# Integrating Elliptic Curve Cryptography with the Modbus TCP SCADA Communication Protocol
## 1 Introduction
However, it does not itself support security of both the data and the commands it manages from interception, and apparently does not support cryptography [5]. In order to address the weaknesses discussed above, our work provides the following contributions:  
* The deployment of the Modbus protocol in SCADA, although is particularly common, has not been studied extensively from the point of view of data and application security as well as IoT/sensor device identification and authentication. In particular, the customary Modbus protocol does not provide end-to-end encryption facilities. Such facilities are provided by our libraries as we demonstrate in what follows. * Our approach targets one of the most critical aspects of today's physical infrastructures which are interconnected on the Internet for remote surveillance based on SCADA/Modbus-like systems: Cyber Physical Security (CPS). Our work enables secure information exchange based on confidentiality, integrity and authentication of involved information exchanges in installations such as smart grids, energy transmission lines, natural gas processing stations, nuclear plants etc. Our approach targets, especially, the attached IoT/sensor devices which are, frequently, the weakest links in a SCADA/Modbus deployment and, thus, the most attractive targets of cybercriminals. * The IoT devices that area usually deployed in SCADA/Modbus installations are, usually, inexpensive and open hardware in order to facilitate massive deployment and easy application development. However, this leads to some inherent weaknesses with respect to computational power, which may limit their ability to handle conventional crypto algorithms due to the large parameter sizes they require. Elliptic curves are particularly useful in this respect since they require much smaller key sizes than conventional cryptosystems for achieving similar security levels. In other words,they require less memory and computation power from IoT/sensor devices than conventional cryptosystems do. The major reason behind the increased security of Elliptic Curve based cryptosystems, in comparison with conventional ones, is that the discrete logarithm problem for elliptic curves appears to have _exponential_ expected time complexity, in contrast to general groups (e.g., multiplicative) which have a discrete logarithm problem of _subexponential_ time complexity. This characteristic of elliptic curves leads to cryptosystems which possess similar security levels with conventional ones but with _much smaller_ key sizes, as we explain in Section 3. * Our approach creates a new set of Modbus libraries which can replace, readily, all Modbus installation existing today since they do not interfere with the client/server application level (see Section 4 as well as the associated discussion therein). Moreover, our approach extends the Modbus protocols to IIoT (Industrial IoT) devices in general. We demonstrate this extension with an experimental setup on an IIoT device which can be incorporated in any SCADA/Modbus installation (see Section 5). In summary, our contribution is a fully compatible, \"plug-in\", Modbus extension fully compatible with existing installations which, also, incorporates IIoT/sensor device security as part of the Modbus extension, owning to the flexibility and small computational requirements of Elliptic Curve Cryptography. Our work also provides a fully working proof of concept of the extended library in an experimental set-up incorporating both server and IIoT devices. In this paper we describe a fully developed secure SCADA environment based on extensive cryptographic extension of the Modbus libraries. The parts of the mechanism are key generation and distribution, message encryption and decryption. Our implementation is based on two C language libraries, which were extensively modified so as to incorporate security mechanisms, the libmodbus [6] and the ECCLIB [7] libraries.