Wireless Sensor Systems Security Implications For The Industrial Environment Fuhr

Wireless Sensor Systems:
Security Implications for the

Industrial Environment
Dr. Peter L. Fuhr
Chief Scientist
RAE Systems, Sunnyvale, CA
pfuhr@raesystems.com
Dr. Peter Fuhr, Presenter: 480+ publications&presentations in wireless sensor
networking arena. Old-timer in this area…etc etc.
RAE Systems Inc.
• Pervasive Sensing Company based
in Silicon Valley founded in 1991
Capabilities
– Radiation detection
• Gamma and neutron
– Chemical/vapor detection
• Toxic gas, VOC, combustible
gas, oxygen, CWA, temperature,
humidity, C02
– Redeployable sensor networks
– Mobile and fixed wireless
monitors
– Cargo Container Sensor Systems
ISA Wireless Security, P. Fuhr 2

Contributors
A number of individuals have provided “content” for these slides. They
include:
Wayne Manges, Oak Ridge National Laboratory
Robert Poor, Ember
Pat Gonia, Honeywell
Hesh Kagan, Foxboro/Invensys
Kang Lee, NIST
Tom Kevan, Advanstar
Ramesh Shankar, Electric Power Research Institute
Larry Hill, Larry Hill Consulting
Rob Conant, Dust
Rick Kriss, Xsilogy
Gideon Varga, Dept of Energy
Jack Eisenhauser, Energetics
Michael Brambley, Pacific Northwest National Labs
David Wagner, UC-Berkeley
Undoubtedly, there are other contributors too (apologies if

your name is not listed).
Wireless Sensor Networking
…it’s not cellular telephony
…it’s not just WiFi...(and it just may be the next big thing)
Each dot represents one cell phone tower.
Wireless devices circa 1930

Sensor Market: $11B in 2001
Installation (wiring) costs: >$100B
• Fragmented market
 platform
opportunity
• Installation cost limits

penetration
 reducing
installation cost
increases market size
Highly Fragmented
Sensor Market
Freedonia Group report on Sensors, April 2002
ISA Wireless Security, P. Fuhr Slide courtesy of Rob Conant, Dust 5

Industrial Market Sizing
Sensor Networking Products
• North American Market for Wireless products used in
Applications where transmission distances are 1 mile or
less:
– 2002 Total: $107 million
– 2006 Forecast: $713 million
– 2010 Estimates: $ 2.1 billion
• Largest Application areas:
– 2002: Tank Level Monitoring, Asset Tracking, Preventative
Maintenance
– 2006: Tank Level Monitoring, Preventative Maintenance,
Environmental Monitoring
• Conclusions:
– Rapid Growth in Industrial markets
– Tank Level Monitoring will remain a significant opportunity
– Key ‘ User’ Needs:
• Lower Costs over Wired (or Manual) Solutions
• Education of Potential Customers on the Technology
• Demonstration of Operational Reliability & Application ‘ Domain’
Knowledge
ISA Wireless Security, P. Fuhr Slide courtesy of Rick Kriss, Xsilogy 6

The True cost per monitored node – to the
End User
Higher Higher
DENSE SPARSE
Bluetooth, 1xRTT, FLEX
802.15.4, WiFi etc SAT, etc
3-Yr Installation
TOC $$$ Costs
Design For Here
Lower Lower
Meters Radio RF Range (dB) Miles

$ $$$$$
Slide courtesy of Rick Kriss, Xsilogy

What to do with the data?
Parameter
of Interest Output Signal
Chemical Measurement System Chemical
Electrical Electrical
Mechanical Output Mechanical
Thermal Sensor Modifier Thermal
Radiation Transducer Radiation
Optical Optical
Magnetic Magnetic
Power
Supply
Great! But how do you get the output signal from the sensor to the location
where the information will be interpreted (used)?
Traditionally the output of the sensor was hardwired to some form of

interpretive device (e.g., PLC) perhaps relying on a 4-20mA signal…

Outline:
1. Security? Who needs it?

2. How is security achieved in a wired channel?
3. The Situation for Wireless (its RF in an industrial setting.
Spectrum, modulation, encryption, spatial…)
4. Security within various Wireless Delivery Schemes
(cellular, WiFi, 802.15.4, Bluetooth, others…)
5. An Integrated Solution
6. The Big Review

Oh, who needs security in a
wireless channel anyway!
(pretty ridiculous statement isn’t it!

Let’s ask some experts:
WINA meeting, Coral Gables, Sept. 2003
www.wireless4industrial.org

What’s a WINA?
In the spring of 2003, the Wireless Industrial Networking

Alliance (WINA) was formed to promote the adoption of
wireless networking technologies and practices that will help
increase industrial productivity and efficiency.
WINA will be holding a 1.5 day meeting at ISA-HQ in RTP, NC on Feb 11/12 –
right after the ISA Wireless Security Expo and conference. Check out
www.wireless4industrial.org for WINA meeting details AND
www.isa.org/wireless for the ISA Wireless Security conf details!
Back to the Question:
Who needs security in a wireless

channel anyway!

Strategy Workshop Participants
• Suppliers (13)
• System integrators (6)
• Industrial end users (10)
– Chemicals – Energy/Utilities
– Petroleum – Forest Products
– Automotive – Electronics
• Industry analysts/venture capitalists (3)
• Others (associations, government, media, researchers)

End-User View of Industrial Wireless
Likes Dislikes
• Mobility • Change to status quo
• Compactness • Complexity
• High cost for coverage in large
• Flexibility
plants
• Low cost • Security issues
• Capability to monitor • Portability issues (power)
rotating equipment • Unproven reliability
• Short range (security) • Too risky for process control
• Ease of installation • Lack of experience in
troubleshooting (staff)
• High reliability
• Restricted infrastructure flexibility
• Impetus to enhance once implemented
electronics support
• Lack of analysis tools

Technology Group: Key Issues
• Security
– Jamming, hacking, and eavesdropping
• Power
• Value (clear to customer)
• Interoperability
– Co-existence with other facility networks, sensors,
collectors, technology
• True engineered solution (sensors, collectors, etc.)
• Assured performance & reliability/MTBA*
• Software infrastructure, data, & systems management
• Robustness (at least as good as wired)
• RF characterization (radios, receivers, environments)

*mean time between attention
Technology Group: Criticality Varies
by Application (5 = most critical)
Applications Biz
Attributes Monitor Control Alarm Shutdown WLAN
Latency 23 35 5 5 1
Device Reliability 23 35 5 5 1
Raw Thruput 2 / 5 2.5 /2.5 1 / 4 1 / 1 1/5

(node / aggr.)
Scalability 5 4 4 1 23
(Max.# nodes)
Data Reliability 1 5 5 5 2
Security 15 5 5 5 5
Low Cost 5 2 13 1 23
Gateway Technology 5 1 34 1 1
Engineered Solution 1 5 4 5 3

Industrial CyberSecurity
• The Case of Vitek Boden

• On October 31, 2001 Vitek Boden was convicted of:
– 26 counts of willfully using a restricted computer to
cause damage
– 1 count of causing serious environment harm
• The facts of the case:
– Vitek worked for the contractor involved in the
installation of Maroochy Shire sewage treatment
plant.
– Vitek left the contractor in December 1999 and
approached the shire for employment. He was
refused.
– Between Jan 2000 and Apr 2000 the sewage
system experienced 47 unexplainable faults,
causing millions of liters of sewage to be spilled.

How did he do it?
• On April 23, 2000 Vitek was arrested with

stolen radio equipment, controller
programming software on a laptop and a fully
operational controller.
• Vitek is now in jail…
Disgruntled
Contractor
Rogue Radio
PLC PLC
Sewage Plant
A Favorite 2.4 GHz Antenna

WarDriving – 802.11 HotSpots in
Silicon Valley

WarDriving – 802.11 HotSpots in
San Francisco

The Question:
Who needs security in a wireless channel
anyway!
The Answer:
We do. So…How do you provide the

appropriate level of security within the
acceptable price and “inconvenience” margin
-> Risk Management!

