A new security approach with lightweight encrypted hardware module for Modbus/TCP

Industrial control systems are used to manage critical infrastructures such as electricity, water, and energy, which directly impact our lives. The communication protocols used in these systems have been developed without considering security parameters since their conception. Due to the continuous advancement of technology, these systems are now connected to the Internet. Consequently, the structure of these systems can be vulnerable to numerous security threats. This thesis aims to address the security vulnerabilities of the Modbus/TCP protocol, one of the most commonly used in industrial control systems. The Modbus/TCP protocol, by its very nature, lacks fundamental security controls such as data integrity, data confidentiality, and login. These deficiencies make systems using the Modbus/TCP protocol vulnerable to numerous attacks, including denial of service, man-in-the-middle attacks, packet sniffing, and packet manipulation. This has led to the need to add a security layer to the protocol. Therefore, approaches that do not negatively impact the operation of industrial systems are critical for enhancing the security of protocol. Numerous studies have been published using various techniques to address these problems, but many are not applicable to real-time systems. Studies have evaluated these issues in areas such as machine learning, deep learning, and cryptographic encryption. Machine learning and deep learning-based solutions generally focus on designing intrusion detection or prevention systems. When implementing cryptographic encryption-based solutions, the appropriate device for encryption operations has been a matter of debate. Industrial devices are resource-constrained hardware with limited processing capacity. Given that encryption is performed on these devices, processing delays can disrupt the operation of the industrial control system. Furthermore, updating or upgrading the software of devices in industrial systems creates significant costs and workloads. Therefore, this study proposes placing a module in front of industrial devices for encryption and decryption. This avoids potential compatibility issues with older devices. Raspberry Pi 4 and Orange Pi R1 LTS Plus were chosen to implement the proposed module. The Orange Pi R1 LTS Plus device has dual Ethernet ports, making it suitable for placement between devices. A USB-to-Ethernet converter was used to connect a Raspberry Pi 4 device to the placement between devices. The Ethernet interfaces on the devices implementing the module are bridged, allowing packets to be routed between them. When encryption is disabled, incoming packets are routed directly to the destination address. When encryption is enabled, Modbus/TCP packets are processed for encryption. On a Linux-based operating system, Modbus/TCP packets are encrypted using lightweight encryption algorithms using the Python programming language in two different scenarios. First, the PDU of the Modbus/TCP protocol is encrypted; second, the ADU of the Modbus/TCP protocol is encrypted. In neither scenario are the IP and TCP header fields encrypted. In this thesis, Modbus/TCP packets of the same size were generated using the Python programming language for two different functions. These packets, generated using seven lightweight encryption algorithms and the AES encryption standard, were encrypted on the sender side and decrypted on the receiver side. The sent Modbus/TCP packets contained data have the Write Multiple Coils function (Modbus function code 15) and the Write Multiple Register function (Modbus function code 16). Encrypting Modbus/TCP data ensures the implementation of confidentiality parameter. However, no information whether the packet has been altered or retransmitted, this attempt does not provide a solution. In this regard, the HMAC code for integrity checking and the nonce value for retransmission detection are added to the Modbus/TCP packet during encryption in the proposed module. Of these two added features, the receiving module first examines the HMAC code; if it does not match the calculated value, the packet is prevented from being forwarded to the destination. If the HMAC code and the calculated value match, the packet is decrypted and the nonce value is checked. If the nonce value is a value that has been sent before, the packet is still blocked from reaching the destination. However, if it is a value that has not been sent before, the packet is successfully forwarded to the destination. In this study, a test environment is created on two proposed modules and two computers that using simulation programs to represent Modbus master and Modbus slave devices. The proposed encryption modules were placed between the computers to provide a suitable environment for encryption and decryption. When the proposed module is run, it prompts the user to select the encryption algorithm and encryption mode. To conduct performance tests, 100 identically sized Write Multiple Coils packets and 100 identically sized Write Multiple Register packets were sent from the Modbus master device to the slave device for each encryption algorithm and encryption mode. The sent packets were encrypted on the sender module and decrypted on the receiver module. The encryption and decryption processing times for all these processes were recorded and detailed in the study. Differences in processing times were evaluated based on the measurements, and the performance effects of the hardware, encryption algorithm, encryption mode, and Modbus function selections were compared. When looking at the measured times, the AES, Grain, Simon, and XTEA algorithms stand out in terms of speed compared to other encryption algorithms. Although the AES algorithm is not a lightweight encryption algorithm, it outperformed some lightweight encryption algorithms. This is due to the AES algorithm's hardware acceleration support. Furthermore, when comparing the performance of the Raspberry Pi 4 and the Orange Pi R1 LTS Plus devices, the Raspberry Pi 4 stands out. This is understandable given the Raspberry Pi 4's powerful hardware specifications. The results indicate that implementing lightweight encryption algorithms on Modbus/TCP packets using the proposed modules results in an acceptable processing cost in terms of performance. Encryption and decryption times in milliseconds demonstrate the proposed module's suitability for use in real-time industrial control systems. Furthermore, the study demonstrates that even when the Modbus/TCP packet being processed is fixed in size, encryption times can vary, depending on factors such as the algorithm structure, the hardware used, and the system's current workload. In conclusion, this thesis demonstrates through experimental studies that Raspberry Pi 4, Orange Pi R1 LTS Plus, and lightweight encryption algorithms can be used to enhance security in Modbus/TCP-based industrial networks. Furthermore, the addition of fields to the Modbus/TCP protocol provides a security layer, demonstrating protection against attacks such as man-in-the-middle, replay, unauthorized access, and denial of service. Finally, this study contributes to the literature on ICS security and lays the groundwork for future hardware-based studies.