensive as thecould involve asymmetric
cryptography, and at minimum
involve group synchronization

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

1. Consumer Leaves Group

3. Group is Synchronized
to Begin Using New Key
Material

www.odva.org

8

Existing Multicast Security Technologies••

Several technologies were examined for potential application to CIPSecurity
No existing technology clearly and seamlessly fills the gap for securingmulticast EtherNet/IP

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

9IPsec and GDOI•

IPsec and GDOI
– IPsec is (from a very high level)similar to TLS, although it works at
the IP layer instead of the transportlayer– GDOI (Group Domain OfInterpretation), along with IKE(Internet Key Exchange) can be used
to distribute/revoke key materials to amulticast group

Key ServerGroup MemberGroup Member• Note this is currently only defined towork with IPsec, although the RFC
mentions that it could be extended toother security protocols
Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

Group MemberGroup Member

www.odva.org

10

GDOI and IPsec Issues
••
•
•
•

GDOI/IKE/IPsec are all very flexible but very complex; far more difficult touse than TLS and DTLSGDOI is a somewhat old technology that hasn’t really kept up to date (stillsupports SHA-1 signatures)
Although there are implementations, it isn’t really widespread and certainly
not within TLS/DTLS libraries
Works with IPsec but far from a drop in to TLS and DTLS; significant work
would be needed to fit this into these technologies
Consumers joining/leaving dealt with via re-key policies, althoughimpersonating producers is not dealt withTechnical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

11

Secure Multicast with DTLS•••

There was an effort within IETF, although it was abandoned years ago
Relied on a server to distribute keys to the multicast group
Looked somewhat promising but there was still significant definition needed
for it to be completed– As this effort is not completed a full analysis is not possible– If there was enough industry pressure then this effort could potentially berestarted

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

12Cellular multicast security••••

3GPP implements multicast security for cellular networks
This is the technology on which 4G and LTE is built
Again, uses a server to distribute keys to a multicast group
Uses a lot of technologies which do not fit well into EtherNet/IP– SRTP instead of TLS– HTTP digest authentication•

Although could provide some “inspiration” for secure multicast in CIP
Security, there are too many diverging technology choices for this to beworkable

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

13

OPC-UA Pub Sub••OPC-UA Pub Sub is a protocol that supports multicast communications
Implements a Secure Key Server (SKS) to provide key materials to themulticast group– Policies can be implemented for key rotation– No protection for producer authenticity•“Closed” solution developed by OPC Foundation– Not freely available like IETF materials– Further analysis requires access to specifications

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

14

Unicast Only•

One has to wonder, why is it that point-to-point security has beenstandardized so well but multicast security has not?
– Perhaps the efficiency benefits of multicast aren’t really that great in the long run,especially when security is taken into account•Lack of energy around defining secure multicast is somewhat telling– Could be similar to the worries around using TLS to secure all web traffic yearsago– Now HTTPS is the norm; networks, hardware, and software all improved to thepoint that this is barely noticeable

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

15

Conclusion•

Two potential options:
1. Do Nothing – if it is determined that the market does not have a strong need formulticast then it is not worthwhile to define a security solution around it; multicast
will likely fade from use over time
2. Define Secure DTLS in IETF – if the market does require multicast, then an effort
in IETF should be started/restarted. This would leverage the larger Internet
community to define secure multicast in a way that is well vetted and workablefor a large community, including IoT and Industrial Communications

Technical Track© 2018 ODVA, Inc.

2018 Industry Conference & 19th Annual Meeting
All rights reserved.

www.odva.org

16

THANK YOU