Inside vs. Outside?
• Where do attacks come from?
% of Respondents
*Source: “2002 CSI/FBI Computer Crime and Security Survey” Computer Security
Institute - www.gocsi.com/losses.
An “Outside” Example.
When? April 2001

“Hacker War I”
•In the Spring of 2001, the US got it’s first a

taste of a new form of warfare.
•Launched from overseas and targeted at
US critical infrastructure.

Honker Union
•Chinese Hacker Group working to advance
and in some cases impose it’s political agenda
•During the spring of 2001, Honker Union
worked with other groups such as the Chinese
Red Guest Network Security Technology
Alliance
•Hackers were encouraged to "...make use of
their skills for China..." Wired.com
Attack Methods:
Denial of Service Attacks
•Website Defacement
•E-mailing viruses to US Government Employees
ISA Wireless Security, P. Fuhr
•“KillUSA” package 28
Cyberwar
• Cyber attacks and web defacements
increased dramatically after the start of the
war against Iraq.
• More than 1,000 sites were hacked in the
first 48 hours of the conflict, with many of
the attacks containing antiwar slogans.
• Security consultants state that the war against
Iraq made March the worst month for digital
attacks since records began in 1995.

Hacker School
• North Korea's Mirim College, is a
military academy specializing in
electronic warfare
• 100 potential cybersoldiers graduate
every year

The Question:
Who needs security in a wireless channel
anyway?
The Answer:
Everyone.

Outline:

6. The Big Review

A few details…
Layered Communications

Wired Data Security Encryption
The “traditional” method involved encrypting the data prior to

transmission over a potentially insecure channel. The level of
protection rests on the encryption algorithm. (There are a few
other factors…such as the physical media.)
Slide courtesy of Wayne Manges, ORNL

Outline:

3. The Situation for Wireless
6. The Big Review

From many perspectives, THIS is what a wireless sensor network can provide.
Wireless Buildings
Key to success: reduced installation costs

ISA Wireless Security, P. Fuhr Slide courtesy of Pat Gonia, Honeywell 36
Modulation
E(t) = A(t) cos[t + (t)]
Amplitude Modulation (AM)
info is in A(t)
Frequency Modulation (FM)
info is in 
Phase Modulation (PM)
info is in (t)
Different vendors use
different schemes and they
are not interoperable.
Phase = 0o Phase = 360o
(or back to 0o)
Phase = 180o
Phase = 270o

The FCC Frequency Assignment
Different vendors may use
different frequencies within
the various ISM bands
(green in the diagram).
The ISM bands most commonly used are at 433, 915 and 2400 MHz.

Multiple Sensors Sharing the Medium:
Multiplexing. FDMA, TDMA and CDMA

Binary Signaling Formats
• Used to Improve Digital
Signal Reception and
Decision
• NRZ: Non-Return to Zero
• RZ: Return to Zero
• Unipolar: Only one side of
0V
• Bipolar: Both sides of 0V
• Manchester: Bi-Phase (“0”
in left 1/2 time slot, “1” in
right)

Narrowband or Spread Spectrum?
Narrowband uses a fixed carrier frequency, F 0.
The receiver then locks onto the carrier frequency, F 0.
Easy to implement (inexpensive).

Prone to jamming or interference (two transmitters at the
same carrier frequency, F0.
Least secure modulation scheme.

Narrowband or Spread Spectrum (cont.) ?
Frequency Hopping Spread Spectrum. Uses a carrier
frequency that varies with time, F 0(t).
Invented and patented by actress Heddy
Lamarr and her pianist George Antheil.
The receiver must track the time-varying carrier
frequency, F0(t).
Relatively easy to implement (inexpensive).

Prone to jamming or interference (two transmitters at the same carrier
frequency, F0) during any single transmit interval. Hopping rates
may be ~1600 hops/second (ala Bluetooth).
Very secure modulation scheme (used in military for decades).
Direct Sequence Spread Spectrum uses a fixed carrier frequency, F 0

but interleaves the data with a precise mathematical 0/1 data
sequence. (This increases the length of the transmitted information
vector making it longer). The information is replicated many times
throughout the bandwidth, so if one “lobe” of the information is
jammed, the remainder “gets through”. Highly robust technique.
The receiver then locks onto the carrier frequency, F 0 receives the signal and then
must “undo” the interleaving.
More difficult to implement (more expensive).
Most complicated scheme (of these presented).
Most secure modulation scheme.

DIRECT-SEQUENCE SPREAD-SPECTRUM SIGNALS
PN Clock Local PN Clock
PN Sequence Local
PN Sequence
Carrier Generator Carrier
Generator
±1 ±1
Wide Narrow Phase Data
Data
BP Filter BP Filter Demod
±1 Data
Clock
Power Power Power

Spectral Spectral Spectral
Density Density Density
“Spread”
RFI RFI
fc fc fc
Frequency Frequency Frequency
Original narrowband, high
Spectrum has wider bandwidth power density spectrum is
Narrow spectrum at restored if local PN sequence is
output of modulator and lower power density after
spreading with PN sequence same as and lined up with
before spreading (PN Rate >> Data Rate) received PN sequence

Which is best?
Each has its pluses and minuses…and each scheme has its share of diehard
advocates and/or naysayers!
Different vendors use these
(and other) schemes at
different frequencies within
the various ISM bands.
ISA Wireless Security, P. Fuhr From a security standpoint, DSSS is best. 45

Reality
DSSS FHSS

No Matter What…Its Just an
Electromagnetic Field
E(t) = A(t) cos[t + (t)]

A(t): amplitude of the wave
: radian frequency of the wave
(t): phase of the wave

The RF “Footprint”
Network “Size”
Personal Area Network: typical radiated power: 0 dBm, size: 10m
Local Area Network: typical radiated power: 20 dBm, size: 100m
Wide Area Network: typical radiated power: >30 dBm, size: >2000m
There are SO many technical questions: such as…
Network Topologies?
Bus Network
Tree Network
Ring Network
Star Network Ad Hoc Network

The Real World Presents the
Wireless Channel with Multipath and
Attenuation…and…

Real World:
Multipath
The Effect
The Cause

Real World:
Atmospheric Attenuation at 2.4 GHz
Rayleigh Fading @ 2.4GHz

Real World:
Signal Attenuation at 2.4 GHz

Real World:
And Signal-to-Noise Ratios really do

matter!
Anecdotal Evidence: As Frankfurt has increased the

deployment of 2.4 GHz wireless surveillance cameras,
the background Noise level has increased by 12 dB.
(This plays havoc with the BER or for fixed BER, the
overall data rate,)

Real World: Which Frequency is Best?
ALERT! ALERT!!
Notice that the operation at 2.45 GHz is
WORSE than at 900MHz (which is worse
than 433 MHz).
Outline:

4. Security within various Wireless Delivery
Schemes
6. The Big Review

Wireless Data Security: Encryption, Spreading, Interleaving
Wireless networks use a variety of techniques to enhance security,
such as spreading and interleaving. These techniques can make the
signal virtually undetectable without prior knowledge about the
network. This can improve the security of the network by orders
of magnitude.
Slide courtesy of Wayne Manges, ORNL
The Wireless Market
TEXT GRAPHICS INTERNET HI-FI STREAMING DIGITAL MULTI-CHANNEL

AUDIO VIDEO VIDEO VIDEO
LONG
LAN
< RANGE >
802.11b
802.11a/HL2 & 802.11g
Bluetooth 2
ZigBee PAN
SHORT
Bluetooth1
LOW < DATA RATE > HIGH

Bluetooth vs. the Rest (cont’d)
Parameter 802.11 HomeRF Bluetooth ZigBee (proposed)
Technology 2.4 GHz, DSSS 2.4GHz, FHSS 2.4 GHz, FHSS 2.4 GHz,DSSS
11 chips/bit 50 hops/s 1000+hops/s 15 chips/bit
Data Rate 11Mbps 1 Mbps 1Mbps 40 kbits/s
Power +20 dBm +20 dBm 0, +20dBm 0dBm
Range 50m 50m 1-10m, 50m 100m
Topology 128 devices 128 devices 8 devices, 100s devices,
CSMA/CA CSMA/CA Piconet CSMA/CA
Security Optional WEP Optional Encryption Not yet
Voice Channel Optional Optional Yes No
Bluetooth – aka IEEE 802.15.1

ZigBee – aka IEEE 802.15.4
Side by Side

802.11?

