# Integrating Elliptic Curve Cryptography with the Modbus TCP SCADA Communication Protocol
## 5 Experiments, Results and Discussion
### Results  
The main objective of our work was to examine the feasibility and performance of incorporating security mechanisms based on elliptic curves into the Modbus protocol. In order to assess feasibility and performance, three factors have to be considered: the storage requirements for the modified Modbus library modules, the overhead that the EC layer adds to the standard Modbus communication overhead and the requirements in run-time memory and CPU speed. We, first, consider the storage requirements of the library modules. As stated before, for our experiments, an Android device was used, acting as a server. The libraries were \begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Model/Value of Feature** \\ \hline Microcontroller & ATmega32u4 \\ Flash Memory & 32 KB \\ SRAM & 25 KB \\ EEPROM & 1 KB \\ Clock Speed & 16 MHz \\ CPU & Atheros AR9331 \\ WiFi & IEEE 802.11b/g/n \\ RAM & 64 MB DDR2 \\ Flash Memory & 16 MB \\ Input Voltage & 5 V \\ Digital I/O Pins & 20 (7 exported on header) \\ PWM Output & 7 (2 exported on header) \\ Consumption & 130 mA \\ PCB Size & 42 \(\times\) 51 mm \\ GPIO & 3 Exported on headers \\ DogOLED Support & 1 Exported on headers \\ Weight & 0.012 Kg \\ Product Code & A000126 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Features of the board. ported to this device, as described in Section 4. The end Android application was packaged as an apk file of size 3.2 MB. After the apk file was installed in the device, the application required 12.06 MB of storage: 5.49 MB of code and 6.57 MB of data. These requirements are easily manageable by several IoT and IIoT devices. The client application, which was used to connect to this Android device performing a small number of requests, required a storage size of 12.1 KB. The compiled shared libraries used during the execution of the program and their respective sizes are reported in Table 3.  
Considering, now, the overhead that the mechanism adds to the standard Modbus communication protocols, we had to determine how many additional bytes were sent over the communication channel, how frequently they were sent and what was the additional delay, as compared to the standard Modbus protocol, due to these additional bytes. The main modification in the communication protocol of Modbus was the additional information exchange that takes place during the connection. What happens in the modified version is that before any Modbus packet exchange, the devices connect and during the connection they establish a shared key. The algorithm used for the establishment is Diffie-Hellman's, thus each device sends the values it calculated using a private number and the curve base point. Consequently, the additional bytes that the protocol sends are dependent on the size of the underlying finite field of the used Elliptic Curve. In ECCLIB, which was used for the implementation, the size of the finite field is determined by the parameter \"bitlength\". This parameter is critical for the security of the implementation, and this is the key size for the cryptographic EC-based primitives. To calculate the average duration of the key exchange process, the time required to generate a shared key in 20 consecutive sessions was measured for each pair of devices. We use 4 pairs and repeat the communication between pairs for 1000 times during each run of the experiment. After the connection to the same network of each pair of devices, 20 consecutive sessions were performed, and the time required for each one to successfully generate a key was measured. We used different field sizes, to generate the corresponding curves and use them to create keys of various sizes. For each different size, we considered the size of the information exchanged during the connection phase. The results are presented in Table 4.  
It is important to note that the overhead times given above are incurred each time a connection is established but _only once_ when the connection is initiated.