The Worldwide View of the 802.11 Spectral
Space

Radiated Field from a single AP
(Kansas City)

20dB Attenuation Profile for Univ of Kansas
Eng Bldg., Mesh and AP deployments

WEP
(encrypted traffic)
• The industry’s solution: WEP (Wired Equivalent Privacy)
– Share a single cryptographic key among all devices
– Encrypt all packets sent over the air, using the shared key
– Use a checksum to prevent injection of spoofed packets

Early History of WEP
1997 802.11 WEP standard released
Simon, Aboba, Moore: some weaknesses

Mar 2000
Walker: Unsafe at any key size
Oct 2000
Jan 30, 2001
Feb 5, 2001 Borisov, Goldberg, Wagner:
NY Times, WSJ break the story
7 serious attacks on WEP
Subsequent Events
Jan 2001
Borisov, Goldberg, Wagner
Mar 2001
Arbaugh: Your 802.11 network
has no clothes
Arbaugh: more attacks …
May 2001
Jun 2001
Newsham: dictionary attacks on WEP keys
Aug 2001
Fluhrer, Mantin, Shamir: efficient attack on way WEP uses RC4
Arbaugh, Mishra: still more attacks

Feb 2002

WEP Attack Tools
• Downloadable procedures from the Internet
– To crack the Key:
• AirSnort
– http://airsnort.sourceforge.net
• WEPCrack
– http://sourceforge.net/projects/wepcrack/
– To brute force enter into WLAN,
• THC-RUT
– http://www.thehackerschoice.com/releases.php

Wi-Fi Protected Access (WPA)
– Flaws in WEP known since January 2001 - flaws include weak
encryption, (keys no longer than 40 bits), static encryption keys, lack of
key distribution method.
– IEEE developing 802.11i standard for enhanced wireless security -

Addresses weak data encryption and user authentication within existing
802.11 standard.
– 802.11i standard will not be ratified until late 2003, possibly early 2004 -
outstanding issues.
– WPA standard joint effort between Wi-Fi Alliance and IEEE - WPA a
subset of IEEE 802.11i standard (Draft 3.0).
•WPA provides stronger data encryption (weak in WEP) and user

authentication (largely missing in WEP).

WPA – Data Encryption
– WPA uses Temporal Key Integrity Protocol (TKIP) stronger data encryption, addresses
known vulnerabilities in WEP.
•TKIP chosen as primary encryption cipher suite Easily deployed and
supported in legacy 802.11b hardware compared to other available cipher
suites.
– TKIP based on RC4 stream cipher algorithm, surrounds WEP cipher engine with 4 new
algorithms,
1. Extended 48bit Initialization Vector (IV) and IV sequencing rules (compared to the shorter 24bit WEP RC4 key).
2. New perpacket key mixing function.
3. Derivation and distribution method a.k.a. rekeying.
4. A message integrity check (MIC) a.k.a. ‘Michael’, ensures messages haven’t been tampered with during transmission.

WPA – Data Encryption, cont’d
• the Temporal Key Integrity Protocol.
Temporal Key
Phase 1
key mixing
TA WEP seed(s)
(represented as
WEP IV + RC4
Phase 2 key)
TTAK Key
key mixing
TSC
MIC Key
WEP
Encapsulation Ciphertext
Plaintext Plaintext
MSDU + MPDU(s)
MPDU(s)
SA + DA + MIC MIC Fragment(s)
Plaintext MSDU
Data
•DA – Destination Address TKIP – Temporal Key Integrity Protocol

•ICV– Integrity Check Value TSC – TKIP Sequence Counter
•MPDU – Message Protocol Data Unit TTAK– result of phase 1 key mixing of Temporal Key
•MSDU – MAC Service Data Unit and Transmitter Address
•RSN – Robust Security Network WEP – Wired Equivalent Privacy
•SA – Source Address WEP IV – Wired Equivalent Privacy Initialization Vector
•TA – Transmitter Address
WPA – Data Encryption, cont’d
– TKIP implements countermeasures - reduces rate which attacker can
make message forgery attempts down to two packets every 60 seconds.
– After 60 second timeout new PMK or Groupwise Key generated, depending

on which attacked – ensures attacker cannot obtain information from
attacked key.
– Countermeasures bound probability of successful forgery and amount of

information attacker can learn about a key.
– TKIP is made available as firmware or software upgrade to existing legacy

hardware.
•TKIP eliminates having to replace existing hardware or having to

purchase new hardware.

Bluetooth?

BlueTooth- Some Specifications
• Uses unlicensed 2.402 - 2.480 GHz frequency range

• Frequency hopping spread spectrum 79 hops
separated by 1 MHz
• Maximum frequency hopping rate: 1600 hops/sec
• Nominal range: 10 cm to 10 meters
• Nominal antenna power: 0 dBm
• One complete Bluetooth data packet can be
transmitted within each 625 msec hop slot.

Potential Bluetooth Markets

Bluetooth Market Forecast
Nov’03: 100M Bluetooth compliant devices worldwide
Bluetooth Protocol Stack
• Adopted Protocols
– PPP(Point-To-Point Protocol)
– TCP/UDP/IP
– OBEX-Session Protocol for IrDA(Infrared Data
Association)
– Contents Fromat(e.g. vCard, vCalendar)
– WAP-Wireless Application Protocol

Bluetooth Security
• Supports Unidirectional or Mutual Encryption based
on a Secret Link key Shared Between Two Devices
• Security Defined In 3 modes:
– Mode1- No Security
– Mode 2 - Service Level Security: Not Established
Before Channel is Established at L2CAP
– Mode 3 - Link Level Security: Device Initiates
Security Before LMP Link is Setup
• Devices and Services can be Set for Different Levels of Security
– Two Trust Levels are Set for Devices
• Trusted Device: Fixed Relationship and Unrestricted
Access to All Services
• Untrusted: No Permanent relationship and Restricted
Services
Bluetooth Security
• Devices and Services can be Set for Different Levels
of Security
– Two Trust Levels are Set for Devices
• Trusted Device: Fixed Relationship and
Unrestricted Access to All Services
• Untrusted: No Permanent relationship and
Restricted Services

Bluetooth Security
• 3 Levels of Service Access
– Require Authorization and Authenication
– Require Authentication Only
– Default Security for Legacy Applications

But is this Wireless Link Secure?
Newsflash: Jan 2001: Norwegian “hackers” crack a

Bluetooth transmission
Analysis of a BlueTooth Transmission
High overhead?

802.15.4/Zigbee?

IEEE 802.15.4 standard
• Includes layers up to and including Link Layer Control
– LLC is standardized in 802.1
• Supports multiple network topologies including Star, Cluster Tree and
Mesh
• Features of the MAC:
Association/dissociation, ACK, frame ZigBee Application Framework
delivery, channel access mechanism,
Networking App Layer (NWK)
frame validation, guaranteed time slot
management, beacon management, Data Link Controller (DLC)
channel scan IEEE 802.2
IEEE 802.15.4 LLC
• Low complexity: 26 primitives LLC, Type I
versus 131 primitives for 802.15.1 IEEE 802.15.4 MAC
(Bluetooth) IEEE 802.15.4 IEEE 802.15.4

868/915 MHz PHY 2400 MHz PHY

PHY overview
• Speed
– 20, 40 or 250 kbps
• Channels
– 1 channel in the 868MHz band
– 10 channels in the 915MHz band
– 16 channels in the 2.4GHz band
• Modulation
– BPSK (868MHz/20kbs)
– BPSK (915MHz/40kbps)
– O-QPSK (2.4GHz/250kbps)
• Coexistence w/
– 802.11b DSSS
– 802.15.1 FHSS
– 802.15.3 DSSS

MAC overview
• Security support
• Power consumption
consideration
• Dynamic channel
selection
• Network topology
–Star topology
–p2p topology
–clustertree network
topology

Device classification
• Full Function Device (FFD)
– Any topology
– Can talk to RFDs or other FFDs
– Operate in three modes
• PAN coordinator
• Coordinator
• Device.
• Reduced Function Device (RFD)
– Limited to star topology
– Can only talk to an FFD
(coordinator)
– Cannot become a coordinator
– Unnecessary to send large
amounts of data
– Extremely simple
– Can be implemented using
minimal resources and memory
capacity
Transmission management
• Acknowledgement
– No ACK
– ACK
– Retransmission
– Duplicate detection
• Indirect transmission

Security
• Unsecured mode
• ACL mode
– Access control
• Secured mode
– Access control
– Data encryption
– Frame integrity
– Sequential freshness

Scalable Security
• Assume the attacker can deploy own nodes (can
create a “ring” at some distance from controller)
[Wisenet 2003]
• Enemy nodes “mimick” the mesh nodes; they
ACK the “health inquiry” as if everything was OK
– but they do not forward to the rest of the net
• The rest of the network is virtually cut off from
inspection by controller
• Need secure key and a random seed that changes
at each round

What About:
1451.5?
1xRTT?
SAT?
CDPD?
Others?
No time this morning!

Outline:

6. The Big Review

There are SO many technical questions: such as…
Integrated Industrial Networks?
If the sensor network is to integrate into an industrial setting, then you

should be cognizant of the Industrial Networking arena.
Industrial Device Network Topology
• Typically, three layers of networking make up enterprisewide networks. Ethernet

acts as the company's intranet backbone, and it's linked to controllers or
industrial PCs, which supply strategic data to the enterprise. An industrial
network, or fieldbus, links sensors and smart devices. A gateway (not uncommon
in a large system with lots of devices) links devices that have only RS-232 or RS-
485 ports to the fieldbus system.

Industrial Device Networks
• General characteristics for industrial device
networks have arisen.
• Obviously the complexity of the network increases as the

functionality is increased.

Classification of Industrial
Networks
• Three logical groupings of instrumentation networks used in an
industrial setting.
• There are over 100 different proprietary networks in the
field.

Inside Security Incident
• Employee attacks PLC in another plant area
over PLC highway.
• Password changed to obscenity, blocking
legitimate maintenance and forcing process
shutdown.
Plant Highway
Disgruntled
Employee
PLC PLC PLC PLC

Steam Plant Paper Plant
* Source: BCIT Industrial Security Incident Database (ISID)

Network Positioning
- Data +
+
+
Ethernet TCP/IP
ControlNet
Functionality
Foundation Fieldbus H2
Complexity
Profibus-DP Profibus-FMS
Interbus-S Data Highway+
Remote I/O Modbus Plus
DeviceNet Fieldbus H1
Other CAN Profibus-PA
SDS Modbus
HART
ASi, Seriplex,
Hardwiring, RS485 etc.
-
-
- Cost +

Too Focused on Internet Issues?
• Myth #1: Our SCADA/PLC/DCS is safe if
we don’t connect to the Internet.
• Myth #2: Our Internet firewall will protect
our control systems.
• Myth #3: Our IT department understands
process control issues and security.

Is Industrial Comm Security Too
Focused on Internet Issues? Enterprise
Resource Planning
Manufacturing Logistics
Internet
Production
Remote Firewall Planning
Engineering
Enterprise Network
Production Networks
Ethernet Process
Historian
SCAD
Programming Stations A WarDialing
Control
Network Attack
PLC PLC
))))) Modem
Handheld 802.11
Operator WLAN OEM
Terminal Field Devices
Source (used by permission): Interface Technologies, Windsor, CT, 2002

Outline:

6. The Big Review

Bit Rate vs. Quality of Service
How Many
Bits are
Needed?
The more bits

you xmit,
the more
power you
consume!
Coding vs. Quality of Service
Is Coding
Really
Necessary?

Direct Sequence Spread Spectrum

Comparing Wireless
Tech. Range RF Battery Numbers

Power life In Area
DSSS Medium Low longest High
FHSS Long High Short Medium
UWB Medium Lowest short High

Technology Beats Marketing in
Performance!
Technology versus Attributes
Summary Chart
Technology
DSSS CDMA Low Mobile BPSK 900MHz
FHSS TDMA Power Ad Hoc Power Embedded Open QPSK 2.4GHz
Attribute UWB FDMA Designs Networks Harvesting Intelligence Diversity FEC Standards M-ary 5.8GHz
Long Range NA NA NA yes NA NA yes yes NA NA 900MHz
Plug-and-Play DSSS CDMA NA NA NA NA NA NA yes NA NA
Long Battery life FHSS FDMA yes NA yes yes yes yes NA M-ary 900MHz
Low RFI risk DSSS NA yes yes NA yes yes NA NA NA 5.8GHz
Self Locating DSSS CDMA NA NA NA yes yes NA NA NA 5.8GHz
Secure UWB CDMA yes NA NA yes yes NA NA NA 5.8GHz
High throughput UWB NA NA NA NA yes yes yes NA M-ary 5.8GHz
non line-of-sight UWB NA NA yes NA NA yes NA NA NA 900MHz
robust connections DSSS CDMA NA yes NA NA yes yes NA BPSK 5.8GHz
low cost FHSS FDMA yes NA NA NA NA NA yes BPSK 900MHz
small size FHSS TDMA yes NA NA NA NA NA NA BPSK 5.8GHz

Statistics on Types of Attacks
% of Respondents
*Source: “2002 CSI/FBI Computer Crime and Security Survey” Computer Security
Institute - www.gocsi.com/losses.

Optimization of Security vs. Cost
• Risk reduction is balanced against the cost of
security counter measures to mitigate the risk.
Optimal Level of Security

at Minimum Cost
Cost ($)
Cost of Security Cost of Security

Countermeasures Breaches
Security Level

Risk in Safety vs. Risk in Security
• Safety Definition: “Risk is a measure of human

injury, environmental damage, or economic
loss in terms of both the incident likelihood
and the magnitude of the loss or injury.”
• Security Definition: “Risk is an expression of
the likelihood that a defined threat will exploit a
specific vulnerability of a particular attractive
target or combination of targets to cause a
given set of consequences.”
*Source: CSPP Guidelines For Analyzing And Managing The Security

Vulnerabilities Of Fixed Chemical Sites
Firewall Architectures
• The external router blocks attempts to use the

underlying IP layer to break security (e.g. IP
spoofing, source routing, packet fragments, etc) and
forces all traffic to the proxy.
• The proxy firewall handles potential security holes in
the higher layer protocols.
• The internal router blocks all traffic except to the
proxy server.
External Internal
Router Router
Internet
 

There’s lot of “Wireless”
• From cellphones to PDAs to WiFi to
Satellitebased

Wireless LAN Standards

Existing/Developing
IEEE 802.11 Standards
• 802.11 Frequency Hopping/DSSS
• 802.11a – 54Mbps / HyperLAN
• 802.11b – (1999) 11Mbps
• 802.11e – Quality of Service
• 802.11f – Point 2 Point Roaming
• 802.11g – (2003) 54Mbps
• 802.11h – European Inspired Changes
• 802.11i – (Q2,2004) New Encryption Protocols
• 802.1x – (Q2,2004) Port Based Network Access
• 802.15 – Personal Area Network (WPAN)
• 802.16 – Wireless Metropolitan Area Network (WMAN)

Wireless Backbone for Inflight “Entertainment”
OnBoard Network Integration PicoCell
BTS
PicoCell
BTS
Noise
Floor
Lifter
6 MCU
SDU
GSM SERVER
ISA Wireless Security, P. Fuhr …and we haven’t even touched on RFID!

114
There’s lot of “Wireless”
• And it all needs to feel more Secure!

For a real review of networking
security…
• Take Eric Byrnes ISA course IC32C…

Will History Repeat?
Cellular networks wireless security: not just 802.11
1980 analog cellphones: AMPS
analog cloning, scanners wireless networks

fraud pervasive & costly
digital: TDMA, GSM 1999 802.11, WEP
1990
TDMA eavesdropping [Bar] 2000 sensor networks
2001 WEP broken [BGW] Proprietary systems
more TDMA flaws [WSK] WEP badly broken [FMS]
GSM cloneable [BGW]  attacks pervasive 2002
GSM eavesdropping 2002
1451, 802.15.4, TinyOS
[BSW,BGW]
2000 2003 WPA 2003
Future: 3rd gen.: 3GPP, … Future: 802.11i Future: ???
PATRIOT Act
• PATRIOT (Provide Appropriate Tools
Required to Intercept and Obstruct
Terrorism)
• Legally classifies many hacking attacks
as acts of terrorism

So… If Nothing else, at least
PLEASE do this for your WiFi
System!
WLAN Security Countermeasures

• Conduct site survey
• Identify areas of signal strength and weakness
• Do a “walkaround” with NetStumbler
• Document and shut down rogue access points
• Document and shut down unauthorized wireless NICs
• AND TURN ON SOME LEVEL OF THE PROVIDED
PROTECTION!

Oh…
And don’t forget that as you layer in all of

these wacky encryption schemes and
CDMA and DSSS and…and… that it takes
some joules to actually implement this. So
if your wireless network has primepower
(a.k.a. AC) you’re ok. But if you’re going
off a battery then it’s a tradeoff of security
versus Power Consumption  You
Choose that one!

...and in the end...
BumbleBee with RF xcvr
...or...
HoneyBee with RFID
Two potential forms of wireless sensor networks.
And they should both be secure!
Outline:

6. The Big Review
7. Glossary and References

Glossary
10BASET: IEEE 802.3 standard for a twistedpair Ethernet network. 10 Mbps transmission rate over baseband using unshielded, twisted
pair cable.
802.11: The IEEE 802.11 standard defines both frequency hopping and direct sequence spread spectrum solutions for use in the 2.42.5 MHz
ISM (Industrial, Scientific, Medical) band.
802.11a: The Global System for Mobile Communications standard for worldwide wireless communications on wide area networks (WANs).
802.11b: The portion of the 802.11 specification that defines the 11 Mbps data rate.
Access Point: Provides a bridge between Ethernet wired LANs and the wireless network. Access points are the connectivity point between
Ethernet wired networks and devices (laptops, handheld computers, pointofsale terminals) equipped with a wireless LAN adapter card.
Analog phone: Comes from the word "analogous," which means similar to. In telephone transmission, the signal being transmitted from the
phone—voice, video or image—is analogous to the original signal.
AntennaDirectional: Transmits and receives radio waves off the front of the antenna. The power behind and to the sides of the antenna is
reduced. The coverage area is oval with the antenna at one of the narrow ends. Typical directional antenna beam width angles are from 90°
(somewhat directional) to as little as 20°(very directional). A directional antenna directs power to concentrate the coverage pattern in a
particular direction. The antenna direction is specified by the angle of the coverage pattern called the beam width.
AntennaOmnidirectional: Transmits and receives radio waves in all directions. The coverage area is circular with the antenna at the center.
Omnidirectional antennas are also referred to as whip or lowprofile antennas.
Association: The process of determining the viability of the wireless connection and establishing a wireless network's root and designated
access points. A mobile unit associates with its wireless network as soon as it is powered on or moves into range.
ATM: Asynchronous Transfer Mode. A type of highspeed wide area network.

Glossary
B
Backbone: A network that interconnects other networks, employing highspeed transmission paths and often spanning a large geographic
area.
Bandwidth: The range of frequencies, expressed in hertz (Hz), that can pass over a given transmission channel. The bandwidth determines the
rate at which information can be transmitted through the circuit.
Bandwidth Management: Functionality that allocates and manages RF traffic by preventing unwanted frames from being processed by the
access point.
BC/MC: Broadcast frames; Multicast frames
Beacon: A uniframe system packet broadcast by the AP to keep the network synchronized. A beacon Includes the Net_ID (ESSID), the AP
address, the Broadcast destination addresses, a time stamp, a DTIM (Delivery Traffic Indicator Maps) and the TIM (Traffic Indicator
Message).
BFA Antenna Connector: Miniature coaxial antenna connector manufactured by MuRata Manufacturing Corporation.
Bluetooth: See Wireless Personal Area Networks.
Bridge: A device that connects two LANs of the same or dissimilar types. It operates at the Data Link Layer, as opposed to routers. The
bridge provides fast connection of two collocated LAN segments that appear as one logical network through the bridge.
Buffer: A segment of computer memory used to hold data while it is being processed.

C Glossary
CAM: Continuously Aware Mode: Mode in which the adapter is instructed to continually check for network activity.
Card and Socket Services: Packages that work with the host computer operating system, enabling the Wireless LAN adapter to interface with
host computer configuration and power management functions.
Cellular Phone: Lowpowered, duplex, radio/telephone that operates between 800 and 900 MHz, using multiple transceiver sites linked to a
central computer for coordination. The sites, or "cells," cover a range of one to six or more miles in each direction.
Centrex: Business telephone service offered by a local telephone company from a local telephone company office. Centrex is basically a single
line phone system leased to businesses as a substitute for a business that is buying or leasing its own onpremises phone system or PBX.
CDMA and TDMA: The Code Division Multiple Access and Time Division Multiple Access standard for wireless communications on wide
area networks (WANs) in North America.
Circuit switching: The process of setting up and keeping a circuit open between two or more users so that users have exclusive and full use of
the circuit until the connection is released.
Client: A computer that accesses the resources of a server.
Client/Server: A network system design in which a processor or computer designated as a server (such as a file server or database server)
provides services to other client processors or computers.
CODEC: CoderDecoder. Audio compression/decompression algorithm that is designed to offer excellent audio performance. Converts voice
signals from their analog form to digital signals acceptable to modern digital PBXs and digital transmission systems. It then converts those
digital signals back to analog so that you may hear and understand what the other person is saying.
Computer Telephony Integration: Technology that integrates computer intelligence with making, receiving, and managing telephone calls.
Computer telephony integrates messaging, realtime connectivity, and transaction processing and information access.

Glossary
D
Data Terminal: Computer transmit and receive equipment, including a wide variety of dumb terminals or terminals without embedded
intelligence in the form of programmed logic. Most data terminals provide a user interface to a more capable host computer, such as a
mainframe or midrange computer.
Decryption: Decryption is the decoding and unscrambling of received encrypted data. The same device, host computer or frontend
processor, usually performs both encryption and decryption.
Desktop Conferencing: A telecommunications facility or service on a PC that permits callers from several diverse locations to be connected
together for a conference call.
Digital Phone System: Proprietary phone system provided by a vendor, such as AT&T, Mitel, Northern Telecom, and so on. The signal being
transmitted in a digital phone system is the same as the signal being transmitted in an analog phone system. The system can consist of a
proprietary PBX system that converts voice signals from their analog form to digital signals, and then converts those digital signals back to
analog. Alternatively, the conversion from analogtodigital can occur in a digital phone.
Direct Inward Dialing: DID. The ability for a caller outside a company to call an internal extension without having to pass through an
operator or attendant. In large PBX systems, the dialed digits are passed from the PSTN to the PBX, which then completes the call.
DirectSequence (DS) Spread Spectrum: Direct sequence transmits data by generating a redundant bit pattern for each bit of information sent.
Commonly referred to as a "chip" or "chipping code," this bit pattern numbers 10 chips to one per bit of information. Compared with
frequency hopping, direct sequence has higher throughput, wider range and is upgradable in the 2.4GHz band.
Diversity Reception: The use of two antennas attached to a single access point to improve radio reception. The second antenna is used only
for receiving radio signals, while the primary is used for both transmitting and receiving.
Driver: A program routine that links a peripheral device, such as a mobile unit's radio card, to the computer system.

Glossary
Elementlevel Management: Level of technologies aimed at small or mediumsized businesses.
Encryption: Entails scrambling and coding information, typically with mathematical formulas called algorithms, before the information is transmitted over a network.
Ethernet: A local area network used for connecting computers, printers, workstations, terminals, servers, and so on, within the same building or campus. Ethernet
operates over twisted wire and over coaxial cable at speeds up to 100 Mbps, with 1 Gbps speeds coming soon.
Filtering: Prevents userdefined frames from being processed by the access point.
Fragmentation Threshold: The maximum size for directed data packets transmitted over the radio. Larger frames fragment into several packets this size or smaller before
transmission over the radio. The receiving station reassembles the transmitted fragments.
Frame Mode: A communications protocol supported by the OEM Modules. The frame protocol implements asynchronous serial PointtoPoint (PPP) frames similar to
those used by serial Internet protocols.
Frequency Hopping (FH) Spread Spectrum: Hedy Lamarr, the actress, is credited in name only for inventing frequency hopping during World War II. As its label
suggests, frequency hopping transmits using a narrowband carrier that changes frequency in a given pattern. There are 79 channels in a 2.4GHz ISM band, each channel
occupying 1MHz of bandwidth. A minimum hop rate of 2.5 hops per channel per second is required in the United States. Frequency hopping technology is recognized
as superior to direct sequence in terms of echo resistance, interference immunity, cost and easeofinstallation. To date, there has also been a greater selection of WLAN
products from which to chose.
FTP (File Transfer Protocol): A common Internet protocol used for transferring files from a server to the Internet user. It uses TCP/IP commands.
Gain, dBi: Antenna gain, expressed in decibels referenced to a half wave dipole.
Gain, dBi: Antenna gain, expressed in decibels referenced to a theoretical isotropic radiator.
Gain, dBic: Antenna gain, expressed in decibels referenced to a theoretical isotropic radiator that is circularly polarized.
Gatekeeper: Software that performs two important functions to maintain the robustness of the network: address translation and bandwidth management. Gatekeepers map
LAN aliases to IP addresses and provide address lookups when needed.
Gateway: Optional element in an H.323 conference. Gateways bridge H.323 conferences to other networks, communications protocols, and multimedia formats.
Gateways are not required if connections to other networks or nonH.323 compliant terminals are not needed.
GHz: International unit for measuring frequency is Hertz (Hz), which is equivalent to the older unit of cycles per second. One Gigahertz (GHz) is one billion Hertz.
Microwave ovens typically operate at 2.45 GHz.
GSM: The Global System for Mobile Communications standard for worldwide wireless communications on wide area networks (WANs).

Glossary
H.323: An umbrella standard from the International Telecommunications Union (ITU) that addresses call control, multimedia management, and bandwidth management
for pointtopoint and multipoint conferences, as well as interfaces between LANs and other networks. The most popular standard currently in use.
Handheld PC (HPC): The term adopted by Microsoft and its supporters to describe handheld computers employing Microsoft's Windows CE operating system.
Interactive Voice Response: System used to access a database access application using a telephone. The voice processing acts as a frontend to appropriate databases that
reside on general purpose computers. For instance, DTMF (touch tone) input of a Personal Identification Number can be required for access or more unusual and
expensive techniques such as voice recognition and voice print matching.
Internet: World's largest network, often referred to as the Information Superhighway. The Internet is a virtual network based on packet switching technology. The
participants on the Internet and its topology change on a daily basis.
Internet Commerce: Electronic business transactions that occur over the Internet. Samples of Internet commerce applications include electronic banking, airline
reservation systems, and Internet malls.
Internet Phone: Device used to transmit voice over the Internet, bypassing the traditional PSTN and saving money in the process. An Internet phone can be a small phone
(such as the NetVision Phone) or a multimedia PC with a microphone, speaker, and modem.
Interoperability: The ability of equipment or software to operate properly in a mixed environment of hardware and software, from different vendors. Enabled by the
IEEE 802.11 open standard.
IP (Internet Protocol): The Internet standard protocol that defines the Internet datagram as the unit of information passed across the Internet. Provides the basis of the
Internet connectionless besteffort packet delivery service. The Internet protocol suite is often referred to as TCP/IP because IP is one of the two fundamental protocols.
International Roaming: Ability to use one adapter worldwide.
Intranet: A private network that uses Internet software and Internet standards. In essence, an intranet is a private Internet reserved for use by people who have been given
the authority and passwords necessary to use that network.
ISDN: Integrated Services Digital Network. Emerging network technology offered by local phone companies that is designed for digital communications, computer
telephony, and voice processing systems.
ISM Band: ISM bandsinstrumental (902928MHz), science (2.42.4835GHz), and medical (5.7255.850GHz)are the radio frequency bands allocated by the FCC for
unlicensed continuous operations for up to 1W. The most recent band approved by the FCC for WLANs was the medical band in January 1997.
ITU: International Telecommunications Union. Standards body that defined H.323 and other international standards.
Jitter: Noise on a communications line which is based on phase hits, causing potential phase distortions and bit errors..
Glossary
Kerberos: A widely deployed security protocol that was developed at the Massachusetts Institute of Technology (MIT) to authenticate users and clients in a wired
network environment and to securely distribute encryption keys.
Key Telephone System: A system in which the telephone has multiple buttons permitting the user to directly select central office phone lines and intercom lines. Key
phone systems are most often found in relatively small business environments, typically around 50 telephones.
Layer: A protocol that interacts with other protocols as part of an overall transmission system.
LPD (Line Printer Daemon): A TCPbased protocol typically used between a Unix server and a printer driver. Data is received from the network connection and sent out
over the serial port.
MAC (Media Access Control): Part of the Data Link Layer, as defined by the IEEE, this sublayer contains protocols for gaining orderly access to cable or wireless
media.
MD5 Encryption: An authentication methodology when MU is in foreign subnet.
MIB (Management Information Base): An SNMP structure that describes the specific device being monitored by the remotemonitoring program.
Microcell: A bounded physical space in which a number of wireless devices can communicate. Because it is possible to have overlapping cells as well as isolated cells,
the boundaries of the cell are established by some rule or convention.
Modem: Equipment that converts digital signals to analog signals and vice versa. Modems are used to send digital data signals over the analog PSTN.
MMCX Antenna Connector: Miniature coaxial antenna connector in use by several major wireless vendors.
Mobile IP: The ability of the mobile unit to communicate with the other host using only its home IP address, after changing its point of attachment to the Internet and
intranet.
Mobile Unit (MU): May be a Symbol Spectrum24 terminal, PC Card and PCI adapter, barcode scanner, thirdparty device, and other
Mobile Unit Mode: In this mode, the WLAN adapter connects to an access point (AP) or another WLAN installed system, allowing the device to roam freely between AP
cells in the network. Mobile units appear as network nodes to other devices.
Modulation: Any of several techniques for combining user information with a transmitter's carrier signal.
Multipath: The signal variation caused when radio signals take multiple paths from transmitter to receiver.
Multipath Fading: A type of fading caused by signals taking different paths from the transmitter to the receiver and, consequently, interfering with each other.
Node: A network junction such as a switch or a routing center. Glossary
Packet Switching: Refers to sending data in packets through a network to some remote location. In a packet switched network, no circuit is left open on a dedicated basis.
Packet switching is a data switching technique only.
PBX Phone System: Private Branch eXchange. Small version of the phone company's larger central switching office. An alternative to a PBX is to subscribe to a local
telephone company's Centrex service.
PCMCIA (Personal Computer Memory Card International Association) PC Card: A credit cardsize device used in laptop computers and available as removable network
adapters.
PCS (Personal Communications Service): A new, lower powered, higherfrequency competitive technology to cellular. Whereas cellular typically operates in the 800
900 MHz range, PCS operates in the 1.5 to 1.8 GHz range. The idea with PCS is that the phone are cheaper, have less range, and are digital. The cells are smaller and
closer together, and airtime is cheaper.
Peertopeer Network: A network design in which each computer shares and uses devices on an equal basis.
Ping: A troubleshooting TCP/IP application that sends out a test message to a network device to measure the response time.
PLD (Data Link Protocol): A raw packet protocol based on the Ethernet frame format. All frames are sent to the wireless network verbatimshould be used with care as
improperly formatted data can go through with undesirable consequences.
Plug and Play: A feature that allows a computer to recognize the PCI adapter and configure the hardware interrupt, memory, and device recognition addresses; requires
less user interaction and minimizes hardware conflicts.
Pocket PC: The term adopted by Microsoft and its supporters to describe handheld computers employing Microsoft's Pocket PC operating system.
PointofSale Device: A special type of equipment that is used to collect and store retail sales data. This device may be connected to a bar code reader and it may query a
central computer for the current price of that item.
POTS (Plain Old Telephone Service): The basic service supplying standard single line telephones, telephone lines, and access to the public switched telephone network.
Power Management: Algorithms that allow the adapter to sleep between checking for network activity, thus conserving power.
PSP (Power Save Polling): stations power off their radios for long periods. When a mobile unit in PSP mode associates with an access point, it notifies the AP of its
activity status. The AP responds by buffering packets received for the MU.
PSTN (Public Switched Telephone Network): Refers to the worldwide voice telephone network accessible to all those with telephones and access privileges. In the U.S.,
the PSTN is provided by AT&T.

Glossary
QoS (Quality of Service): Measure of the telephone service quality provided to a subscriber. QoS refers to things like: Is the call easy to hear? Is it clear? Is it loud
enough?
RBOC (Regional Bell Operating Company): One of the seven Bell operating companies set up after the divestiture of AT&T, each of which own two or more Bell
Operating Companies (BOCs).
Roaming: Movement of a wireless node between two microcells. Roaming usually occurs in infrastructure networks built around multiple access points.
Repeater: A device used to extend cabling distances by regenerating signals.
Router: The main device in any modern network that routes data blocks from source to destination using routing tables and determining the best path dynamically. It
functions as an addressable entity on the LAN and is the basic building block of the Internet.
SNMP (Simple Network Management Protocol): The network management protocol of choice for TCP/IP based intranets. Defines the method for obtaining information
about network operating characteristics, change parameters for routers and gateways.
Scanning: A periodic process where the mobile unit sends out probe messages on all frequencies defined by the country code. The statistics enable a mobile unit to re
associate by synchronizing its frequency to the AP. The MU continues communicating with that access point until it needs to switch cells or roam.
Site Survey: Physical environment survey to determine the placement of access points and antennas, as well as the number of devices necessary to provide optimal
coverage, in a new or expanding installation.
Spread Spectrum: A transmission technique developed by the U.S. military in World War II to provide secure voice communications, spread spectrum is the most
commonly used WLAN technology today. It provides security by "spreading" the signal over a range of frequencies. The signal is manipulated in the transmitter so that
the bandwidth becomes wider than the actual information bandwidth. Despreading the signal is impossible for those not aware of the spreading parameters; to them, the
signal sounds like background noise. Interference from narrowband signals is also minimized to background noise when it is despread by the receiver. Two types of
spread spectrum exist: direct sequence and frequency hopping.
Stream Mode: A communications protocol supported only by the Telnet and TCP protocols. Stream mode transfers serial characters as they are received by encapsulating
them in a packet and sending them to the host.

Glossary
T1: A type of dedicated digital leasedline available from a public telephone provider with a capacity of 1.544 Mbps. A T1 line can normally handle 24 voice
conversations, each one digitized at 64 Kbps. With more advanced digital voice encoding techniques, it can handle more voice channels. T1 is the standard for digital
transmission in the U.S. Canada, Hong Kong, and Japan.
TCP/IP: Networking protocol that provides communication across interconnected networks, between computers with diverse hardware architectures, and various
operating systems. TCP/IP is used in the industry to refer to the family of common Internet protocols.
TCP (Transport Communication Protocol): Controls the transfer of data from one client to one host, providing the mechanism for connection maintenance, flow control,
retries, and timeouts.
Telnet (Terminal Emulation Protocol): A protocol that uses the TCP/IP networking protocol as a reliable transport mechanism. Considered extremely stable.
Terminal: An endpoint, which provides for realtime, twoway communications with another terminal, gateway, or mobile unit.
Token Ring: A ring type of local area network (LAN) in which a supervisory frame, or token, must be received by an attached terminal or workstation before that
terminal or workstation can start transmitting. Token ring is the technique used by IBM and others.
UDP (User Datagram Protocol): UDP/IP is a connectionless protocol that describes how messages reach application programs running in the destination machine;
provides low overhead and fast response and is well suited for highbandwidth applications.
Video Conferencing: Video and audio communication between two or more people via a video CODEC (coder/decoder) at either end and linked by digital circuits.
Voice Mail System: Device or system that records, stores, and retrieves voice messages. The two types of voice mail devices are those which are "stand alone" and those
which offer some integration with the user's phone system.
WiFi: A logo granted as the "seal of interoperability" by the Wireless Ethernet Compatibility Alliance (WECA). Only select wireless networking products possess this
characteristic of IEEE802.11b.
Wireless AP Support: Access Point functions as a bridge to connect two Ethernet LANs.

Glossary
Wireless Local Area Network (WLAN): A wireless LAN is a data communications system providing wireless peertopeer (PCtoPC, PCtohub, or printertohub) and
pointtopoint (LANtoLAN) connectivity within a building or campus. In place of TP or coaxial wires or optical fiber as used in a conventional LAN, WLANs transmit
and receive data over electromagnetic waves. WLANs perform traditional network communications functions such as file transfer, peripheral sharing, email, and
database access as well as augmenting wired LANs. WLANs must include NICs (adapters) and access points (inbuilding bridges), and for campus communications
buildingtobuilding (LANLAN) bridges.
Wireless Personal Area Network (WPAN): Personal area networks are based on a global specification called Bluetooth which uses radio frequency to transmit voice and
data. Over a short range, this cablereplacement technology wirelessly and transparently synchronizes data across devices and creates access to networks and the Internet.
Bluetooth is ideal for mobile professionals who need to link notebook computers, mobile phones, PDAs, PIMs, and other handheld devices to do business at home, on
the road, and in the office.
Wireless Wide Area Network (WWAN): Wide area networks utilize digital mobile phone systems to access data and information from any location in the range of a cell
tower connected to a dataenabled network. Using the mobile phone as a modem, a mobile computing device such as a notebook computer, PDA, or a device with a
standalone radio card, can receive and send information from a network, your corporate intranet, or the Internet.

A Few References
Berge J.,"Fieldbuses for Process Control: Engineering, Operation, Maintenance". ISA Press 2002, ISBN 1-55617-760-7.
Black U., "Physical Level Interfaces and Protocols". IEEE, ISBN 0-8186-8824-6.
Black U., "The V-series recommendations". McGraw-Hill, ISBN 0-07-005592-0.
Bonfig K., "Feldbus-Systeme". Expert Verlag 1992, 3-8169-0771-7.
Borst W., "Der Feldbus in der Maschinen- und Anlagentechnik". Franzis Verlag, ISBN 3-7723-4621-9.
British Standard Institute, "Guide to the evaluation of fieldbus protocols". Report DISC PD0014:2000.
Brown, "The OSI Dictionary of acronyms". McGraw-Hill 1993, ISBN 0-07-057601-7.
Burton, "Fieldbus for Industrial Control Systems". Chapmann & Hall 1997, ISBN 0-412-57890-5.
Centrum voor Micro-elektronica, "Intelligente sensornetwerken". 1993, 1996
Control Engineering, issues of 1994 and 1995, "Fieldbus series".
Dietrich D., "Feldbustechnik in Forschung, Entwicklung und Anwendung". Springer Verlag, 1997.
ETG Fachbericht 37, "Datenübertragung auf Fahrzeugen mittels serieller Bussysteme". VDE Verlag, ISBN 3-8007-1829-4.
ETZ Report 27, "Standardisierung der Prozeßdatenkommunikation". VDE Verlag 1991.
Fachzeitschrift DE, "Bussysteme für die Gebäudeinstallation. Hüthig & Pflaum, 1999.
Färber, "Bussysteme - parallele und serielle Bussysteme in Theorie und Praxis". Oldenbourg Verlag, ISBN 3-486-28581-5.
Frankort, "Digitale Communicatie". Delta Press 1989, ISBN 90-6674-726-9.
Gladdis, "How to automate your home". Baran-Harper 1991, ISBN 0-9632170-0-3.
Gruhler, G. "Feldbusse und Geräte-Kommunikationssysteme". Franzis Verlag 2001, ISBN 3-7723-5745-8.
Hill, "A distributed control & diagnostic architecture for railway maintenance". University of South-Carolina 1998.
Holzmann, "Design and validation of computer protocols". Prentice-Hall, ISBN 0-13-539834-7.
Huber J.,"Industrial Fiber Optic Networks". ISA Press 1995, ISBN 1-55617-521-3-G.
Hulsebos, R., "Veldbussen". Kluwer 1996, ISBN 90-557-6059-5.
IEE, "Colloquium: Fieldbus devices - A changing future". IEE 1994, Ref. 1994/236.
ISA, "Fieldbus Standard for use in industrial control systems". ISA 1993, ISBN 1-55617-317-2.
ISA, "The ISA Fieldbus Guide". ISA 1997, ISBN 1-55617-637-6.
Johannsmeyer, "Investigation into the intrinsic safety of fieldbus systems (FISCO)". PTB, report W53, ISBN 3-89429-310-1.
Jordan, "Serial networked field instrumentation". Wiley 1995, ISBN 0-471-95236-1.
References (cont.)
Keithley Instruments, "Demanding measurements on the factory floor".
Kluwer, "Handboek Industriële Netwerken". Kluwer 2000, ISBN 90-5404-628-7.
Kriesel, "Bustechnologien für die Automation, 2nd Ed.". Hüthig Verlag 2000, ISBN 3-7785-2778-9.
Lian, "Performance evaluation of control networks for manufacturing systems". Proceedings of the ASME
(Dynamics and Control Division), 1999.
Miklovic, "Real-time control networks". ISA 1993, ISBN 1-55617-231-1.
Mikrocentrum Nederland, Syllabi themadagen "Industriële netwerken". 1993-2001.
Newman, "Direct digital control of building systems". Wiley, 1994, ISBN 0-471-51696-1.
Phoenix, "Grundkurs Sensor/Aktor-Feldbustechnik". Vogel Verlag, ISBN 3-8023-1708-4.
Phoenix, "Grundkurs Feldbustechnik". Vogel Verlag 2000, ISBN 3-8023-1813-7.
Phoenix, "Basic course in sensor/actuator fieldbus technology". Vogel Verlag.
Physikalische Technische Bundesanstalt, "Investigations into the intrinsic safety of fieldbus systems".
PTB 1994, ISBN 3-89429-512-0.
Reinert, "Sichere Bussysteme für die Automation" Hüthig Verlag 2001, ISBN 3-7785-2797-5.
Reißenweber B., "Feldbussysteme". Oldenbourg Verlag, 2002, ISBN 3-486-24536-8.
Rikkert de Koe, "OSI-Protocollen lagen 1 t/m 4". Kluwer Telematica, ISBN 90-201-2388-2.
Rosch, "Gebäudesystemtechnik: Datenubertragung auf dem 230V Netz". Verlag Moderne Industrie 1998, ISBN 3-
478-93185-1.
Scherff, B. "Feldbussysteme in der Praxis". Springer Verlag 1999, ISBN 3-540-63880-6.
Schnell, G. "Bussysteme in der Automatisierungs- and Prozesstechnik" (4th Ed.). Vieweg Verlag 2000, ISBN 3-528-
36569.
Svacina, "Understanding Device Level Buses". Turck.
Thompson, "Industrial Data Communications: Fundamentals And Applications" 3rd Edition. ISA Press 2002, ISBN
1-55617-767-4-G.
Texas Instruments, "RS422 and RS485 Application Guide".
VDI/VDE, "Richtlinien 3687: Auswahl von Feldbussysteme durch Bewertung ihrer Leistungseigenschaften für
verschiedene Anwendungsbereiche". VDI/VDE, 1997.
Wittgruer, F. "Digitale Schnittstellen und Bussysteme". Vieweg Verlag 1999.
Wrobel, "Optische übertragungstechnik in der Praxis, 2nd Ed.". Hüthig Verlag 1998, ISBN 3-7785-2638-3.
Wybranietz, "Multicast-Kommunikation in verteilten Systemen". Springer Verlag 1987, ISBN 3-540-52551-3.
Questions?
Comments?

Wireless Sensor Systems Security Implications For The Industrial Environment Fuhr

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Wireless Sensor Systems Security Implications For The Industrial Environment Fuhr

Caricato da

Copyright:

Formati disponibili

Wireless Sensor Systems:

Security Implications for the

ISA Wireless Security, P. Fuhr 2

Undoubtedly, there are other contributors too (apologies if

Wireless devices circa 1930

• Installation cost limits

ISA Wireless Security, P. Fuhr Slide courtesy of Rob Conant, Dust 5

ISA Wireless Security, P. Fuhr Slide courtesy of Rick Kriss, Xsilogy 6

Meters Radio RF Range (dB) Miles

Slide courtesy of Rick Kriss, Xsilogy

Traditionally the output of the sensor was hardwired to some form of

ISA Wireless Security, P. Fuhr 8

1. Security? Who needs it?

ISA Wireless Security, P. Fuhr 9

ISA Wireless Security, P. Fuhr 10

ISA Wireless Security, P. Fuhr 11

In the spring of 2003, the Wireless Industrial Networking

Who needs security in a wireless

ISA Wireless Security, P. Fuhr 13

ISA Wireless Security, P. Fuhr 14

ISA Wireless Security, P. Fuhr 15

ISA Wireless Security, P. Fuhr 16

Latency 2­3 3­5 5 5 1

Device Reliability 2­3 3­5 5 5 1

Raw Thru­put 2 / 5 2.5 /2.5 1 / 4 1 / 1 1/5

ISA Wireless Security, P. Fuhr 17

ISA Wireless Security, P. Fuhr 18

ISA Wireless Security, P. Fuhr 19

• On April 23, 2000 Vitek was arrested with

ISA Wireless Security, P. Fuhr 21

ISA Wireless Security, P. Fuhr 22

ISA Wireless Security, P. Fuhr 23

We do. So…How do you provide the

ISA Wireless Security, P. Fuhr 24

ISA Wireless Security, P. Fuhr 26

•In the Spring of 2001, the US got it’s first a

ISA Wireless Security, P. Fuhr 27

ISA Wireless Security, P. Fuhr 29

ISA Wireless Security, P. Fuhr 30

ISA Wireless Security, P. Fuhr 31

1. Security? Who needs it?

ISA Wireless Security, P. Fuhr 32

ISA Wireless Security, P. Fuhr 33

The “traditional” method involved encrypting the data prior to

Slide courtesy of Wayne Manges, ORNL

1. Security? Who needs it?

ISA Wireless Security, P. Fuhr 35

Key to success: reduced installation costs

ISA Wireless Security, P. Fuhr 37

ISA Wireless Security, P. Fuhr 38

ISA Wireless Security, P. Fuhr 39

ISA Wireless Security, P. Fuhr 40

The receiver then locks onto the carrier frequency, F 0.

Easy to implement (inexpensive).

ISA Wireless Security, P. Fuhr 41

Relatively easy to implement (inexpensive).

Direct Sequence Spread Spectrum uses a fixed carrier frequency, F 0

ISA Wireless Security, P. Fuhr 43

Power Power Power

ISA Wireless Security, P. Fuhr 44

ISA Wireless Security, P. Fuhr From a security standpoint, DSSS is best. 45

ISA Wireless Security, P. Fuhr 46

E(t) = A(t) cos[t + (t)]

Latency 23 35 5 5 1

Device Reliability 23 35 5 5 1

Raw Thruput 2 / 5 2.5 /2.5 1 / 4 1 / 1 1/5